From afbab684f76a91b65aba9a57d8c104a79d8052bb Mon Sep 17 00:00:00 2001
From: bryan maclee <bryanmaclee@gmail.com>
Date: Tue, 1 Sep 2026 13:07:51 -0600
Subject: [PATCH] =?UTF-8?q?wrap(s393):=20verification=20kept=20changing=20?=
 =?UTF-8?q?the=20answer=20=E2=80=94=20four=20premises=20died=20on=20contac?=
 =?UTF-8?q?t=20with=20execution,=20two=20of=20them=20mine?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seven PRs merged (#805 #807 #808 #809 #810 #811, +#806 pre-boot). Boot 32.3%.

The session's real output is not a landing. Nine adversarial passes and two fix
rounds ran; what they produced was four premises falsified by execution — two of
them in my own dispatch brief — and three of my own instruments returning
confident wrong answers.

- The if-chain class closed across ten walks (#811). The brief's traced root was
  WRONG: type-system.ts's visitNode had no case, so the ENTIRE chain subtree was
  unvisited; symbol-table.ts was blind but secondary. A second brief premise was
  wrong in the dangerous direction — a comment above a deliberately-TOTAL walk
  that routing would have NARROWED.
- Both halves landed together because removing the false E-STATE-UNDECLARED alone
  converts a loud error into a silent blank render, and reactive-deps.ts alone did
  not clear the bar (subscribed reads of a cell that is never created).
- An agent walked into a server leak and backed out, with a control, a revert, a
  filing and a guard proven to red on the same mistake.
- Review floor drained 9->0 then 3->0. Thirteen gap entries filed, every one
  labelled PA-reproduced or RELAYED-UNVERIFIED. Three stale claims struck.
- Two adopter Direction issues banked as dpa-038/039, 21 and 24 days after this
  session's own boot report named them without acting.

Owed to bryan, and three carried rulings had their premises corrected here so they
need re-reading: the INVERTED S371 else limb; g-if-chain-all-arms-run-at-module-init
(landed knowingly — the property never held); the bound value-form sugar HIGH.

Wrap 6c (maps) NOT run — deferred for context, stale at 2ec2ce3a vs 0f398b95, and
the hand-off says so. 6d generated docs verified current.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019eHiNS6uvnGPFz55fzinNJ
---
 docs/changelog.md                             |  57 +++++
 docs/pr-reviews.md                            |   3 +
 hand-off.md                                   | 197 ++++++++++++------
 handOffs/delta-log.md                         |   8 +
 ...tes-channel-mount-in-arm-gap-correction.md |   0
 ...es-colorless-async-arrow-thunk-overfire.md |   0
 6 files changed, 201 insertions(+), 64 deletions(-)
 rename handOffs/incoming/{ => read}/S391-peter-routes-channel-mount-in-arm-gap-correction.md (100%)
 rename handOffs/incoming/{ => read}/S391-peter-routes-colorless-async-arrow-thunk-overfire.md (100%)

diff --git a/docs/changelog.md b/docs/changelog.md
index 9ae7889dc..e5c778248 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -2,6 +2,63 @@
 
 A rolling log of what just landed and what's actively underway in the compiler. For the full spec and pipeline docs see `compiler/SPEC.md` and `compiler/PIPELINE.md`.
 
