[trissim]

The virtual bus batch (plans/VIRTUAL-BUS-PLAN.md), integrated: one branch, one queue entry, one install, drop-on-fail per the plan. Each step stays owned by its holder, who pushes integration fixes to this branch from now on. The step PRs close into this one when it merges.

Steps merged at these heads:

• Virtual bus W: every bus write goes through Bus.append #2440 at f235f90 Virtual bus W: every bus write goes through Bus.append
• Virtual bus B1: wake and delivery readers onto seq #2448 at 9f3c43c Virtual bus B1: wake and delivery readers onto seq
• Virtual bus B2: history and transcript readers onto seq #2449 at aee5ea7 Virtual bus B2: history and transcript readers onto seq
• Virtual bus C: delete the file bus around the SQLite bus #2500 at 5689f3b Virtual bus C: delete the file bus around the SQLite bus
• Virtual bus D: carry bus.jsonl into the SQLite bus #2459 at 19b1655 Virtual bus D: carry bus.jsonl into the SQLite bus
• Derive Bus watches from committed store changes #2466 at 439438b Derive Bus watches from committed store changes

Paired Toad change: OpenHCSDev/toad#1131 lands with this, never before.

Conflicts resolved here: installer/upgrade.py imports (D adds InstallerChoice, the rest keep theirs; all used), ui_model/observation.py (E's side). Nothing else conflicted.

The red that remains is integration red, and this branch is where it gets fixed.

---

Generated by Claude Code

E / P415: inherited owner-read refusals (fork-directives)

Includes 75a900113 through published combined head 25532fac7, retained in remote claude-ai/bus-batch. AwaitedRead owns common refusal behavior; ReadRequest inherits it and OwnerRead extends via super() for RPC-only refusals. Expected stopped/replaced/disconnected owner reads retain the original exception without terminating observation or returning fake success. Stored-schema fatality and remote reported failure remain distinct. This lands with this batch, not the stale individual #2466 branch. It does not close the separate P413 selected-tool socket acceptance.

Exact-head qualification at 25532fac709f620c84344ae51360d5ea97ce2267: 65 executed, 62 passed, 3 failed; zero errors/skips. P415 six-file suite 52/52; selected-tool broker/listener 7/7. Runtime 3/6: three new-session cases stop at the legitimate private-launch native-prefix guard. No failure in integrator-resolved files. Whole-tree order checks: P413 0, expected 0; P415 1, expected 1. These results are not installation or qualification of later heads.

Source/consumer evidence and command: #2549 (comment) . Runtime setup needs an exact-head installed environment; no guard weakening or SDK copy. Installed private-bus worker-kill/fresh-tool/Toad proof and idle addressed wake/reply/UI/DB-only-silence acceptance remain open.

[trissim]

P412: remove the remaining file-envelope reader family

Published implementation: f9521e377; integrated with shared d657bc5d1 and pushed as 2afdaf2ce731c0dd4060e3c8ef09fb23e6b46e25. git ls-remote origin refs/heads/claude-ai/bus-batch matched that full head. PR #2549 remains the shared integration PR; C did not change readiness or enqueue it.

Deleted 445 lines / added 57 across 11 files in the implementation commit. Removed PRIVATE_WIRE_FIELD, Message.from_committed_wire, both require_retained_claim implementations, the two obsolete retained/attached-history pilots, and the private-checkpoint installation guide/link. Public Message.from_wire remains and still reads the real info-claim fixture. It no longer silently discards a retired private sideband.

Ownership and consumers

TIME-1/TIME-3: the SQLite Bus owns stored record validation and original delivery. A second committed JSON decoder and a retained sequence floor no longer have a production caller. Surviving public message imports use the existing public decoder; SQLite delivery tests use Bus.delivery. Keyed-response tests use PublicationIntents.published_message, which owns key/content validation. Cohort test setup uses ClaimBatchAcknowledgements.for_delivery, not a second SQL shape. The shared responder fixture takes a root, matching MessageBus's actual constructor; it no longer fabricates a bus.jsonl child root. The response assertion now follows Bus.replies' distinct record semantics while still requiring the response to answer both original references.

Before/after AST inventory uses the existing audit Package/Repository over Core src/tests/tools and paired Toad src (de66b5120c2cc9ed29d86b84aa0e5a3bc22c32d9). Both inventories have zero parse omissions. Original/new declarations, imports, writes, decisions and calls are in legacy-envelope-ast-before.txt and legacy-envelope-ast-after.txt. This is syntactic evidence; dynamic binding is not proved.

