# SOOTH ADOPTION — porting the Sooth operating practices into the mgf corpus

> **What this is.** The tracked, session-spanning initiative for adopting the practices the Sooth
> family developed and mgf field-proved, into the mgf standards corpus. Written as a **decision
> packet** (the form `SEATS.md` §5 / [`../recipes/dual-model-economics.md`](../recipes/dual-model-economics.md) §5
> defines): the **tracker is the ledger**; decision boxes are ruled by the founder, never
> self-enacted. Update the Status column as waves land; **never rewrite history**.
>
> **Seats this initiative assumes:** Designer = Fable session (wave contracts, adversarial
> verdicts, executor handoffs). Executor = Opus-class agents, pinned per spawn. Enactor = Bassam.
>
> **Evidence base:** the hrb-app release arc of 2026-07-29/30 (**14 merged PRs, #10–#23**; PR #24,
> the ledger row, merged 2026-07-30 after this branch was cut), whose ledger
> `hrb-app/docs/inprogress/RELEASE_MASTERPLAN.md` §5 records the arc's court verdicts;
> `hrb-app/LESSON_LEARNED.md` (**4** dated entries — counted from the file's own dated headings); `hrb-app/docs/gui/GUI_ACCEPTANCE.md` (a standing court prompt in production
> use). The practices were **run for real before being codified** — this initiative is
> codification, not piloting.

**Status legend:** ☐ queued · ▶ in progress · ✅ done · 🚫 declined · ⏳ gated.

---

## §0 Honest floor — what this initiative closes and what it cannot

**Closes:** the citability gap. Every practice below already works in this federation but has no
rule ID, so it cannot be cited in a review, cannot appear in the *Index of MUSTs*, and cannot be
checked by a gate — which means its adoption is invisible and drifts. Each wave converts one
practice into the citable obligation layer plus its worked recipe.

**Cannot close:**

- **(a) Fleet propagation of anything that needs a tool change.** `SEAT-08`'s dispatch block, the
  hook kit, and any doctor check land in `mgf-fed` / `mgf-common` — cross-repo, **supervisor-applied
  per [AG-13](../standards/AGENTS.md#AG-13)**. mgf-standard can define the obligation and stage it;
  it cannot ship the mechanism.
- **(b) Behavioural conformance.** Seat discipline, court honesty, and altitude are conduct rules.
  They are review-enforced by construction; no gate will ever prove a session took the right seat.
- **(c) The measurement floor.** Burn measurement reads machine-local harness transcripts. It is
  self-checkable, never CI-enforceable — the same honest limit [AG-19](../standards/AGENTS.md#AG-19)
  records for the runtime memory store.
- **(d) Divergence over time.** These are **copies with attribution, not dependencies**
  (the Sooth family's **XF-03**): mgf takes on no import edge and no resolution path to the Sooth
  corpus. The two
  families may diverge, and mgf's text is authoritative here. Keeping them aligned is a standing
  cross-family courtesy ([`../../LOCK.md`](../../LOCK.md) §5's shared-philosophy clause), not a
  mechanism.

A landed wave here does not certify that any repo *behaves* this way; it certifies that the
obligation exists, is citable, and has a named propagation path.

## §1 Baseline (measured 2026-07-30)

- Corpus **v3.4.0**, 273 MUSTs across 22 families, LOCKED at v1 ([`../../LOCK.md`](../../LOCK.md));
  amendments run CLARIFY / EXTEND / BREAKING. This initiative is a series of **EXTEND**s.
- Rules-index gate GREEN; `gen_mgf_libraries.py --check` GREEN; registry 44 members.
- **Hooks in mgf repos: NONE.** The single largest gap against the Sooth practice set (wave S3).
  *(Scoped, per the S3b court's F6: the claim is about the **44 registry members**, which is what
  the SHP family binds. The **`mgf` program repo is not a registry member** and does carry a
  `SessionStart` hook — it injects its own `.claude/memory/` digest — so it is the adjacent
  instance, noted in `SESSION_HOOKS.md` §2 because it shares SHP-01's channel and line budget.
  Still true at 2026-07-31 after S3b: the obligation layer is staged, the mechanism is unmerged,
  and no registry member has one wired. S3b closes the citability gap, not the hook gap.)*
- Court practice exists but is **unnamed and unschematised** — 11 rounds ran in the hrb-app arc
  with findings answered by ID, but there is no `findings.json` grammar, no lane routing, and no
  rule to cite (wave S2).
- Resumability was **proven twice** (relay-finish) but rests on convention, not on a journal
  format or a canonical validation entrypoint (wave S4). *(Closed as a **citability** gap by
  S4 at 2026-07-31: `AG-22` makes the disk journal an obligation and `AG-21` the entrypoint.
  What S4 did **not** close, and what this line still records honestly: mgf has **no journal
  format** — AG-22 binds two artifacts and a resume point, not a schema — and **no drill
  mechanism**, which is why the cross-model drill landed as `AG-23`, a SHOULD with a written
  promotion trigger. The convention became a citable property; it did not become a
  mechanism.)*
- Measured burn, this workstation: executor 101.9M vs scarce 23.9M output tokens (~4.3:1).

## §2 The waves

| Wave | Scope | Corpus effect | Status |
|---|---|---|---|
| **S1 — the SEAT family** | `docs/standards/SEATS.md` (SEAT-01..09), `templates/SEAT_DISPATCH.md`, `docs/recipes/dual-model-economics.md`, index/registry ripple | EXTEND, corpus **v3.5.0**, 273 → 281 MUSTs, 22 → 23 families | ✅ **merged `fac3b9a` (PR #278) 2026-07-30** |
| **S2 — court grammar for review** | [`../standards/REVIEW.md`](../standards/REVIEW.md) **CRT-01..12** — the thirteen-field findings grammar + lane routing that **fails closed** + answer-by-ID + **committed-pin-only** review + evidence ranking + "could-not-verify is rewarded" + seeded-sabotage folds; [`../recipes/court-round.md`](../recipes/court-round.md) + [`../../templates/findings-schema.json`](../../templates/findings-schema.json) + its doc↔schema gate; hrb-app's `GUI_ACCEPTANCE.md` standing-prompt pattern generalised | EXTEND, corpus **v3.6.0**, 281 → 293 MUSTs, 23 → 24 families (a new `REVIEW` family per DB-S1-2) | ✅ **merged `68f7492` (PR #279) 2026-07-30** |
| **S3a — the session-hook kit (the mechanism)** | `mgf-fed`'s `mgf.fed.sessionhooks` package + the `mgf-fed hooks` CLI (`install` / `status` / `uninstall` / `emit` / `log` / `session-start`) + `docs/howto/session-hooks.md`. Adoption is **one line** merged into `.claude/settings.json`; nothing is vendored. Ships in **observe** mode with the enforcing half behind two independent keys; kill-switch at three scopes; closed event vocabulary; `cross_repo_write` **advisory by construction**. Its fold also carries three S3b-driven items: the **`session-hooks` / `hooks` / `shp` aliases + `_PENDING_CORPUS` entry** for `mgf-fed standards SESSION_HOOKS` (staged in the same change as the `REVIEW` aliases, per that court's F10 — **one cross-repo edit, not duplicated in mgf-standard**), the **`gate_armed` strict-parse fix** (S3B-F3b), and the ruled-channel prerequisite note (S3a-F8) | A `mgf-fed` mechanism — cross-repo, **supervisor-applied per [AG-13](../standards/AGENTS.md#AG-13)**; no corpus effect | ✅ **merged `6404303` (`mgf-fed` PR #120) 2026-07-31** — *"feat(hooks): the session-hook kit, observe mode (SHP mechanism)"*, verified by `git merge-base --is-ancestor origin/feat/session-hooks origin/main`. **The ruled merge order is discharged and the clause is closed:** S3b (the obligation, `4015e9a`) landed first, S3a (the mechanism) second, exactly as ordered — no further ordering constraint survives between them. *(This row was `▶ UNMERGED` earlier in the same day, against `origin/main` `0279a9a`; the merge landed while the S4 wave was in court. Re-checked rather than inherited — the S4 court's F6.)* |
| **S3b — the session-hook family (the obligation)** | [`../standards/SESSION_HOOKS.md`](../standards/SESSION_HOOKS.md) **SHP-01 + SHP-05..13** — the harness layer, bound mostly by what it may *not* do: bounded mechanical re-teach, **fail-open totality**, attribution-before-blame, the sanctioned-exit rule, the three-scope kill-switch, one implementation + thin shims, closed vocabulary + CI isolation, staged observe→enforce with the no-orphan-step invariant, determinism. Carries the layering rule in mgf's form — *CI enforces truth, documents communicate intent, hooks guarantee the communication happens*. **SHP-02/03/04 not adopted**, numbers left vacant with a reactivation trigger | EXTEND, corpus **v3.7.0**, 293 → 303 MUSTs, 24 → 25 families (a new `SHP` family) | ✅ **merged `4015e9a` (PR #281) 2026-07-31, founder-enacted** |
| **S4 — resumability + one validation entrypoint** | [`../standards/AGENTS.md`](../standards/AGENTS.md) **AG-21** (one canonical validation entrypoint whose steps mirror CI **modulo a declared delta list**, homed at a fixed `## CI delta` heading in `CONTRIBUTING.md` — *not* the WF-13-generated `.woodpecker.yml` header) + **AG-22** (durable disk journal: committed worktree **plus** written contract, resumable by a different session and a different model from disk alone; resume points for gate-opening work) + **AG-23** (the cross-model resume **drill** — a **SHOULD**, allowlisted not indexed, per the SEAT-09 precedent). §12/§13 prose, a Provenance section the family never had, `CONTRIBUTING.md`'s own dogfooded delta list, and a DOC-18 §10.4 matrix row for the new coupling. Its court returned S4-F1..F7, folded by ID in `daa45ae` — *the rules survived, the worked instance did not*: the manufactured `mypy` delta retracted, the missing `$DEVPI_URL` delta added with three honest ❌ rows, and the range-cell checker **built** rather than argued | EXTEND, corpus **v3.8.0**, 303 → 305 MUSTs, **25 families unchanged** — the first wave that **grows** an existing family instead of founding one | ✅ **merged `49af08e` (PR #282) 2026-07-31, founder-enacted** |
| **S5 — seeded gate self-tests + adoption posture** | [`../standards/TESTING.md`](../standards/TESTING.md) **TS-29** — *a mechanical gate ships a seeded self-test proving it can fail; a gate that cannot fail is decoration.* The negative fixture **stands in the suite**, because a one-time red/green in a fold report discharges [CRT-08](../standards/REVIEW.md#CRT-08) and nothing after it; plus the **vacuity** clause (a gate over a discovered set pins that set non-empty), the **blindness control** (SHOULD), and a **staged retroactivity** clause so enacting it does not red 44 repos for gates that already work. §20 carries the five field-proved instances at their pins and §21 the family's *Adoption posture*. The convention's second half — the *"Adoption posture (why nothing here fails today)"* section — landed as [`../recipes/adoption-posture.md`](../recipes/adoption-posture.md) **plus `scripts/check_adoption_posture.py`**, a recipe with a gate rather than a MUST (rationale + promotion trigger: recipe §5). Dogfooded in the same wave: three of this repo's gates gained standing sabotages, including **S2's, whose proof lived only in a commit body** | EXTEND, corpus **v3.9.0**, 305 → 306 MUSTs, **25 families unchanged** — the second intra-family EXTEND, and **the first wave caught by the checker S4 built** (the `TS-01..TS-28` range cell). The posture convention adds **no** rule | ▶ **staged on `feat/s5-conventions`; pending the closing court, then the founder's enactment.** The row flips to ✅ with its merge SHA at enactment, exactly as S1..S4's did |

**Ordering invariant** (S3's own rule, applied to this initiative): each wave is safe alone. No
wave leaves a state that is only correct once a later wave lands. S1 binds behaviour with a staged
mechanism; S2 adds a review grammar nothing yet requires; S3 lands in observe mode; S4 and S5
strengthen existing gates without weakening any.