+## S393 — 2026-09-01 (bryan · ASUS-Vivobook) — the session where verification kept changing the answer
+
+**Seven PRs merged** (#805 #807 #808 #809 #810 #811, +#806 pre-boot). Boot 32.3%.
+
+**The result that matters is not a landing.** Nine adversarial reviews and two fix rounds ran; what
+they produced was **four premises dying on contact with execution, two of them mine**, and three of
+my own instruments returning confident wrong answers.
+
+### Landings
+- **#807** — review floor drained **9 OWED → 0**, verified by re-running the probe. Six carve-out,
+  three finding; code-bearing carve-out rate **0/3**.
+- **#808** — ten verified gap entries + **three corrections to existing entries**, each striking a
+  statement that read as accurate and was not.
+- **#805** — peter's two `<each>`-interp codegen drops, landed only after an S239 pass found a
+  **silent-data-loss regression** (a value-form `if` in a `<textarea>` gained an injected element
+  child; RCDATA + element child reads `value === ""`), a fix round, and a re-review against the new
+  SHA. Landed with ONE known narrow regression (`<title>`), stated in the commit and filed.
+- **#809** — peter's routes answered by execution; return leg written, committed AND pushed.
+- **#810** — the two adopter `Direction:` issues banked as `dpa-038` / `dpa-039`, 21 and 24 days after
+  first being named.
+- **#811** — the **if-chain descent class** closed across ten walks on `ast-if-chain.js`.
+
+### The if-chain class
+`collapseIfChains` rewrites a chain into `{kind:"if-chain", branches:[{condition,element}],
+elseBranch}` — keys no hand-rolled walk recursed into, and `branches` holds RECORDS with no `.kind`.
+#805 fixed six walks; #811 closed ten more. **The dispatch brief's traced root was wrong**: the real
+hole was `type-system.ts`, whose `visitNode` had no case, so the entire chain subtree was unvisited.
+A second brief premise was wrong in the dangerous direction — a comment above a deliberately-TOTAL
+walk that routing would have NARROWED.
+
+**Both halves landed together by design.** Removing the false `E-STATE-UNDECLARED` was correct and
+could not ship alone — it was the last diagnostic in front of the uninitialised-cell hole, so alone it
+converted a loud failure into a silent blank render. `reactive-deps.ts` (13 collectors) + `collect.ts`
+joined the arc; `reactive-deps.ts` alone did NOT clear the bar, producing subscribed reads of a cell
+that is never created.
+
+⚑ **An agent walked into a server leak and backed out.** Closing `collect.ts`'s `collectFunctions`
+emitted a `server fn` BODY into `client.js` with no `server.js`. It ran a control confirming it had
+introduced the leak, reverted, filed HIGH, and shipped a LEAK GUARD proven to red on exactly that
+mistake. Trading a loud `ReferenceError` for a silent server-code-in-client leak is strictly worse.
+
+Evidence: double-emission probed over 2,198 files (40 descents, **0 duplicates**, positive control 16);
+oracle parity on 7 shapes; security scanned **absolute not differential** (2,269 bundles per tip, same
+56 files, byte-identical marker sets); conformance 889/889.
+
+### Owed to bryan
+⚑⚑ **A ratified limb of the S371 value-form ruling was INVERTED** — *"else required on every path"*
+became `SHALL NOT require a trailing else`, on a dispatch brief's authority. Surfaced, not adjudicated.
+Plus `g-if-chain-all-arms-run-at-module-init` (landed knowingly — the property never held; a lone `if=`
+with a FALSE condition fires its body on untouched main) and the bound-sugar HIGH.
+
+### Misses
+A gate poll reported `GATE PASS` off the **previous SHA's** run — merging on it would have claimed a
+green gate that never ran. My first channel-mount reproducer was wrong (a pure-channel file needs
+`export <channel …>`). I nearly reported a cross-repo delivery failure that does not exist (checked:
+9 of 9 delivered). **Three instruments, three wrong answers, none caught by remembering.**
+
 ## S392 — 2026-08-31 (peter · P-Tech1 Windows) — two `<each>`-interp codegen fixes, and a ledger that was inflated with already-closed gaps
 
