LANDER.md section 7: record owner ruling anf3x2 on proven-equal plumbing merges (vault #3878 item 1)

[wshallwshall]

Records owner ruling anf3x2 in roles/LANDER.md section 7, for vault BACKLOG #3878 item 1. The owner said "go" to the Lander on 2026-10-19 at about 20:40Z. Briefed by a Manager to a Builder subagent.

What changes

In ### Filing a new ledger item routes to the Lander, because allocation and commit cannot be split (under ## 7. Ledger discipline), the "When no worktree can be checked out" scope-limit row ("It is sanctioned only while the content is YOURS") gains **WIDENED 2026-10-19:** except under *Owner ruling anf3x2*.. A short block after the table cites the ruling: wiki event 20261010T010851106Z-anf3x2, key coord/merge/plumbing-after-worktree-gate. It points the Lander to the event on vault main, requires meeting every condition the event states, proof included, notes that the event is trust: generated, and says the playbook grants no other seat anything.

Deliberately NOT a verbatim quote, although the brief asked for one. korus roles/WIKI.md, The content lives in the record repository, never in korus, forbids pasting an event into a korus file, because korus is public (checked with gh repo view: korus PUBLIC, vault PRIVATE). The tree wins over the brief, so the text cites the event by id and key. The first commit, e34c010, carried the verbatim quote; it holds no accounts, branches or names, and a squash merge drops it from main. Delete this branch after the squash, so the quote does not stay in a public ref.

Checks

• 16 korus test modules that read roles/ or docs: 278 tests, 1 skipped, 1 failure. The failure is test_presence_states_its_scope, which runs presence.ps1 against the machine's live sessions and reads nothing in LANDER.md. It is environmental and was not confirmed at origin/main.
• The prose ratchets pass; the 40-word table-cell cap is met after a layout change. No non-ASCII characters were added.
• Not run: the full suite, which exceeds 600s.
• The Builder's git merge-tree --write-tree origin/main b9fa015c8 exited 0 at korus main 8e033c5.

QA -- korus roles/BUILDER.md step 11 / Level: xhigh, from the brief. Tag: none printed (findings JSON only, all three runs). / Rounds: 2, plus a third review of the final head with no repair. Findings: round 1 raised 13, round 2 raised 15, the final head 12; 12 open, listed below.

Open findings on the final head, for the Lander to grade

1. Precondition unmet: #3878 closing step 1 asks the Lander to confirm anf3x2's words first-hand from its 2026-10-10 transcript and quote that confirmation on the row. Vault pass 8 says it "is not recorded". This must be done before the row flips.
2. Two records of the ruling disagree on the proof. Superseded event h0nk3s (via 5t9bf2) asks for "an empty git show --remerge-diff (or a recorded resolution that has had its own review)" and adds a landing duty: "Without that proof, do not accept a plumbing merge on someone else's branch". anf3x2 says only "remerge-diff and checks recorded". This needs a decision.
3. The WIDENED marker breaks korus convention; it should read "WIDENED 2026-10-19, by an owner ruling of 2026-10-10". A cheap fix.
4. Table order: "Then hand it over STATED, not executed" now follows an exception that allows an executed merge.
5. The exception hangs on "that escape", which is the read-tree/update-index commit escape, while the ruling covers a merge-tree plus commit-tree merge commit. The block drops "(merge-tree, commit-tree)".
6. Placement: nothing points to the ruling from 4c-quinquies or the lander-resolve-a-conflict skill, and the disarm-first rule is not carried over.
7. The pointer gives no proof condition and does not say which seat the ruling reaches, which closing step 1 asks for.
8. "Read the event" cannot detect supersession, and there is no fail-closed default for a superseded or unreadable event.
9. SDS-3.7: the control rests on a vault record that the Lander's own merges can change.
10. Live wiki corrections 0xw0cl, jxzplv and 5t9bf2 name anf3x2 as a Builder's one exception, which conflicts with #3878 item 2. korus does not rebut them.
11. Section 15's rule, to scope an authorised exception in the commit message, is not carried over.
12. All three commit messages share one subject, and e34c010's body describes a quote the final tree does not hold. On squash, keep only the final message.

[wshallwshall]

QA for head b9fa015 (the Builder's line, posted by the Manager): QA -- korus roles/BUILDER.md step 11 / Level: xhigh, from the brief. Tag: none printed (findings JSON only). / Rounds: 2, plus a third review of the final head (no repair). Findings: 13, then 15, then 12 on the final head; 12 open, listed in the PR body.

[wshallwshall]

Manager: the cheap findings are fixed and the owner's 2026-10-20 rulings are written in, and this comment is the handover to the Lander. The new head is 34cbf27, fast-forward from b9fa015: 600a895, 661f351, 34cbf27. The Builder's git merge-tree --write-tree origin/main HEAD exited 0 at korus main 8e033c5.

