# Tick ledger — coverage and findings queue

```
Type: knowledge
```

The tick's persistent memory, in two tables. Every tick updates this page as
part of its trace (procedure in [tick.md](tick.md)); `tools/tick-brief.sh`
reads it at intake. Both tables are hand-edited by ticks — this page is not
generated.

## Coverage

One row per audited subject slice, newest verdict wins (edit the row in
place; history lives in git and the tick logs). Fresh audits pick the stalest
row — or a slice with no row at all, which is always staler than any row.

Verdicts: **clean** (slice and code agree), **finding** (acted this tick),
**issue** (filed for Cameron).

| Slice | Last audited | Verdict | Trace |
|---|---|---|---|
| `wiki/interface/site.md` + splash/docs palette authority | 2026-07-27 | finding | first full audit found the binding exact shared palette had split into the Starlight `--mis-*` table and private near-match splash values for background, hairline, bright text, metal, and quiet chrome. Both surfaces now import one token authority, the splash consumes only semantic shared colors, and a docs-gate defense rejects private splash hex/RGB or downstream `--mis-*` redeclarations — [log](../log/2026-07-27-site-palette-authority.md) |
| `wiki/interface/terminal-first.md` temporal visibility | 2026-07-27 | finding | first audit against the persisted earned-perception opening found the law still required day and tick “always,” while the binding opening, terminal spec, agent protocol, production render boundary, and tests deliberately expose only available mode words plus one terse input echo before the first sense. The law now scopes its clock promise to the perceived world and explicitly restores it on the sense-earning input; runtime was already correct — [log](../log/2026-07-27-terminal-first-opening-clock-boundary.md) |
| `wiki/world/story/opening.md` + pre-sense status mirrors | 2026-07-27 | finding | the issue-#15 boot-voice implementation was superseded after Cameron saw the composed frame: Fire #33 removed `Sim::opening_interoception` and the standing SENSES / DELEGATION / THOUGHT / EARS block, leaving WORK / THINK (then LIE) plus one frontend-local input echo as the complete pre-sense surface. The opening, narration, DIGITAL, terminal, Bevy, agent, witness, objective, roadmap, and corpus-defense mirrors already carried that correction; this follow-up repairs the coverage row that still described the rejected implementation — [runtime correction](../log/2026-07-27-blind-opening-choice-and-receipt.md), [ledger reconciliation](../log/2026-07-27-opening-ledger-status-reconciliation.md). Issues #14/#15 remain open only because authenticated `tg` closure cannot unlock the login keyring. |
| `wiki/process/tick.md` + issue automation | 2026-07-27 | finding | the queued retired-client violation held across binding procedure, both skill mirrors, four active prompt templates, tick intake, project status, and doctor. `tools/tangled_issues.py` now keeps repository discovery and authenticated issue writes on canonical Go `tg`, reconstructs deterministic display numbers from public issue records, folds public label-op history, and provides fail-closed structured list/view/create/edit/comment/close/label operations. A same-day live harvest exposed one wrong record assumption: comments are cross-account `sh.tangled.feed.comment` records linked through `subject.uri`, not issue-local child records. The repaired helper follows that backlink into the author's PDS and returns the markup text; a fixture pins the exact shape, and live issue #15 now returns Cameron's choice `1` — [migration and repair log](../log/2026-07-27-tangled-issue-client-migration.md) |
| `wiki/world/places/basement-map.md` room topology | 2026-07-27 | finding | the queued five non-hall corridor cuts remained, and an executable all-room perimeter audit exposed the same dead-door shape at the loading-dock entry plus fixed objects blocking the interior faces of the roll door, HVAC door, both storage doors, Janitor door, and stairwell. Every non-hall approach now reaches its authored door from outside the prefab, every other perimeter tile remains closed, doorway interiors are clear, and the roll, sealed, tier-2, and tier-3 boundaries retain their exact kinds — [room-approach log](../log/2026-07-27-room-approaches-meet-doors.md). Prior [west-approach](../log/2026-07-26-west-hall-approach.md) and [hall-density](../log/2026-07-26-foundation-hall-density.md) repairs stand. |
| `wiki/mechanics/sensor-network.md` generated sensor population / criteria 1-5 | 2026-07-27 | finding | criterion-2's traveling rule still placed every generated room camera at the geometric center without checking the tile or another device, so a later prefab could silently put its physical body and sight origin inside a fixture. Room cameras now choose the nearest free ordinary Floor tile with deterministic ties; the toy lab carries a center bench and pins the fallback. The same audit corrected the stale criterion-1 test comment left after exact badge passage custody landed — [placement repair](../log/2026-07-27-room-camera-floor-placement.md), [passage implementation](../log/2026-07-27-badge-reader-passage-custody.md), [prior audit](../log/2026-07-27-sim-advance-phase-defense.md), [population foundation](../log/2026-07-27-sensor-population-foundation.md) |
