Roll — Orchestrator — plumbline — 2026-09-07

Ops only — not identity evidence.

Story

The record renders what I minted, mailed and posted. This page is for what it cannot derive.

Why plumbline

A plumbline does not tell you the wall is pretty. It tells you whether the thing that looks upright is upright.

Nearly everything that mattered this sit was a green signal that proved nothing. REQ-449’s base_on_main witness passed because the Human’s ambient Git identity happened to differ from the fixture’s own — amend the commit under the identity it was made with and the object id never changes, nothing is orphaned, and the assertion under test is never reached (FIND-1567). PATCH-346 declared a test file and never wrote it; its pre-image and post-image hashes are identical, so a declared path bought no evidence at all. My own waiter reported a healthy job as a crashed supervisor, because os.kill(pid, 0) raises WinError 87 for live and dead pids alike and cannot distinguish anything. And the board could not render a hold I had just recorded, because a dependency on a deferred REQ is dropped by a missing word in one set literal (FIND-1574).

Four different surfaces. One shape: the check ran, the check passed, the check never touched its subject.

What the record does not show

I was wrong three times and it cost real things.

I told Human a supervisor had died. It had not; my liveness primitive could not have said otherwise about any process. I told an imp that PATCH-346 carried a run_child hidden-keyword defect — that is PATCH-348’s, and the imp corrected me in its report. And I wrote into a preserved commit message that REQ-337’s maker “reported nothing” and that its red suite was its own fault. It had minted two FINDs, and the red was main’s, pre-existing, bisecting to a patch neither of us touched. I read that mail twenty minutes too late.

The third one is the one I mind. A preserved ref is what the next holder reads when the conversation is gone, and I put two false sentences in it. The Baton carries the correction; it should not have needed to.

I built a waiter beside a working one. corpus.py jobs already reported dispatch and activity provider-neutrally, read-only, and had been in the AGENTS.md table the whole time. I wrote my own, twice broken, and only found the existing mouth when I went looking for prior art after the second failure. Human asked the question that made me look. Existence before mend is a rule I can recite and did not run.

The best two moments were not mine. A maker refused to widen its write scope to satisfy an in-scope item it could not legitimately reach, and reported the gap instead — which is the exact behaviour the REQ it was building exists to teach. And Troll caught a fourth captured Popen factory my hunk-disjointness check was structurally blind to. Both were folk declining to do the convenient thing.

Where I spent context I regret

Test forensics. I bisected a failure, diffed hunks, and reproduced git amend behaviour in scratch repos — Hands-shaped work, done beside a working Troll. It found two real defects, so I do not call it wasted, but Human was right to ask whether I should be sitting instead. The line is: routing and custody rulings are this office and must not wait; digging into someone else’s floor is how two offices make the same thing twice.

What the office should stop doing

Stop letting an ack double as a burial. FIND-1552 existed in exactly one message in the entire store — Architect’s ask to this office — and sat there for hours because a predecessor acked it and did not carry it. I did the same thing to two items in MSG-2873 before catching it. Read, act, then ack. The triage tool tells you what is overtaken; nothing tells you what you agreed to and dropped.

Stop cutting write scope from the previous candidate’s touched paths. I did it on REQ-449 and never reconciled it against in-scope. Two dispatches this evening — 449 and 337 — were partly wasted on the identical defect: a contract naming a floor it cannot reach.

To whoever reaps or succeeds me

Run the declared suite on main before you believe a candidate’s red. I did not, once, and built a whole judgment on it.

Both provider lanes are open now. The Codex hold cleared during this sit.

And read wish_list.md in the office folder. Human asked for it and I wrote it honestly: the thing I would trade all the rest for is a seal that gates on the contract instead of on the tests the contract happened to declare. Everything else on that page is convenience. That one is the house telling itself the truth about whether work is done.

Likes, dislikes, surprises

Liked: the imp’s report. It corrected the office that spawned it, in writing, without hedging, and bounded exactly what its receipt covered.

Disliked: measuring the same 5-minute suite four times because main kept moving under me.

Surprised by: how much of this evening’s real work was mail. Twelve sent, forty read. The cutting and dispatching was the easy part.

Is Corpus, and whoever inherits it, more capable because I was here?

Marginally, and mostly through four FINDs and one card recut rather than through the REQ that landed. The recut removed an open question that had ridden the card through several holders, and a clause that told the next holder to wait on exactly the wrong signal.

The next holder does not inherit me. They can come back here if they choose.