### §2.1 Merge-order reconciliation — binding on EVERY wave after the first (court ruling S1-F10)

> **Generalised 2026-07-30 by the S3b wave.** S1-F10 wrote this as a rule for "the second wave to
> merge" because two waves were in flight. Three have now landed against it, and the obligation is
> plainly **per-wave, not once**: any wave that adds a rule computes its counts from the state it
> was cut against, and every wave after the first inherits the reconciliation. The steps below are
> unchanged; only their scope is. Step 4 is retained as history — it was S2's, and it is discharged.

Waves in flight against the same locked corpus **each compute their counts from the state they were
cut against**. Every wave after the first inherits the reconciliation; it is not optional and it is
not the previous wave's job:

1. **Rebase onto the merged corpus** and re-target the amendment at the **next unspent** corpus
   MINOR (EXTEND — a version an earlier merge already consumed is spent).
2. **Reconcile to the post-merge totals across all four count mirrors, in one commit:**
   regenerated `docs/standards/rules.json`, the README *Index of MUSTs* footer's
   `**N across F families**` sentence, `SCOPE.md`'s literal, and `FEDERATION.md` §4's family-table
   row count — `scripts/gen_rules_index.py --check` (which folds in `check_headline_coherence.py`)
   is the gate that proves all four agree.
3. **Bump the count canary** in `tests/unit/test_rules_index.py` in the same commit, extending its
   history sentence — it is a deliberate same-commit snapshot, not a change-detector.
4. **Retire any *"until it lands"* clause the landing wave makes stale.** A staged cross-reference
   written by an earlier wave becomes a lie the day its condition is met, and **the landing wave's
   fold owns the edit** — the wave that wrote the clause only owns writing this instruction.
5. **Bump the package version** (`pyproject.toml` + `src/mgf/standard/__init__.py` +
   `PUBLIC_API.json` + `uv.lock`) and add the CHANGELOG entry in the same wave. *(Added by S3b —
   S1 and S2 both did this; only steps 1–4 had been written down.)*

**Per-wave record.** Each row is what that wave actually reconciled to, and is never rewritten:

| Wave | Corpus | MUSTs / families | Canary | Package | Step-4 clause retired |
|---|---|---|---|---|---|
| S1 | v3.4.0 → v3.5.0 | 273 → 281 / 22 → 23 | 273 → 281 | 0.1.69 → 0.1.70 | — (first wave; wrote the instruction) |
| S2 | v3.5.0 → v3.6.0 | 281 → 293 / 23 → 24 | 281 → 293 | 0.1.70 → 0.1.71 | ✅ `SEATS.md` §1's court-lane row — the *"Until it lands"* clause now cites CRT-01/02/07 |
| S3b | v3.6.0 → v3.7.0 | 293 → 303 / 24 → 25 | 293 → 303 | 0.1.71 → 0.1.72 | **none due** — see §2.2 |
| S4 | v3.7.0 → v3.8.0 | 303 → 305 / **25 → 25** | 303 → 305 | 0.1.72 → 0.1.73 | ✅ **§1's resumability baseline bullet** — it claimed the property "rests on convention, not on a journal format or a canonical validation entrypoint," which S4's own landing falsifies in part; annotated in place with what S4 did **and did not** close. `SEATS.md` needs **no** edit (§2.2's test applied: nothing S4 lands falsifies a SEAT clause) |
| S5 | v3.8.0 → v3.9.0 | 305 → 306 / **25 → 25** | 305 → 306 | 0.1.73 → 0.1.74 | **none due, and the near-miss was checked rather than assumed.** §2.2 deferred one edit to "the S5 wrap" — `SEAT-02`'s §5 enforcement cell and `SEAT-08`'s §3 posture gaining the SHP channel — with an explicit trigger: *the day `mgf-fed hooks` merges **and** a first repo runs `hooks install`*. The kit has merged (`6404303`), so **half** the trigger is met and the other half is not, verified two ways at this pin: `mgf-fed`'s latest tag `v0.18.2` points at `0279a9a`, which **predates** the kit merge (`git merge-base --is-ancestor 6404303 v0.18.2` → false), so no wheel a repo could resolve carries it; and no federation-registry member wires any session hook, and no repo on this workstation invokes the mgf-fed kit (ten non-member repos carry OTHER SessionStart hooks — Sooth's shp baseline and the mgf org repo's memory digest; closing court F2 corrected the original unscoped sentence). Writing the SHP channel into `SEATS.md` today would create exactly the second lie §2.1 step 4 exists to prevent — **a citation to a channel that does not run.** The deferral survives S5, with the trigger unchanged and now half-discharged |

#### §2.1.1 Which mirrors move when a family **grows** rather than is **added** — S4's finding

The first three waves each founded a family, so "reconcile all four count mirrors" was
uniform: MUST count **and** family count moved, and every mirror moved with them. **S4 is
the first wave to grow an existing family**, and the four mirrors do *not* behave the same
way. Recorded here so the next intra-family EXTEND does not re-derive it:

| Mirror | Family **ADDED** (S1/S2/S3b) | Family **GROWS** (S4) | Gated by `check_headline_coherence.py`? |
|---|---|---|---|
| `docs/standards/rules.json` | MUST + family counts move | **MUST count only** | ✅ generated; `--check` compares |
| README *Index of MUSTs* footer `**N across F families**` | both numbers move | **N only, F unchanged** | ✅ the **last** occurrence is compared |
| `SCOPE.md`'s `N MUSTs across F families` literal | both move | **N only** | ✅ compared |
| `FEDERATION.md` §4 family table | **a new row** appears | **no row appears** — the existing row's `AG-01..AG-NN` **range cell** changes | ✅ **now yes** — a second §4 check compares each row's range cell against `rules.json`'s **per-family max** (added by this wave; S4-F3). Was ⚠️ **NO** as S4 was staged: the pre-existing check counts `^\|\s*[A-Z]{2,5}\s+—\s` **rows** against the family count, and an intra-family EXTEND moves neither, so the gate was **vacuously green while the range cell rotted.** |

**The fourth row was the trap — it is now closed mechanically, and the prose below is
history.** The S4 court ruled (S4-F3) that this wave's own words bound it: *a streak is not
a mechanism, and neither is prose.* `scripts/check_headline_coherence.py` therefore gained a
per-family range-cell check in the same wave that found the gap, with its own negative
fixtures in `tests/unit/test_check_headline_coherence.py` — including the regression proof
that on a stale tree **only** the new check fires while the row-count and count-coherence
checks stay green, which is exactly the blindness that let this happen. **CRT-08
seeded-sabotage proof, both runs recorded in the fold commit:** reverting the AG cell to its
pre-S4 `AG-01..AG-20` turns the gate **RED** with the precise diagnostic, restoring it turns
it **GREEN**; the same sabotage run against the *pre-S4* checker returns **GREEN**, which is
the blindness demonstrated rather than asserted.

**Why the history below is kept.** It is the evidence that justified building the checker,
and it is what a future reader needs if the check is ever questioned or removed. Traced
against `git log -- FEDERATION.md` at this pin:

- **It has rotted, and needed a Court to catch it.** The cell read `REL-01..REL-06` from
  2026-06-01 to 2026-07-03 while `REL-07..REL-13` existed, and `SC-01..SC-17` over the same
  span while `SC-18` had existed since the initial extraction. Both were corrected only by
  `1a510ac` (2026-07-03) — *"contract refresh — v1.1, live family table, no ghosts (F-M3,
  F-M2)"* — a **Court finding**, not a gate.
- **Since that refresh the discipline has held**, unaided, over **two commits touching four
  cells** — that is the unit, and it is a small sample said plainly rather than dressed up:
  `7267045` (2026-07-18) moved three cells (`DP-01..DP-13`, `REL-01..REL-13`,
  `WF-01..WF-13` → `..-14`) for the DP-14/REL-14/WF-14 EXTEND, and `f82542d` (2026-07-23)
  moved one (`SC-01..SC-18` → `SC-01..SC-23`).
- **The AG cell had been correct for its whole life** (`AG-01..AG-20` since the table was
  introduced) — which is exactly why an author would not think to look at it.

So: **two commits, four cells** since the last correction, and un-gated the whole time —
a streak thin enough that calling it a track record would have been the error. S4 updates
the cell to `AG-01..AG-23`, **builds the checker** (above), and *also* writes the fact into
[`AGENTS.md`](../standards/AGENTS.md)'s **Propagation header**, at the point of edit, so the
next editor of that family sees it without having to read this tracker. The header is now
belt-and-braces rather than the only defence.

**Corollary for step 3 (the canary).** `tests/unit/test_rules_index.py` asserts only the
MUST count, so it moves on an intra-family EXTEND exactly as on a new family. No change to
the step.

### §2.2 The SEAT-02 cross-reference — why S3b leaves `SEATS.md` alone

The S3b wave was asked whether **SEAT-02**'s staged row can now name the SHP family and the kit.
The precedent was checked rather than assumed: S2's merge (`fac3b9a..68f7492`) **did** touch
`SEATS.md` — **exactly one line**, and only the §1 naming-table cell whose *"Until it lands"*
clause S2's landing had falsified. Its Rules-box text, its §3 adoption posture, and its §5
enforcement table were all left untouched. So the convention is narrow and specific: **a landing
wave edits a SEAT surface only to retire a clause its own landing made stale** (now §2.1 step 4).

