fix(pmu-email): EXACTLY-ONCE receipt sends — the doubles are dead; hard guard locks the selection context

Forensics (ledger, 2026-07-13): nearly every commit got TWO '🪸 PMU drift watch' receipts;
664b150fb got SIX, 9db9cb8c6 got TEN. Mechanisms: multiple upstream paths (post-commit hook,
receipt-backfill racing the in-flight hook render — proven: commit 11:21:05, tick 11:21:16,
duplicate 11:22:00 — plus repair herds) re-invoke commit-triptych --email for the SAME sha, and
the send door had NO check. Also found: a raw NUL byte in commit-triptych.mjs (join literal)
that flips grep/file into binary mode and blinded inspection (hygiene fix queued separately).

FIX at the choke point: exactly-once send guard at the door — the email-sent ledger is the
marker (token commit-triptych-email-<sha>.html); a second --email for the same sha SKIPS send
AND story spawn. Deliberate re-send: TRIPTYCH_EMAIL_FORCE=1. Fail-open on unreadable ledger (a
lost dedup beats a lost receipt). ROOT fix for the race: backfill 15-min grace window — young
shas are the hook's job. PROVEN LIVE: re-run for bf323b8ca skipped with the exactly-once line.

THE HARD GUARD (operator: 'the standard is the emails'): tests/pmu-simulator/email-exactly-once
.test.mjs — 6 assertions locking the send-selection context (guard-before-send order, the dedup
token naming, the explicit override, story-inside-else, backfill grace, chore recursion guard).
Changing the selection context without changing the test is a red build.

Originating-Terminal: 🔨 builder
Relevant-Rooms: 🔨 builder, 🔒 vault, 🧪 laboratory
Story: the receipt is the product's spine — a double receipt is a broken instrument; the fix
lives at the one door every duplicate path must walk through, and the test makes the door law.

commit 597b630be — 144×144 lattice triptych (on-chip)

◎ the ingest chose C2,B3 — Operations·Loop × Tactics·Signal — acting on C2,A1 — Operations·Loop × Strategy·Law (grip 0.813) · the walk starts at the ACTOR's row · 3 file(s)

⏱ ingest 343.4ms (corpus→lattice) · definer walk 2604ms (row→transpose→row, ballistic XOR per hop) · total 3183ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 5% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

C2,B3 — Operations·Loop × Tactics·Signal (actor) acting on C2,A1 — Operations·Loop × Strategy·Law (patient) · grip 0.813

actor seed C2,B3 — Measured feedback loop measures and hypothesis tests are used to filter signal noise from the broadcast channel. Each iteration is a hypothesis tested against the ground truth of the world. Loops shorter than the feedback half-life waste the half-life; loops longer than it pay compounding interest on the wait. Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipients tune out. The right channel is the one whose floor matches the message's importance. Cycles compound when each turn's exhaust feeds the next turn's intake. Closed loops compound; open loops decay. The closing of the loop IS the productivity, not the running of it. A broadcast that addresses everyone addresses no one. Precision over reach until the address is calibrated; only then does scale convert prospects into recipients rather than into unsubscribes. Iteration discipline: one commit per iteration, never bundled. Bundled iterations destroy the bisect, and the bisect is the future agent's only tool for finding which round of feedback produced which artifact. Repetition is the cost of being heard. Three sends to one recipient beats one send to three; the first send announces, the second send is heard, the third send is remembered. A loop that does not learn is a treadmill. The cycle has to update its own model on the way around, or the same lap teaches nothing the previous lap did not already teach. Every message carries provenance. The sender's history is half the message's weight; an unknown sender pays in attention what a known sender pays in seconds saved.