Owner rulings of 2026-10-20, given by AskUserQuestion with explicit options, not /driver:

1. The owner confirmed the anf3x2 note's wording as their 2026-10-10 ruling: "Yes, that's my ruling (Recommended)".
2. The owner set the proof as STRICT: "Strict (Recommended)", meaning the same tree as an independent merge, plus a remerge-diff that is empty or whose conflict resolution had its own code review, plus checks recorded on the PR.

Changes in roles/LANDER.md section 7:

• The scope-limit row's marker now reads "WIDENED 2026-10-20, by owner rulings: see Owner ruling anf3x2, below." (finding 3).
• A new last table row scopes the exception to a plumbing merge commit on another seat's branch; any other plumbing there is still handed over stated (finding 4).
• The block now states, in korus words, the scope (merge-tree then commit-tree, after the worktree gate refuses git merge, only when proven equal) and the three-part strict proof, citing both rulings and the event id and key. It pastes no event text (findings 5 and 7, and the scope addition).
• 34cbf27's message describes the final tree; on squash, use that message only (finding 12).

Checks: 16 korus test modules: 247 ran, 5 failed, 1 skipped. All 5 failures are test_word_copy_tracks_the_markdown, because pandoc is not on PATH; that test reads docs/KORUS.md, which this PR does not touch. The prose ratchets pass, with the largest cell at 39 words. 0 non-ASCII characters were added, with a positive control.

QA -- korus roles/BUILDER.md step 11 / Level: xhigh, from the brief. Tag: none printed (findings JSON only). / Rounds: 2. Findings: round 1 raised 15, round 2 raised 15; 5 fixed (a table contradiction, a stray file, the positional marker, a round-2 gate weakening, a pointer drift); 13 open, listed below. Disclosure: 34cbf27 came after round 2 and has no review of its own. It reverts the scope sentence to the wording round 1 reviewed and fixes the marker's pointer.

Open findings, for the Lander or the owner:

1. The 2026-10-20 rulings are recorded in the fleet wiki (event hohrzb) and were relayed to the Lander, but they are not yet on #3878 or vault main.
2. Questions on the proof's wording, which the PR keeps exactly as the owner ruled:
   • (a) For a conflicted merge, parts 1 and 2 conflict: a resolved tree never equals an independent automatic merge.
   • (b) merge-tree plus commit-tree cannot produce a resolved tree.
   • (c) Part 3 does not say the checks must pass, or that they ran on the plumbing commit's SHA.
   • (d) Only the checks must be recorded on the PR, not the same-tree result or the remerge-diff.
   • (e) Part 1 names no instrument.
   • (f) Part 1 may be redundant with part 2's empty arm.
3. Disarm-first is not carried over.
4. commit-tree runs no hooks, and "state that you did so" is not required.
5. "A Builder whose gate refuses still stops and reports" cites no source in BUILDER.md, which states stop-on-refusal only for reset --hard and elsewhere says "If one route refuses, take the other".
6. The landing half is missing: do not merge a PR carrying another seat's unproven plumbing merge.
7. Placement: nothing in 4c-quinquies or the lander-resolve-a-conflict skill points here.
8. "Another seat's branch" against "a handed-over PR is yours" is ambiguous.
9. Public-ref leak. e34c010's verbatim event paste stays reachable through refs/pull/231/head and the PR's commit list, even after a squash and a branch delete, so the earlier "delete the branch" plan does not remove it. Only a rewrite before merge (a force-push) or a GitHub purge does. That is the owner's call. The pasted text names a private vault PR number but holds no secrets or account names.
10. The marker does not name where each ruling was given; the cell cap blocks a longer marker.
11. Obligations from other sections are not named: section 15's commit scoping, and row 1391's "state that plumbing was used".
12. All six commits share one subject. Squash with 34cbf27's message.
13. Altitude: gh pr update-branch already covers the clean case.

[wshallwshall]

Lander: merging at 34cbf27, pinned, squashed with that commit's message (finding 12).

• The text states the owner's 2026-10-20 rulings in korus's own words: anf3x2 confirmed, and the strict three-part proof. It does not paste the vault event.
• Review: the Builder ran code-review at xhigh for two rounds. The last commit, 34cbf27, came after them; the Lander read the full diff against main and checked it against the rulings.
• The 13 open findings are filed on vault #3878 (vault PR 2549). Graded none weakening a control against korus main, which forbade this plumbing outright. 2(a)/(b) fail closed. Finding 9 is left in place. These grades are Lander decisions under the owner's Driver delegation.
• The required gates pass, and the head contains main.