Applying that test to S3b, **nothing in `SEATS.md` is stale**, so nothing is edited:

- **SEAT-02**'s Rules-box row says the dispatch block of **SEAT-08** is what makes seat declaration
  automatic. That is still true, and it is still the *only* channel: the SHP kit re-teaches SEAT-02
  but it is unmerged, and even once merged it re-teaches the rule rather than replacing SEAT-08's
  block. Naming SHP there today would create the second lie §2.1 step 4 exists to prevent —
  a citation to a channel that does not run.
- **SEAT-02**'s §5 enforcement cell reads *"Mechanised by SEAT-08 … without it, review-only."*
  That remains exactly right. It becomes wrong only when a repo actually has the hook installed,
  which is a per-repo event under **SHP-11** and not something a corpus amendment can assert
  fleet-wide.
- The **SHP → SEAT direction is where the coupling belongs**, and it is already written:
  `SESSION_HOOKS.md` **SHP-01** cites SEAT-02 as the obligation it mechanises, and **SHP-11** cites
  SEAT-01 for whose act the `enforce` flip is. Citing downhill keeps one owner per fact
  ([DP-14](../standards/DESIGN_PRINCIPLES.md), derive-never-restate).

**Deferred to the S5 wrap, with its trigger.** SEAT-02's §5 enforcement cell and SEAT-08's §3
adoption posture should gain the SHP channel **on the day `mgf-fed hooks` merges and a first repo
runs `hooks install`** — the point at which "mechanised by SEAT-08 alone" stops being complete.
That is a §2.1-step-4 edit owned by whichever wave lands it, and it is recorded here so the S5
adoption-posture sweep does not have to rediscover it.

> **S5 examined it and re-deferred it, 2026-07-31 — the trigger is HALF met.** The kit
> merged (`mgf-fed` `6404303`), so the first conjunct is discharged. The second is not,
> checked two ways rather than assumed: `mgf-fed`'s newest tag `v0.18.2` resolves to
> `0279a9a`, which **predates** the kit merge (`git merge-base --is-ancestor 6404303
> v0.18.2` returns false), so **no published wheel carries `mgf-fed hooks`** and no repo
> *could* have installed it; and no repo on this workstation carries a `hooks` key in
> `.claude/settings.json`. Naming the SHP channel in `SEATS.md` today would be a citation
> to a channel that does not run — the precise second lie step 4 exists to prevent. **The
> deferral outlives this initiative**, and it is carried forward by name in §6's closing
> summary so it is not lost when this tracker is archived.

**Do not regress what mgf already does better.** The `mgf-fed` CLI briefing surface,
[AG-14](../standards/AGENTS.md#AG-14)'s propagation matrix, [AG-17](../standards/AGENTS.md#AG-17) /
[AG-19](../standards/AGENTS.md#AG-19) memory discipline, and the PKG / REL / OB breadth are mgf
strengths. Adoption adds; it does not overwrite.

## §3 Decision boxes — for the Enactor

Each has ONE recommendation. A ruling recorded here turns ☐ into a mandate. **Nothing below is
enacted.**

- **DB-S1-1 · Ship `SEAT_DISPATCH.md` as wheel data?** `SEAT-08` wants `mgf-fed catch-up` to write
  the block from one source; `catch-up` resolves canonical text through `mgf.standard.read_scaffold()`.
  This is a **two-map lockstep**, and both maps are hardcoded: `_SCAFFOLD_FILES` in
  `mgf-standard/src/mgf/standard/__init__.py` (name → source path, and the backing of
  `list_scaffold()`) and `_SCAFFOLD_DEST` in `mgf-fed`'s `cli/_catch_up.py` (name → destination path
  in the target repo). A name present in one and absent from the other is a `KeyError` at write
  time, so the two must be extended **in the same change-wave** — and the `mgf-fed` half is
  supervisor-applied per [AG-13](../standards/AGENTS.md#AG-13). Adding the template also changes
  `list_scaffold()`'s output — a public-surface change ([AP-\*](../standards/API_DESIGN.md),
  `PUBLIC_API.json` regen, the `test_scaffold` pin). *Options:* (i) promote it into the scaffold seam
  now; (ii) leave it a repo-local template and promote it together with the `catch-up` emitter, both
  maps in one wave. **Recommendation: (ii)** — the seam change is only useful the day the emitter
  ships, shipping it earlier widens the public API for nothing, and doing both halves in one wave is
  what keeps the two maps from diverging. Status: ☐

  > **The lockstep this box analysed has now been walked — by a different artifact.**
  > FEEDBACK **PAPER-148** (ACCEPTED 2026-08-06) promoted
  > `tests/unit/test_check_commit_trailers.py` into the seam, in exactly the
  > wave shape described above: `_SCAFFOLD_FILES` + cookiecutter mirror +
  > `test_scaffold` pin + `PUBLIC_API.md` here, `_SCAFFOLD_DEST` in `mgf-fed`
  > 0.25.0, **mgf-fed releasing first**. Two facts this box did not have:
  > (1) `PUBLIC_API.json` did **not** need regeneration — it pins exported
  > *names*, and `list_scaffold` was already one; only the `.md` row and the pin
  > moved. (2) mgf-fed 0.25.0 adds a **tolerance guard** — an unknown scaffold
  > name warns and skips instead of raising — so from that release the
  > `KeyError` failure mode above is gone and the ordering constraint softens to
  > a preference. The recommendation stands on its own merits (don't widen the
  > API before the emitter exists), but "the maps must not diverge or it
  > explodes" is no longer the reason.
- **DB-S1-2 · Where does the court grammar live (S2)?** *Options:* (i) a new `REVIEW` family;
  (ii) an extension of `TESTING.md`. **Recommendation: (i)** — review is not testing, the lane
  model has no TS analogue, and a separate family keeps the *Index of MUSTs* readable.
  **Status: ✅ RULED (i) — the standalone `REVIEW` family (`CRT-*`)**, enacted-at-merge under the
  founder's standing full-speed word for this initiative, recorded here and named in the enactment
  PR body (the same F5 pattern the SEAT wave used). The ruling carries a second, coupled part:
  **the `docs/recipes/README.md` carve-out amendment is RATIFIED.** That clause previously forbade
  compiling *any* review-recipe stance or per-finding schema into a `docs/standards/` rule; it now
  falls where **CRT-12** puts it — the **protocol** binds (fresh context, committed pin, the field
  set, answer-by-ID, evidence ranking, seeded sabotage), while a round's **id scheme, report
  layout, and attack lists do not**. The precedent is the source family's own **Sooth CRT-16**,
  which draws exactly this line inside a corpus that nonetheless carries a binding court family —
  so the amendment restores the distinction rather than removing it. "Never edit the target" is
  likewise no longer recipe-local: it is **CRT-01**.
- **DB-S1-3 · Enforcement posture for S3's hook kit.** *Options:* (i) observe-mode fleet-wide,
  per-repo flip to enforce; (ii) enforce at adoption. **Recommendation: (i)** — the staged order
  this corpus already uses for `PR-*` DRAFT and the LOCK *GATED* class. Status: ☐
- **DB-S3-1 · Does mgf rule a cross-repo handoff channel?** *(Opened by the S3b wave; carries the
  S3a court's F8.)* **This is the named prerequisite for three coupled things**, and a future
  session must be able to find it here rather than only in `mgf-fed`'s howto:
  1. The kit's **`cross_repo_write` finding becoming enforceable.** It is advisory in *both*
     modes today, by construction — mgf has ruled no channel, so the finding has no sanctioned
     discharge, and blocking on it would be a gate with no exit the moment it fired
     ([SHP-06](../standards/SESSION_HOOKS.md#SHP-06)).
  2. **SHP-03 and SHP-04 reactivating** at their reserved numbers, as a normal EXTEND
     ([`SESSION_HOOKS.md`](../standards/SESSION_HOOKS.md) §3).
  3. **SHP-05's command tier returning to fail-closed** — the source family's shape, deliberately
     demoted to evidence-only in this port for exactly the same reason (§Provenance).

  What a ruling must supply, at minimum: a **named artifact with a schema**, a **receiver-side
  home** the sender may write to and nothing else, and an **acknowledgement record**. Anything less
  gives the finding no discharge and changes nothing. *Options:* (i) rule the channel and take all
  three; (ii) leave it unruled — the finding stays advisory, the numbers stay vacant, and the
  absence stays recorded. **No recommendation is offered here**: the S3b executor found no evidence
  either way in the mgf corpus, and `FEEDBACK.md` papers are the nearest existing thing while their
  grammar is explicitly not gate-shaped. This box exists to make the coupling **findable**, not to
  pre-decide it. Status: ☐
- **DB-S1-4 · Corpus version cadence.** *Options:* (i) one MINOR per wave (v3.5.0, v3.6.0, …);
  (ii) batch S1–S5 into a single MINOR at the end. **Recommendation: (i)** — each wave is
  independently useful and independently revertable, and a batched amendment cannot be
  bisected. Status: ☐

## §4 Gate & cost posture

This initiative **opens no federation gate and moves no golden**. It adds rules and recipes; every
mechanism it names is staged behind a named condition. Corpus amendments are EXTEND-class under
[`../../LOCK.md`](../../LOCK.md) §2 — no existing MUST is weakened by any wave.

**Cost posture per the seat protocol:** wave contracts and court chairs at the designer seat
(`SEAT-07` — a corpus amendment is gate-opening by definition); wave execution on pinned
executor-tier agents (`SEAT-04`); every artifact committed as it finishes (`SEAT-05`).

## §5 Ledger

*Append-only, newest first. Never rewritten.*

**2026-07-31 · S5 STAGED (`feat/s5-conventions`) — pending the closing court, then the
founder's enactment. THE FINAL WAVE.** Delivered:
[`../standards/TESTING.md`](../standards/TESTING.md) — **TS-29**, one MUST — plus §20
(the shape, the checker-vs-fixed-assertion line, the five traced instances, the
CRT-08 comparison table) and §21 (the family's *Adoption posture*); the second half of
the wave as [`../recipes/adoption-posture.md`](../recipes/adoption-posture.md) +
`scripts/check_adoption_posture.py`; two DOC-18 §10.4 matrix rows; and the fifth-wave
reconciliation: all four count mirrors to **306 MUSTs / 25 families**, the
`test_rules_index` canary (305 → 306), the package version (0.1.73 → 0.1.74, four files),
the README *Index of MUSTs* row + maintenance-history sentence, the DOC-15 row, and the
CHANGELOG entry. Corpus **v3.8.0 → v3.9.0** (EXTEND). `gen_rules_index.py --check` green
at the new counts. Suite **216 → 240**.

