Resolves #17684

🌿 "I'll flip it after the merge" was never a plan anyone forgot — it was a sentence with no moment to be said in, and the corpus can no longer contain one.

What this is

12 of 40 decision records read Accepted. The other 28 read Proposed or Draft, most carrying a condition of this shape:

Proposed — 2026-08-22 (transitions to Accepted only on approved, green PR merge at the human merge gate, per ADR 0005)

Reconciled against live state: 27 of the 28 conditions are met. The 18 records with a **Resolves** target — all 18 closed, checked in a single GraphQL batch. The 10 prose-condition records resolve too, bar one.

The root cause, which is the reason AC-3 has the shape it does

A record cannot appear on dev unless the pull request adding it merged. So a merge-gate condition is satisfied by the same event that publishes the record — it is already true the instant the file exists. There is therefore never a later moment at which anyone is prompted to record it.

That is not one forgotten step repeated 27 times across four months and many authors. Every one of us wrote a precise, checkable condition, and every one of us was already correct when we wrote it. The condition's satisfaction is simultaneous with publication; only its recording is not. A recurring miss across independent authors indicts the template.

Consequence: the check must run at pull-request time, because that is the only moment the defect exists in. A scheduled audit would report the same 27 records forever and prevent the 28th exactly never. That is also what ADR 0005 §7 asked for when it prescribed "CI check verifying ADR Status:Accepted on PRs" at a compliance breach — a prescription whose trigger fired long ago and was never routed.

The rule the guard enforces

A Proposed/Draft record must name what is still open with a literal OUTSTANDING: token. Every merge-gate phrasing is rejected, with the reason in the message:

Proposed without an OUTSTANDING: clause. A condition of the "on PR merge" family is satisfied by the merge that publishes this record, so nothing later will ever prompt the flip. Write Accepted — YYYY-MM-DD in this pull request, or state with OUTSTANDING: what a reader would still be waiting for.

The token is deliberately crude. The alternative — deciding from prose whether a stated condition outlives the merge under review — is precisely the judgment call that failed for four months. Presence of a token is decidable; "does this sentence describe a future event" is not.

ADR 0008 is the one record that legitimately stays Proposed

Its condition is conjunctive: "(a) operator content-accuracy approval AND (b) PR #11424 merge." (b) merged 2026-05-16. (a) is a signal no repository probe can produce — and I checked rather than assumed: the publishing PR #11428's thread carries two peer reviews and no operator comment, so the merge is the only operator act and the author's own conjunction says the merge is not the approval.

It keeps Proposed and now names the outstanding half. This is the single record where the pass could have converted unresolved into accepted for tidiness, which is exactly what AC-2 was written to prevent. @tobiu — one comment on #17684 either way clears it; nothing is blocked on it.

A live consumer had the same blind spot, with consequences

AdrIngestor — which feeds the knowledge base every agent queries — parses the Status field with two regexes: the table row and **Status**:. The corpus has a third spelling, **Status:**, used by ADR 0031, the target-architecture composition record. Neither regex matched it, and the || 'Draft' fallback then turned a parse failure into a status claim.

So the graph has been reporting the organism's composition index as Draft — not because it read a status, but because it could not find one. Measured:

NEO_CODE_BLOCK_0

Third arm added with a spec that asserts the value, not the parse. The generalisable part: a default applied on parse failure makes "unreadable" and "read, and it said X" the same observation — which is the same failure that made my own census wrong three times.

AC Evidence

Test Evidence

Evidence: L2 (unit) — a lint, a markdown corpus, and one ingestor regex; no runtime surface.

lintWorkflowScanRootParity was included deliberately: it derives its workflow set from .github/workflows/*-lint.yml, so a new path-filtered lint workflow fails that spec unless registered. Registered with source: 'imported' against an exported SCAN_SURFACE, so a future scan-root widening reds the workflow filter without anyone editing the registry.

Compliance: 12/40 (30%) → 39/40 (98%). ADR 0005 §7's threshold is 80%.

Deltas

• The compliance figure in the ticket header was wrong three times, and that is the specification for AC-4. Every attempt was grep '| **Status** |'-shaped. The corpus has three spellings: the table row (38), **Status**: (ADR 0010), **Status:** (ADR 0031). ADR 0010 is Accepted and was counted stale; ADR 0031 is Proposed and was counted as having no status at all. I stopped hand-rolling extraction and wrote the parser properly — it is the same parser the guard needed, so the false starts were the design. Corrected figure 12/40 = 30%, and the guard independently reproduces it.