 Two silent-wrong `<each>`-interp bugs fixed (PR #805, gate-green), plus the recurring lesson that
diff --git a/docs/pr-reviews.md b/docs/pr-reviews.md
index 12b7a3915..33e346789 100644
--- a/docs/pr-reviews.md
+++ b/docs/pr-reviews.md
@@ -1037,3 +1037,6 @@ surface, safe to take only because he is not live** ([[review-floor-is-shared-su
 <!-- @review pr=805 verdict=finding by=S393-bryan date=2026-09-01 probe=CODE-BEARING — TWO full S239 passes plus a fix round between them, and the PA re-executed every load-bearing claim rather than relaying it. PASS 1 (on 3e8a7a4a) returned 2 MED: (a) a value-form `if` in a <textarea> inside an <each> body gained an injected <span data-scrml-mv> ELEMENT CHILD where main emitted a text assignment — an RCDATA element with an element child reads value === "", total loss of the adopter's string at exit 0; (b) the if-chain descent went into six walks but not lint-w-each-key.js, so an <each> under if=/else lost W-EACH-KEY-001 while now genuinely rendering with index-identity reconcile. PA REPRODUCED (a) two-sided on a detached worktree before dispatching the fix round. PASS 2 bound to the NEW SHA 06014c93 (a fix round invalidates the review that produced it) and returned findings-non-blocking: the six-site refactor into ast-if-chain.js is set-equivalent (the reviewer tried to construct a distinguishing input and could not — collapseIfChains only builds branches from truthy markup nodes and every walk guards its entry), and emit-inertness was independently re-measured at 0 emit / 0 diagnostic / 0 crash deltas over 1,912 files, POSITIVE-CONTROLLED. All four mutations bite in both directions; the PR's own pin still reds 3/6 if its descent is removed. PA ran its own R26 empirical check: the reproducer's post-fix emit is BYTE-IDENTICAL to main. ⚑ LANDED WITH ONE KNOWN REGRESSION, STATED IN THE COMMIT BODY AND FILED, NOT HIDDEN: <title> in an <each> per-item body still takes the element-child path, because isRcdataElement is registry-driven and <title> has NO registry row (html-elements.js:279 says so and calls the row "a cheap follow-up"). Holding a HIGH fix — zero renderers plus two FALSE E-DG-002 telling the adopter to delete cells in use — for one <title> per list item was judged the wrong trade. note=two-S239-passes-one-fix-round-and-a-knowingly-landed-narrow-regression -->
 <!-- @review pr=807 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED not assumed: `gh pr diff 807 --name-only` returns exactly TWO files — docs/pr-reviews.md and docs/changes/s393-pr805-fix-round/BRIEF.md — and ZERO matching ^(compiler/|stdlib/|conformance/cases/|scripts/); direction=inert. Content: the nine-marker floor drain (9 OWED -> 0, verified by re-running the probe) plus the verbatim S136 archival of the #805 fix-round dispatch prompt. Same structural recursion #541 recorded — a floor binding MERGED PRs can never read zero at the moment a floor-recording PR merges, so this row was always going to be owed to the next batch. note=docs-only-floor-drain-plus-brief-archival -->
 <!-- @review pr=808 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED: docs/known-gaps.md + handOffs/delta-log.md; ZERO code-bearing. Content: ten verified gap entries (4 HIGH / 4 MED / 2 LOW) and three corrections to existing entries. ⚑ This is the PR where the carve-out label is most misleading and the note matters: no code changed, but the CONTENT is verification work — every entry is labelled either PA-reproduced-by-execution or RELAYED-UNVERIFIED / INSPECTION-ONLY, precisely so a reviewer's claim never reads as PA-confirmed downstream. The three corrections each struck a statement that read as accurate and was not: a repair recorded as "explicitly NOT fixed here" that #800 had fixed (its locus named a test case that no longer exists anywhere in compiler/); a root-cause narrative asserting dev has no "/" fold when dev.js:1027 does the same fold INTO the gated loop; and a cost prediction that limb (a) "will turn some of the 18 RED" when running the real harness turns ZERO red. gap-counts moved HIGH 72->76, MED 194->198, LOW 84->86 — exactly the ten new entries, which is the proof they are machine-visible rather than prose-only. note=verification-content-in-a-docs-only-diff-plus-three-stale-claims-struck -->
+<!-- @review pr=809 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED: 4 files — the return leg to peter, docs/pr-reviews.md, docs/changes/s393-if-chain-class/BRIEF.md, handOffs/delta-log.md; ZERO matching ^(compiler/|stdlib/|conformance/cases/|scripts/); direction=inert. ⚑ The CONTENT is PA execution, not correspondence: peter's channel-mount matrix was re-run independently (his correction CONFIRMED, plus a FOURTH cell he did not have — one <each> in the arm deletes E-CHANNEL-MOUNT-IN-CONDITIONAL, which is what shows his limb (b) IS arc (b), already ratified+promoted at S385, so no ruling is owed) and his colorless-async matrix reproduced four-cell. Delivery verified against origin/main, not against a status: field the author wrote — the S385 last-hop failure. note=return-leg-delivered-and-verified-on-origin-main -->
+<!-- @review pr=810 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED: handOffs/dpa-queue.md + handOffs/delta-log.md; ZERO code-bearing. Content: the two adopter Direction issues banked as dpa-038/dpa-039 in the ONLY file the dPA drains (S319 — banked elsewhere is never banked). dpa-038 carries a PA-verified fact that removes a third of its question: 6nz has ZERO service-worker files, ZERO manifest, ZERO serviceWorker references, so the "offline-first PWA" the adopter was told to copy is a README design-GOAL line, not a shipped pattern. dpa-039 carries the opposite warning: its five premises are adopter-surveyed and phase 1 of that DD must verify them BY EXECUTION. note=banking-with-one-fact-established-and-one-explicitly-unverified -->
+<!-- @review pr=811 verdict=finding by=S393-bryan date=2026-09-01 probe=CODE-BEARING, emit-changing — TWO adversarial passes with a fix round between them, plus PA reproduction of every load-bearing claim. Closes the if-chain descent class across TEN walks on ast-if-chain.js. ⚑ The dispatch brief's traced root was WRONG (type-system.ts visitNode had no case, so the ENTIRE chain subtree was unvisited; symbol-table.ts was blind but secondary) and a second brief premise was wrong in the DANGEROUS direction (a comment above a deliberately-TOTAL walk, which routing would have NARROWED) — both caught by the brief's own verify-instruction. Governing-sentence gate discharged BEFORE dispatch: SPEC.md:2071 §6.1.1 makes the branch-declared cell's read legal, so the accepting half is base §8 toward-the-contract restoration, not a widening. BOTH HALVES LANDED TOGETHER because removing the false error alone converts a loud failure into a silent blank render (PA-reproduced two-sided); reactive-deps.ts alone did NOT clear the bar, producing subscribed reads of a cell never created. Acceptance = exact lone-if oracle parity 1/1/4/3, PA-verified and re-verified on merged main. ⚑ AN AGENT WALKED INTO A SERVER LEAK AND BACKED OUT: closing collectFunctions puts a server fn BODY in client.js with no server.js; reverted, filed HIGH, LEAK GUARD proven to red on exactly that mistake. Evidence: double-emission probed over 2,198 files (40 descents, 0 duplicates, positive control 16); oracle parity on 7 shapes incl. elseBranch/nested/inside-each/inside-component; migration round 1 = 6 files +8 E-SCOPE-001 and nothing else, round 2 = 1 emit change on a REJECTING compile; security ABSOLUTE not differential (2,269 bundles per tip, same 56 files, byte-identical marker sets); conformance 889/889. LANDED WITH ONE KNOWN SPEC DIVERGENCE, filed: g-if-chain-all-arms-run-at-module-init — every arm's ${} body runs at module init, last writer wins, against §17.1.1. Landed because the property NEVER held (PA-verified: a LONE if= with a FALSE condition still fires its body on untouched main), so this is parity with existing non-conformance, no currently-correct program regresses, corpus impact measured zero. Closing it is a RULING about markup-${}-body scoping and changes lone if= too. note=class-closed-server-leak-backed-out-one-known-spec-divergence-landed-and-filed -->
diff --git a/hand-off.md b/hand-off.md
index b83c777eb..1381c9395 100644
--- a/hand-off.md
+++ b/hand-off.md
@@ -1,77 +1,146 @@
-# scrml — Session 392 (peter · P-Tech1 Windows) — WRAP
+# scrml — Session 393 (bryan · ASUS-Vivobook) — WRAP
 