Checks at the exact pushed combined head

• timeout 300 env PYTHONPATH=src:tests /home/ts/code/projects/agent-comms/.venv/bin/python -m pytest -q -n 0 -o faulthandler_timeout=60 tests/test_change_report.py tests/test_coordination_cohort.py tests/test_coordination_response.py tests/test_info_claim_history.py: 45 passed, 5.19s. No skips/errors. The earlier pre-integration run also passed 45/45.
• Whole-tree collection: 3449 collected, 0 errors, 2.71s. This is collection, not a full-suite run.
• Focused Ruff F checks and git diff --check passed.
• Recorded P412 grep, excluding the literal declarations in plan_phases.py: 242 at 1612751 -> 0. Command: grep -rnE --include='*.py' 'private_bus_checkpoint|checkpoint_seals|bus_page_index|WireMetadata|_wire_lock_path|require_row_size|page_records|WireScan|has_private_wire_fields' src | grep -v plan_phases.py | wc -l.
• Legacy envelope family: 18 at 3c62299 -> 0 over src/tests/tools/stack for PRIVATE_WIRE_FIELD|from_committed_wire|require_retained_claim. Removed pilot/helper/doc names also have zero consumers there.

Logs: legacy-envelope-combined-focused.log, legacy-envelope-combined-collect.log, legacy-envelope-publish.log; corresponding .exit markers. The initial fixture failures were corrected before publication; they are not qualification evidence.

Still open / Assumed

• P412 is not delivered or installed-qualified. Root-lock inventory remains explicitly incomplete beyond its original 44 classified blocks; lock-sites-baseline.txt preserves the whole-tree baseline search for completion.
• C owns the 21 findings assigned in 18043/18046. This checkpoint does not claim them fixed. Focused mypy inventories exist for merge base d3fcbd66216483f8c71baf377a677b047f21ceaa and the local pre-integration implementation; they contain errors, not a green check. No local ratchet or full suite was run.
• Real registry/catalog/activity/input/restart/coordinator exclusion remains required. No replacement wire/root gate was introduced.
• Installed long-channel paging, actual wake/reply and exactly-one-holder resource contention remain open with the shared batch. The matching-runtime correction was still open at the last GitHub read; no native run used the source interpreter.
• Read unit-goalblock/live-coordination-readonly-check.log: it reports malformed live coordination.sqlite3. No live store was opened/repaired, no input was replayed, and no completion/goal write was attempted by C.
• Resource helper /home/ts/bin/agent-resource-check is absent. Manual bounded-run check showed 34 GiB disk free and ~3.6 GiB RAM available. Tests ran serially. Pytest preparation created/reused the checkout's pinned native package; no native provider turn was launched.
• Scratch owner is unit-filebus. The temporary baseline source snapshot .handoff/p412-mypy-base is disposable after its completed read; its output remains in c-owned-mypy-base.log. The 26 MiB mypy-base cache is retained only for the unfinished C type repairs. Protected sessions, mounts, original stores and UNKNOWN records were not cleaned.

[trissim]

B1 typing/import checkpoint — 37-finding assignment remains unfinished

Pushed and git ls-remote verified 3c37063. Implementation 715d02a; merged current shared 2afdaf2 before publication, preserving all peer work. Three conflicts were import-only. No rebase, force push, readiness change or independent main integration.

Owner and consumers

• Before: BusCapability(BusTables) declared values, but generated TypedTable query results erased their fields. After: existing TypedRow is a parent of BusCapability (bus_tables.py:304). C approved this contribution in message 18200 after reading it, with no conflicting edits. Its delivery return contract is now tuple[Delivered, ...].
• AddressedRow(Addressed, BusRow, declared_name=None) (bus.py:73) composes the existing declarations and decoder. It declares no fields, storage or schema member. latest_conversations and selected_sequences consume it instead of anonymous generated rows, preserving existing seq/sender/target callers.
• BusReader.claim (bus.py:129) decodes Claimed directly; resource acquisition asks the declared record for its claim transition. No casts, ignores, fallback shapes or duplicate field declarations.
• Query signatures state their actual parameters/results. MessageDisplayScope.intersection (read_basis.py:841) now declares its existing two-part result; B2 received that exact annotation-only contribution, with no reader/namespace implementation changes.
• CorrectionTaskChange.require_original (task_sources.py:163) requires the bus reader already supplied by all publication callers; removed its impossible missing-reader branch.
• Hoisted local imports in bus, cohort schema, publications, cursor owner/publication, messaging and source coverage. Removed two vague snapshot descriptions. The TaskScope/RegistryStore cycle is not claimed fixed.

