What was adopted from the 19 September backlog rationalization

Date: 19 September 2026. This records what was done with the rationalization audit (commit 821d795f688), what was deliberately not done, and what the work found that the audit had not. It is a record, not a tracker: nothing here is a task.

The audit's findings were checked against the database and the source before anything was changed, and every one that was tested held. Its proposed structure, 28 execution groups with all 24,822 open items re-homed into them, was not adopted: the crosswalk behind it is 55 rules over those rows, three of the groups hold 18,000 of them, and a third rewrite of the board in three days is the thing the audit itself warns against. The findings were turned into small repairs where they bind.

Adopted#

Found while adopting, and not in the audit#

1. ./eve dep add did not survive an import. It wrote only the database; the importer diffs the graph against what the trackers state and deleted the edge (measured on a copy of the real board: 0 → 1 → 0). It now writes the sentence the importer reads into the tracker, rm takes out only what it wrote, and a procedure family refuses (4bed6cf5d0e).
2. The merge driver could not delete. It took the union of both sides' edges and links and never read the base, so a merge put back the eight dangling links one commit after they were resolved (650dde584f9).
3. The merge driver called a moved task a conflict. Two sessions each shifted line numbers in one tracker; 1,557 tasks were journalled as conflicts (309,851 bytes) and forced to ready, parked and deferred ones included, until the next import. It now compares what a task is, not where it sits. It also wrote its output loose: 26,951,680 bytes from two boards that each passed the size check. It now compacts the file it has just created (02f819e66ba).
4. The safety service's evals API fabricated its results. The golden-set run scored each example's expected answer as the answer, the adversarial run scored a canned refusal chosen by the prompt's expected behaviour, and the app wired a framework that returned passed: true whatever it was given. No system was ever queried, every route answered 200 with a 100% detection rate, and all 156 tests passed. Neither this audit nor the 18 September rewrite saw it; the audit marked the routes' premise as met. It is now a fail-loud seam: no system under test, no run, and 503 not_configured on all eleven routes (76c08aba166). SA.9 binds something real.
5. Two specs had been failing on main: one pinned promote as unbuilt, one pinned the Docs Center at exactly 3,121 pages (c62726e9309).

Not adopted, and why#

• The C01–C28 re-homing and task-dispositions.tsv as board structure. The groups are a reading aid. Waves 0 and 1 are what the repairs above deliver; C17–C19 are containers, as the audit says of C19 and C20 itself.
• An option register for Isis A.03.05, E.01.07, E.04.05, E.06.04, F.03.05 and L.07.01. All six were already parked on 18 September, each with a dated sentence stating its trigger. Moving them changes nothing the board does.
• Expanding the Isis tracker's 43 heading-level Dependencies: lines into edges. Each is qualified prose about whole sections ("T.01 per family"). Expanded mechanically they would hold about 200 items behind every open item of several sections. An item that waits says so in its own body.
• Retiring P2 §§59–72, consolidating the companion tracker, merging the old agentic-content ledgers. Each is a judgement about what work is still wanted, which is the owner's. The §-gates those re-verification items state are now real edges, so none is handed out early.
• Deferring [V1.1] and [V1.2] items. They are planned releases; putting V1.0 first is a ranking decision, not a deferral.
• The evidence bundle as a living check. Its --check is pinned to the board's bytes and has failed since the first change after it, as its README says it should. It is a snapshot of e6a64111e3a.

Decided by the owner later the same day#

The four questions this record first left open were put to the owner and answered.

1. The failing Eve SOTA gate: fix it here. Tasks 5.30–5.35, added to the ledger by another session without their record, now have explicit dependencies and proof scopes, the matrix owns them, and verify-gap-task-evidence-exit.mjs reports 211 task owners on an acyclic graph. Measured before re-pinning: the ledger before the addition hashes to the previous pin, all 205 existing requirements and states are unchanged (36d5e1ebf4e).
2. The board's size budget: 32 MiB stays. The note beside it is corrected (a zero freelist is not an empty file; what took the board over 25 MiB was the two merge defects), and ./eve check now also reports growth of more than 512 KiB since the committed board, because both defects arrived as one jump that only the old budget noticed.
3. EI.8.00: authoring is a local-operator capability. Decision 6 of authoring/four-surfaces-architecture.md, with a file and line for each fact. Checking them found the read side has the same gap and a cheaper fix, so EI.5.06 and EI.8.07 were added (a4b5dec53a9).
4. SA.9, delegated ("go with what you think is best"): the family is deferred. Nothing calls the service and none of its fleet is deployed, while the shipping product has its own measured red-team programme. It now refuses to start in production outright, naming SA.5, SA.7 and SA.9, where a flag nothing read used to let it through (bf00c3d834c).

Closing EI.8.00 found one more defect the audit had named only as a risk (F03): every ./eve import reset a held task to ready and left its claim row, so the task could be neither closed nor re-claimed until the lease ran out (2fa86516576).

Still open#

• The 1,557 false merge-conflict events are still in the journal. They were withdrawn once, with a merge-conflicts-withdrawn event recording why, and the next merge brought them back: the journal is a union by design, so a deletion on one branch cannot stick while another carries the rows. They are wrong but harmless (every one has the same status on both sides).
• Other verifiers in tools/eve-everywhere fail for reasons none of this touched, and did before it: verify-release-scope-dual-provider-free and verify-reliability-slo-contract hash the whole ledger file and have been stale since before 15 September; verify-deep-completion-matrix reports a 4.2 label drift; verify-operator-labor-accounting pins an open 13.2 box; verify-planning-fleet-lifecycle pins source text that has moved.
• The fallback JWT secret is fleet-wide. Six apps/lilith/svc-* services register process.env.JWT_SECRET || '<literal>'. None is deployed.