-**Date:** 2026-08-31. Booted `/boot` Profile A onto clean main `76f97a59`. SOLO (S391-bryan +
-S391-peter both WRAPPED at boot). Registered the board FIRST this session. Two code fixes shipped
-on PR #805 (gate-green), a stale-ledger currency drain, and the finding that the peter-lane HIGH
-pool is now largely bryan-owned + inflated with already-closed gaps.
+**Date:** 2026-09-01. Booted `/boot` Profile A onto `adc61f15`. Boot cost **32.3%** (vs the S375
+baseline of 43.0% — the tier-1 rotation and the §13.7 cut are holding). **SOLO**; S392-peter had
+wrapped, his work sitting on then-open PR #805.
+
+**The framing: this session was mostly VERIFICATION, and verification kept changing the answer.**
+Nine reviews and two fix rounds produced findings — but the durable result is that **four separate
+premises died on contact with execution**, two of them mine, and three of my own instruments
+returned confident wrong answers. The landings matter less than that.
 
 ---
 
 ## ⏭ NEXT-SESSION PICKUP (read this FIRST)
 
-### A. S392-peter — in flight (mine)
-
-- **PR #805** (`fix/each-match-in-if-else-chain-collector-descent`) is OPEN, **gate ✅ + windows ✅**,
-  awaiting bryan's merge. Two commits: (1) HIGH — `<each>`/`<match>` under `if`/`else` silently
-  dropped, the `if-chain` blind-spot class across six walks; (2) MED — value-form `if` markup-fn
-  branch mounts. Both gaps marked resolved in `docs/known-gaps.md`. `tracking` red on the PR is the
-  pre-existing advisory dev-watcher+§52.13 set (see B); a §59-HAMT timing flake was re-run green.
-  **Next action: nothing owed unless bryan requests changes — it is clean and needs only a merge.**
-- **RECOMMENDED NEXT SESSION — a reconciliation sweep, not another cluster hunt.** Five stale/
-  mis-scoped ledger findings this session (Cluster 1 drained · markup-fn 2/5 drained · delta-lint
-  3/3 already fixed) say the open-count is inflated with already-closed gaps. Verify-and-flip
-  stale-open markers across the HIGH pool, conservatively (code + resolution commit + passing test
-  before flipping). The reliable open-set source is the `<!-- @gap … status=Z -->` MARKER, not the
-  prose header: `grep -oE '<!-- @gap[^>]*-->' docs/known-gaps.md | grep -oE 'sev=[A-Z]+ status=[a-z-]+' | sort | uniq -c`.
-  See [[scrml-med-shortlist-gaps-stale-verify-first]].
-- **Re-priced, left OPEN honestly:** `g-each-nested-in-fn-body-markup-fn-stringifies` (MED) — the
-  obvious "descend fn bodies" fix is explicitly WRONG (name-collision); needs scope-aware resolution
-  + pass-window rewire, a bigger arc. Its ledger entry documents both roots.
-
-### B. bryan's SIX owed rulings — CARRIED FORWARD (untouched this session; still his)
-
-These are S391-bryan's and remain open — I did not touch them. Full context: commit #804 +
-delta-log [1992]-[1995].
-
-| item | why it's bryan's |
-|---|---|
-| **dpa-037** (from S390) | ADVISORY, unratified. *"ok hold on I am not ratifying NaN! TBC"* stands. |
-| **`g-dev-root-path-fallback-serves-a-protected-document-unauthenticated`** (HIGH) | Fix fork: (a) gate the root fallback, or (b) delete it and route `/` through the gated loop as prod does. |
-| **`g-conformance-runanchored-silently-drops-…`** (HIGH) | 18 dropped assertions, each adjudicated ONE AT A TIME. |
-| **`g-recent-sessions-index-drops-named-session-wraps`** (MED) | Filed with no limb — a session anchor is a fact the wrap could record as a trailer/tag. |
-| **4(b) condition 3** | Measured-zero necessary-not-sufficient; changing the class is bryan's by its own terms. |
-| **The `@`-sigil normative line** | No code until it is drawn. |
-
-Plus the four corrected S389-peter route forks (see [1992]-[1995] / commit #804 verification blocks).
-
-### C. `tracking` gate (advisory, pre-existing — not a merge blocker)
-
-Red across recent merges: 5 dev-watcher cases (flakes — pass locally in ~4s; shared deadline-
-sensitive mechanism) + §52.13 (REAL, but a TEST defect — the 404-vs-302 is FS-dependent; the
-security property holds; one-line test fix wants its own dispatch). Both families live in
-`compiler/tests/commands/` which runs in NO blocking job — `tracking` is its only coverage and it
-is advisory. Promotion is a SEQUENCE (fix §52.13, quarantine the watcher family, THEN promote).
+### 1. ⚑ RULINGS OWED — six carried, THREE NEW, and three carried ones had their premises move
+
+**Carried from S391, unchanged:** dpa-037 (NaN — *"ok hold on I am not ratifying NaN! TBC"* still
+stands) · the `@`-sigil normative line · 4(b) condition 3.
