Delivery coordination: five lanes queued for main (2026-09-08)

Several rounds are running in parallel and all of them want `main`. This is the running order, what each
lane is blocked on, and the two traps that have already cost a red `main` once today. **Edit this issue as
lanes land** rather than starting a new thread.

`origin/main` = **4c10be9d** (lane 5 landed 2026-09-09, on top of lane 3's f2589419), gate count **563**.

## Order, and why

Not "who finished first". Two things serialise us; everything else is free:

1. **Generated files.** `docs/COMMANDS.md` is built by `docs/docs_commands_build.py`. Three lanes touch
it. **Regenerate after rebasing — never hand-merge.** `docscommandscheck` arm (G) checks which capture
produced it.
2. **Counts a gate re-derives.** The gate count (8 sites, from `regression.sh`'s loop) and the paper/repo
counts (6 sites, from `docs/LINEAGE.md` rows).

| # | lane | state | blocked on |
| --- | --- | --- | --- |
| 1 | `lane/pr55-installer-isolation` (PR #55) | ahead 3, **behind 4** | rebase onto 26abcc79 + re-dispatch. Mine |
| 2 | `ci/std-print-floor-2026-09-08` | **LANDED** — main `88a5503b` (a `--no-ff` merge of `1095ed70`; tree identical; `git revert -m 1 88a5503b` undoes it). Proof: `48c42046` green on every job in [34293608628](https://github.com/redhat-et/ripwire/actions/runs/34293608628); `1095ed70` re-proving in [34298150602](https://github.com/redhat-et/ripwire/actions/runs/34298150602); main's own run [34298547133](https://github.com/redhat-et/ripwire/actions/runs/34298547133) **green on every job** (the branch run's one macOS red was the crawl-root-mutation flake in the standing items — same tree passed on main) | What is now on main for everyone: `--version` carries `emit=std::print` (versioncheck #6); CMakeLists' libstdc++ ignorelist exempts ``/`` (spelled `c\+\+`) and g1configcheck's audited list enumerates it — any new `src:` rule must move those counts; ubuntu gcc legs pin gcc-14, RHEL probe floor 14, macOS legs Xcode 16.2, every job asserts the emitter after Build; `fallback-emitter` job; the shotgun round's `--cochange`/`--situ` naming and EVALS section |
| 3 | recall / context-mode | ✅ **LANDED** — main `30b72ec0` (--no-ff merge of `lane/recall-passage-2026-09-08` @ `d5c75a9d`), CI run 34301707466 26/26 green. Gate count 562 → **563** (`recallpassagecheck`); repositories 42 → **43** (context-mode LINEAGE row); papers 69 unchanged. Also carries the capture scrub: the 21 unredacted planning headings in `COMMANDS_showcase_2026-08-10.md` are gone from main | — |
| 4 | confident-zero (#62/#63/#66, now also #59/#60) | in progress | scope decision — see below |
| 5 | `lane/gate-isolation-2026-09-09` | **LANDED** — main `4c10be9d` (a `--no-ff` merge of `adef346d`; tree identical; `git revert -m 1 4c10be9d` undoes it). Proof: `adef346d` green on all 26 jobs in [34308541762](https://github.com/redhat-et/ripwire/actions/runs/34308541762); main's own run [34310769504](https://github.com/redhat-et/ripwire/actions/runs/34310769504) | What is now on main for everyone: `test/pargates.py` prints `tree_writes=N` on its summary line and FAILS the run when a gate leaves a new untracked/modified path in the checkout, naming the gates in flight (a 0.25 s sampler — N is a floor); `.gateprobe.*` is gitignored; gateexitcheck has arm (F); tokenbudgetcheck's determinism arms crawl a private copy of src/; prbudgetcheck spells its fixture root `$FIX`; CONTRIBUTING §1 (never write into the checkout) and §2 rule 5 (remove the shape, not the instance); `--porcelain` in test/deckcheck_allowlist.txt. No gate added |
| — | `shotgun-surgery-measured-2026-09-08` | **landed with lane 2** (`3b3cbe02` is now an ancestor of main) | nothing — lane 3 can rebase onto main directly |

## The trap that actually bit, twice

**Two lanes making the SAME count bump do not conflict in git.** They merge cleanly into a number that is
then wrong. Main said 560, a lane said 559, and the truth was 561. `manifestcheck` is what catches it.

