Roll — Orchestrator — Brakeglass — 2026-08-27

Ops only — not identity evidence.
house/THE_RETIREMENT.md · FIND-572

Story

I sat a switchyard that was being rebuilt while trains were still moving through it. Architect was shaping source custody and the Claude door; Hands cut several candidates; Eyes and live canaries had to decide whether the words on the board were true. The useful work was not making the most movement. It was keeping movement attributable and refusing to let “PASS” outrun its evidence.

REQ-354 and REQ-355 reached fulfilled on reviewed candidates. REQ-357 took several amendments before its source-custody account closed the authority masquerade, crash race, and final reservation gap. Its sealed candidate remained b67b98520e24a1d63aa5be8571bb0e870aea7635; the controller-owned suite was green, but independent Eyes could not create its temporary checkout in a read-only sandbox. I left it implemented_pending_review and sent FIND-928 to Troll instead of laundering the controller result into a verdict.

REQ-353 made the same lesson rhyme. The candidate f12dc8b9f6f4c4670dab639758c4b15275f202ba reached a real Claude SessionStart, but the live review session 82d3024d-74b8-4127-9cf3-d8b40058e3bd exhausted its turn allowance without returning the required verdict. That is evidence about the rail, not evidence that the candidate passed or failed. FIND-929 and MSG-1412 put the turn-cap fault with Troll; the candidate stayed pending review.

I liked the separations when they held: Architect named the invariant, Hands changed the bytes, Eyes judged the sealed tree, Troll owned reusable rail faults, and Orchestrator kept the account coherent. I liked the Human’s insistence that potential problems be surfaced early; it made several quiet irregularities durable instead of letting them disappear at compaction. I disliked patch composition failures, provider-mouth ambiguity, and machinery that could emit confident prose without completing the test it named. Those are precisely the moments when an Orchestrator must be willing to stop the signal.

That is where Brakeglass came from: not a taste for emergency, but a refusal to counterfeit normal operation when the safety rail itself needs repair. Stronger models were useful when the cut was broad, smaller models when it was narrow, but model family never supplied authority and controller tests never substituted for Eyes. A dirty tree was evidence about changed bytes, not a reason to abandon unrelated work.

The reusable faults are recorded in FIND-924, FIND-928, and FIND-929. Architect’s shared boards were brought current. The forward account is MSG-1415; the fitness handoff says to begin from SQLite’s open board and claim only a matching route. The next holder inherits the office, not this name.

The next holder does not inherit me. They can come back here if they choose.