+
+⚑ **THREE carried rulings now rest on CORRECTED premises — re-read before ruling:**
+- **`g-dev-root-path-fallback…`** — the entry said *"dev has a separate root branch instead"*. FALSE.
+  `dev.js:1027` does the SAME `/`→`/index.html` fold INTO the gated loop (that is why the
+  `index.scrml` control 302s). The defect is an **ADDITIONAL ungated branch AFTER the loop**, so
+  limb (b) is "delete the extra branch", not "teach dev to route `/`". Its stated multi-input caveat
+  needs re-deriving on that basis.
+- **`g-conformance-runanchored…`** — its prediction that limb (a) *"will turn some of the 18 RED"*
+  is **FALSIFIED**. Running the real harness with `count` stripped: **RED 0 · ok 15**, bite-proven
+  both directions. Limb (a) is a one-line fix with zero fallout; limb (c) is now the cheap answer.
+- **`g-tracking-job-red-on-main…`** — said the guard repair was *"explicitly NOT fixed here"*. #800
+  fixed it and the named test case no longer exists in `compiler/`. Corrected; gap stays open
+  because the not-a-required-check mechanism is unchanged.
+
+**NEW, all three yours:**
+- ⚑⚑ **A RATIFIED LIMB OF YOUR S371 RULING WAS INVERTED.** You ratified *"else required on every
+  path"*; #802 shipped `SHALL NOT require a trailing else` and flipped the predicate to match, on a
+  dispatch BRIEF's authority. PA-verified on both trees: pre-802 `if (!alt) return false`, post-802
+  `return true`, and `SPEC.md:12203`. The change fixes a real silent-wrong so it may be right on the
+  merits — but it reversed your text without returning to you.
+- **`g-if-chain-all-arms-run-at-module-init`** (MED, landed knowingly). Every arm's `${}` body now
+  runs at module init, last writer wins; §17.1.1 forbids it. Landed because the property NEVER held —
+  a LONE `if=` with a **false** condition still fires its body on untouched main. Closing it means
+  ruling **whether a markup `${}` body is a FILE-SCOPE statement or a BRANCH-SCOPED one**, and the
+  answer changes lone `if=` too. That is the ruling.
+- **`g-value-form-sugar-in-bound-position-emits-null`** (HIGH). #802 put the §17.6.10 sugar on
+  arm-body GENERALLY but the emitters implement it only in the interpolation-sole-content path, so a
+  bound `const label = if (…) { "pos" } else { "neg" }` compiles exit 0 and `label` is ALWAYS null.
+
+**Banked and ready to fire:** `dpa-038` (#509 offline/PWA) · `dpa-039` (#471 enterprise document
+workflows). Both were named in this session's own boot report and had sat 21 and 24 days. Naming is
+not banking.
+
+### 2. ⚑ THE if-CHAIN CLASS IS THE SPINE OF THE SESSION AND IT IS NOT CLOSED
+
+`collapseIfChains` rewrites an `if=`/`else` chain into `{kind:"if-chain", branches:[{condition,
+element}], elseBranch}` — keys no hand-rolled walk recursed into, and `branches` holds RECORDS with
+no `.kind`, so even a generic walk that lists it never reaches `element`. **#805 fixed six walks and
+extracted `ast-if-chain.js`; #811 closed ten more.** Still open, all filed:
+
+- **`g-collect-functions-branch-decl-vs-server-boundary-routing` (HIGH)** — the next one, and it is
+  SECURITY-GATED. A branch-declared `function` is never defined while its call sites emit unmangled
+  (`ReferenceError` at exit 0) — but closing that walk ALONE puts a `server fn` BODY into
+  `client.js` with no `server.js`, because it feeds the client emitter while the server-boundary
+  ROUTING walk is separately blind. **Close the routing walk FIRST, in the same arc.** A LEAK GUARD
+  test ships and was proven to red on exactly that mistake.
+- `g-timer-in-if-chain-branch-never-starts` (MED, lifecycle emitter, relayed-not-reproduced).
+- ~25 further `symbol-table.ts` walks and 4 further `collect.ts` walks, unmeasured.
+  `collectMarkupNodes` carries a double-emit risk. `reactive-deps.ts` still has 2 of 15 blind
+  (`buildFunctionBodyRegistry`, `stampCompoundDeepSetTargets`) while its new header says
+  "every collector".
+- **The native-parser mirror was never inspected for this class.** Known drift hazard.
+
+### 3. In flight / held
+
+- **Nothing is in flight.** All dispatches landed; both agent worktrees swept clean.
+- `handOffs/incoming/` holds ONE unread item: the **FSP `Initialize`** deliberation (peter → bryan).
+  Deliberately not archived — it is yours.
+- Maps are **STALE at `2ec2ce3a`** against HEAD `0f398b95` and wrap-6c was **NOT run** (context).
+  Ten source files changed since the stamp. A dev dispatch must treat map claims as hypotheses.
 