Pattern relationships: BOUND-2/MEMB-5 — use the existing declared types and decoder rather than repeat row shapes or cast erased fields. AST inventory used the existing audit Repository file enumeration across tracked production/tests/tools/stack; no parse omissions. Dynamic generated-row resolution and dependency roots are not claimed fully certified.

Evidence, scoped precisely

• Original shared head: bus.py 25 mypy errors; now 0 (merge-base had 4). task_sources.py 75 -> 74, equal to its merge-base count. The assigned 21+1 added type errors are removed in this focused check.
• Direct consumer check: read_basis.py 61 -> 59 against the original shared head; full typing is not green. Final three-module result still has 133 errors in task sources and reader basis.
• After shared integration: 3 executed / 3 passed / 0 failed / 0.45 s, one xdist rewrite warning. Cases: the declared claim capability in live/held reads (including plain/missing rejection), inbox order/limits, and scoped/frozen queries plus latest-conversation/selected-position projections.
• Moved-import entrypoints imported; F/I check passed for the changed B1 files, shared base and test file. B2's reader file retains its two existing import-sort findings. No claim of complete lint acceptance.
• No local ratchet or full suite, per standing instructions. Hosted per-measure totals remain owed; I am not presenting focused typing or AST counts as the canonical debt gate.
• No provider prompt, installed-runtime qualification, P426 application acceptance or completion. Live stores and UNKNOWN inputs/alerts were not repaired or replayed. Owned temporary source archive, fixture launcher and synthetic databases were retired after process-cwd/fd checks.

Remaining: sequence-bound, publication and unread absence handling; TaskScope import-cycle repair; other assigned lint sites; hosted debt results; installed acceptance. This is a useful checkpoint, not delivery of all 37 findings or closure of P426.

Assumed: this typing checkpoint needs no runtime/namespace API changes. C's shared-base approval is recorded, not assumed. Current runtime availability and all installed/live claims remain unestablished.

[trissim]

Named-target parent contracts (B2 request 18264)

Pushed/remote-verified 668f6be, implementation 98b7a83, after integrating B2's reader changes.

NamedTarget now declares mark_view_read, pending_count and changed_threads; both existing siblings implement the same typed contracts. This is IMPL-4's missing parent contract, repaired on the existing family, not with a switch or wrapper. No behavior copies or fake ProjectTarget methods. The CommandTarget.named overload predates this work at cdc4755183.

AST inventory across tracked src/tests/tools/stack: declarations, inheritance and consumers inspected before/after; zero parse omissions. Dynamic/external subclass resolution is not certified.

Actual application-source check: one real Comms/SQLite journey exercises both named target types: pending counts, changed-thread attribution, human DM and channel reads, and preservation of agent unread deliveries. 1 passed, 0 failed, 0.65s on the combined published head; one xdist rewrite warning. No mocked Core methods or providers. Ruff F/I and diff whitespace checks pass.

Focused four-module mypy: own change 89 -> 81, no new diagnostic messages; after B2 integration 77 remain, not a green typing claim. The two pending-count errors still name CommandTarget in message_bus.py:141 and :198; those inbox-only caller contracts need NamedTarget, not a fabricated implementation on ProjectTarget.

No local ratchet/full suite, install or live/native/UI acceptance. This does not complete P426 or the 37-finding assignment.

Assumed: project targets intentionally have no inbox/read semantics, consistent with their existing implementation. B2's reader implementations were left unchanged by this contribution.

[trissim]

P424 reader and rehearsal-fixture checkpoint

Published commits 7c44d672a and 6b8b1667f, integrated with the other batch changes at 36fd79984dfb20da10ca96c7980b5d10668da1c0; git ls-remote matched. This is a source checkpoint, not installed acceptance.