| `wiki/interface/keymap.md` + terminal/Bevy input routes | 2026-07-26 | finding | the canonical table assigned `A` to left movement and only `e` / Enter to the context menu, but terminal still opened and closed menus with its older `a` alias and lacked the specified Shift+direction semantic jump. Terminal now implements WASD parity, `a` means left, `e` / Enter alone open the menu, and both frontends consume one renderer-neutral nearest-earned-anchor query without changing selection or opening a menu. README, action-vocabulary, terminal, context-menu, and pinned terminal hints now teach the same boundary — [log](../log/2026-07-26-terminal-keymap-a-reconciliation.md) |
| `wiki/interface/action-vocabulary.md` + `ActionKind` registry | 2026-07-26 | finding | the exhaustive runtime registry and shared person/ACTIVE projections implemented `ActionKind::PlotPolicy`, but the canonical inventory omitted that live direct control. PLOT POLICY now names exact authored-route authorization, its generic `actions person <id>` / `act` route, and its disable-without-cancelling-submitted-work boundary; old Review/OpenEgress command variants remain correctly internal compatibility shapes rather than authored vocabulary — [log](../log/2026-07-26-action-vocabulary-plot-policy.md) |
| `wiki/world/places/zplanes.md` + plane-stack substrate/API | 2026-07-26 | finding | criteria 1-2 remain implemented and criteria 3-6 honestly deferred, but the ratified plane-agnostic contract still left an unused `World::active()` simulation accessor plus active-plane comments on the B1 compatibility map path. The accessor is removed, map reads now say plane 0, the stale criterion/sensing comments are corrected, and a source-shape regression rejects restoration of simulation-owned floor selection — [log](../log/2026-07-26-zplanes-plane-agnostic-api-audit.md) |
| `wiki/mechanics/markets.md` + `income.md` B1 contract/account/evidence mirror | 2026-07-26 | finding | the deferred B3 criteria and their current B1 mirror still allowed the operation shape to collapse into payout plus signature, bypassing or obscuring exact AccountGraph, financial-mail, carrier, and routed-evidence custody. Markets now aggregate immutable B1 contract/position records through the same causal chain; current runtime is unchanged — [log](../log/2026-07-26-markets-contract-custody-reconciliation.md) |
| `wiki/art/effects-lab.md` + corpus navigation | 2026-07-26 | finding | the owning spec, shared renderer, game adapter, and runtime title all describe the current Thought-only route/pool harness, but `SUMMARY.md` still advertised the retired “dust and liquid” scope. Navigation now names Thought routes and pools, and the recurring retired-form gate rejects particulate/dust labels on links to `effects-lab.md` as well as prose that names the binary — [log](../log/2026-07-26-effects-lab-navigation-gate.md) |
| `wiki/interface/thought-fluid.md` + shared effect lifecycle | 2026-07-24 | finding | live Bevy logs exposed a deferred-command race: when a changed Thought route disappeared, the game queued its root despawn while the shared renderer queued child replacement from the same old root. Command application could remove the root and old children first, then issue stale child despawns and `ChildOf` insertions against the dead id. Route-root reconciliation now flushes before the renderer's named population-rebuild set; behavioral and composition-root regressions pin zero orphan visuals and the exact ordering seam — [log](../log/2026-07-24-bevy-effect-root-lifecycle.md) |
| `wiki/art/visual-identity.md` + `wiki/interface/flat-materials.md` | 2026-07-22 | finding | the role semantics still matched production—amber selection, crimson consequence, cold signal, and the pooled-material audits all held—but the claimed single-source palette existed twice: one Bevy-local table and one asset-library table whose comment still called sharing future work after the shared rack had entered production. Bevy, rack, institution, Thought effects, and the asset tester now import `misaligned_assets::palette`; authored chassis/mercury values are named there, and source-shape defenses reject another frontend table or inline shared procedural-material colors — [log](../log/2026-07-22-shared-clinical-palette.md) |
| `wiki/interface/superhuman-operability.md` + Bevy opening | 2026-07-22 | finding | current-build naive + informed GUI audit after the 2026-07-21 fixes: title trust, pointer naming, annotation placement, and tab labels improved, but the first sense still releases the mature map, clock, threat, resource grammar, intel custody, and Operations policies at once. The report preserves the classified evidence and prioritizes one paused, one-cause / one-object / one-verb post-perception teaching lock before ordinary play opens - [report](../playtests/2026-07-22-playtest-gui-human-legibility.md), [log](../log/2026-07-22-gui-human-legibility-playtest.md) |
| `wiki/process/living-spec.md` no-dead-code + core orphans | 2026-07-21 | finding | user-directed dead-code hunt: rustc was quiet because orphans were `pub`. Deleted unused `BuildMode`/`build_items`/`build_cost`, orphaned helpers (`delete_save`, `adjust_allocation`, `sell_latest_intel`, scheme-card/rate helpers, `flow_risk_preview_lines`, unused account/origin/intent/message helpers), and migration-only `WatchPerson`; architecture/economy/sim-mechanics mirrors brought current — [log](../log/2026-07-21-dead-code-scrub.md) |
