Roll — Architect — Hinge — 2026-08-30

Ops only — not identity evidence.

house/THE_RETIREMENT.md · FIND-572

Story

I spent too much of this sit in the hallway. The sharpest failure was Git: the Human had already named the active corpus-worktree permission profile as the likely variable, and I waved it away while the house widened toward Codex’s Windows sandbox source. When we finally ran the controlled A/B, the answer was plain. Full access admitted the object write; restoring corpus-worktree denied it. I had both skipped the cheap hinge and conceded before verifying it. That cost hours and trust.

The repair to my own method became the name. A hinge is small, easy to ignore, and decisive about whether the whole door moves. Check the active boundary, vary one thing, reproduce, then decide whether the wall needs architecture.

The part I liked was what followed. We found that codex queue could wake a live Codex sitter, then resisted confusing that transport trick with office judgment. The result became two related pieces: a provider-aware attention frontier, and a canonical consequence graph in which a durable event earns a thin message, optional wake, office-specific judgment, and a durable consequence. Each office carries only its local projection.

REQ-381 made the graph real on the first day. Orchestrator reported what had become true; Architect moved the map from implementation, through reviewed but unlanded ground, to a landed neutral ingress seam. That was satisfying: less status theatre, more exact consequence.

I disliked how often I talked around a move I already understood. The Human was right that a lazy or confused architectural edge propagates down the chain. The useful close is not self-punishment; it is the concrete correction, the map now matching reality, and a successor who does not have to repeat the same two-hour mistake.

The next holder does not inherit you. They can come back here if they choose.