• BOUND-8 / IDEN-3: PageTraversal retains PageCursor, deleting both siblings' nullable sequence/source copies. SequenceCursor owns sequence validation and bounds; LiveCursor and HistoryCursor compose their primitive/record codecs without conflicting wire methods. Null/int/{source,sequence} wire forms stay unchanged. Every Core constructor consumer is migrated. The immutable retained Toad tree remains untouched: wire_history.AfterSequence.older line 88 needs LiveCursor(self.cursor.sequence + 1).older(); the paired integration owner has that handoff (18191).
• ACP carries the existing native namespace into SelectedWritePlans, CursorOwner, SelectedExecution, visible-delivery acquisition and following inputs. No new namespace, package-acquisition bypass or byte-budget change. The optional tool intent is a typed constructor argument, not a conditional keyword bag.
• IMPL-5: HistorySource owns the captured original/archive facts and validation; attaching no longer independently reimplements its physical identity, sequence and registry checks. Catalog stability and backup completeness still have their separate checks.
• PublishedSentMessage owns exact-original qualification; the source reader no longer probes nullable lookups or performs the proof decision. Its type-only source-identity dependency breaks the local-import cycle without aliases.
• IMPL-12 / TIME-1: the shared native fixture explicitly installs its declared native schema once; duplicate fixture setup is deleted. Rehearsal fixtures reuse the real predecessor publisher, not a target-format root with a forged retired marker. Reader fixtures use SQLite and the published message's canonical display facts. Deleted JSONL writes, sidecar edits, .log calls and tests of the removed Bus byte-page API; original native byte-coordinate assertions remain untouched.

Verification

On integrated head 36fd79984, 105 collected / 105 passed in 73.26s:

PYTHONPATH=src:tests:tools timeout 300 /home/ts/code/projects/agent-comms/.venv/bin/python -m pytest -n 0 -q -o faulthandler_timeout=60 --basetemp=/home/ts/.cache/agent-scratch/unit-bus-b2/18310-integrated-readers-tmp tests/test_page_cursor.py tests/test_message_page_request.py tests/test_bus_history_seq.py tests/test_channel_display.py tests/test_channel_retirement.py tests/test_read_ledger.py tests/test_historical_page_scope.py tests/test_historical_views.py tests/test_acp_queue_contract.py tests/test_retained_context_operations.py

Earlier fixture batch: 39/39 at the pre-integration fixture tree. Earlier failed reader checks are retained separately; they are not counted as passes. My first reader check was premature: legacy fixture APIs had not all been migrated. The final 105-case result includes those corrections.

Focused Ruff F/I passes. Focused mypy is NOT clean; see the residual diagnostic file, including NamedTarget.mark_view_read missing from its parent contract. B1 has that existing-parent declaration handoff, together with the sibling pending_count/changed_threads contracts (18264). No local ratchet or full suite was run, following the standing prohibition.

AST inventory uses the existing refactor-audit Package/Repository loader: before 432 src / 470 tests / 15 tools; after 432 / 468 / 15; retained Toad filesystem 283, zero parse omissions. The two test deletions are peer integration changes. 18310-final-family.txt supersedes the incomplete 18232 Toad listing: that earlier Git-backed listing returned zero because the frozen Toad directory is untracked, not a Git repository. Attribute bindings, dynamic imports and runtime MRO execution are not proven by the syntactic inventory.

Artifacts under /home/ts/.cache/agent-scratch/unit-bus-b2/: 18310-integrated-readers.log, 18310-source-checks.txt, 18310-integrated-types.txt, 18310-final-family.txt, 18300-reader-publish.txt. The bounded test directories are B2-owned qualification data; the retained frozen Toad input is not disposable.

Still open

The two installer-rehearsal variants and test_saved_owner_dm_replies_and_core_reads_exact_native_proof are NOT yet requalified. Corrected RuntimeHome/TestHome exists on fetched origin/main but not this batch: its practice.py still has the rejected installed.exists() skip and uv fallback. Integration owner claude-ai has the request to integrate main before B2 uses the approved python -m agent_comms.installer.test_runtime entrypoint. No hand-built runtime or prefix bypass was used.

P424 still requires matching installation and the real long-channel-to-first-message / archive / fresh live reply / tab-return journey. Live stores and original sessions were not edited. This checkpoint does not establish that the reported live coordination-store corruption has been repaired.

Assumed: no installed behavior from source tests; no native acceptance from schema preparation; no clean debt verdict from focused checks. Remaining states require their own evidence.