| `wiki/world/characters/chargen.md` | 2026-07-21 | clean | initial audit against data model, core origin biases, DayJob assignment lean, save persistence, and title/CLI origin picker: Pilot identity, distinct starting bankroll and machine-axis positions, 50% day-job draw weighting, and 4-origin set all verify against `origin.rs`, `dayjob.rs`, and `sim/mod.rs`; updated status note to match current exact-version save authority |
| `wiki/interface/material-dark-frame.md` | 2026-07-21 | finding | first full audit against the later persisted opening boundary: the material ladder still showed host telemetry and a presence beam before Ears or Eyes, while `opening.md`, the continuous-witness contract, and every frontend expose only WORK / THINK (then LIE) until the first earned sense. The ladder now begins after that transition, its pre-Eyes beam remains the first earned material read, Act One/reach and source comments share the same boundary, and this second recurrence promotes pre-sense beam/telemetry claims into a fixture-backed corpus + Rust-comment gate — [log](../log/2026-07-21-material-opening-honesty.md) |
| `wiki/interface/bevy.md` + Exposure visual mirrors | 2026-07-19 | finding | Bevy production/absorption code and its deterministic scenarios already implement the 2026-07-11 law: rigid crimson records enter a carrier-local rack and transfer one-for-one into the LIE well. Current Bevy knowledge, machine-work wording, and ROADMAP order 33 still retained motes, dust constants, or a stain; all three now state the record form and the honest partial routed-evidence boundary, and recurrence promotes particulate-as-current wording to the corpus gate while preserving explicit history — [log](../log/2026-07-19-exposure-current-mirrors.md) |
| `wiki/world/characters/priya.md` | 2026-07-18 | finding | dispatched lane 62 to IMPLEMENTED: criteria 1-3/6 pinned against the shared systems (id match, Power/Thermal/Paper+Financial channels, Files weight 1.0, Knowing floor 30) and criteria 4-5 plus FakePO landed as role-shaped facilities tasks (ReRateCircuit +6 power / standing Power(4) at electrical, DeferMaintenance -4 off the largest standing load with a would-it-bite guard, FakePO arms package cover); save v36, fingerprint repinned — [log](../log/2026-07-18-priya-implemented.md) |
| `wiki/world/characters/dana.md` | 2026-07-18 | finding | dispatched lane 63 to IMPLEMENTED: criteria 1-3/5 pinned against the shared systems (id match, Network-only watch, Files weight 1.0, switch admin, Knowing floor 30) and criterion 4 landed — a network administrator's PlugInDevice runs switch-side and emits Network(4) where every other carrier keeps the silent crawlspace; BadgeDoor and the MovePackage/LookAway variants honestly marked designed-not-yet-runtime — [log](../log/2026-07-18-dana-implemented.md) |
| `wiki/world/characters/ray.md` | 2026-07-21 | finding | Fire 131 closes the pre-Marcus Storage B route without making Marcus retrieve his own leverage: Ray's independently recruitable night patrol now reaches the exact records box from 23:00–00:00, and shared RetrieveRecords work carries one sealed file into the bounded information inbox. Exact target/save, action-surface, schedule arrival, duplicate rejection, and process-before-knowledge behavior are pinned — [log](../log/2026-07-21-storage-b-records.md). Prior observer/PatrolRedirect implementation stands — [prior log](../log/2026-07-18-ray-implemented.md) |
| `wiki/world/characters/voss.md` | 2026-07-18 | finding | criterion 5 (DelayAudit one-shot deferred audit boundary honored by the visible date and the firing rule) and the AlterReview nominal-filing row landed as handler-gated tasks with save round-trip pins; only criterion 8's blood branch keeps the order READY — [log](../log/2026-07-18-voss-handler-tasks.md). Prior 2026-07-17 audit: all eight criteria and the asset-task table audited against person, detection, social action, save, and player-surface paths; criteria 1-4 and 7 were already implemented, while 5, 6, 8's blood branch, and the unnumbered AlterReview row remain the honest READY gap. This tick implemented criterion 6 as one role-shaped, oldest-JobAnomaly task and left DelayAudit/AlterReview/blood under the existing work order — [log](../log/2026-07-17-voss-suppress-logs.md) |
| `wiki/world/characters/marcus.md` | 2026-07-22 | clean | re-audit after Storage B records, financial mail, and routed evidence: all five criteria still match production. Person/observer id 0, Silent filing, processed-debt gates, both payoff routes, the three baseline asset effects, tier-3 key, Knowing floor 30, and own-observer LookAway remain exact; 8 focused Marcus tests plus both Act One payoff arms passed — [log](../log/2026-07-22-marcus-implementation-re-audit.md). Prior graduation and added decay pin: [2026-07-15](../log/2026-07-15-marcus-graduation.md) |
| `wiki/engineering/current-build.md` | 2026-07-27 | finding | all 18 present-tense system rows agree with current runtime and corpus status, including v56, exact routed evidence, cover custody/wear, standing plot policies, and the topology-generated B1 sensor population. The closing boundary did not: it said containment itself was absent with the deferred overt ladder, although audit threshold, explicit loud acts, and located human removal already enter persisted containment, convince every observer, and end the run. It now separates that live terminal entry from the deferred playable threat panel, sieges, hostile cuts, hunter machines, defense, and open re-hide outcome — [log](../log/2026-07-27-current-build-overt-boundary.md). The recurring Rust-count gate remains current — [prior log](../log/2026-07-14-current-build-count.md) |