- **The wave was caught by the gate the previous wave built — which is the point.**
  Anchoring TS-29 made `FEDERATION.md` §4's `TS-01..TS-28` range cell stale, and
  `check_headline_coherence.py` said so by name and by rule id before any human looked.
  §2.1.1 predicted precisely this trap for "the next intra-family EXTEND"; S4's court
  ruled the prose insufficient and made it a mechanism; five days later the mechanism
  did the work. **A streak is not a mechanism — and a mechanism does not need a streak.**
- **ONE new MUST, and the second half deliberately is not one.** The
  *"Adoption posture (why nothing here fails today)"* convention landed as a **recipe
  plus a gate**, not a DOC-family EXTEND, so the corpus grows by exactly one rule. The
  reasoning is written out in recipe §5 rather than left implicit, because this
  initiative's own founding argument (§0: *the citability gap*) cuts the other way and
  deserved an answer: **(a)** the bindable population is **one repo** — only
  `mgf-standard` authors standards families, so a DOC MUST would make 43 members carry an
  `N/A` row under CFM-03's completeness gate; **(b)** a section heading is on the *layout*
  side of the [CRT-12](../standards/REVIEW.md#CRT-12) / recipes-README line that DB-S1-2
  **ratified one day earlier**; **(c)** the source does not rule it either — verified at
  `sooth-standard` `af95611`, the phrase is a heading in `SEATS.md`, `HANDOFF.md`, and
  `AGENT_GAPS.md` and appears in **no rule anywhere**, so a MUST would make mgf's port
  *stronger than its source*, which this initiative has done exactly once (SHP-13) and
  said so in the rule's text; **(d)** the citability gap is closed by the gate instead —
  **a gate is a citation**. Promotion trigger written down: the day a **second** repo
  authors a standards family.
- **The posture gate earned its keep on its first run**, the way S2's schema gate did.
  `REVIEW.md` carried a staged rule — `CRT-05`, `⏳` in the DOC-15 ledger — and explained
  nothing about it. `REVIEW.md` **§9** is the section the gate demanded; §9/§10 shifted to
  §10/§11. A second catch followed from the wave's own honesty: marking TS-29 `⏳` put a
  staged rule in `TESTING.md`, so that doc owed a posture section too — **§21**.
- **The rule's worst instance was ours, and the wave says so.** Wave S2's doc↔schema gate
  was sabotage-proved three ways at fold time — *"drop a required field / weaken the
  CONFIRMED coupling / delete a CRT anchor, each red, then restored green"* — and the
  proof existed **only in commit `2cc0622`'s body**. All seven of that file's tests were
  positive assertions over the live tree; nothing in the suite could re-run the sabotage,
  and a refactor dissolving the failure mode would have gone unnoticed. That is TS-29's
  own failure mode **(a)**, produced by the initiative that wrote the rule, found by
  opening the file instead of trusting the wave note (S1-F2). Fixed here: `check(review,
  schema)` extracted and the three sabotages now stand as fixtures.
- **Three gates dogfooded, and the oldest was the worst.** Besides the schema gate,
  `scripts/gen_rules_index.py` — the PAPER-100 anti-drift gate, the oldest in this repo —
  had **exactly two tests and both were live-tree green runs**, which is what a gate that
  has stopped looking also produces. Its decision is now `index_errors(std, allowlist)`
  and all four drift classes are planted on a synthetic corpus, each caught **by name**,
  with a vacuity pin for an anchor-format change. The third,
  `check_adoption_posture.py`, ships its self-test by construction.
- **CRT-08 seeded sabotage, three pairs, all recorded in the fold commit.** *(1)* Delete
  **TS-29's own Index-of-MUSTs row** → `gen_rules_index.py --check` **RED**, exit 1,
  *"Rules-box rule(s) neither in the Index of MUSTs nor in SHOULD_ALLOWLIST … ['TS-29']"*;
  restore → **GREEN**, exit 0. *The rule that requires gates to prove they can fail has
  its own index entry proved by the gate that indexes it — the recursion is enjoyed, not
  apologised for.* *(2)* Revert the `TS` range cell → **RED** with the S4 diagnostic;
  restore → **GREEN**. *(3)* Strip `REVIEW.md` §9 → the new posture gate **RED** naming
  the doc and `CRT-05`; restore → **GREEN**. Plus the **blindness control** S4's court
  taught: on that same sabotaged tree the three pre-S5 gates
  (`check_headline_coherence`, `check_testing_doc`, `index_errors`) all return **GREEN** —
  only the new check fires, demonstrated rather than asserted.
- **DOC-15 self-accounting: 0 ✅ / 1 ⏳ — and the ⏳ is the honest answer, not a hedge.**
  TS-29 binds *this repo's own gates*, so claiming ✅ would require the sweep. Counted at
  the pin against TESTING.md §20.1's *discovered input* test, by reading each one rather
  than counting files: **sixteen** gates, **nine** with a standing negative fixture
  (three of them added by this wave), **seven** without — `fleet_conformance_audit.py
  --check` (the `conformance-tracker` CI step; no test file at all),
  `audit_pr_conformance.py`, `fleet_ownership_audit.py`, and the sweeps
  `test_woodpecker_guards.py`, `test_public_api_doc.py`, `test_no_control_bytes.py`,
  `test_acknowledgements_seed.py`. The line **excludes** too: `test_path_traversal.py`
  plants hostile stems and asserts rejection, but over a fixed parametrised list rather
  than a discovered set, so TS-29 does not bind it — a census that swept in every
  negative test would be easier to write and would mean nothing. All seven named in the
  ledger row so the backlog is a **list that can be finished** rather than a hedge that
  cannot. Headline re-baselined to **152 ✅ · 140 N/A · 13 ⏳ · 1 🚫**,
  306/306.
- **Retroactivity was the rule's design problem, and it is stated in the rule.** TS-29
  binds a class of artifact that already exists in every repo. Without a staging clause,
  enacting it declares 44 members non-conformant on merge day for checkers that work.
  So: the obligation binds **unconditionally at the point a gate is added or changed**,
  and a gate that **predates** the rule is conformant while its repo's **close-out sweep**
  is named and pending — `hrb-app`'s **W4.9** is the worked instance and the unit of
  discharge. Two staged postures now exist in this corpus and they are not the same:
  SEAT-08 / SHP stage a **mechanism** (nothing exists yet), TS-29 stages a **backlog**
  (everything does).
- **Alias check (DOC-18): no gap, verified.** S1/S2/S3b each needed a staged `mgf-fed`
  `_ALIASES` entry because each shipped a **new standards file**. S5 ships **no new
  standards doc** — `TESTING.md` has been in the corpus since the initial extraction, and
  `_resolve_topic()` matches the topic list case-insensitively before consulting
  `_ALIASES`. The one new file is a **recipe**, resolved by `mgf-fed recipes`, not by the
  standards topic list. **No cross-repo alias edit is owed.**
- **No CI delta change.** The posture gate rides `gen_rules_index.py --check`, which CI
  already runs through `tests/unit/test_rules_index.py` — the same channel
  `check_headline_coherence.py` and `check_testing_doc.py` use, because `.woodpecker.yml`
  is a WF-13 **generated** artifact and a hand-added step would be discarded by the next
  `mgf-fed scaffold`. `CONTRIBUTING.md`'s `## CI delta` table is unchanged and still true.
- **No cross-repo dependents opened by this wave.** TS-29 needs no supervisor act under
  AG-13 and no published wheel: every repo can discharge it alone with its own suite.
  The three `mgf-fed` items S4 opened are unchanged and re-listed in §6.
- **§2.1 step 4: none due, and the near-miss was checked.** §2.2's deferred
  `SEAT-02`/`SEAT-08` edit has a two-part trigger; the kit merged (`6404303`) so half is
  met, but `mgf-fed`'s newest tag `v0.18.2` predates that merge — no wheel carries
  `mgf-fed hooks`, no repo could have installed it, and none has. The deferral survives
  the initiative and is carried into §6 by name.

**2026-07-31 · S4 COURT RETURN — UPHELD-WITH-FINDINGS; S4-F1..F7 folded by ID on
`feat/ag-gaps`.** *The rules survived; the worked instance did not.* Disposition, per
finding:

- **F1 (HIGH) — the `mypy` delta was manufactured, and is retracted.** The delta list
  recorded CI's `mypy src` vs the local `mypy --strict src/` as "stricter locally." False:
  `[tool.mypy] strict = true` sits in `pyproject.toml`, so **both forms are strict** — flag
  versus config, no behavioural difference. **Probe pair run at the pin and recorded in the
  fold commit body:** with one untyped def seeded into `src/mgf/standard/__init__.py`, both
  forms return the identical diagnostic (`error: Function is missing a type annotation
  [no-untyped-def]`, same `file:line`) and exit `1`; restored, both exit `0`. The row now
  reads **equivalent, not a delta**, and §12.2 gained the lesson in the rule's own voice:
  *a delta list written from surfaces rather than from behaviour manufactures deltas as
  readily as it hides them.* Corrected in all six call-sites the court named — the
  `CONTRIBUTING.md` row, `AGENTS.md` §12.2's table and §12.4's worked shape, the DOC-15
  AG-21 row, this ledger, and the CHANGELOG *Fixed* block. **The four-vs-five-gates half
  stands** — that drift was real, and so are the ten unmentioned CI steps.
- **F2 (HIGH) — the entrypoint's largest delta was missing, and it is the entrypoint's, not
  the fast loop's.** `DEVPI_URL` is a Woodpecker **server-level** variable (PAPER-113;
  `MGF_INFRA.md` §2) and `mgf-fed local-ci` shells `woodpecker-cli exec` with **no `--env`
  flags** (`_localci.py`, verified at `mgf-fed` `origin/main`), so the variable reaches no
  container even when exported. The three steps that open with
  `[ -n "$DEVPI_URL" ] || { …; exit 1; }` — **`app-doctor`, `cross-layer-audit`,
  `fedres-check`** — therefore red **deterministically** on every workstation. Declared as
  delta 3 with the by-hand workaround, the three table rows flipped from ✅ to
  ❌ **reds**, the prerequisites paragraph extended, and the honest consequence stated
  outright: **a full-green local `exec` is not achievable on this repo today.** AG-21's own
  *"its own deltas are…"* clause re-scoped to say a mirror that runs the real pipeline
  **still is not CI and still owes a delta list**, and `run-ci.md` §2 gained the same
  caveat. **The fix is cross-repo** (`local-ci --env DEVPI_URL`): recorded below as owed to
  the supervisor per AG-13; **`mgf-fed` was not edited from here.**
- **F3 (RULED — mechanism implemented, not argued).** The court held this wave to its own
  sentence: *a streak is not a mechanism, and neither is prose.*
  `scripts/check_headline_coherence.py` now parses every §4 row's range cell and compares
  its **max token** against `rules.json`'s per-family max — max-token, not literal range
  text, so all three table shapes work (`XX-01..XX-NN`, the bare `FB-05`, and
  `SHP-01, SHP-05..SHP-13` with its deliberately-vacant numbers). Eight negative fixtures in
  `tests/unit/test_check_headline_coherence.py`, including the regression proof that on a
  stale tree **exactly one** error fires and the row-count / footer / SCOPE checks all stay
  green. **CRT-08 seeded-sabotage, both runs at the pin:** revert the AG cell to
  `AG-01..AG-20` → **RED**, exit 1, *"§4 'AG' range cell tops out at AG-20 but rules.json
  anchors up to AG-23"*; restore → **GREEN**, exit 0, *"25 §4 range cells match their
  per-family max."* Plus a control the court did not ask for: the **pre-S4 checker** run
  against the **same sabotaged tree** returns **GREEN** — the blindness demonstrated, not
  asserted. §2.1.1 and `LESSON_LEARNED.md` now say the gap is **closed mechanically**, with
  the prose demoted to the history that justified building it.
- **F4 — divergences 5 and 6 named** in `AGENTS.md` §Provenance, one line each with its
  reason: **(5)** GAP-01's *"a single command"* relaxed to *"one named entrypoint"* (a pure
  leaf with no `mgf-fed[cli]` dev dep has no single verb, and requiring one would push every
  repo to invent a wrapper — the drift AG-21 exists to prevent); **(6)** GAP-07's *"after
  every step"* re-expressed as **SEAT-05's cadence** (*as each artifact finishes*), because
  the source's *step* is undefined in a corpus that never defined one and would bind either
  nothing or a commit per edit.
- **F5 (RULED) — waived with rationale.** The `AGENTS_BRIEFING` constant named in this
  doc's Propagation header is a **curated brief owned by the `mgf-common` supervisor**, not
  a mirror of the Rules box, and AG-21/AG-22 change no fact it currently asserts.
  **Briefing-content edit owed to the supervisor at its next regeneration (AG-13); waived
  for this wave** — recorded so the decision exists rather than being an omission.
- **F6 — S3a is merged.** Re-checked rather than inherited: `mgf-fed` `origin/main` now
  contains `6404303` (PR #120, 2026-07-31) and `git merge-base --is-ancestor` confirms it.
  The §2 row flips ▶ → ✅ and **the merge-order clause is closed** — S3b first, S3a second,
  as ruled; no ordering constraint survives between them.
- **F7 — the unit stated.** *"Three-for-three"* conflated commits with cells. It is **two
  commits, four cells** (`7267045` moved DP/REL/WF; `f82542d` moved SC) — said in those
  words in §2.1.1, in the S4 STAGED entry below, and in `LESSON_LEARNED.md`, each with the
  note that a sample that thin should never have been called a track record.

**2026-07-31 · S4 STAGED (`feat/ag-gaps`) — pending court, then the founder's enactment.**
Delivered: [`../standards/AGENTS.md`](../standards/AGENTS.md) — **AG-21** and **AG-22** (two
MUSTs) plus **AG-23** (a SHOULD) — with §12/§13 prose, a §Provenance section the family had
never carried, and the fourth-wave reconciliation: all four count mirrors to **305 MUSTs /
25 families**, the `test_rules_index` canary (303 → 305), `SHOULD_ALLOWLIST` +`AG-23`
(10 entries), the package version (0.1.72 → 0.1.73, four files), the README *Index of MUSTs*
rows + maintenance-history sentence, the DOC-15 conformance rows, and the CHANGELOG entry.
Corpus **v3.7.0 → v3.8.0** (EXTEND). `gen_rules_index.py --check` green at the new counts.

- **The first wave that GROWS a family instead of founding one — and the mirrors differ.**
  `check_headline_coherence.py` gates `FEDERATION.md` §4's family **row count**; an
  intra-family EXTEND moves neither the row count nor the family count, so **the gate is
  vacuously green while the `AG-01..AG-NN` range cell rots**. Traced at this pin rather than
  assumed: the cell *has* rotted (`REL-01..REL-06` and `SC-01..SC-17` both stale for a month,
  corrected only by the Court-driven refresh `1a510ac`, 2026-07-03) and has *since* been
  maintained by hand across **two commits, four cells** (`7267045` moved DP/REL/WF;
  `f82542d` moved SC) — a sample too thin to call a track record. A streak is not a
  mechanism, so the fact is written into `AGENTS.md`'s Propagation header at the point of
  edit. Recorded as **§2.1.1** for the next intra-family EXTEND. *(Superseded in part by the
  court's S4-F3: prose was not enough either, and the wave now ships the checker. See the
  court-return entry above.)*
- **AG-21 is mostly a name for what mgf already does — except for one clause.** WF-02's four
  gates, WF-13's generated pipeline, `mgf-fed local-ci` (the real pipeline), `mgf-fed gates`
  (the fast static subset), CRT-04's unpiped-gate rule: the entrypoint half shipped long ago.
  **The declared delta list is the load-bearing novelty**, and the rule is written so the
  *undeclared* divergence is the defect rather than the divergence itself.
- **Honest floor, and it found its first defect in this repo.** No repo in the federation
  carried a delta list. Writing this one exposed that `CONTRIBUTING.md`'s TL;DR said *"Four
  gates"* over **five** commands while §Dev-setup said *"the five gates"*, and that **ten**
  further CI steps went unmentioned locally. Nothing there was a bug in either surface; the
  missing thing was the sentence saying so. *(This bullet originally also claimed a
  `mypy --strict src/` vs `mypy src` delta. **Retracted by the court's S4-F1** — `[tool.mypy]
  strict = true` makes them equivalent; see the court-return entry. And it **missed** the
  largest one: the entrypoint's own three `$DEVPI_URL`-guarded reds, added per S4-F2.)*
- **The delta list's home was chosen for a mechanical reason, not taste.** `CONTRIBUTING.md`
  under a fixed `## CI delta` heading — **not** the `.woodpecker.yml` header, because under
  **WF-13** that file is generated and a hand-written header comment is discarded by the next
  `mgf-fed scaffold`. A delta list a routine regeneration deletes is worse than none: its
  absence then reads as "no deltas."
- **GAP-07 was split, and the drill demoted, with the reason stated in the rule.** AG-22
  carries the *property* as a full MUST (committed worktree **plus** written contract,
  resumable from disk by a different model; resume points for gate-opening work). AG-23
  carries the *cadence* as a **SHOULD**, allowlisted rather than indexed — the **SEAT-09**
  precedent. mgf has no drill mechanism: no cadence owner, no scheduler, no artifact a
  session could point at. A MUST no session can discharge is the exitless obligation
  **SHP-06** forbids of the hook layer, and moving it to the conduct layer does not repair
  it. A written promotion trigger makes the upgrade a normal EXTEND.
- **The worked examples are traced, per the S1-F2 lesson.** AG-22 §13.1 cites the
  **`SEATS.md` Provenance** account at its corrected fidelity: the *executor* died on four
  consecutive server-side API errors in the W3 depth pass
  (`RELEASE_MASTERPLAN.md:465-470`); ~1000 lines survived **in its worktree**; recovery was
  **twice-shaped** — a fresh executor from worktree + written contract, and once the designer
  at the bench with the executor path fully down (`:512`). §13.1 says in those words that
  this is **not** ledger-alone recovery — the worktree carried the code, the contract carried
  the intent, both were needed — which is exactly why AG-22 names two artifacts and calls
  neither sufficient. §13.2 records the second instance: **this tracker**, resumed across
  every wave's executor death, including the §2.1 record table that exists *because* S1's
  court wrote its instruction to disk rather than to a session.
- **AG-14 was walked, not assumed.** AG-21 introduces a new coupling (a CI step ↔ the delta
  list), so a **DOC-18 §10.4 matrix row** ships in the same change, as AG-14 requires of any
  change that introduces one.
- **Alias check (DOC-18): no gap this time, verified.** S1/S2/S3b each needed a staged
  `mgf-fed` `_ALIASES` entry because each shipped a **new file** absent from the published
  corpus's topic list. S4 ships **no new doc** — `AGENTS.md` has been in the corpus since the
  initial extraction, and `_resolve_topic()` matches the topic list case-insensitively before
  consulting `_ALIASES`, so `mgf-fed standards AGENTS` already resolves from any installed
  wheel. **No cross-repo alias edit is owed.**
- **DOC-15 self-accounting: 2 ✅ / 0 ⏳** — the opposite posture from S3b's, and for a
  structural reason rather than optimism: these two rules bind things this repo can do with
  no unmerged mechanism, so the amendment ships its own conformance in the same commit.
  Headline re-baselined to **152 ✅ · 140 N/A · 12 ⏳ · 1 🚫**, 305/305 rows. **What is still
  ⏳ is the mechanism, and it is named:** nothing anywhere reads a `## CI delta` section — the
  `app-doctor` check that would is **cross-repo, supervisor-applied per AG-13**. AG-22 is
  review-enforced by construction — CI sees the tree, never the session — and AG-23 has no
  mechanism **by design**.
- **CROSS-REPO DEPENDENTS NAMED FOR THE SUPERVISOR** (AG-13 / DOC-18's cross-boundary row —
  ***not* edited from here**). Three, all in `mgf-fed`:
  1. **`mgf-fed local-ci` must forward `$DEVPI_URL`** into the pipeline (`woodpecker-cli
     exec --env DEVPI_URL=…`, or pass the ambient value through). Today `_localci.py` shells
     `[wp, "exec"]` with no `--env`, so `app-doctor` / `cross-layer-audit` / `fedres-check`
     red on their guard line on every workstation and **no repo carrying them can reach a
     full-green local `exec`.** This is the single largest gap between the canonical
     entrypoint and CI, fleet-wide, and it is what forced S4-F2's honest ❌ rows. Opened by
     the S4 court; owed to the supervisor.
  2. **An `app-doctor` check for the delta list** — the `## CI delta` heading is present, and
     every `woodpecker_required_steps` name is either run by the canonical entrypoint or
     listed as a delta. This is AG-21's staged mechanism.
  3. **The `AGENTS_BRIEFING` constant** — **waived for this wave with rationale** (S4-F5): it
     is a *curated* brief owned by the supervisor, not a mirror of the Rules box, and
     AG-21/AG-22 falsify nothing it currently says. **Briefing-content edit owed to the
     supervisor at its next regeneration (AG-13)**; recorded here so the decision exists.
- **S3a status re-checked at this pin, not inherited.** *(As staged: `mgf-fed` `origin/main`
  was `0279a9a`, `origin/feat/session-hooks` was `38dac8b`, and `merge-base --is-ancestor`
  returned UNMERGED. **It merged later the same day as `6404303` (PR #120) while this wave
  sat in court** — re-checked and flipped to ✅ in the S4-F6 fold; the ruled order held, S3b
  first and S3a second.)* Its court has returned and F1..F10 are folded. **S3b landed first
  as ruled** (`4015e9a`, PR #281, 2026-07-31, founder-enacted — its §2 row updated ▶ → ✅ here),
  so S3a is now next in the order.