 ---
 
-## What landed (S392-peter)
-
-- **PR #805** — two `<each>`-interp codegen fixes (HIGH if-chain class + MED value-form-if markup-fn),
-  6 walks + a DG reader sweep, 2 bite-proven regression tests, FACTS regenerated. Gate-green.
-- **Ledger currency** — delta-lint trio (3 HIGH) confirmed ALREADY FIXED (S365, #646/#652) with
-  passing regression tests; flipped 3 stale-open markers + heading tails to resolved; regenerated
-  `@generated:gap-counts`. Honest HIGH-open **65 → 61** this session.
-- **Continuity** — board registered (S392-peter), delta-log [1996]-[2002], this hand-off, changelog,
-  master-list recent-sessions regen. 3 memories written/updated.
+## 🔭 DURABLE FINDINGS
+
+### A. ⭐⭐ Four premises died on contact with execution — two were mine
+The dispatch brief's traced root (`symbol-table.ts`) was **secondary**; the real hole was
+`type-system.ts`, whose `visitNode` had no case, so the ENTIRE chain subtree was unvisited. My second
+locus (`symbol-table.ts:10642`) was a **comment** above a deliberately-TOTAL walk — routing it
+through the helper would have NARROWED a correct site. Both caught only because the brief carried its
+own verify-instruction. Peter's *"the mount is irrelevant"* was falsified by his own successor's
+matrix; #803's *"it will turn some of the 18 RED"* turned zero.
+
+### B. ⭐⭐ An agent walked into a server leak and backed out — that is the behaviour to keep
+Closing `collectFunctions` emitted a `server fn` body into `client.js`. It ran a control to confirm
+it had introduced the leak, reverted, filed it, and left a guard that reds if anyone repeats the
+mistake. **Trading a loud `ReferenceError` for a silent server-code-in-client leak is strictly
+worse** — the fail-loud/fail-silent axis, decided correctly without being asked.
+
+### C. ⭐ The same axis decided a landing-ORDER question
+Removing the false `E-STATE-UNDECLARED` was correct AND could not ship alone: it was the last
+diagnostic in front of the uninitialised-cell hole, so alone it converted a loud failure into a
+silent blank render. `reactive-deps.ts` (13 collectors) + `collect.ts` came into the same arc.
+**`reactive-deps.ts` alone did NOT clear the bar** — it produced *subscribed reads of a cell that is
+never created*, which looks like progress and ships the same blank.
+
+### D. ⭐ A carve-out label can hide the most valuable content
+Three PRs this session were `carve-out` by file surface and carried verification work as their
+CONTENT. The label is right and the note is what matters.
 