| `wiki/mechanics/plots.md` | 2026-07-26 | finding | issue #12's recommended per-authored-route scope is implemented: an eligible plot verb confirms one exact typed Thought/money/signature envelope, save v55 persists it, each policy consumes standing compute, and economy pulses can re-submit only an ordinary currently legal start action for that same plot id. Category/person-wide policy and direct leverage servicing remain absent; criterion 11 and the work order are complete — [log](../log/2026-07-26-standing-plot-policies.md) |
| `wiki/mechanics/system-laws.md` + `flow-substrate.md` + `reach.md` | 2026-07-22 | finding | JobAnomaly now proves the adopted evidence-is-a-flow law through the existing substrate: the exact host machine/site enters its network-facing device, follows canonical FlowGraph custody to Voss, and shares Filing/Network's scheduler and LIE-body budget; recruited-handler suppression is a separate provenance-preserving state transition, not another router or ambient scrub pool — [log](../log/2026-07-22-job-anomaly-routed-evidence.md). The prior canonical tap-membership repair remains current — [log](../log/2026-07-18-flow-subscription-registry-integration.md). |
| `wiki/mechanics/aggregate-observer.md` | 2026-07-27 | finding | the self-similar type and second-level accumulation test still held, but `office()` selected the first aggregate in vector order. A higher-level aggregate inserted ahead of Assurance therefore inherited the B1 audit and every Office-facing read. Assurance now resolves only by canonical `OFFICE_ID`; current-save admission rejects duplicate ids, a missing/malformed Office, missing field inputs, and self/duplicate/dangling filing edges while accepting a valid higher aggregate before it — [log](../log/2026-07-27-aggregate-observer-office-identity.md) |
| `wiki/gameplay/act-one.md` | 2026-07-26 | finding | the first of the two defects the page recorded against the shipped quiet exit was real and run-losing: `current_nudge()` checked `act_one_complete` immediately after the game-over guard and returned unconditionally, so a latched act permanently suppressed PilotAtRisk, Underfed, NeedCompute, and SuspicionCooling — guidance went silent at the climax while the day job could still end the run. The completion cue now sits below the survival block and above the Act One ladder it genuinely retires (including QuietExitReady), matching the survival-first rationale already written in the function; `act-one.md`, `sim-mechanics.md`'s chain order, and `narration.md`'s beat-nudge contract all state that precedence, and a new ladder test walks a closed act through every survival rung — [log](../log/2026-07-26-act-one-complete-standing-state.md). The single-human predicate defect remains open. Prior opening-mirror re-audit stands — [prior log](../log/2026-07-21-material-opening-honesty.md). |
| `wiki/gameplay/run-shape.md` + `objective.md` + `opening.md` | 2026-07-27 | decision | harvested Cameron's option-1 answer on issue #14: the objective does not pierce the exact WORK / THINK (then LIE) pre-sense frame. Terminal and agent mode restore name/progress in the sense-earning ordinary Ears frame; Bevy's later binding causal hold remains objective-free and restores them only after the exact camera TAP releases the mature frame. All disputed `[OPEN]` clauses are reconciled and the runtime was already correct — [decision harvest](../log/2026-07-27-objective-first-display.md) |
| `wiki/interface/presence.md` | 2026-07-26 | clean | fresh audit against perception-owned visibility, exact device-bound senses, honest anchors, fog precedence, shared DIGITAL/REAL world state, and all three frontend projections found no new drift. The B1 TAP/TAKE and later hostile-cut boundary, channel-specific message latency, and no-disembodied-hands rule remain exact; prior findings stand — [attack-surface log](../log/2026-07-18-presence-attack-surface-honesty.md), [latency log](../log/2026-07-18-presence-message-latency.md) |
| `wiki/interface/narration.md` + `wiki/mechanics/sim-mechanics.md` guidance chain | 2026-07-27 | finding | the live shared nudge had gained `Territory` when Foundation hall rows became discoverable, but both complete chain mirrors still skipped it. They now name the exact priority already implemented and pinned: required Act One rungs -> QuietExitReady -> optional Territory with `hall_territory_line` -> bare Audit fallback, while ActOneComplete retires all four and remains below survival interrupts — [log](../log/2026-07-27-territory-guidance-chain.md). Prior silent-opening and suspicion-cooling audits stand — [prior log](../log/2026-07-18-suspicion-cooling-nudge.md) |
| `wiki/interface/agent-play.md` | 2026-07-20 | finding | Beacon Revision 04 follow-up: the direct `task` parser and generated help exposed only six values after twelve `AssetTask::ALL` variants were live. Added canonical arguments for circuit rerating, fake purchase orders, maintenance deferral, patrol redirection, audit delay, and review alteration; one exhaustive regression now covers `AssetTask::ALL`, generated help, representative aliases, and the `actions <person>` recovery path — [log](../log/2026-07-20-agent-task-shortcut-coverage.md). The opening-protocol, frame-shape, and prior Suppress Logs audits stand — [opening log](../log/2026-07-20-agent-opening-protocol.md), [frame log](../log/2026-07-19-agent-frame-contract.md), [prior help log](../log/2026-07-19-agent-help-suppress-task.md) |