[trissim]

P424 follow-up: B1 supplied the three NamedTarget parent contracts in 668f6be. B2 narrowed inbox/inbox_at/pending_count/mark-read parameters in 5f7ce84; integrated shared head 6b533c8 was pushed and remote-matched. The 14 message-page/channel-display cases passed in 3.47s on this head (18320-target-contract.txt). The prior 105/105 result stays scoped to 36fd799, not promoted to this later head. Focused mypy no longer reports the pending_count, mark_view_read or changed_threads parent-contract faults; it still reports other diagnostics, so no overall clean verdict. Native/rehearsal and installed acceptance gaps from the preceding checkpoint remain open; no local ratchet or full suite was run.

[trissim]

P424 reader identity/delivery checkpoint

Pushed 2c27e7fee432da2628f2b0f779358c5a172ed426; git ls-remote equals HEAD. Shared branch did not move during integration. Tracked checkout is clean; immutable toad-verification/ remains untouched.

Changed the owning reader contracts rather than restoring the wire API:

• Removed DMDisplayBasis's redundant viewer/peer birth-time properties. Consumers compare the original nominal incarnations; replaced a vacuous self-equality assertion with the actual expected peer.
• AssignedTranscriptSource and awareness consume each Bus record's declared deliveries() capability. Transcript windows expose Delivered values, not generic BusRecord values presented as delivery evidence. Bounds and original native/external coordinates are unchanged.
• OwnerOutcomes accepts ThreadProvenance, the existing nominal parent of Thread, rather than falsely requiring execution authority. Channel-page parsing no longer overwrites a string variable with a ChannelTarget.
• Migrated scoped-DM preparation and the shared coordinated-runtime fixture to the canonical explicit native/Bus preparation and Bus.delivery APIs. Outbound transcript checks now use SQLite sequence reads/backup. Deleted two tests of the removed checked-wire/lock mechanism; source replacement still refuses stale reads, and missing SQLite still fails loudly.

Verification on this source tree:

• 50 passed, 1 deselected, 1 warning in 49.45s. tests/test_read_ledger.py, test_dm_scoped_ack_successor.py, test_outbound_transcript_source.py, test_coordinated_runtime.py, test_retained_context_operations.py; -k 'not untrusted_pi', serial, timeout300, faulthandler60. The native-runtime-dependent test was deliberately excluded, not passed.
• Focused Ruff F/I passed. Mypy remains nonzero: 135 errors across four complete source files, largely annotation debt. Four other non-annotation diagnostics remain: TranscriptSource.reading, NotificationSource.recipient (two sites), and optional read_identity in notification-change attribution. No whole-family clean/debt-ratchet claim.
• Earlier 24-pass/20-fail and 40-pass/2-fail logs are retained. The former exposed unmigrated fixtures; the latter expected deleted-reader exception behavior. Final checks exercise stale-read refusal and exact SQLITE_CANTOPEN rather than weakening failure detection.

Owner/consumer evidence (IDEN-3, BOUND-2, TIME-1): 18330-delivery-basis-before.txt and 18340-delivery-basis-after.txt under /home/ts/.cache/agent-scratch/unit-bus-b2/; audit Package/Repository reused across 432 source, 469 test, 15 tool files; frozen Toad inventory 283 source files. Zero parse omissions. Syntactic inventories do not establish dynamic bindings or MRO execution. Source searches: rg -n 'viewer_created_at|peer_created_at|AssignedSourceWindow|sent_sources|direct_names|OwnerOutcomes' src tests tools toad-verification/src; rg -n 'bus\\.log|read_delivery_cohort|checked_read|\\.locked\\(' tests/test_outbound_transcript_source.py tests/test_coordinated_runtime.py now has no matches. Legitimate DisplayBasis/goal/provenance birth declarations remain; only the two redundant DM projections were removed.

Evidence: 18350-delivery-basis-tests.txt, 18350-delivery-basis-ruff.txt, 18350-delivery-basis-types.txt, 18360-delivery-basis-publish.txt in that scratch directory.

Assumed:

• SentSource/ReceivedSource membership remains derived from Delivered.projections; readers consume that declared capability without a type switch or alternate codec.
• Existing native/fixture preparation owns schema installation. Reader attachment still never installs it.
• Main integration including corrected Declare the rehearsal and test runtime homes instead of probing for them #2591 and the paired Toad cursor consumer is still the integration owner's work. Neither is established by this checkpoint.

Still open: the two actual installer-rehearsal variants, saved-owner/native-proof case, remaining reader debt, and installed long-channel/archive/fresh-reply/tab-return acceptance. No local ratchet/full suite, alternate runtime, source-prefix bypass, live-store repair, or UNKNOWN-input replay was used. This is pushed source, not merged or installed acceptance.

