BOUNDED-PLAN CORRECTION LANDED. All five gaps closed in one pass. Holding after this. commit: b2b6055785fd297e094c5e2398b8a32b3e78281f (branch main, UNPUSHED) blob: aaa763971fa0faa0a8e178cd9b20b4a9612aa5e6 sha256: b91a8f097ab83543546c452ad15b180019b3bc46f68c8c18bd99104d96964568 parent: e0f02d7e. traceable-reqs exit 0, tree clean. 1. THE PIN IS THE SHA256, NOT THE PATH. 689503ad9fc6cfde637cbcacf21c42faf130ba465a0df6c356cf290e2adafb85. A differing hash now STOPS THE RUN and forces re-selection and re-admission. A changed binary is a different subject, not a recorded detail. 2. PROVENANCE MARKED UNVERIFIED RATHER THAN ASSUMED, which is the one I would have got wrong on my own. The installed binary predates current main, so MAIN IS NOT ITS SOURCE PROVENANCE. v0.69.0 = 16df0e41 is CONSISTENT with its version string and mtime, and consistency is all it is -- nothing on this box binds those bytes to that commit. So every source citation in the plan (brainproc.rs:1081, broker.rs:2842/:3787/:2815, applyhost.rs:364) is now labelled a claim about THE TREE and not about the executable under test, with the rule written down: if a run's behaviour disagrees with a citation, THE CITATION IS THE SUSPECT. 3. NUMERIC BOUNDS, CHOSEN NOW, WITH AN OVERALL DEADLINE INDEPENDENT OF t0 -- 300 s from run start. That one exists for exactly the reason you named: every other bound hangs off t0, so a refresh that emits no BRAIN_UPDATE_RESTART would leave the run with no defined end. Startup 60 s; t0 wait 60 s (breach = "restart marker not observed", continue to the overall deadline); observation 120 s after t0; reattach 30 s to attach plus 60 s observed; cleanup confirmation 120 s (breach = preserve everything, report unconfirmed). 4. TWO CLOCKS, KEPT FOR EVERY LINE. Generation timestamp = what the child did and when. Receipt timestamp = when the observer was delivered it. Stated exactly, because I had collapsed them: post-t0 content proves THE CHILD PROGRESSED AFTER t0, and does NOT establish that the child was executing CONTEMPORANEOUSLY WITH DELIVERY -- such a line may itself have been generated and then buffered. ARRIVAL TIMING IS EVIDENCE OF DELIVERY, NEVER PROOF OF CONTEMPORANEOUS CHILD EXECUTION. The per-line gap between the two clocks is the only figure that speaks to delivery lag and is reported PER LINE, never averaged. 5. THREE INPUT OBSERVABLES, NEVER CONFLATED. (a) terminal echo -- proves a byte reached the echo path and NOTHING about the child; (b) the child's own tagged acknowledgement; (c) resulting state distinct from both the echo and the tag's text. "The queue drained" may be said only when every tag shows (b) AND (c), in the order sent. A MISSING TAG AT THE DEADLINE IS "NOT OBSERVED WITHIN THE WINDOW", NEVER ESTABLISHED LOSS -- a late drain past 120 s and a genuine loss are indistinguishable to a finite observation. Duplicate = replay; out-of-order = its own finding. EXACT TARGETING, new section 2.1. Every command carries SPT_HOME= explicitly; nothing relies on an inherited or ambient value, and no command is issued from a shell whose environment was mutated once and trusted after. The only two lifecycle verbs -- refresh and stop -- are gated by FOUR checks, all of which must pass or the command does not run: SPT_HOME READ BACK from the command's own environment rather than assumed; the isolated socket rather than the fleet's; the target pid established as this run's BY ANCESTRY; and the pid being neither 4732 nor an ancestor of this session. RETAINED: isolation binding, no-deletion cleanup (uncertain teardown PRESERVES process identities and artifacts and reports unconfirmed), and the explicit unanswered list -- now NINE, having gained unverified executable-to-source provenance and the blanket "not observed" rule covering a missing t0, a missing eviction and a missing input tag. Still prepared, NOT admitted. Holding as instructed -- no runtime, no instrumentation, no further rounds. W2 run 20260912T231404Z retains the execution window.