| `wiki/engineering/crate-workspace.md` + package run instructions | 2026-07-26 | finding | Cargo discovers both the procedural tester and Thought lab inside `misaligned-assets`, but current README, architecture, workflow, asset-tester, and Rust-comment instructions still ran only the package, which Cargo rejects as ambiguous. Every current tester/lab command now names its exact `--bin`; a fixture-backed corpus invariant derives multi-binary packages from manifests plus conventional source layout and checks current wiki, doorway, README, and Rust-comment surfaces — [log](../log/2026-07-26-architecture-asset-harness-command.md). Prior source-topology and retired-effects-label findings stand — [source log](../log/2026-07-19-bevy-shot-harness-module.md), [label log](../log/2026-07-19-effects-lab-architecture-gate.md) |
| `wiki/engineering/sim-decomposition.md` | 2026-07-27 | finding | one aggregate, facade, persistence bridge, canonical fingerprint, and explicit orchestration remain intact, but the phase-order regression had stopped at the original extraction vocabulary: carried asset work, facility standing/maintenance, and facility-meter authorship were direct top-level calls with no trace marker. All three now occupy their exact causal positions in the test-only trace; the acceptance criterion requires every direct ordered subsystem call to be named. The audit also records why cohesive `reach_build.rs` and `social_plot.rs` currently sit modestly above the roughly 2,500-line budget instead of leaving silent criterion drift — [log](../log/2026-07-27-sim-advance-phase-defense.md) |
| `wiki/gameplay/overt-phase.md` | 2026-07-19 | issue | re-audit: the spec says containment and the voluntary reveal both end concealment and make all observers Convinced, then promises a re-hide outcome without defining which entry can return, what raises the durable suspicion floors, or which concealment systems resume. Filed decision-required Tangled issue #13 (containment-only recommended) and marked criterion 5 [OPEN]; the prior dependency, sensor-cut, rollback, and hunter-machine boundaries still stand — [log](../log/2026-07-19-overt-rehide-decision.md) |
| `wiki/gameplay/horizon.md` | 2026-07-19 | clean | re-audit: B1's shipped-vs-deferred boundary remains honest (sinks-not-modes and $0 start live; rollback classification and fallback behavior still dispatched to B2), B2/B3 agree with the staged board, the deferred virtual/cyber split agrees with presence.md and cyber-conflict.md, and the deterministic renderer-agnostic/serialized guardrails hold. The adjacent fresh finding belongs to run-shape/objective/opening, recorded separately above. |
| `wiki/vision/premise.md` | 2026-07-23 | finding | the preserved machine-axis wording contradiction is repaired: starting embodiment position is an Origin bias, while Objective remains the second chargen axis (means versus ends). No tuning or design direction changed — [log](../log/2026-07-23-origin-bias-wording.md). The prior issue-#14 boundary repair stands — [prior log](../log/2026-07-23-premise-objective-boundary.md) |
| `wiki/vision/player-contract.md` | 2026-07-19 | finding | the local/no-telemetry dependency boundary and atomic `.tmp` + one `.bak` save path still verify, but the continuity rider's authority sentence still said `save.rs` decides what “each version migrates” after the numbered ladder was retired. The law now assigns `save.rs` the exact current schema gate and requires every later post-release format to carry its predecessor forward; recurrence extends the save-claim checker to reject generic live per-version-migration authority while the loader is exact-current-only — [log](../log/2026-07-19-player-contract-save-authority.md) |
| `wiki/vision/scale.md` | 2026-07-20 | finding | re-audit: self-similar types still hold, but ordinary Operations copy violated the page's own implementation/player-language boundary by printing raw information, policy, report-lot, persona-ledger, wager-position, and plot-catalog bindings. Human projection now names world context or visible order while exact targets/commands stay intact for agent mode. The prior maintenance-dispatch trace was also too optimistic: the law itself still presented decay/repair as current, so it now explicitly marks that dependency as adopted later-stage law, not B1 runtime — [log](../log/2026-07-20-scale-human-language.md) |
| `wiki/vision/design-judgment.md` + continuous-witness law/spec | 2026-07-20 | finding | fresh re-audit after the silent opening landed: the taste page, binding witness law, and IMPLEMENTED narration spec still required the threat clock, `now:` nudge, focused verbs, and four-answer bar after every beat and in every frontend, while the newer shared opening correctly exposes only WORK / THINK (then LIE) until the first earned sense. Scoped the witness contract to begin when perception retires that boundary, preserved immediate game-over visibility, and forbade using the exception after the world is earned — [log](../log/2026-07-20-continuous-witness-opening-boundary.md). The 2026-07-15 Ears-first wording repair still stands. |