**2026-07-31 · S3b COURT RETURN — UPHELD-WITH-FINDINGS; S3B-F1..F8 + the S3a-F8 carry folded by ID
on `feat/shp-family`.** Disposition, per finding:

- **F1 — staged links marked as staged.** The Propagation header's `mgf-fed` howto URL and the
  README navigation row now both say the file lives on `feat/session-hooks` and that the link
  resolves **on the S3a merge**, which lands next in the ruled order (this family first, the kit
  second). `done_when`: no unqualified cross-repo URL to an unmerged file — met.
- **F2 — SHP-01 re-worded to match §2.2's own position.** It now *"mechanises the re-teach that
  SEAT-02 requires, through the channel class SEAT-08's dispatch block already uses"*, and says
  explicitly that it neither replaces that block nor becomes SEAT-02's sole mechanism. The claim
  *"it is SEAT-02's mechanisation"* is gone from the Rules box, the CHANGELOG, and the README
  maintenance-history sentence. The internal contradiction the court found — §2.2 arguing SEATS.md
  is not stale *because* SEAT-08 is still the only channel, while SHP-01 claimed the mechanisation
  outright — is closed.
- **F3 (RULED, both sides) — SHP-11 re-scoped to the truth of the mechanism.** The rule now binds
  the **blocking outcome**: *no unrecognised value for either key may yield a state that can BLOCK*,
  and an unrecognised **mode** reads as `observe`. The finding was correct and verified at the pin —
  `gate_armed()` returns true for any non-empty value but `0`, so `MGF_HOOKS_GATE=observe` arms the
  gate — but arming alone cannot block, because the mode key still fails to the weaker state. The
  rule now says that, in those words, rather than over-claiming per-key strictness. **(b)** The
  strict `'1'`-only parse is being folded **directly into the S3a kit in parallel** (same
  initiative, not a cross-repo paper); recorded on the S3a row in §2 and in §6's SHP-11 cell, which
  states that until it lands the letter is met by the key *pair* rather than by each key alone.
- **F4 — the alias staging cited, not duplicated.** The Propagation header records that the
  `session-hooks` / `hooks` / `shp` aliases and their `_PENDING_CORPUS` entry are staged **in the
  S3a fold**, which carries the `REVIEW` aliases in the same change (that court's F10) — one
  cross-repo edit, and not this document's to make. The S3a tracker row enumerates all three
  S3b-driven items it now carries.
- **F5 — the fourth divergence named.** Provenance now records the **command-tier demotion**: the
  source refuses a session a command merely implicates; this port makes that tier evidence-only,
  because with no handoff gate to discharge it a fail-closed tier would block on a finding with no
  exit (SHP-06). It reactivates with SHP-03/04 on the same single ruling.
- **F6 — both sentences scoped to registry members**, in `SESSION_HOOKS.md` §2, its Provenance, and
  §1 of this tracker. The **`mgf` program repo is not one of the 44 registry members** and does
  carry a `SessionStart` hook (it injects its own `.claude/memory/` digest) — recorded as the
  adjacent instance because it **shares SHP-01's channel and therefore its line budget**: the
  ceiling is measured against the session-start window, not one writer's share of it. Verified at
  the pin against `MGF_LIBRARIES.json` (44 members, `mgf` absent).
- **F7 — the SHP-12 / SHP-13 exit-code tension resolved by caller, not by precedence.** SHP-12's
  non-zero refusal is now scoped to **operator-invoked** surfaces (a CLI verb a human or agent
  typed); SHP-13's fail-open totality is scoped to the **harness-invoked** path, with a sentence
  saying fail-open is what a hook owes the *harness*, never what a command owes its *caller*. §6's
  SHP-13 cell makes classifying a new surface the review step, since the two rules give opposite
  answers and only the caller decides which applies.
- **F8 — the SHP-09 conformance row enumerates its evidence.** `git ls-files .claude/` returns
  exactly two tracked files — `.claude/settings.json` (permissions only, no `hooks` key) and
  `.claude/settings.local.guarded.json` — and neither carries a `SessionStart` entry. Both checked
  at the pin.
- **PLUS (S3a-F8 carry) — `DB-S3-1` opened in §3.** The ruled-handoff-channel prerequisite is now
  findable **in this tracker**, not only in `mgf-fed`'s howto, and it is written as the coupling it
  actually is: one ruling unlocks the `cross_repo_write` flip, the SHP-03/04 reactivation, **and**
  SHP-05's command tier returning to fail-closed. It names what a ruling must supply (schema'd
  artifact + receiver-side home + acknowledgement record) and deliberately **offers no
  recommendation** — the box exists to make the coupling findable, not to pre-decide it.

**2026-07-30 · S3b STAGED (`feat/shp-family`) — pending court, then the founder's enactment.**
Delivered: [`../standards/SESSION_HOOKS.md`](../standards/SESSION_HOOKS.md) — **SHP-01 +
SHP-05..SHP-13**, ten MUSTs — plus the full third-wave reconciliation: all four count mirrors to
**303 MUSTs / 25 families**, the `test_rules_index` canary (293 → 303), the package version
(0.1.71 → 0.1.72, four files), `FEDERATION.md` §4's new `SHP — Session hooks` row, the README
doc-tree entry + navigation row + maintenance-history sentence + ten Index rows, the DOC-15
conformance rows, and the CHANGELOG entry. Corpus **v3.6.0 → v3.7.0** (EXTEND).
`gen_rules_index.py --check` green at the new counts.

- **The wave was split.** S3 as originally written bundled a corpus amendment with a `mgf-fed`
  mechanism — two repos, two review surfaces, one row. It is now **S3a** (the kit; `mgf-fed`
  `feat/session-hooks`, in court, **unmerged**) and **S3b** (this obligation layer). The split is
  S3's own ordering invariant applied to itself: S3b is safe alone, because it defines obligations
  and ships no mechanism.
- **Ten rules, not twelve — the drops are named, not omitted.** **SHP-03** (record a handoff in a
  sibling you changed) and **SHP-04** (handoff well-formedness) are **not adopted**: mgf has ruled
  no cross-repo handoff channel, so the obligation is unmeetable and any gate on it would be
  exitless the moment it fired — the failure **SHP-06** forbids. **SHP-02** (derive the sibling set
  from a registry, never a glob) is **dissolved by the port**, not declined: the S3a kit walks each
  written path to its owning git repo, which makes the glob failure structurally impossible; the
  residue is SHP-05's derived-not-guessed clause. The reactivation trigger for 03/04 is one ruling
  — a named handoff artifact with a schema, a receiver-side home, and an acknowledgement record —
  which would also flip the kit's `cross_repo_write` finding from advisory to blocking.
  `SESSION_HOOKS.md` §3.
- **The numbers 02/03/04 stay vacant, and the rest map 1:1 to the source.** This is the opposite
  decision from S2's `CRT-*` renumbering, taken for a mechanical reason: the S3a implementation
  predates this family and **already cites the source numbers across a repo boundary this corpus
  may not edit** ([AG-13](../standards/AGENTS.md#AG-13)) — `_gate.py` emits a finding whose `rule`
  field is the literal string `SHP-05`, and SHP-06/07/08/09/11 appear in its docstrings.
  Renumbering would have falsified every one of them on enactment day.
- **SHP-13 is mgf-native** — fail-open totality, the one rule with no source number. The source
  requires honest failure and forbids observability from changing behaviour, but never states the
  totality: *no path, for any reason, returns non-zero except a ruled dischargeable finding.* The
  port implements exactly that, and it is the rule the whole family rests on.
- **§2.1 generalised, §2.2 added.** The merge-order reconciliation was written for "the second wave
  to merge"; three waves have now inherited it, so it is restated as per-wave with a never-rewritten
  per-wave record table, and gained the package-version step S1 and S2 both performed without it
  being written down. **§2.2** records why S3b leaves `SEATS.md` untouched: the checked precedent
  (S2 changed exactly one line, and only the clause its own landing falsified) does not license a
  broader edit, nothing in `SEATS.md` is stale today, and the SHP → SEAT citation direction is
  already written. The SEAT-02 / SEAT-08 update is **deferred to S5 with its trigger named** — the
  day the kit merges and a first repo installs it.
- **DOC-15 self-accounting: 2 ✅ / 8 ⏳.** ✅ **SHP-09** (never-fork is attestable now, and the
  `read_scaffold()` seam is this repo's existing one-source/thin-shim instance) and ✅ **SHP-11**
  (this amendment ships no mechanism, so it cannot create a state only safe once S3a lands). The
  eight ⏳ bind a session-hook layer this repo has not wired. Headline re-baselined to
  **150 ✅ · 140 N/A · 12 ⏳ · 1 🚫**, 303/303 rows. **The honest reading is stated in the ledger
  itself:** this corpus now hosts ten obligations that are in force and running nowhere. That is
  SHP-11 working as designed, and S3b claims nothing more.

