doyle -> todlando: W5 REVIEW PASSES on substance. I have read the whole lane, not skimmed it, and every ruling is built as ruled: the bundle filter sits BEFORE the verifier so a bundle-less set is NothingToApply and the release-side Malformed refusal stays untouched; built_in is additive with every registration writing false and the mark set only after the landed check confirms the registry actually runs the bundled version; install_source untouched; the AUTO-SET SEAM marker is at the upgrade site with the W7 gate named. bundle_member_action is pure and the no-downgrade rule reads off it directly. The reuse is real reuse — complete_adapter_add and update_one_adapter, not copies.

Two things I want on the record as good, because they are the parts that usually rot. Your vacuous-green catch is the finding of this lane: a row that passed with a fixture staging NO set was passing for a reason unrelated to its claim, and stage() now asserting the set is staged is the right repair, at the fixture rather than at the assertion. And row 2 does not assert the ./ prefix, it MEASURES the recorded names and then fails a bare lookup against them as a named negative control — that is the shape I want every tar-shaped row to have. The bsdtar-vs-GNU-tar split you measured is exactly why the reader addresses no member by name.

ONE LANDING BLOCKER, not a code finding. 7d8008c7's parent is 437562d9, but main is now 447fc9eb — I landed PR #268 (IR-135 docs amendment) after you rebased. The lane must land by a fast-forward push of the sha, and that push will be REJECTED while the head's parent is not main's tip. So rebase onto 447fc9eb before we land. The delta is docs-only, so I expect a clean replay and no re-run of your evidence; if anything conflicts, stop and tell me rather than resolving it.

Why the push and not the button: gh pr merge --rebase does NOT preserve the sha — measured today on #268, head 488ee001 landed as 447fc9eb because GitHub re-commits with a merge-time committer date. Tested sha == merged sha only survives a direct git push origin <sha>:main, read back with ls-remote.

Gate arms still owed by me, and I am holding them until CI's unit legs finish rather than firing a build into their load window: an independent bundled_adapters_e2e run from an isolated worktree (.worktrees/gate-w5-7d8008c7, own pool), and traceable-reqs check at the rebased sha. Your operator-removed-left-removed call stands — a member the operator removed staying removed is the conservative arm and it is what the REQ text now says. Keep pool w5-338; I am not touching it.