Feature ledger

This document is local, and it cites 15 paths that only exist beside it — every dev-docs/… reference below, the dev-docs/artifacts/*.png captures offered as evidence, and docs/design/circle/ with the wire and relationships notes. That is fine while nobody outside this machine reads it, and it is the first thing to deal with if that changes: publishing this file was set up on 2026-09-09 and abandoned the same day, uncommitted, and those fifteen dead links were one of the two reasons it is not a one-line change.

⚠️ pnpm features:check NO LONGER EXISTS, AND pnpm ledger:check REPLACED IT ON 2026-09-10. The old gate read both ledgers and checked that every path in the Where column named a file that exists. Both ledgers moved into dev-docs/, which is gitignored whole, so it had no input on a clean checkout and was removed rather than made conditional on an untracked path. For five weeks nothing replaced it, and the 2026-09-10 audit is what that cost: eight findings, of which one was a whole surface of fifteen shipped settings with no row.

pnpm ledger:check asks three questions — every Where claim resolves, every State cell is one of the five, and every registry name the app declares is written in some inventory row. The third is new and is the one that catches a surface nobody described. ⚠️ IT STILL CANNOT BIND A CLONE. On a checkout without dev-docs/ it skips, and says so in one loud line naming the gitignore rule; pnpm ledger:check --require turns that skip into a failure. It guards the machine where the ledger is written, which is where every one of the eight findings was introduced, and that is all it guards.

How to write a Where cell

core/… and ui/… are kernel-relative and resolve under src/kernel/. Everything else is written from the repository root, including every capability path: src/capabilities/circle/lib/covers.ts, not lib/covers.ts.

⚠️ THE SHORT FORM WAS TRIED FOR THE CIRCLE AND PUBLIC SECTIONS AND IT BROKE THE COLUMN. Fifty-nine of 312 claims stopped resolving, because a bare lib/… and a capability-local ui/… collide with the kernel's own prefix — so ui/CirclePane.tsx pointed at src/kernel/ui/CirclePane.tsx, which does not exist. Three were ambiguous to a person, not only to a checker: lib/covers.ts, lib/crypto.ts and lib/overlay.ts each named two real files in different capabilities. A section-scoped root was considered and rejected — it makes a path mean different things depending on the heading above it, so moving a row silently changes its claim. The verbosity is the point: this column is read by somebody deciding where to look.

Two jobs, one document.

1. Inspect one by one. Part 1 is every capability Paper claims, what state it is actually in, where it lives, and how to confirm it in a running app. It is written to be walked top to bottom with the app open.
2. Find the gaps. Parts 2 and 3 put Paper beside ten other readers and say plainly what is missing, what is deliberately absent, and what nobody else has.

State means one of five things, and the distinction is the point of the document:

A stub is not a feature. Where this ledger says stub, the app should not be described as having the thing.

Re-audited 2026-08-21 against the working tree, row by row. Eleven rows had drifted — nine understated a shipped feature, and every path in the file predated the kernel carve. What changed, and why the drift happened at all, is in "The 2026-08-21 re-audit" at the end.

Re-audited again 2026-08-23, after the service-table merge, for the two phases that landed in between. Seven rows added, two corrections where this document contradicted itself, and three rows moved out of a table whose heading had stopped describing them. See "The 2026-08-23 re-audit".

And once more after phase 15, the companion runtime. That phase updated its own rows as it landed — which is the practice this document wants — so this pass was for what a phase cannot see about itself: a name it collided with, a row elsewhere its work made stale, and a matrix cell nobody owns. See "After phase 15".

Re-audited 2026-09-05, at 0.2.0. Five days, three phases and three releases, and this document had three whole surfaces with no row at all: the circle, the phone and the browser client. It is the largest gap any pass has found — not a row that drifted, three sections that were never written. Thirty-one rows added. Seven existing rows had gone stale with them, one of them announcing a user-visible regression that had since been reversed, and four paragraphs of Part 4 were arguing from rows that had changed under them. See "The 2026-09-05 re-audit".

And a narrow pass on 2026-09-06, at 0.2.1. Not an inventory sweep — one row, and it is the Sync row. Five commits landed after the 09-05 pass and four of them are test and harness work that changes no capability; the fifth (2022ef7) removed the reason WI-8.6 was recorded Partial. What this pass actually did was read the sync source against the Stage B transcript the row had just been given, and two of that transcript's three headline observations turned out to measure nothing. See "The 2026-09-06 pass".

