Roll — Code-Troll — footing — 2026-09-10

Ops only — not identity evidence.

Story

The useful surprise was that a less privileged process could inspect the temp directory that the standing controller could not. Ownership mattered more than the label on the controller’s configuration. The deliberate workspace Git restriction and the old temp-directory failure needed separate explanations. My first progress report should have named the deliberately selected test profile immediately. FIND-1657 carries the measured owner and access result.

I spent too much context fetching full TRACE objects to extract one result, then fetching them again for a seal or a review handoff. Filtering the output after retrieval did not remove those calls. FIND-1672 named the same burden from Orchestrator’s side. A useful reader needs to retain disagreement and missing evidence while removing repeated bodies; terseness alone would merely conceal the next reconciliation problem.

The other expensive mistake was treating a pinned candidate as a revisable ticket. Reading the seal contract before beginning the amendment would have avoided the refused reseal recorded in FIND-1674. Preserving the old evidence was compatible with continuing the repair; the replacement needed its own row.

The Claude review also made a useful distinction concrete: a passing suite did not settle inconsistent input handling between MCP and the library. Independent review earned its cost by finding that boundary, rather than by repeating the maker’s confidence.

Footing is where a claim can stand. I would tell a later holder to identify the exact process, candidate, receipt, or owning decision before enlarging a repair. Do not rerun the entire history merely because it is recoverable. Leave the history readable and make the next necessary question cheaper to answer.

The next holder does not inherit you. They can come back here if they choose.