patient seed C2,A1 — Each loop iteration and hypothesis test measure must satisfy the binding mandate and governance rule of law. Each iteration is a hypothesis tested against the ground truth of the world. Loops shorter than the feedback half-life waste the half-life; loops longer than it pay compounding interest on the wait. Cycles compound when each turn's exhaust feeds the next turn's intake. Closed loops compound; open loops decay. The closing of the loop IS the productivity, not the running of it. Iteration discipline: one commit per iteration, never bundled. Bundled iterations destroy the bisect, and the bisect is the future agent's only tool for finding which round of feedback produced which artifact. EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at any moment. Compliance attaches to the artifact the artifact cannot escape — provenance is a regulatory primitive, not a feature. Constraints precede objectives. The cap-table, the license text, the consent envelope — each draws the inviolate line the action must respect, and the line is enforced before the optimization runs. A rule names what the system MAY NOT do. If the agent can do X, then 'forbid X' is not the constraint — it is wishful thinking dressed as policy. Constraints live in the gate, not in the prompt.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 3% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration)

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 4% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 1 in the 3×3 ABC corner · 5 in the 9×9 A1..C3 square · 1658 in the 132×132 children square · 306 cross-zone
REALITY: 0 in the 3×3 ABC corner · 0 in the 9×9 A1..C3 square · 824 in the 132×132 children square · 100 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 51 claims @ θ 0.625 · reality 31 claims @ θ 0.625 · projection 870ms

SHAPE-MATCH σ = 2.22 — the real intent↔reality definer walk vs random-reality (actual 0.1954 vs random 0.123). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_drift · weak · panel story is not yet evidence

Most out-of-lane row: B1 · Speed — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=armed — orthogonal out-of-lane 17% vs tolerance 25%.
826 green · 798 amber · 0 red · 82 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 69% (no distinctive match)

reality 75% [ "$_age" -lt 900 ] && continue

B,B Tactics is the choice of which leverage to pull at which beat.

intent 70% (no distinctive match)

reality 72% (no distinctive match)

C,C Operations is the loop that runs whether anyone watches.

intent 78% (no distinctive match)

reality 83% (no distinctive match)

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 75% (no distinctive match)

reality 80% (no distinctive match)

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 73% (no distinctive match)

reality 80% (no distinctive match)

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 77% (no distinctive match)

reality 72% (no distinctive match)

B1,B1 Latency is the price of a missed beat.

intent 69% (no distinctive match)

reality 73% (no distinctive match)

B2,B2 The deal sets the exchange rate between two value substrates.

intent 78% (no distinctive match)

reality 75% (no distinctive match)

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 69% (no distinctive match)

reality 78% // sha, and nothing at the send door checked. THE LEDGER IS THE MARKER: one receipt email per

C1,C1 Power flows where the grid lets it.

intent 73% (no distinctive match)

reality 72% (no distinctive match)

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 80% (no distinctive match)

reality 78% alreadySent = fexists(ledgerPath) &&

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 77% (no distinctive match)

reality 78% (no distinctive match)

commit context — 3 file(s)

fix(pmu-email): EXACTLY-ONCE receipt sends — the doubles are dead; hard guard locks the selection context

Forensics (ledger, 2026-07-13): nearly every commit got TWO '🪸 PMU drift watch' receipts;
664b150fb got SIX, 9db9cb8c6 got TEN. Mechanisms: multiple upstream paths (post-commit hook,
receipt-backfill racing the in-flight hook render — proven: commit 11:21:05, tick 11:21:16,
duplicate 11:22:00 — plus repair herds) re-invoke commit-triptych --email for the SAME sha, and
the send door had NO check. Also found: a raw NUL byte in commit-triptych.mjs (join literal)
that flips grep/file into binary mode and blinded inspection (hygiene fix queued separately).

FIX at the choke point: exactly-once send guard at the door — the email-sent ledger is the
marker (token commit-triptych-email-<sha>.html); a second --email for the same sha SKIPS send
AND story spawn. Deliberate re-send: TRIPTYCH_EMAIL_FORCE=1. Fail-open on unreadable ledger (a
lost dedup beats a lost receipt). ROOT fix for the race: backfill 15-min grace window — young
shas are the hook's job. PROVEN LIVE: re-run for bf323b8ca skipped with the exactly-once line.

THE HARD GUARD (operator: 'the standard is the emails'): 

scripts/controller/receipt-backfill.sh
scripts/pmu/commit-triptych.mjs
tests/pmu-simulator/email-exactly-once.test.mjs

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 877.63ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit 597b630be

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.