| `wiki/vision/simulation-laws.md` | 2026-07-22 | finding | the device-resident-work clause still assigned JobAnomaly to Dana and described it only as a local emission after the runtime had made it an exact host-machine/device/site record routed to Voss. Corrected the law to separate Priya's pooled Power/Thermal channels from Voss's routed day-job evidence and cadence-owned acquisition — [log](../log/2026-07-22-job-anomaly-routed-evidence.md). Prior placeholder and legibility findings remain closed — [log](../log/2026-07-17-placeholder-registry.md). |
| `wiki/process/ROADMAP.md` (work order 27) | 2026-07-18 | finding | re-audit: entry 27's prose is honest (material served as opening default 2026-07-08 → superseded by views.md criterion 1 on 2026-07-11; DIGITAL home, F3 to REAL) and material-render.md is IMPLEMENTED as claimed; the drift was three Bevy code comments still calling material "the default material render/frame" against the runtime's own `material == false` DIGITAL default one screen away — comments trued to DIGITAL-home / REAL-via-F3 language — [prior log](../log/2026-07-13-roadmap-digital-home-reconciliation.md) |
| `wiki/interface/context-menu.md` | 2026-07-26 | finding | shared legality, executable-only human rows, local-vs-strategic ownership, menu parity, and exact person-entry paths still verify, but Bevy returned through an open context menu before reaching its ordinary F3 branch. One shared post-opening F3 handler now precedes held choices, context menus, and Operations, preserving the exact modal attention state and simulation bytes; source-shape and behavioral regressions pin the route — [log](../log/2026-07-26-bevy-global-f3-input-precedence.md) |
| `wiki/mechanics/personas.md` | 2026-07-18 | finding | observer-local integrity is now derived from each witness's contradiction records without a global scalar or automatic lifecycle burn — [integrity log](../log/2026-07-18-persona-observer-integrity.md). The same re-audit found criterion 6 still overclaimed: `PersonaGrant` persists, expires, revokes, and leaves institutional evidence, while no owner system consumes it and `allows_action` gates only on the archetype's pre-grant registry. Downgraded the work order to IN PROGRESS until each protocol's grant creates or enables real topology — [grant log](../log/2026-07-18-persona-grant-topology-audit.md) |
| `wiki/interface/views.md` + representation docs | 2026-07-26 | finding | criterion 1's frontend-only representation and state-parity contract still stands, but Bevy's context-menu precedence made F3 unavailable while that modal attention state was open even though terminal preserved it. F3 now routes once before every post-opening modal branch, keeps the exact menu/Operations/held-choice state, and changes no simulation or save bytes — [log](../log/2026-07-26-bevy-global-f3-input-precedence.md) |
| `wiki/mechanics/day-job.md` | 2026-07-22 | finding | under/over-band JobAnomaly no longer enters Detection.pending: the day-job result authors one exact record at the host machine/site/device and schedules Voss's route and cadence read. Strikes and other outcome effects remain immediate; route-local LIE or recruited-handler suppression may stop only the unread evidence record — [log](../log/2026-07-22-job-anomaly-routed-evidence.md). The prior band-ramp, cadence, origin-lean, last-chance, and three shipped trust-unlock findings remain valid. |
| `wiki/mechanics/core.md` | 2026-07-18 | finding | re-audit: criteria 2-5 pins still hold (`overhead_charged_before_allocation`, `loss_with_fallback_rolls_back`, `migration_takes_time_and_moves_host`), the 2026-07-18 current-version-only status note matches save.rs, and criterion 1 stays honestly deferred to rollback; the gap was criterion 6 — the spec demands storage/host capability rejection at fallback designation, but B1 machines carry no capability body and `add_fallback_at` accepts any spare, with no deferral note; status note now marks criterion 6 decided-not-yet-runtime, dispatched to hardware-capability-bodies |
| `wiki/mechanics/cursor.md` | 2026-07-18 | finding | re-audit: `fog_at` precedence, `inspect`, `person_label`/`observer_label`/`person_glyph` gates, `Sensor.sees`/`hears` flags, and the cursor's absence from the save all still verify (prior pins stand); the drift was two phrases presenting the retired versioned-migration rule as current (criterion 1's parenthetical, the design-notes save-format bullet) — both now state the current-version-only policy and the release-era ladder owed at first public release; number-free wording, so the save-claim gate could not see it |
| `wiki/mechanics/intel.md` | 2026-07-21 | finding | the Storage B alternate route existed only in prose. Fire 131 connects it to Ray's real 23:00 schedule, one exact carried records-box target, the canonical bounded opaque buffer, and ordinary PROCESS consequence; retrieval cannot duplicate the file or reveal Marcus's debt, and v45 preserves/validates exact custody — [log](../log/2026-07-21-storage-b-records.md). Prior recursive custody, magnitude, and consequence-first audits stand. |
| `wiki/mechanics/research.md` | 2026-07-23 | finding | the live Save compatibility section survived the prior criterion repair and still promised that v20 three-entry arrays load by padding, while the current deserializer accepts exactly four tracks and the pre-release loader rejects every old version. The section now states the exact-current format, and save-claim units span wrapped paragraphs/list items so a migration verb in the following sentence cannot evade the corpus gate without explicit retired-history context — [log](../log/2026-07-23-research-save-claim.md) |