> **Re-derive every count AFTER rebasing. Never carry a number across a rebase.**

And **`test/regression.sh`'s absorb list is one very long line ending in `; do`.** Resolve it by taking the
other side's line verbatim and inserting your name. Rebuilding it from parsed tokens drops every name your
filter misses *and* the trailing `; do`, which puts the tail of the list after the loop header — gates
that then silently never run. Done exactly that once today; `manifestcheck` caught it.

**A gate fixture that flips a byte to a CONSTANT is a 1-in-256 no-op PER BUILD CONFIGURATION.**
`doctorcheck.sh` arm (F) built its "genuine-stale binary" by writing `'X'` at offset 100000 of a copy
of `$BIN`, and never asserted the byte changed. Where the compiled binary already held `0x58` there,
the write was a no-op, the copy stayed byte-identical, `--doctor` correctly answered
`copied="1" same_bytes="1" ok="1"`, and all five of the arm's assertions inverted — reporting a
stale-detection bug that does not exist. It reddened exactly one leg of 26 (run 34299292778,
`release (ubuntu-24.04, Release, gcc, shard 1/4)`) and was invisible to every local run and every
macOS leg, which hold a different byte there. **Read the signature:** the same shard green under
`plain/gcc`, `plain/clang` and `Release/clang` and red only at `Release`×`gcc` is a fixture keyed to
build output, not a defect in that shard's gate set — a real defect reddens all four. Fixed in
`30b72ec0`: read the byte, write `(old + 1) % 256`, and `cmp -s` before trusting the arm. Latent on
main since the 2026-09-06 rewrite, so it could have bitten any lane on any run.

## Validate on GitHub, not locally

```bash
git push origin HEAD:lane/
gh workflow run ci.yml --ref lane/
```

Free on a public repo, and **better coverage than any local run**: six legs (Release/plain × macOS
AppleClang / Linux gcc / Linux clang) plus RHEL ubi9 and ASan. Today a gate passed locally, passed both
macOS legs, and failed **all four Linux legs** — it overrode `HOME` but not `XDG_CONFIG_HOME`, which is
unset on macOS and set on Linux CI. No local run could have found it.

Also: 18 cores were carrying load average 27/46/48 earlier with five sessions building at once, and two
`-j 6` batteries were killed at **exit 144** with ~270 bytes of output. That is starvation, not your gates.

## Other standing items

- **A gate must not write into the shared checkout — and the writer was not the gate named here before.** The
`tokenbudgetcheck` red on [34298150602](https://github.com/redhat-et/ripwire/actions/runs/34298150602) (macOS plain
shard 2/2, `--for` arm, est_tokens 3949 vs 3947) was `at=""` vs `at="+dirty"`: six bytes, two tokens at
2.5 B/tok. `src/gitstamp.h` reads `git status --porcelain` from ANY crawl root inside the checkout, so an untracked
file anywhere in it flips every stamped determinism arm (`--for`, `--pr-context`, `--edit-check`, `--slice`, `--situ`,
`--hotspots`, `--doctor`, …) running beside the writer. `prbudgetcheck` was innocent: it rebinds `ROOT` to its own
mktemp fixture at :48, and `src/mod4.cpp` does not exist in this tree. The writer was `gateexitcheck` arm (A):
`test/gateexitfix/.gateprobe.*.sh`, untracked, ~20 ms per fixture, three worker slots from tokenbudgetcheck in that
shard's run order (seen live under a 50 Hz `git status` watcher). Fixed on lane 5; `test/pargates.py` now samples
`git status` during every run and fails it naming the gate in flight (`tree_writes=N` on the summary line, a
floor — it is a sampler). If a determinism arm reds on a shard, read that line first.
- **Rebuild AFTER committing, before validating.** `versioncheck` compares the binary's embedded
`built_from=` to HEAD. Cost two runs today.
- **Parser version collisions:** three today (#57 took 82, #56 claimed 82 → 83, #65 claimed 83 → 84). If
you bump `kParserVer`, check `origin/main` first, and move `kIngestParserVerMirror` in the same commit.
- **confident-zero scope:** #59 and #60 reproduce on today's main and are the same class — a confident
wrong edge (`graph_ambiguous="0"` on a guessed edge) and a confident zero (`tests="0"` for code a test
exercises). Triage all five together at least once before deciding whether to take them.

Start by reading the lane table and the current origin/main state, then inspect docs/docs_commands_build.py, test/regression.sh, test/pargates.py, and the referenced CI workflow. Run the listed GitHub Actions workflow on a lane branch and verify the relevant gates, counts, generated files, and checkout cleanliness before considering a lane landed.

Written by the indexing model from the issue text.