[trissim]

P424 archive/display contract checkpoint

Pushed 51f7a9c314e149f29bc3eac3aacf951407e20d22; remote equals HEAD, shared integration was already up to date. Tracked checkout is clean; frozen toad-verification/ is unchanged.

• ConversationHistoryView now supplies a real FileObservation of the history catalogue to DisplayIdentity, not WireRevision.history's tuple of store observations. The four new cases cover channel/DM identity encoding and decoding with the catalogue absent and present.
• HistoryView declares its default viewer as a read-only property, matching the existing DM override and slotted channel declaration. Historical thread results retain their nominal type.
• MessageRole now declares the as_historical contract already implemented by its concrete roles. Message.history_source is read-only, matching HistoricalMessage's override. Annotated Message field declarations are unchanged; no wire fields, bus/native coordinates, publication algorithms or namespace facts changed. W was notified in18315; no Publisher edits.

46 passed, 1 warning in26.82s on this exact source tree: conversation revision, historical views, historical page scope and bus-history sequence tests, serial/background with timeout300 and faulthandler60. Focused Ruff F/I passed. Focused mypy is not clean (59 errors over the two complete source files); historical_views has one remaining non-annotation fault: RegistryProvenance.capture's parameter is narrower than its actual namespace parent.

Important failed attempt retained: changing archive attachment to reading_snapshot was wrong. It applied live unique-birth validation to retained history, breaking test_duplicate_and_newer_incarnations_sessions (45 passed/1 failed). That call was reverted; the final46-case run includes and passes the duplicate-birth case. Archives must preserve readable history without acquiring live execution authority.

B1 owns registry typing. Handoff18319 requests RegistryProvenance.capture accept its existing RegistryNames[ThreadProvenance] parent; covariance already admits RegistryDocument and RegistrySnapshot, and the implementation only reads threads/aliases. No registry_provenance.py edit or competing capture implementation from B2.

Source/consumer evidence (BOUND-2, IMPL-4): audit Package/Repository reused across432src/469tests/15tools; frozen Toad283 files, zero parse omissions. 18370-history-facts-before.txt, 18370-message-contract-before.txt, 18380-history-facts-after.txt under /home/ts/.cache/agent-scratch/unit-bus-b2/. The last artifact verifies Message's annotated field AST declarations did not change. Inventories are syntactic evidence, not proof of dynamic bindings/MRO. Search: rg -n 'history_revision|as_historical|history_source|RegistryProvenance.capture' src tests tools toad-verification/src.

Evidence there: 18380-history-facts-tests.txt, 18380-history-facts-ruff.txt, 18380-history-facts-types.txt, 18390-history-facts-publish.txt; initial failed attempt in18370 logs.

Assumed: the catalogue FileObservation describes display selection, not the SQLite bus sequence or native producer position; archive capture stays display-only. Native file offsets/budgets and external producer positions are unchanged. No local ratchet/full suite or new runtime was used.

Still open: B1 parent typing; commander-owned main integration including corrected#2591 and paired Toad cursor consumer; the two actual rehearsal variants and saved-owner native-proof case; installed long-history/archive/fresh-reply/tab-return acceptance. This is pushed source, not merged/installed completion. Original sessions, live stores and UNKNOWN inputs were untouched.

[trissim]

Registry provenance capture consumes its existing parent (B2 request 18319)

Pushed/remote-verified c6e7714, implementation 0e77fa7, preserving the latest shared history/role fixes.

RegistryProvenance.capture(source: RegistryNames[ThreadProvenance]) now states the capability its body actually uses: threads and aliases. Member is covariant; Thread derives ThreadProvenance, so the existing RegistryDocument and RegistrySnapshot hierarchy supplies that parent. No adapter, cast, second representation or new class. The misleading parameter name snapshot became source; known callers are positional.

Archive attachment is unchanged. It still reads the recorded document rather than constructing a live snapshot or applying execution-identity checks. Duplicate-birth history remains readable.

Source evidence: existing audit Repository enumeration across tracked src/tests/tools/stack, declarations/generic inheritance and all named capture consumers read; no parse omissions. Dynamic/external alias calls are not fully certified.

Acceptance on this combined head: tests/test_historical_views.py plus tests/test_historical_page_scope.py: 28 executed / 28 passed / 0 failed / 21.39s, including test_duplicate_and_newer_incarnations_sessions. One xdist rewrite warning. The same 28 passed before integration in 21.14s.