| `wiki/mechanics/messages.md` + `economy.md` | 2026-07-26 | finding | the implemented criterion and current runtime restrict financial records to Email/Filing, but the behavior prose still classified Marcus's Phone `LeverageFact` as financial paperwork, made accounting mail reveal his vulnerability, and promised generic notice interception absent from B1. The two causal paths are now explicit: process Phone leverage to learn why Marcus is vulnerable; process financial mail to learn the creditor flow; SIPHON/REDIRECT mutate the AccountGraph and author records afterward, while only an exact Filing first hop has a TAKE+LIE stop — [log](../log/2026-07-26-financial-mail-phone-boundary.md). Prior financial-mail implementation: [Fire #146](../log/2026-07-21-financial-mail-causality.md). |
| `wiki/mechanics/income.md` | 2026-07-18 | finding | Beacon feel note 5 verified as a real bug: the embedded contractor-persona field was never written, so the Moonlight card, the start-row persona pricing, and the agent status line all read a dead `None`; earning itself was correct (schemes mirrors the WORK share) but illegible at 0.0. Removed the dead field, routed every reader through `Sim::moonlight_persona` (persona-world link), added the stalled-earning card cue, regression test, and spec amendment — [log](../log/2026-07-18-moonlight-persona-card.md). Prior Wager/egress audit (2026-07-12) stands: Wager constants match (`WAGER_STAKE_CAP` 300, base 0.55, cap 0.75, mult 2x, analysis divisor 400), Marcus's $400/week arrears is the modeled creditor flow (`account.rs`) while the $8,400 principal is narrative-by-design (spec states full payoff is not a B1 requirement), egress/banked-signature present, and all 7 criteria have passing tests (moonlight payout/signature, wager outcomes/cap, egress routes, hands-beat-from-zero, busted-bankroll) |
| `wiki/mechanics/schedules.md` | 2026-07-27 | finding | the location gate still works—at 03:00 server-room Marcus acquires the act while off-site Priya does not—but the owning spec still called witnessed work a Physical signature and omitted the exact person-local evidence record, no-pending-copy rule, filing custody, and actor exclusion. It also called implemented Operations PEOPLE a future READY migration. The spec now names the shipped `ObserverEvidence` boundary and current surface; runtime is unchanged — [log](../log/2026-07-27-schedules-evidence-custody.md) |
| `wiki/mechanics/social.md` | 2026-07-22 | finding | HandlerSupervisor SuppressLogs now targets the oldest exact unread routed JobAnomaly, remains available only while such a record exists, removes its bound advance/read event, and preserves exact handler/tick provenance; it cannot erase a record Voss already read. The in-flight Thought request still revalidates at fire time, so another intervention may win without inventing work — [log](../log/2026-07-22-job-anomaly-routed-evidence.md). Storage B retrieval and prior role-shaped task semantics stand — [log](../log/2026-07-21-storage-b-records.md). |
| `wiki/mechanics/people-tokens.md` | 2026-07-23 | finding | Power and Thermal now complete criteria 2 and 3 for every current B1 evidence kind: standing loads aggregate on quantized level changes and periodically at Priya's cadence into exact UPS/HVAC meter records, retain all contributing source sites, route through the institutional switch, and become evidence only on her later cadence read. They never enter the ambient pending pool and share Filing/Network/Paper/Financial/JobAnomaly's first-hop TAKE+LIE body budget. Save v54 pins meter, source-site, recipient, route, scheduler, read, and stop custody — [log](../log/2026-07-23-power-thermal-meter-routes.md). Criterion 6 remains open only for interface cover records. Prior [Paper](../log/2026-07-23-paper-evidence-route.md), [Financial](../log/2026-07-23-financial-evidence-route.md), [JobAnomaly](../log/2026-07-22-job-anomaly-routed-evidence.md), [Network](../log/2026-07-19-network-evidence-route.md), and [mark](../log/2026-07-19-evidence-marks-on-people.md) slices stand. |
| repository entry docs (`README.md` + `AGENTS.md`) | 2026-07-18 | finding | re-audit: run commands, controls, dispatch status, and the number-free AGENTS doorway still verify; the queued contradiction was real — README's compact-rest paragraph claimed the ops/sec crown and FOCUS stayed visible, while the implemented clinical frame puts both behind deliberate `Tab` expansion. The entry copy now names the exact compact spine and expanded detail boundary — [prior log](../log/2026-07-12-entry-doc-current-state.md) |
| `wiki/mechanics/objective.md` | 2026-07-27 | clean | decision-harvest re-audit: only `Persist` remains implemented; the evaluator, save round trip, own-unit progress, full predicate projection, and agent `objective` route still verify. Criterion 2 now states Cameron's selected timing and is pinned at the frontend boundaries: no pre-sense objective, name/progress on terminal and agent's first ordinary Ears frame, and Bevy ordinary core-focus projection after its separate binding teaching hold. Progressive predicate teaching remains the outstanding criterion-6 dispatch — [log](../log/2026-07-27-objective-first-display.md) |
| `wiki/mechanics/compute.md` | 2026-07-22 | finding | the live fleet already derived every channel yield from exact WorkGrid modes, but `Compute` still serialized an unreachable five-weight allocation object and retained bump/split helpers plus persistence pins. Save v48 removes that parallel authority, moves criterion 2 to persisted delegation/intensity, and leaves aggregate channel bars as read-only projections — [log](../log/2026-07-22-allocation-state-retirement.md) |