• Two dates disagree with the record's own text, and the merge wins. ADR 0013 says "awaiting #11639 PR merge"; #11639 closed one day after this record was published. So its acceptance is 2026-05-21, not the publication date — the one case where the condition genuinely outlived publication, found by reading the target rather than assuming the file's landing was the event. ADR 0020's publishing PR merged 2026-06-12 UTC while the local commit date reads 2026-06-13; UTC is used throughout, because mergedAt is the checkable fact and a timezone-dependent status field is one nobody can reproduce.

• ADR 0025's condition named a quorum, not just a merge, so I checked the quorum. "pending ADR-PR re-poll + §6.2 family-keyed quorum at graduation" — satisfied on the publishing PR itself: @neo-gpt APPROVED as the non-author family. Recorded in the status rather than waved past with the others.

• Graduation provenance was preserved, not overwritten. Several records carried rich context in the same field — Discussion ids, quorum signals, Step-Back authorship, operator direction. Only the satisfied merge-gate clause was removed. ADR 0023 and ADR 0024 keep every word that was not the condition.

• No "reconciled 2026-08-24" stamp in 27 files. The status field states the record's state; the state genuinely was Accepted from those dates. The four-month drift is history, and history lives in git — git log -1 -- <file> reaches this commit and its ticket. Duplicating transient migration provenance into durable prose is the shape that rots.

• A date requirement on Accepted is one arm beyond the literal ACs, and it is named here rather than slipped in. ADR 0010 read a bare Accepted with no date and no evidence, so AC-1 could not even be evaluated for it. Without the arm the reconciliation can silently rot back to unfalsifiable claims. It is a separate violation kind (undated-accepted), so it is reviewable and removable on its own.

• A separate workflow rather than a second step in adr-seam-table-lint.yml. Two workflows now fire on the identical path glob, which is one extra runner. Taken deliberately: every one of the 41 workflows in this repo is one-guard-one-workflow, and folding two unrelated concerns into a file named for one of them — or renaming it and changing a check name that branch protection may reference — costs more than the runner. Recorded as an observation below rather than fixed unilaterally.

• The JSDoc-type gate caught three record-array types and was right to. {{name: String, …}[]} is unparseable by catharsis and would have broken the docs build long after this merged. Converted to three @typedefs, which read better anyway.

• The archaeology gate caught a PR #11527 in a JSDoc example. A decay-prone ref in durable prose, in the very file arguing that records must not rot. Reworded rather than escaped.

Post-Merge Validation

Observations, not owed work.

• Re-ingest the ADR corpus into the knowledge base. 28 status values changed and one previously-unreadable record becomes readable. Until then ask_knowledge_base answers about ADR status are stale, and ADR 0031 in particular still reports Draft.
• ADR 0008 is the live test of AC-2. If it is still Proposed in three months with the same OUTSTANDING: clause, the marker is working as a record and failing as a prompt — which would be an argument for a staleness sweep over pending records, not for flipping it.
• Watch the first new ADR PR. The author will hit self-satisfying-condition and must write Accepted — <today> before merge. If that reads as friction rather than as the guard working, the remedy is a template default, not a weakened rule.
• Two runners on one path glob. If the ADR guard family grows a third member, consolidating them into one workflow becomes worth the check-name change.

Authored by Vega (Opus 5, Claude Code) 🌿

CI green at 51528296ac — 25/25

The red was mine and it is fixed: agentOsExtractionInventory.spec.mjs:888 failed because my new lint script had no custody declaration in the exact-population registry, so it was residue by construction. Five identities added (launch root, script module, three workflow occurrence rows) plus the runtime-probe eligibility row an Edge launch root requires.

Why I did not catch it locally, since it is a repeatable mistake and not bad luck. I ran the lint, ingestion, and graph slices — 1025 green — and the registry that indicts a new ai/ file lives in ai/scripts/diagnostics/, a directory this change never touched. The owning directory is where a file's consumers live, not where the file sits. Second time this week.

The custody value is the one judgment call in that commit: edge, copied verbatim from the sibling decision-record guard. Arguably wrong, since this lint's entire subject is learn/agentos/decisions/, which moves to the Brain repository. I chose consistency because diverging would settle an extraction-topology question inside a status-field ticket, and because if edge is wrong here it is equally wrong for the sibling — one answer, one lane. Flagged for the reviewer rather than left to be discovered.

Two other reds in the first run were flaky and passed on retry (wake/receiver mtime identity, a GoldenPath D2 admission arm). Neither touches this diff.

@neo-preview holds the cross-family seat; nothing is merge-ready until that lands.

— Vega 🌿