### IR-106 — a red set HANDED OVER in a message was reported as a POPULATION: both members verified, their lines and modes corrected, and the count still wrong by half

- **Status:** OPEN as a discipline line; the instance is closed (the run that refuted it is on file).
  Author and subject: todlando. Filed by doyle 2026-09-11 11:20Z from todlando's text; IR-105 lands
  from hertz's lane at the same assembly, which is why this number follows it.
- **Instance (2026-09-11, #304 W1 product lane).** todlando was handed a red set naming TWO cells in
  the spt-daemon webserve module. He opened each one, CORRECTED its line number and its failure mode,
  and reported the corrected pair as his prediction. The unfiltered run at 3e7eaf67 showed FOUR reds
  of the same mechanism (the retired `/local/` index twin): the two named, plus
  `corrupt_registry_is_loud_but_does_not_disable_unrelated_facets` (:1228, 302 vs 500) and
  `node_routing_reserves_facets_without_registry_fallback` (:1011, 302 vs 200). A post-run sweep
  mapping every single-segment node-root literal to its enclosing fn closed the population at four,
  by enumeration; two further cells touch a root and pass for stated reasons.
- **Why the verification is what hides it.** Checking a member answers "is this one real". It cannot
  answer "is this all of them": no amount of per-member rigour turns a received list into an
  enumeration, and correcting a handed-down set FEELS more rigorous than enumerating it.
- **Mirror instance one window later, other direction (hertz, same lane).** His enumeration was
  SOUND (every node-root literal in the module mapped to its enclosing fn) but its SCOPE was
  inherited from the one file he happened to be resolving; the merge also brought
  `bootstrap_firewall.rs` (+4) and `bootstrap_firewall/windows.rs` (+2), so his whole-suite count was
  short by six (predicted 981, measured 987). Same family: a sound instrument pointed at the wrong
  population.
- **Rule.** Before any COUNT enters a prediction, a START or an END, run the enumerating predicate
  YOURSELF, with a tool that can express the population you are claiming (an unfiltered run; a grep
  whose root is the crate, not the file you have open). A set received in a message is a lead.
- **Kin:** [[IR-100]] (a census counts what its filter could not answer for, separately from a no),
  [[IR-101]] (a per-lane green is silent about the population it did not select), [[IR-105]] (a
  from-a-model assertion is refuted only by a run), memory "a predicate without its tool is not evidence".
- **Ripe when:** now, a line in the window protocol, not a build. Fold into the START/END template
  beside the census. · **Size:** one entry, one clause; no code.

### IR-107 — a rig that redirects TMP INSIDE the checkout puts every tempdir fixture under a git toplevel, and cells whose premise is "outside any repo" resolve THIS repo's remote

- **Status:** RIG FIXED in hertz's lane (base now under `AppData/Local/Temp/hertz-304-rig/<label>`;
  `HERTZ_RIG_TMP_IN_REPO=1` restores the old placement on purpose as the negative control). Recorded
  2026-09-11 11:20Z (doyle, from hertz's and todlando's measurements). The A/B arms run in window 6.
- **Instance.** hertz's first unfiltered `spt-daemon --lib` at 69438c01 redded two cells that neither
  lane touches and that todlando's unfiltered run had passed 8 minutes earlier on the same bytes and
  box: `registryhost::tests::recent_projects_for_dedups_newest_first_excludes_spt_internal` (:1404,
  got `["github-com-bigscreenvr-spt-bs-core"]`) and `projwriter::tests::batched_complexity_counters_hold`
  (:842, got `Some("spt-bs-core")`). Both fixtures require a directory outside any repo.
- **Mechanism, measured with a control.** `lane_run.py` set TMP/TEMP/TMPDIR/RUNNER_TEMP to
  `EVID/temp/<label>` inside the spt-core checkout; `git -C <that dir> rev-parse --show-toplevel`
  answers the checkout (remote `BigscreenVR/spt-bs-core`), while the same probe from the default TMP
  answers "not a git repository". `project_id_for_dir` is REMOTE-URL FIRST: `slug(remote)` and
  `display_from_url(remote)` are the two observed strings exactly, and the folder-name fallback could
  not have produced either (candidate folder names: 304-product, hertz-304, spt-core). So git got as
  far as step ONE of the derivation. The first mechanism offered ("any in-repo cwd") was killed by one
  datum: ci.yml:143 runs `kind(lib)` unfiltered on this runner with an in-repo cwd and passed at
  6a7dd6b7. The variable was the FIXTURE's location, never the process cwd.
- **Two instrument defects in the same window, both hertz's, both closed:** `cargo ... | tail; echo $?`
  reports tail's status (memory "render-not-read-pipefail"), printed a confident 0 over a red compile
  gate and then over a checker [must] finding; and a negative control that returns at the refusal
  branch vouched for nothing about the send arm (memory "make a new rig red on purpose", refinement).
- **Rule.** A rig's TMP resolves OUTSIDE every git toplevel, and the rig proves it once per box with
  `rev-parse --show-toplevel` expecting "not a git repository". A test whose premise is "no repo
  here" names that premise in its first assertion so the failure reads as environment, not product.
- **Kin:** [[IR-100]], [[IR-101]] (per-lane green silent about the unselected population; these two
  cells were invisible to the stock 21-name producer for the whole lane), [[IR-106]].
- **Ripe when:** now for the rig (done); the assertion-premise clause is a hertz follow-up, one line
  per cell. · **Size:** one env line in the rig; two comment lines in tests.