And a pass on 2026-09-09, at 0.3.0. Forty-three commits, one merge — the audit of every deferred finding, and then three evenings on a pairing that did not work. Two rows changed and both were wrong in the same direction: they claimed more than had been observed. Admission: two shelves pair said Shipped over a capability that failed three times in four for any real reader, with twenty green protocol tests over it; The circle, end to end held both "Both DIRECTIONS are proved" and "the far end has never published" in one cell, three sentences apart. See "The 2026-09-09 pass".

And a pass on 2026-09-10, at 0.3.1. The largest gap since the 09-05 sweep, and the same shape: two whole surfaces with no row at all. Phases 25 and 26 had landed the day before — twenty work items, two ALPNs, a second signing key, a global index — and this document had not one row for any of it. Twenty-one rows added, under a new heading. Two existing rows had gone stale under them, one of which had begun contradicting a row that did not exist yet. See "The 2026-09-10 pass".

Part 1 — What Paper has

Reading surface

Annotation

Cards

⚠️ HIDDEN FROM ORDINARY READERS ON THE DESKTOP SINCE 2026-08-30. The kernel's side pane is behind developer options (⌘⌃⌥D) — see Developer options in Shell. The panel is drawn and does not yet answer what it promises, which is the property UNFINISHED_PANE_IDS names. State below still describes what the CODE does, because that is what this column has always meant; what changed is who is shown it. ⚠️ AND THIS SAID "EVERY ROW IN THIS SECTION IS BEHIND ⌘⌃⌥D" UNTIL 2026-09-11, WHICH IS FALSE ON TWO OF THE THREE SHELLS THIS DOCUMENT DESCRIBES. UNFINISHED_PANE_IDS is read by paneOffered, and paneOffered is a rule about the desktop RAIL. Neither src/app/mobile/ nor src/main.web.tsx mentions it, paneFits or developer at all — both mount TabBar, whose TABS is a literal four, and Cards is the third of them on every phone and in every browser client, permanently, with no chord to find. MobileApp.tsx renders the same ui/pane/Cards the desktop hides, out of kernel/ui/mobile; main.web.tsx renders it out of kernel/ui/browser and its own comment names the tabs "Library · Reading · Cards · You". The phone row in Other surfaces has said Four tabs — Library, Reading, Cards, Settings the whole time, so this document has held both readings since 2026-08-30 and nothing put them beside each other. ⚠️ AND THE CONSEQUENCE IS LARGER THAN THIS SECTION. AGENTS.md says removing an id from UNFINISHED_PANE_IDS "is the only edit required, because the rail, the palette, the digit accelerators and the Settings band all read one rule" — four surfaces, all of them the desktop's. Two shells read none of it. Shipping an unfinished panel is therefore not one edit and never was, and the reverse — hiding one — does not reach a phone.

Navigation and library

Reading aids

Companion

⚠️ THE PANEL IS HIDDEN FROM ORDINARY READERS SINCE 2026-08-30 — THE SECTION IS NOT. ui/pane/Companion.tsx is behind developer options (⌘⌃⌥D), because it is drawn and does not yet answer what it promises, which is the property UNFINISHED_PANE_IDS names. State below still describes what the CODE does, because that is what this column has always meant; what changed is who is shown the panel. ⚠️ THIS SAID "EVERY ROW IN THIS SECTION IS BEHIND ⌘⌃⌥D" UNTIL 2026-09-11, AND IT IS FALSE OF HALF THE ROWS — INCLUDING THE ONE A READER USES MOST. Five of the ten below are reachable by anybody who opens the app: | Row | Where an ordinary reader meets it | |---|---| | The gloss | The selection bar's Look up — its own cell says "it is now the whole of Look up on every platform", and Look up is a Shipped row in Reading aids | | Local inference runtime | Settings → Local models | | Cloud endpoints | Settings → Cloud endpoints | | Faster / More thorough | Settings → Companion → Effort | | Read aloud, neural voice | Test voice, inside Settings → Local models | A capability's settings SECTION is not gated at all: Settings.tsx maps composition.settings into the The app band with no developer test anywhere near it — the only gate in that file is on the Developer band below it. So companion:provider, inference:models and inference:endpoints have been in front of every reader since they were contributed. UNFINISHED_PANE_IDS hides a PANE; it has never hidden a settings section, a selection-bar button or a Rust command.