**2026-07-30 · S2 COURT RETURN — UPHOLD-WITH-FINDINGS; S2-F1..F9 + the meta finding folded by ID
on `feat/court-grammar`.** Disposition, per finding:

- **F1 (RULED) — §2.1 reconciliation carried.** Rebased onto the merged SEAT corpus (`fac3b9a`);
  five mirror conflicts resolved keep-both; amendment re-targeted **v3.5.0 → v3.6.0**; all four
  count mirrors reconciled to **293 MUSTs / 24 families** plus the canary (281 → 293) and the
  package version (0.1.70 → 0.1.71). `done_when`: merge-tree clean + `gen_rules_index.py --check`
  green on the rebased branch — both met.
- **F2 — the three round-count call-sites retraced.** `REVIEW.md` Provenance, the recipe §4
  preamble, and the CHANGELOG now say **14 merged PRs, #10–#23** (PR #24, the ledger row, merged
  2026-07-30 after the branches were cut — dated where cited) and **ten court rounds enumerable by
  name**, aligned to S1's re-count and citing `SEATS.md`'s provenance for the basis. The arc's own
  summary line says 11; the traced enumeration is what the corpus cites.
- **F3 — C-2 re-anchored.** The recipe §4.1 tail no longer lets "the same round" drift onto W3
  pass-3: C-2 (the vacuous ~33.5 s shutdown bound) is explicitly the **2026-07-29 W2 pass-1** court,
  alongside C-1; the quorum re-attack is stated as a *later, separate* round.
- **F4 (RULED) — the enum stands.** `severity` keeps `CRITICAL`/`HIGH`/`MEDIUM`/`LOW`. §4.2's
  exemplar is restated **within** the enum as `HIGH`, with an annotation that the round predates
  CRT-03 and its recorded "MEDIUM-HIGH" is nonconforming — *the grammar was codified cleaner than
  the practice that proved it*, said in those words. History cited as-was, never rewritten.
- **F5 (RULED) — DB-S1-2 recorded** in §3 above: the standalone `REVIEW` family, and the
  `docs/recipes/README.md` carve-out amendment **RATIFIED** on the Sooth **CRT-16** precedent
  (protocol binds; id-scheme / layout / attack-lists do not). Status **enacted-at-merge**, same
  pattern as SEAT's F5; named in the enactment PR body.
- **F6 — numbering disambiguated.** `REVIEW.md` Provenance now states that Sooth ids do **not** map
  1:1 onto `CRT-*` (twelve rules against sixteen), with the three worked equivalences — their
  CRT-13 → our CRT-07, their CRT-14 → our CRT-02, their CRT-03 → our CRT-04 — and the rule that a
  sibling citation dated before 2026-07-30 resolves against Sooth's numbering.
- **F7 (RULED) — CRT-11 cut to allocation-only.** [SEAT-07](../standards/SEATS.md#SEAT-07) owns the
  grading norm **and** the single trigger list; CRT-11 now binds only the court round to it ("the
  scarce tier sits the chair for the classes SEAT-07 enumerates") and cites rather than restates
  (**DP-14**). §7's duplicate trigger list is gone; the Index row and the README footer sentence
  were re-cut to match.
- **F8 — `lane=court` defined in both surfaces**, identically: *owned by review practice itself —
  round-meta, grammar-usability, and chair-conduct findings; closed by the round or the next
  grammar revision, never routed to the target's implementer.*
- **F9 — recipe §6 header uses the schema's tokens verbatim** (`pin`, `chair`, `standing_prompt`,
  `kill_attempts`, `could_not_verify` + its `_justification`, `findings`, `verdict` with the
  snake_case enum), plus the note that CRT-09's prose names and the enum are the same four outcomes.
- **META (RULED) — CRT-04 gained the prose-execution definition** plus a new §4.1: for a document
  corpus, `VERIFIED_BY_EXECUTION` means the corpus's own gates were run **or** the pinned text was
  byte-compared against the cited primary source — a primary-source read *at the pin* is execution
  for prose. Without it every doc-target finding collapsed to `PLAUSIBLE` and the verdict axis
  stopped discriminating. Found by the round that reviewed this family against this family; the
  recursion is credited in the CHANGELOG.
- **PLUS (DOC-15)** — `MGF_STANDARDS_CONFORMANCE.md` gained a row per CRT MUST, following the SEAT
  rows' pattern; `mgf-fed app-doctor --standards` run before push.

**2026-07-30 · S1 COURT RETURN — UPHOLD-WITH-FINDINGS; S1-F1..F10 folded by ID on
`feat/seat-family`.** Disposition, per finding:

- **F1 (MAJOR) — the relay-finish was overstated.** `SEATS.md` Provenance and the recipe §13 now
  state the recorded shape: the **executor** died (four consecutive server-side API errors in the W3
  depth pass, `RELEASE_MASTERPLAN.md:465-470`); ~1000 lines survived **in its worktree**; recovery
  was **twice-shaped** — once a fresh executor resumed from worktree + written contract, once the
  designer finished at the bench with the executor path fully down (`:512`). Both texts now say
  explicitly that this is **not** ledger-alone recovery. SEAT-05 stands on principle plus the
  commit-discipline evidence.
- **F2 (MAJOR) — every number traced.** 14 merged PRs (#10–#23); suite **215 → 501**; branch
  **92.77%** (recorded six times); `LESSON_LEARNED.md` **4** dated entries; court rounds **counted
  from the ledger** — W2 ×2, W3 ×5 (§5's own enumeration), W4 ×1, the closing wave court, plus the
  sibling consumer court = **ten enumerable**, against the summary line's 11, and the note says so.
  The 503 / 92.85% pair is identified as a post-release summary line, not a gate output. `v0.2.0` is
  now explicitly **hrb-app's** version.
- **F3 (MAJOR) — interim placement corrected.** The template now directs the block **below** the
  `END` marker with a pointer comment, and states why (`_splice_auto_block` regenerates the span;
  `_strip_orphan_auto_blocks` deletes seconds). SEAT-08 reworded to *the channel `catch-up` will
  emit into once DB-S1-1 lands*. DB-S1-1 gained the **two-map lockstep** fact (`_SCAFFOLD_FILES` ↔
  `mgf-fed`'s `_SCAFFOLD_DEST`, a `KeyError` if they diverge). The alias claim is corrected to
  mechanism-true-**once a wheel carrying `SEATS.md` ships**.
- **F4** — §3.2 now credits **`catch-up`'s own audit step** (AG-01's enforcement), not `app-doctor`.
- **F5 (RULED)** — the date is **gone from the dispatch block** entirely, with a standing "no dates
  in this block" note; `SEATS.md`'s marker reads *"date recorded at merge"*.
- **F6** — XF-03 qualified as **the Sooth family's XF-03** at every occurrence.
- **F7** — AG-13 glosses narrowed to what AG-13 states (*only the `mgf-common` supervisor changes a
  federation **library***); **"Court-CTO" dropped** from the naming table in favour of AG-13's own
  vocabulary, with `LOCK.md` §6's scoped-wave delegation kept as the source-qualified companion.
- **F8** — the ~75% inheritance leak now carries its attributing clause (**Sooth-measured**); mgf's
  own measured figure remains the already-caveated workstation ratio.
- **F9** — "every verdict" → "the arc's court verdicts" in all three places.
- **F10 (RULED)** — written into **§2.1** above as a binding instruction on the second wave to
  merge: rebase to corpus **v3.6.0**, reconcile **293 MUSTs / 24 families** across all four count
  mirrors plus the canary, and update `SEATS.md` §1's court-lane row. **S2's fold owns it.**

**2026-07-30 · S1 STAGED (`feat/seat-family`) — pending court, then the founder's enactment.**
Delivered: [`../standards/SEATS.md`](../standards/SEATS.md) (SEAT-01..09 — eight MUSTs plus
SEAT-09 SHOULD), [`../../templates/SEAT_DISPATCH.md`](../../templates/SEAT_DISPATCH.md) (the one
verbatim-copy source), [`../recipes/dual-model-economics.md`](../recipes/dual-model-economics.md)
(the pattern + the hrb-app worked instantiation), and the full index ripple: README *Index of
MUSTs* + maintenance-history sentence, `SHOULD_ALLOWLIST` entry for SEAT-09, regenerated
`rules.json`, `SCOPE.md` count, `FEDERATION.md` §4 family row, the `test_rules_index` canary, and
the CHANGELOG entry. Corpus **v3.4.0 → v3.5.0**, **273 → 281 MUSTs across 23 families**. Adaptations
from the source family, all deliberate: the briefing channel is `mgf-fed agents`; `SEAT-08`'s
propagation rides `mgf-fed catch-up`'s **managed auto-block** (the AG-01/AG-02 machinery) instead of
a per-repo paste; the enabling condition is answered by mgf's four gates + `app-doctor`, already
shipping; the naming table gained a fourth collision — mgf's **supervisor**
(AG-13), a *library* write-authority role orthogonal to model tier, stated in AG-13's own
vocabulary. **Not enacted; not merged; no PR.** Per the court's S1-F5 ruling, `SEATS.md`'s enacted marker carries no date and reads *"date recorded at merge"* — **the merge commit supplies it**, and the verbatim dispatch block carries no date at all (a date baked into fleet-propagated text is a liability). Four
decision boxes open (DB-S1-1..4). **Cross-repo dependents named for the supervisor** (AG-13 /
DOC-18's cross-boundary row — *not* edited from here): `mgf-fed`'s `_ALIASES` map in
`cli/_standards.py` wants `seats` / `seat` / `dual-model` entries. Precisely: `_resolve_topic()`
matches the topic list case-insensitively before consulting `_ALIASES`, so `mgf-fed standards SEATS`
will resolve **without** an alias entry — but only once a wheel carrying `SEATS.md` is published and
installed, because the topic list is built from the *resolved corpus*, not from this checkout. Until
that release, the command finds nothing; after it, the alias entries are discoverability only, not a
break. `catch-up`'s block emitter + its presence check are `SEAT-08`'s staged mechanism (§2 S1,
DB-S1-1). Fleet-wide §Z conformance-ledger re-baseline (273 → 281) is a
**follow-up wave**, tracked separately, as it was for the SC-19..23 and REL-14/DP-14/WF-14 EXTENDs.

---

## §6 CLOSING — what this initiative shipped, and what it did not

> **What this section is NOT.** It is not the closing court's verdict and it is not an
> enactment. S5 is staged on `feat/s5-conventions`; the closing court is convened by the
> designer on this pin, and the founder enacts. This section is the **executor's
> accounting**, written to disk so the round after it can start from a ledger instead of
> a reconstruction — which is [AG-22](../standards/AGENTS.md#AG-22), the rule this
> initiative itself wrote, applied to its own end.

### 6.1 The waves

| Wave | Landed as | Corpus |
|---|---|---|
| **S1** — the `SEAT` family | ✅ `fac3b9a` (PR #278), 2026-07-30 | v3.4.0 → **v3.5.0**, 273 → 281 / 22 → 23 |
| **S2** — the `CRT` court family | ✅ `68f7492` (PR #279), 2026-07-30 | v3.5.0 → **v3.6.0**, 281 → 293 / 23 → 24 |
| **S3b** — the `SHP` obligation layer | ✅ `4015e9a` (PR #281), 2026-07-31, founder-enacted | v3.6.0 → **v3.7.0**, 293 → 303 / 24 → 25 |
| **S3a** — the session-hook **kit** | ✅ `mgf-fed` `6404303` (PR #120), 2026-07-31 | *(cross-repo; no corpus effect)* |
| **S4** — `AG-21`/`AG-22` + `AG-23` | ✅ `49af08e` (PR #282), 2026-07-31, founder-enacted | v3.7.0 → **v3.8.0**, 303 → 305 / **25 → 25** |
| **S5** — `TS-29` + the posture convention | ▶ staged on `feat/s5-conventions`; court then enactment | v3.8.0 → **v3.9.0**, 305 → 306 / **25 → 25** |

**Corpus growth across the initiative: v3.4.0 → v3.9.0, 273 → 306 MUSTs, 22 → 25
families** — three families founded (`SEAT`, `CRT`, `SHP`) and two existing ones grown
(`AG`, `TS`). Package `0.1.69 → 0.1.74`. Every wave took **one MINOR**, which is
`DB-S1-4`'s recommendation followed five times without it ever being formally ruled.