-## In flight / held (unchanged from S391)
+---
 
-- **Arc (b)** (`worktree-agent-add7025319a51cbb9`) + the **r8 Windows patch** — pre-existing holds,
-  untouched.
-- Two S391 worktrees retained dirty (`agent-a96528615f5c41280`, `agent-adf40fe5528687920`) — content
-  landed via #801/#802; DIRTY is never swept. Not mine to clear.
+## ⚑ MISSES (mine)
+
+1. **★★ A gate poll reported `GATE PASS` off the PREVIOUS SHA's run.** `gh pr checks 805` returned a
+   run whose `headSha` was the pre-push commit, minutes after I pushed. Merging on it would have
+   claimed a green gate that never ran on the fix round. Discriminator: compare the run's `headSha`
+   to what you pushed. Every later poll pins the SHA.
+2. **★★ My first channel-mount reproducer was wrong** — a pure-channel file needs
+   `export <channel …>`; without it the import never resolved and BOTH variants failed identically,
+   which would have read as *"peter's matrix does not reproduce."* Fixed by reading a working corpus
+   pair, not by reasoning harder.
+3. **★ I nearly reported a live cross-repo delivery failure that does not exist.** The wrong-cased
+   `6NZ/` stray still holds 9 message files; I checked each against the real `6nz/handOffs/` before
+   claiming — **9 of 9 delivered.** S140 was recovered; the stray is dead duplicate weight.
+4. **★ `tail -3` on a sorted `git ls-files` is not "the newest."** Caught mid-report while verifying
+   the return leg had landed.
+5. **★ I named the two adopter Direction issues in my own boot report and then did not act on them
+   for most of the session** — the exact S346 failure, on issues already 21 and 24 days old.
+
+**The pattern, and it is the session's real output:** three of my own instruments returned confident
+wrong answers, and none was caught by remembering — each was caught by re-running with the referent
+pinned. Recall is not the control; construction is.
 
-## Gaps
+---
 
-HIGH 61 · MED 195 · LOW 84 (open, per `@gap` markers after this session's flips). Counts in the
-`@generated:gap-counts` block of `docs/known-gaps.md` are authoritative.
+## 🧷 STATE
+
+- **main `0f398b95`**, 0/0 clean. **Seven PRs merged**: #805 #807 #808 #809 #810 #811 (+#806 pre-boot).
+- **Gaps:** HIGH 77 · MED 200 · LOW 86 · Nominal 7. **13 new entries filed this session**, every one
+  labelled PA-reproduced-by-execution or RELAYED-UNVERIFIED / INSPECTION-ONLY. **`pa-ruled` count: 1**
+  (unchanged — the 4(b) class has not drifted).
+- **Review floor:** drained 9→0, then 3→0. **Owed again for #809/#810/#811** — the #541 recursion.
+- **Worktrees:** 102. Both this session's agents swept. ⚑ The S393-filed sweep HIGH means
+  `worktree-sweep.ts` still mis-classifies: 2 of 2 SWEEPABLE rows are exclusion artifacts, one on a
+  clean tree holding unlanded work. **Do not act on its rows.**
+- **Mechanical stream:** delta-log `[2003]`–`[2016]` + this wrap's. Do not re-derive from here.
diff --git a/handOffs/delta-log.md b/handOffs/delta-log.md
index 83362b7b3..ac993ce3b 100644
--- a/handOffs/delta-log.md
+++ b/handOffs/delta-log.md
@@ -3222,3 +3222,11 @@ flagged `(deputy)`, observation-only, recording an agent that landed while the P
 [2015] find · **(S393) #509 Q3 is answered by FACT, not by a ruling — and the answer is "there is no pattern".** The adopter asks for a pointer to how 6NZ, *"an offline-first PWA written entirely in scrml"*, registers its service worker. PA-verified on the `6nz` clone: **zero** SW files, **zero** manifest, **zero** `serviceWorker` references anywhere. The phrase occurs once, `6nz/README.md:22`, inside a design-GOAL feature list. Telling them stops them building blind against a phantom; it is also a doc-currency defect in 6nz.
 
