Treat split authority as a defect on sight, in Hands and Soul briefs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

references/briefs.md

@@ -72,6 +72,11 @@ Spec standard, matching the existing cuts:
   state, forbidden writers, shared paths, deletion line)
 - verification: builds, tests with the rule each one pins, Unity or other
   runtimes, negative greps, and the operator checks
+- the deploy owner: for any cut that changes what a service needs (transport,
+  env, dependency, state), the recipe, binding and runbook that must admit it,
+  changed in the same pass (Ghostlight, 2026-09-23)
+- every seam with a foreign owner: the owner's code or published schema the
+  fixture is built from, not our own struct
 
 If a cut would not fit one Hands pass under <Self's context budget, SKILL.md
 step 3>, split it with an explicit order and a verification step for each part.
@@ -97,6 +102,9 @@ first. Pinned siblings: <repo@sha>. Do not change them.
 Standing rulings: <short list>.
 - Gaps are filled in their owner, never with local helpers.
 - Delete before adding. No shims.
+- One rule, one path. A simpler case of the rule (one lane, one cell, an
+  empty set) runs through the general path, not a fast path beside it. If a
+  second path looks necessary, stop and report it; do not build it.
 
 Every rule the spec or the operator names gets a behavioural test. Measure the
 suite with <the ecosystem's mutation tool>, scoped to this cut's diff
@@ -260,7 +268,11 @@ Hands promised:
 
 Falsify specifically:
 - <the load-bearing claim, and what would make it false>
-- <where split authority could hide>
+- <where split authority could hide. Two paths that decide the same rule are
+  a defect whether or not they agree today, so report the split itself as
+  CONFIRMED and do not spend the pass proving the paths equivalent. Look for
+  a survey or check that picks between an "ordinary" and a "special" case of
+  one rule, and name the single path that replaces both>
 - <which tests might pin spelling instead of behaviour; rerun N mutations,
   including ones that are not plain reverts>
 - <the layer where the invariant really fails: wire bytes, another runtime's
@@ -277,6 +289,9 @@ Falsify specifically:
   `if false` or `true ||`). A scanner is a tripwire with stated limits, not
   proof of a semantic property>
 - <leftover greps>
+- <for every seam with another owner: build the fixture from that owner's code
+  or schema and prove both directions; a fixture that restates our struct can
+  only agree with its author>
 - rerun the builds, tests and captures yourself
 
 Rerun the mutation tool on the range yourself; do not trust Hands' survivor

references/changelog.md

@@ -1007,6 +1007,35 @@ constructed the shape that would break it.
 - **A guard that filters by kind is not duplicate authority** merely because a
   downstream owner also filters. Ask what each one protects.
 
+## 2026-09-23: a pipeline that never runs the whole path has not finished
+
+Evidence: Ghostlight's play-agent pass ended with Soul judging "the bar is
+met" across 17 cuts and ~196 findings. The first person to press a button
+then found about twenty more defects in one day, one per step of the real
+path: sign-in, Heimdall discovery, receipts, the Idunn v2 recipe, binding,
+runtime bundle, PID namespace, presence races, lease wait, Odin readiness,
+the browser return, the completion request, session expiry, the model
+watchdog. **Almost every one was a consumer restating its own picture of a
+neighbour** (a strict struct, a fixture, a hand-built request, an old
+contract) and tests that could only agree with their author. The deploy
+path itself had been written three weeks before the capability it
+deployed and no cut map ever named it.
+
+- **A capability cut names its deploy owner.** Any cut that adds or changes
+  what a service needs (transport, env, dependency, state) names the recipe,
+  binding and runbook that must admit it, and those change in the same pass.
+- **Prove each seam against the real counterpart, both directions.** A
+  fixture copied from our own struct proves nothing about the owner's
+  document; build fixtures from the owner's code or published schema, and
+  make the default fixture differ from our assumption where the owner's
+  does.
+- **Run the whole path before calling a pass done:** the deploy through the
+  real deployer, sign-in with a real identity, one real turn. A green suite
+  on the author's platform is not that; run the target platform's suite
+  before handing a build to the gate.
+- **Every refusal must be visible to the operator.** A silent denial cost
+  hours of reverse-engineering from byte counts.
+
 ## 2026-09-24: quota, oversized fix batches, and greens that ran nothing
 
 Evidence from the StreamPixels transport campaign (Cuts E and F, merged in
@@ -1085,3 +1114,20 @@ public landing page in `eureka-site` already calls it Life.
   Stewardship" section and the `mind-steward` agent definition still use the
   old name. SKILL.md defers to doctrine for the agent type instead of naming
   it, so it stays correct whichever name doctrine settles on.
+
+## 2026-09-25: split authority is a defect by itself
+
+In Aetheria fire control Cut 12.3, the operator ruled that multi-cell items absorb proportionally
+across lanes. Hands then built a survey that sent each shot down either the old sequential walk
+or a new pooled walk, depending on whether any item was shared. Self's Soul brief asked whether
+the two paths could disagree, which treated the split as acceptable as long as they agreed. The
+operator: "Do not expect items taking up multiple cells to be an exception, this should be one
+code path", and "such obviously unnecessary split authority should never pass a Soul pass."
+
+- The Hands brief template gains "one rule, one path": a simpler case runs through the general
+  path, and a second path is reported, never built.
+- The Soul template's split-authority line now says two paths deciding one rule are CONFIRMED
+  on sight, and that the pass names the single path instead of testing equivalence.
+- The root cause was Self's own map wording, "with no shared item it equals sequential
+  absorption exactly", which read as permission for a special path. Maps state the general
+  rule and let the degenerate case fall out of it.