The DoD Closure Plan

Jump by type: Decisions · Your calls · The five exits · Risks · Gap inventory (depth) · How this plan was checked (depth)

The journey — how one empty slider became the whole plan

1. You saw it before any instrument did. A practice’s sliders sat empty on our copy while the real site showed real slides — and the label on the link said “proven good.” The door itself had refused to certify (it has never certified anything), but a human-shared preview and a shallow check outran the machine. Your question — “what else is lying about being green?” — is what this plan answers.
2. The first diagnosis was wrong — and the process caught it before it shipped. I first told you the capture had missed the slider data and we’d need to re-crawl. Three independent reviewers attacked that claim with disk evidence, and they were right: the capture never lost a byte. Every real slider payload is sitting inside our deployed copy right now, byte-for-byte the size the live site serves.
   ↘ go deeper — the receipts that killed the wrong diagnosis

   Live site’s slider feeds, fetched tonight: home #1 = 25,837 bytes · home #2 = 45,161 · what-to-expect #3 = 29,173. Files found in our deployed copy (il-deploy/il-resources/ajax/): 25,837 · 45,161 · 29,173 — exact matches, hash-named, present. The serving map, meanwhile, points those same sliders at 185-byte empty stand-ins (crawl/ajax-responses/home/_manifest.json) and has no entry at all for home #2. Verified independently three times: by the review panel, by me from raw, and by the follow-up grader.
3. The real disease — truth has no single authority, so producers and consumers keep meeting in different rooms. The pipeline keeps two parallel stores of fetched data. The downloader filled store A with the real slider bytes. The slider-fallback stage and the serving layer both consult store B — found it empty, fabricated empty stand-ins into it, and served those. Real truth on disk, shadowed by a stub. And this same pattern — two rooms, wrong door — explains every defect found this week, at four different layers of the system. Your phrase for it was exact: multi-pipeline and wiring confusion. Nothing is rotting. Nothing needs re-capturing.
   ↘ go deeper — the four layers, each with its receipt

   1. Inspection battery ↔ capture engine: ~30 probes authored against the old engine’s artifacts; the door ships through the new engine (22 receipted mismatch items in probe-classification.json).
   2. Serving map ↔ download store: the slider case above (per-page-ajax-map.ts reads only crawl/ajax-responses/; the downloader writes the HAR/url-map store).
   3. Route list ↔ the world: the deploy’s route authority derives from its own crawl; the live sitemap and the site’s own nav links disagree with it (95× one link-format mismatch class alone).
   4. Instruments ↔ a second gate: 56 of 127 verdict-emitting checks never reach the door; ~50 report to a separate script (run-production-readiness.sh) the door never runs.
4. The law that closes the class: one authority per kind of truth — and no stage may quietly author or drop truth. Every kind of truth (fetched bytes, routes, verdicts) gets exactly one derived authority, and every consumer resolves through it — parallel stores merge into the authority or are retired. Fabricating a stand-in is legal only where the authority truly holds nothing for that request, and then only with a ledger entry that auto-recovers, proves itself harmless against the live world, or blocks the certificate. Faking empty is only wrong when the world isn’t empty — and that’s now a mechanical comparison, not a judgment call.
   ↘ go deeper — what mechanically changes

   The serving map derives from the downloader’s own record (the url-map). A new shadow gate: for every request the capture browser fetched and stored, serving must return exactly those bytes — a stub over a real body goes red, with the offender named in structured output. Byte gates pass only browser-captured provenance. The 8 places that today can drop data with only a log line each become ledgered-or-fail-closed. A meta-gate fails CI whenever any check’s verdict reaches no legitimate exit — so “built-but-not-wired” stops being a thing anyone must notice. And the plan’s own evidence layer gets a tripwire fixture, because this round proved even a census can misread a store.
   Added at your prompt (v2.2) — make it structurally impossible, not just reviewed. The root of every “two rooms” incident: our pipeline stages talk by dropping files at path conventions — an API with no compiler, no owner, no collision alarm. So the law above gets enforced by the build, not by discipline: (1) one door — a resolver is the only legal way to read the truth layer; you ask for the artifact by role, never a file by path, so binding to a wrong store becomes inexpressible; (2) one producer per truth class — a registry where a second writer fails the build, and — the part that keeps it from becoming another stale hand-list — unregistered reads and writes BOTH fail, so forgetting the registry is loud in both directions; (3) one runtime — the old engine goes diagnostic-only now and is deleted after Tier-1. The deeper frame: this gives the factory the same spine as the product — one canonical truth layer, every surface a derived projection — the genome law, extended one level down into the machine that builds the genomes.

   Ownership (call 4 — RATIFIED 07-07): the pattern is Quanta-native, Neuron-bound — the truth-class law is authored once in Quanta’s canon (same discipline as the edge contract you ratified today: one canonical home, binders never inherit sibling copies), Neuron binds as the first factory instance, its attestations deposit into the existing quanta planes, and the Plato face gets one capability ask (sole-writer/sole-reader proofs as first-class queries). Not proprietary to this repo — a per-repo registry format would be the two-rooms disease about the cure. Ratified; the Quanta session is briefed first.
5. The proof is refusal-first. Before any fix lands, the rebuilt door must refuse today’s broken build — and the refusal’s machine-readable list must name all four shadowed sliders (home #1, home #2, what-to-expect #3, demo #24) as an exact set check, not prose. If it certifies the broken thing, the door is wrong and we know immediately. Then the break battery: one planted defect per class of check, every green forced red at least once, every proof deposited in the permanent honesty ledger. “What else is lying?” becomes a ledger you read, not a fear.
6. The road: five phases, five hard exits. Wire one door → lock honesty in → fix the routing & mint the first certificate → force every green red once → you walk the certified site. Each phase ends in a command whose output is a verdict — no phase is “done” by anyone’s say-so.
   ↘ go deeper — the five phases and their exit tests

   P1 — One truth, one door. Fix the 15 battery/engine mismatches; thread the deploy address into the inspection stage; rule all 56 stray instruments (wire / keep-at-bookkeeping-tier / retire loudly); re-pin the code map. Exit: every probe returns a verdict, none excluded, none crashing.
   
   P2 — Single authority + honesty locks. The AJAX authority; the shadow gate; provenance-aware byte gates; the loss ledger (8 conversions); two-legged completeness (internal consistency + a world audit that breaks self-grading); the meta-gate. Exit: the door refuses today’s build naming all four sliders — the set check.
   
   P3 — Routing fix + the world eye. Serve the already-captured bodies; slider equality against per-slider baselines derived from every slider page (not a hand sample); video joins the behavior taxonomy. Exit: the first certificate ever minted, signed and verified.
   
   P4 — The break battery. Derived class map (an unclassified check fails the battery itself); a planted defect per class; every red proof deposited. Exit: coverage equals the class map; restore; re-certify green.
   
   P5 — Your walk. The certified copy against the live source, your viewport, your beats. Exit: machine word and your eyes agree — Tier-1 declared.

Decided (red-pen any of these)

Your calls — all four ruled (round 1: the surface, 2:22 PM · round 2: chat)

What could go wrong (named, with the counter)

How we’ll know it worked

Depth — the gap inventory the phases trace to

Depth — how this plan was checked before it reached you