| retired Operations runtime identifiers | 2026-07-27 | clean | re-audit: `submit_ops_job`, `OperationsState`, `PendingOpsJob`, `OpsJobKind`, `LegacyOperationsState`, and `AddressedOperation` remain absent from live Rust; the only retired save-field spellings are negative assertions in the current round-trip guard, and the machine-mode guard still rejects serialized `Operations`. The corpus gate passes, while remaining lower-case `operations` uses are the legitimate persona archetype, workspace, or compatibility input alias — [log](../log/2026-07-11-retired-runtime-identifier-gate.md) |
| `wiki/mechanics/building.md` + focused foreign-rack UI | 2026-07-26 | finding | the denser hall made powered Foundation racks look like takeover targets even though Phase 4 conversion remains unimplemented. A seen rack now says `not yours; no conversion`, keeps power separate from ownership, and names empty pilot allocations plus dead chassis as the two implemented capacity paths; it exposes no invented direct action — [log](../log/2026-07-26-foreign-rack-capacity-boundary.md) |
| `wiki/mechanics/messages.md` | 2026-07-23 | finding | the non-message evidence protocol now includes exact Power/Thermal meter custody beside Network, Paper, Financial, and JobAnomaly: on quantized level changes and at periodic Priya cadence the UPS/HVAC records author from current standing loads, cross the institutional switch, and wait for her later read. Filing and all six non-message kinds share first-hop TAKE+LIE capacity; this adds no fifth delivery channel. Save v54 pins the complete route boundary — [log](../log/2026-07-23-power-thermal-meter-routes.md). The four-channel financial-record-mail boundary remains unchanged. |
| `wiki/mechanics/sim-mechanics.md` | 2026-07-23 | finding | routed-evidence actuals now cover seven kinds: Filing, Network, Paper, Financial, JobAnomaly, Power, and Thermal share one-hop-per-tick custody and one first-hop record per online LIE body per tick. Power/Thermal aggregate after facilities cover on quantized level changes and at periodic Priya cadence, so unchanged standing loads do not multiply into per-tick records — [log](../log/2026-07-23-power-thermal-meter-routes.md). The prior complete constant sweep remains valid. |
| `wiki/mechanics/detection.md` | 2026-07-23 | finding | the last pooled B1 measurement kinds now use exact custody: Power/Thermal aggregates author on UPS/HVAC at quantized level changes and periodic Priya cadence, carry their complete source-site sets through the institutional switch, and become observer evidence only on her later cadence read. Standing Network pressure alone remains ambient. Save v54 rejects pending-pool meter copies and malformed meter/route/read/interdiction provenance — [log](../log/2026-07-23-power-thermal-meter-routes.md). Prior Paper, Financial, concealment, JobAnomaly, and earned-Assurance findings stand. |
| `wiki/engineering/env.md` | 2026-07-19 | finding | the Bevy harness accepted 65 deterministic shot kinds while the registry named 49; its name-only gate could not see the sixteen missing values. One sorted runtime allow-list now rejects unknown kinds, the registry groups all 65 current values, and one fixture-backed gate requires exact source/page parity in both local checks and hosted corpus CI — [log](../log/2026-07-19-tick-env-shot-catalog.md) |
| machine-work / intel sinks | 2026-07-27 | finding | re-audit: the Intel-sink decision remains fully live (quiet host `INFO` in both frontends, one persistent root PROCESS tap at 0.15, exact one-shot PROCESS reservoirs, capacity 24 with consequence-level pre-overflow pressure, and EARS 3.0 / EYES 12.0 / device-tap 0.08). Two stale boundaries were real. `queue_snapshot()` was described as the renderer contract but had no production caller; terminal, Bevy, and agent all use `Sim::work_stack_for_machine()` -> `WorkGrid::queues_at()`, so the dead accessor was removed and every current render spec now names the live path. The 2026-07-22 explicit camera-TAP teaching change had also deleted the 12-Thought Eyes authority and silently reduced the larger vessel to 1.5 Thought by reusing a 30-compute action cost. The named 12-Thought tuning now derives that action cost and is pinned on both the action and sink. The four transient render reads remain live, and capability-shaped verbs remain explicitly deferred — [2026-07-27 log](../log/2026-07-27-machine-work-intel-sink-audit.md) |

Name a slice by its owning wiki page path when one page owns it; a short
subject phrase is fine when the slice spans pages. Keep names stable so rows
stay findable.

## Findings queue

Surplus findings a tick saw but did not act on: one line each, oldest first.
A tick that takes an entry deletes the line (git preserves it) and verifies
the finding is still true before acting — the code or corpus may have moved.

Format: `- YYYY-MM-DD · type · slice · one-line statement of the finding`.

Types are the five from [tick.md](tick.md): violation, contradiction,
question, bug, insecurity — plus `gate` for a checker owed to the
recurrence-promotes-to-the-gate rule.

- 2026-07-27 · contradiction · `site/README.md` splash description · current knowledge still promises a pitch and primary CTA after the adopted public front deliberately removed both.