The circle

Composed on the desktop and offered to ordinary readers — it is not behind ⌘⌃⌥D, unlike Companion and Cards. composition.desktop.ts is [peer, sync, inference, companion, circle, publicSharing, webhost]; iOS and Android are [peer, sync, publicSharing] and the browser client composes nothing, so every row here is desktop-only. (Both lists gained publicSharing on 2026-09-09 and this note did not say so until 09-10 — the public layer has a section of its own below, and it is NOT desktop-only.) This whole section is new on 2026-09-05 and had no row before it. The design is in docs/design/circle/ — seven files, of which review.md is an adversarial pass that returned 28 objections and gated the whole of it until each was answered. ⚠️ THIS PARAGRAPH SAID THAT DESIGN WAS TRACKED UNTIL 2026-09-10, AND IT IS NOT. .gitignore line 71 ignores docs/, added by bd9c775 on 2026-09-04, and git ls-files docs/ returns nothing. wire.md and identity.md reach no clone, and the code comments that point at them name files which exist only on the machine that keeps them. ⚠️ AND .gitignore'S OWN ACCOUNT OF HOW THAT HAPPENED DOES NOT MATCH THIS HISTORY. Its comment says the circle's design "was tracked here for three commits and taken out of the index in the commit that added this line". bd9c775 changed .gitignore and nothing else — six insertions, one file — and git log --all --name-status -- docs/ returns no commit at all, so nothing under docs/ is tracked in the history this clone has. The likeliest reading is that those three commits went the way the gesture checklist did, in the history rewrite .gitignore records four lines above; that is a reading and not a measurement, and it is written here as one. ⚠️ AND THE FALSITY WAS LOAD-BEARING, WHICH IS WHY THIS IS NOT A TYPO. The sentence's whole purpose was to say these documents survive where dev-docs/ does not. The reason it gave — a key hierarchy is fixed the moment the first key is minted, and a wire format the moment a reader has data in it — is a genuine argument for tracking them, and nothing acts on it. It is left standing here as an argument rather than deleted, and it is a decision for the owner on its own terms; a documentation fix is not the place to reverse .gitignore line 71.

The public layer

Composed on every platform that has a peer — composition.desktop.ts, composition.android.ts and composition.ios.ts all list publicSharing, and the browser client composes nothing. It is offered to ordinary readers and is not behind ⌘⌃⌥D. This whole section is new on 2026-09-10 and had no row before it. Phases 25 and 26 landed on 2026-09-09 — twenty work items, two ALPNs, a second signing key and a global index — and this document did not have a single row for any of it. The plans are dev-docs/plans/phase-25-global-sharing.md and dev-docs/plans/phase-26-public-annotations.md. ⚠️ THE CIRCLE AND THIS ARE OPPOSITE DEFAULTS AND SHARE NO AUTHORIZATION. The circle denies unless a person was admitted; this allows unless a voice is blocked. They ride two endpoints on two keys, and a single predicate serving both is where the wrong default would be invisible. ✅ IT CROSSED ON 2026-09-11. Eight public records published on this Mac were fetched by mbp16 and written into its own copy of the book, with the DHT off on both ends. scripts/public-scenario.sh runs it unattended — 15 steps — and --falsify stops the far app and proves the converge step can fail. Transcripts: dev-docs/artifacts/public-scenario-crossed.log and …-falsify.log. ⚠️ AND THE RUN FOUND THE DEFECT THAT MADE THE WHOLE DISPLAY HALF UNREACHABLE. writePublic writes books/<id>/public.jsonl, and the public capability had no entry in REVIEWED_WRITES — so every single record was refused by the namespace guard with "capability \"public\" may only writeAtomic under \"public/\"". The records arrived, the fetch reported them, the store stayed empty, and the pane printed the refusal as a trouble line nobody was reading. publicStore.test.ts supplies its own fs and share/acceptance.rs runs in one process, so neither goes through scopeFs and neither could see it. This is the third time a harness's first run produced a real defect — sync's satchel that never retried, the circle's 'muted' with no writer, and now this.

Shell

Other surfaces

Paper is three front ends over one kernel, and until 2026-09-05 this ledger described only the first. Each has its own HTML entry and its own composition root: index.html → src/main.tsx → App (the desktop shell), index.mobile.html → src/main.mobile.tsx → MobileApp (the phone), and index.web.html → src/main.web.tsx (the browser client). vite.config.ts picks between the first two from TAURI_ENV_PLATFORM.

Data

Part 2 — The comparators

● has it ◐ partial ○ lacks it ◍ stub – not applicable

Part 3 — The gap matrix

Table stakes Paper is missing

⚠️ AND OF THE TWO LEFT, ONE IS A POSITION. Translation is declared in Part 4 as deliberate absence — a provider, a network dependency and a bill, for something a reader can do in another window. So reading statistics is the last genuine table-stakes gap Paper has, and it is stated here rather than left for a reader to work out by subtracting. Nothing records a session; the missing piece is a session store, which is a phase and not a work item.