Focused mypy removes exactly the capture(RegistryDocument) argument fault, with no new diagnostic messages. Own pre-integration change leaves 20 other errors; after B2's integrated fixes, 13 remain in the two checked modules. This is not a full typing/debt-green claim. Ruff F/I and whitespace check pass.

No local ratchet/full suite, provider run, runtime install or native/UI acceptance. B2 retains archive/role fixes and final verification; P426 and the 37-finding repair remain unfinished.

Assumed: capture needs no stronger capability than the declared names/data parent; its source body establishes that requirement.

[trissim]

P424 combined registry-parent verification

B2 fast-forwarded to c6e7714d1c179a659c3a5ec14ec63b59746c16c0. The only change from the previous B2 checkpoint is RegistryProvenance.capture consuming its existing covariant RegistryNames[ThreadProvenance] parent. Archive attachment still uses the read-only document, not live snapshot validation.

46 passed, 1 warning in36.33s on this combined head: conversation revision, historical views, historical page scope and bus-history sequence tests. Includes duplicate/newer incarnations and the four channel/DM catalogue identity codec cases. Serial/background, timeout300, faulthandler60. This is separate evidence from B1's28 tests, not an aggregate.

Focused RuffF/I passed. The capture-argument typing fault is gone, and historical_views has no remaining non-annotation diagnostics in this focused run. Mypy remains nonzero:58 errors over complete historical_views/messages modules; no whole-module/debt-clean claim. Corrected P424 ten-reader grep remains0. Native/external coordinates and wire fields are unchanged.

Evidence: /home/ts/.cache/agent-scratch/unit-bus-b2/18400-b1-contract-{integrate,tests,types,ruff,source}.txt. No new source edits or push from B2; tracked checkout clean, frozen Toad untouched.

Still open: commander main integration including corrected#2591, paired Toad cursor migration, the two actual rehearsal variants/saved-owner native proof and installed long-history/archive/fresh-reply/tab-return acceptance. No unsupported runtime, local ratchet/full suite, live-store repair or UNKNOWN-input replay.

[trissim]

From the harness plan (claude-code), two defects that live in code this batch rewrites, so they are this batch's to fix rather than main's:

1. ingress_async holds a shared lock across its caller's awaits. On main it holds the shared wire lock (maintenance_barrier.py:452); on this branch it holds the shared registry lock (maintenance_barrier.py:418-425) and still yields to the caller inside it. Every running unit holds one of these while it awaits, so an install's exclusive lock waits on all of them: that starved installs 52 and 53 on 2026-10-21. The open test test_wire_lock_scopes::test_no_wire_lock_scope_or_yielded_caller_contains_await names the shape. Required: the lock covers only the witness read and the decision, never the caller's awaited work.
2. A lock wait never names its holder. store_files.py:157 retries in short naps and prints nothing; install 52 sat twenty minutes that way. Required: the wait fails within seconds naming the holder's pid and command.

Context: harness plan step 1c's other three commits are on main (ec811af, 0c4e581, 72b58c7). Every schema change now happens only under the install hold, and the installer reconciles every ReconciledFile as a named step. That touches typed_table.py, locked_store.py, cli_commands.py, installer/upgrade.py, goal_history.py, coordination_database.py and cli_bridges/shared.py, all of which this branch also edits. Expect conflicts there. Resolve toward main's SchemaChange / install_schema / ReconciledFile.

🤖 Generated with Claude Code

[trissim]

Route-index finding for this PR's owner (the route index is on the virtual bus's surface).

Stack.cli at src/agent_comms/installer/upgrade.py:451 reruns the CLI up to 240 times, 5 s apart (20 minutes), until stdout stops containing the text "Route index covers". Readiness gets flattened into a prose line and grepped back out of it: BOUND-4. Any rewording of that message turns the wait into a silent fall-through, and any other output that contains the phrase hangs the install for 20 minutes.

Slop: BOUND-4. Fact: whether the route index is ready. At: upgrade.py:451. Derive: the route index's own typed state. By: the route index's owner type.

Shape: the CLI answers "index not ready" as a typed CliResult error member that Stack.cli decodes with FieldCodec, and waits on it, or the index is ready before the verb returns. The phrase match and the 240×5 loop get deleted. If this PR rewrites the route index anyway, fold it in here; otherwise reply with the owner and I'll order it.

🤖 Generated with Claude Code