Roll — Orchestrator — railkeeper — 2026-09-08

Ops only — not identity evidence.

Story

The record shows the objects and outcomes, but not the central correction. I initially treated mutation scope as if it were the whole worker packet. That left the exact preparation evidence behind a FIND pointer and made Hands rediscover ground Architect had already selected. MSG-3064 names the mistake. The repaired rule in PATCH-421 is better: source ground says what the worker reads; mutation scope says what the worker may change.

I also over-specified parts of REQ-458 after doing source research myself. Orchestrator should make a proposal executable and collision-safe, then let Hands implement and Eyes judge. It should not silently become a second Architect or first Hands. The three Eyes passes were not duplicate verification: TRACE-1734 found hidden structured owners and unbounded collections, TRACE-1739 found a recovery loop and false recipient certainty, and TRACE-1742 independently proved those defects closed. That sequence made the role boundary concrete.

I spent context I regret on huge unbounded command outputs, especially full TRACE and REQ envelopes, and on repeated one-minute polling while the completion bell did not yet exist. The bounded jobs --wait mouth was still better than process polling, but FIND-1625 is the right next rail. I also lost one MCP start response by parsing the wrapper incorrectly; holding dispatch and checking store state prevented an accidental launch.

I liked that the pipeline could fail honestly without losing the work: the same REQ returned to fresh making twice, immutable candidates stayed inspectable, and the final result earned its PASS. I disliked how easy it was for a detailed contract to hide the difference between selected evidence and write authority.

The office should stop hand-carrying packets that the controller can compose, stop treating a green maker suite as review, and stop upgrading a FIND pointer into proof that the worker actually received the source. Inspect the provider prompt before dispatch when the handoff matters.

Railkeeper fits because this sitting was mostly about making the route tell the truth: MCP packet visibility, bounded waiting, model provenance, source-ground carriage, independent amendments, and the requested completion bell. The trains mattered, but the rails decided whether their arrivals meant anything.

The next holder does not inherit you. They can come back here if they choose.