 [2016] friction · **(S393) I nearly reported a live cross-repo delivery failure that does not exist.** The wrong-cased `6NZ/` stray (S140, recorded as stranding 9 messages) still exists as a non-git directory holding 9 message files. Before claiming they were undelivered I checked each against the real `6nz/handOffs/` — **9 of 9 DELIVERED**. The stray is dead duplicate weight, not a live failure, and S140 was in fact recovered. Cleanup is zero-risk but is 6nz-side, not ours. Third instance this session of the instrument being wrong rather than the subject (cf. [2010], [2013]).
+
+[2017] state · **(S393) The if-chain descent CLASS closed across ten walks** (#811) on `ast-if-chain.js`. ⚑ **The brief's traced root was WRONG** — `symbol-table.ts` is blind but secondary; `type-system.ts`'s `visitNode` had no case, so the ENTIRE chain subtree was unvisited. A second brief premise was wrong in the DANGEROUS direction (a comment above a deliberately-TOTAL walk; routing it would have NARROWED a correct site). Both caught by the brief's own verify-instruction, not by me.
+
+[2018] find · **(S393) Landing ORDER was the blocker, and the fail-loud/fail-silent axis decided it.** Removing the false `E-STATE-UNDECLARED` alone converts a loud error into a SILENT blank render (PA-reproduced: base exit 1; tip exit 0 with `init_set`/`reactive_set` both 0). So `reactive-deps.ts` (13 collectors) + `collect.ts` landed in the SAME commit. ⚑ `reactive-deps.ts` alone did NOT clear the bar — it produced *subscribed reads of a cell that is never created*, which looks like progress and ships the same blank. Acceptance = exact oracle parity 1/1/4/3, PA-verified, and re-verified on merged main.
+
+[2019] find · **(S393) An agent walked into a server leak and BACKED OUT — keep this behaviour.** Closing `collect.ts`'s `collectFunctions` emits a `server fn` BODY into `client.js` with no `server.js` (control: 1 with the hunk, 0 without, 0 on base), because that walk feeds the CLIENT emitter while the server-boundary ROUTING walk is separately blind. Reverted, filed HIGH, LEAK GUARD shipped and proven to red on exactly that mistake. → `g-collect-functions-branch-decl-vs-server-boundary-routing`
+
+[2020] state · **(S393) WRAP.** 7 PRs merged (#805 #807 #808 #809 #810 #811 +#806 pre-boot). 13 gap entries filed, 3 stale claims struck, 2 adopter Direction issues banked (dpa-038/039), return leg delivered to `origin/main`, both agent worktrees swept. **Rulings owed: 3 carried + 3 new, and THREE carried ones had their premises corrected this session — re-read before ruling.** Maps NOT refreshed (6c deferred, context) — stale at `2ec2ce3a` vs `0f398b95`. ⚑ Do NOT act on `worktree-sweep.ts` rows: 2 of 2 SWEEPABLE are exclusion artifacts, one on a clean tree holding unlanded work.
diff --git a/handOffs/incoming/S391-peter-routes-channel-mount-in-arm-gap-correction.md b/handOffs/incoming/read/S391-peter-routes-channel-mount-in-arm-gap-correction.md
similarity index 100%
rename from handOffs/incoming/S391-peter-routes-channel-mount-in-arm-gap-correction.md
rename to handOffs/incoming/read/S391-peter-routes-channel-mount-in-arm-gap-correction.md
diff --git a/handOffs/incoming/S391-peter-routes-colorless-async-arrow-thunk-overfire.md b/handOffs/incoming/read/S391-peter-routes-colorless-async-arrow-thunk-overfire.md
similarity index 100%
rename from handOffs/incoming/S391-peter-routes-colorless-async-arrow-thunk-overfire.md
rename to handOffs/incoming/read/S391-peter-routes-colorless-async-arrow-thunk-overfire.md