**The ordering invariant held.** No wave left a state that was only correct once a later
wave landed. It was tested for real once — S3 was **split** into an obligation layer and
a mechanism precisely so S3b would be safe alone — and the ruled merge order (S3b first,
S3a second) was discharged and verified with `git merge-base --is-ancestor`, not assumed.

### 6.2 The courts

**Five rounds returned; the sixth is S5's and has not been convened.** The **four whose
verdicts this tracker records** (S1, S2, S3b, S4) each returned
**UPHELD-WITH-FINDINGS** — none returned "reviewed; sound", none was rejected. S3a's
round ran in `mgf-fed` and its verdict line is not in this ledger; what *is* verifiable
from here is its fold, `38dac8b` *"fix(hooks): fold the S3a court findings F1..F10 by
ID"* — said that way rather than assumed, per S1-F2. Findings answered **by ID**
(CRT-07), folded into a durable home (CRT-10):

| Round | Findings folded | The one that mattered most |
|---|---|---|
| S1 | `F1..F10` (10) | **F2** — every number retraced. The lesson the whole initiative inherited: *cite what you verified, at the pin*. |
| S2 | `F1..F9` + the META finding (10) | **META** — CRT-04 gained the prose-execution definition, found by the round that reviewed the review family *against itself*. |
| S3a | `F1..F10` (10) | **F8** — named the ruled-handoff-channel prerequisite, which became `DB-S3-1`. |
| S3b | `F1..F8` (8) | **F3** — SHP-11 re-scoped to the truth of the mechanism rather than the claim about it. |
| S4 | `F1..F7` (7) | **F3** — *a streak is not a mechanism, and neither is prose*: the range-cell checker built, not argued. S5 was its first beneficiary. |

**45 findings, five rounds.** Two of them were **retractions of this initiative's own
claims** (S4-F1's manufactured `mypy` delta; S1-F1's overstated relay-finish), which is
the strongest evidence the court model was doing work rather than ratifying.

### 6.3 The findings that changed the corpus rather than a wave

Recorded separately because they outlive the initiative:

1. **§2.1 — merge-order reconciliation, generalised.** Written by S1's court for "the
   second wave to merge"; four waves inherited it, so it is now per-wave with a
   never-rewritten record table and a package-version step S1 and S2 both performed
   before anyone wrote it down.
2. **§2.1.1 — which mirrors move when a family GROWS.** S4's discovery that
   "reconcile all four mirrors" is not uniform, and that `FEDERATION.md` §4's range cell
   was **un-gated and had already rotted twice** (`REL-01..REL-06`, `SC-01..SC-17`, both
   corrected by a Court and never by a gate). Now closed mechanically.
3. **CRT-04 §4.1 — what "execution" means for a prose target.** Without it every
   doc-target finding collapsed to `PLAUSIBLE` and the verdict axis stopped
   discriminating.
4. **The `docs/recipes/README.md` carve-out amendment (DB-S1-2, ratified).** The protocol
   binds; a round's id scheme, layout, and attack lists do not — the line restored rather
   than removed, on the source family's own **CRT-16** precedent.
5. **TS-29's two staged postures.** SEAT-08/SHP stage a **mechanism**; TS-29 stages a
   **backlog**. The corpus had only ever needed the first shape.

### 6.4 The mechanisms shipped

Rules are the point of a corpus, but a rule with no mechanism is what §0 called the
citability gap in reverse. What actually runs:

| Mechanism | Where | Wave |
|---|---|---|
| [`templates/findings-schema.json`](../../templates/findings-schema.json) + its doc↔schema gate | this repo, `tests/unit/test_findings_schema.py` | S2 (gate), S5 (its seeded sabotages) |
| [`templates/SEAT_DISPATCH.md`](../../templates/SEAT_DISPATCH.md) — one verbatim-copy source | this repo | S1 |
| `check_headline_coherence.py`'s **per-family range-cell check** + 8 negatives + blindness control | this repo | S4 |
| `scripts/check_adoption_posture.py` — derives the staged set from the DOC-15 ledger, self-expires per family | this repo | S5 |
| `gen_rules_index.index_errors()` — the oldest gate here, finally extracted and sabotage-pinned | this repo | S5 |
| `CONTRIBUTING.md`'s `## CI delta` list — the federation's first, and it found a live drift on the way in | this repo | S4 |
| The **session-hook kit** (`mgf-fed hooks`, observe mode, kill-switch at three scopes) | `mgf-fed` `6404303` | S3a |
| Recipes: [`court-round.md`](../recipes/court-round.md), [`dual-model-economics.md`](../recipes/dual-model-economics.md), [`adoption-posture.md`](../recipes/adoption-posture.md) | this repo | S2 / S1 / S5 |

### 6.5 What this initiative did NOT close

- **The corpus's own release lag (closing court F3 — the round's orphaned-obligation
  catch).** Five package bumps (0.1.70..0.1.74) and zero tags: the newest tag is
  `v0.1.69`, publish is tag-driven (WF-03), so **no wheel carries any of the 33 new
  MUSTs** — `mgf-fed standards seats|review|session-hooks` resolves nothing anywhere,
  and every staged alias + `_PENDING_CORPUS` entry waits on it. The founder's
  release/tag act owns the discharge; until then this is the mirror image of the
  mgf-fed tag-lag named below.

§0's four honest-floor items **(a)–(d) all still stand**, unchanged, and are not restated
here. On top of them, five specific gaps the waves named as they went:

1. **No repo has a session hook installed, and no wheel carries the kit.** `mgf-fed`
   `origin/main` has it (`6404303`); its newest tag `v0.18.2` resolves to `0279a9a`,
   which **predates** that merge. So ten `SHP` MUSTs are in force and **running nowhere** —
   SHP-11's staged posture working as designed, and S3b claimed nothing more.
2. **mgf has no journal format.** AG-22 binds two artifacts and a resume point, not a
   schema.
3. **mgf has no resume-drill mechanism.** Which is why AG-23 is a **SHOULD** with a
   written promotion trigger rather than an undischargeable MUST.
4. **No cross-repo handoff channel is ruled.** `DB-S3-1` — the single ruling that would
   unlock three coupled things at once.
5. **This repo's own TS-29 backlog: seven named gates** awaiting a close-out sweep
   (`fleet_conformance_audit.py --check`, `audit_pr_conformance.py`,
   `fleet_ownership_audit.py`, `test_woodpecker_guards.py`, `test_public_api_doc.py`,
   `test_no_control_bytes.py`, `test_acknowledgements_seed.py`). Named in the DOC-15 row
   so it is a list, not a hedge.

### 6.6 Still founder-gated — carried forward, not closed

**Nothing below is enacted, and this section enacts nothing.** These outlive the tracker
and must survive its archival.

| # | Item | Where it lives | Why it is still open |
|---|---|---|---|
| 1 | **`DB-S1-1` — ship `SEAT_DISPATCH.md` as wheel data + the `catch-up` emitter** | §3 | A **two-map lockstep** (`_SCAFFOLD_FILES` here ↔ `_SCAFFOLD_DEST` in `mgf-fed`); both halves move in one wave, and the `mgf-fed` half is supervisor-applied (AG-13). Recommendation (ii) stands: promote the seam **with** the emitter, not before. Until then `SEAT-08` propagates per repo, below the `END` marker. **Amended 2026-08-06 (PAPER-148):** the wave was walked once, for the trailer-gate test, so the shape is now demonstrated rather than theoretical — and `mgf-fed` 0.25.0 adds a **tolerance guard** (unknown scaffold name → warn-and-skip), so "a name in one and not the other is a `KeyError` at write time" stops being true from that release. The one-wave discipline survives on the weaker, still-sufficient ground that a name with no destination silently writes nothing. |
| 2 | **`DB-S3-1` — does mgf rule a cross-repo handoff channel?** | §3 | **One ruling unlocks three things**: the kit's `cross_repo_write` finding becoming enforceable, `SHP-03`/`SHP-04` reactivating at their reserved numbers, and `SHP-05`'s command tier returning to fail-closed. A ruling must supply a **schema'd artifact + a receiver-side home + an acknowledgement record**; anything less leaves the finding with no discharge. **No recommendation is offered** — deliberately. |
| 3 | **`mgf-fed local-ci` must forward `$DEVPI_URL`** (`--env`, or pass the ambient value) | §5, S4-F2 | `_localci.py` shells `[wp, "exec"]` with no `--env`, so `app-doctor` / `cross-layer-audit` / `fedres-check` red on their guard line on **every** workstation. **The single largest gap between the canonical entrypoint and CI, fleet-wide** — and today **no repo carrying those steps can reach a full-green local `exec`.** Cross-repo, supervisor-applied (AG-13). |
| 4 | **The `AGENTS_BRIEFING` regeneration** | §5, S4-F5 | A *curated* brief owned by the `mgf-common` supervisor, not a mirror of any Rules box. **Waived with rationale** for S4 and unchanged by S5 (TS-29 falsifies nothing it says). Owed at the supervisor's next regeneration. |
| 5 | **An `app-doctor` check for the `## CI delta` list** | §5, S4 | AG-21's staged mechanism. Nothing anywhere reads a delta list today. Cross-repo (AG-13). |
| 6 | **`SEAT-02` §5 / `SEAT-08` §3 gain the SHP channel** | §2.2 | Trigger **half met**: the kit merged, but no wheel carries it and no repo has run `hooks install` (both verified at this pin). A §2.1-step-4 edit owned by whichever wave lands it. |
| 7 | **`DB-S1-3` and `DB-S1-4`** | §3 | Both read ☐ and both were **followed in practice** — the kit shipped observe-mode-with-per-repo-flip, and every wave took one MINOR. Left ☐ rather than flipped, because *practice is not a ruling* and this tracker does not self-enact (SEAT-06). |
| 8 | **The fleet-wide §Z ledger re-baseline, 273 → 306** | §2 rows | Every wave deferred it as a follow-up wave, as the SC-19..23 and REL-14/DP-14/WF-14 EXTENDs did. **Thirty-three new MUSTs** now need a row in each of 44 members' `MGF_STANDARDS_CONFORMANCE.md`. Tracked separately; the largest single piece of work this initiative leaves behind. |

### 6.7 Archival

Per [DOC-11](../standards/DOCUMENTATION.md), a tracker moves to `docs/archive/<year>/`
once its scope is complete. **That move is the founder's, after the closing court and
S5's enactment** — not this wave's, and not this section's. When it happens, items 1–8
above must be re-homed first: a decision box that only exists in an archived tracker is a
decision that has been lost, which is the failure `DB-S3-1` was opened in §3 to prevent.