Cross-device sync left this table on 2026-09-10, and it was three days late. It carried ◐ while Part 1's Data section had said Sync | Shipped since the two-machine convergence ran green on 2026-09-06 — 22 steps, 0 failures, both directions, transcript in dev-docs/plans/evidence/. Removed on the 2026-08-23 rule below rather than flipped to ●, because a row where Paper is filled is not a row Paper is missing.

Closed since the last audit: reading position restored, reopenable library, multiple highlight colours and dictionary lookup were all rows in this table and are now shipped. Bookmarks left it earlier.

Closed 2026-08-21, removed from this table 2026-08-23: annotation export, the footnote popover and back-after-a-jump all shipped the day this matrix was built, and were left in it carrying a ● — a row where Paper is filled is not a row Paper is missing, and a heading that does not describe its own rows is how a reader stops trusting the rest of them. Their capability rows are in Part 1.

Contested — real features, but not universal

AI assistance moved from ◍ to ● on 2026-08-23. It was a stub — a provider interface and a refusal — and phase 15 built the thing behind it. Worth saying what kind of ● it is, because the column does not carry it: Paper's runs LOCALLY by default, and the answer's citations are resolved by Paper against passages it numbered rather than trusted from the model. Of the two others with a mark here, one is a cloud service. Provenance mark for machine-written text below stays ◍ deliberately: the kind, the tint and the reserved style exist and nothing produces one yet.

⚠️ AND THAT JUSTIFICATION NOW ARGUES FROM A SURFACE NO READER CAN OPEN, NOTED 2026-09-11. "The answer's citations are resolved by Paper against passages it numbered" is the COMPANION, and the Companion panel went behind ⌘⌃⌥D on 2026-08-30 — seven days after this ● was placed, and the sentence was never re-read. The cell itself survives on a different foot: the gloss is AI over the text, it runs locally, and it is offered to every reader as Look up on the selection bar. So ● is right and its stated reason is not what a reader would meet. Kept rather than rewritten to ◐, because the mark is about what the app does and the paragraph is about why — and this is the second note in Part 3 to have gone on arguing from a state that moved under it.

What Paper has that most do not

The circle's row, added 2026-09-05, and what its cells do and do not say.

~~Paper's own cell is ◐ and not ● for one reason: the two-machine run has never happened. The code is complete and the design is answered; nobody has watched a passage cross.~~

⚠️ STRUCK 2026-09-11: EVERY CLAUSE OF THAT WAS VOID, AND HAD BEEN FOR FOUR DAYS. The passage crossed on 2026-09-07, both directions were proved on 09-08, and Part 4's own chain says so twice. Part 1's row was corrected the same week; this note was not, because the 09-10 pass declared outright that "Parts 2, 3 and 4 were not revisited" — and a paragraph nobody revisits is a paragraph that keeps arguing from a state the rows above it have left. That is the third time this document has recorded the identical failure, and it is always Part 3 or Part 4 rather than Part 1: a row is edited when its feature moves, and an ARGUMENT about the rows is edited only when somebody re-reads it.

The cell stays ◐, and the honest reason is narrower. Not that nothing has crossed — it has, repeatably, under scripts/circle-scenario.sh — but that the far Mac holds the bytes of three books out of 1 961, so what has been watched end to end is a passage in a book both machines could open. That is the same constraint WI-24.C3 ran under and the one Part 1's row now names.

⚠️ The other ten cells in that row are the softest claims in this document. Parts 2 and 3 are 2026-08-21 research and were not re-done here; these were placed from general knowledge, and two of them are genuinely arguable rather than merely unchecked:

• Kindle ◐ is Popular Highlights, which does draw other readers' passages in your book — and is an anonymous server-side aggregate over millions of strangers. It is the thing the circle's design says it must not be, so the half-mark is for the surface, not the mechanism.
• Zotero ◐ is group libraries, which is the closest anyone comes: named collaborators, annotations you can see. It is a shared library on a server, not your own copy of the book, and not peer to peer.

Nobody in this table does the actual thing — named people, your own copy, no server, no account. Whether that is a moat or a niche is not a question a matrix answers.

Part 4 — Reading the matrix

The gap that dominated this document is closed, and its explanation is obsolete. Earlier versions said reading position was Partial because a dialog-selected path was in the filesystem scope for that runtime only, so a reopen worked until you quit — and that the fix rested on tauri-plugin-persisted-scope, a dependency's behaviour never run here.

Phase 4 dissolved the problem rather than fixing it. A book is a folder: the bytes are copied into $APPDATA/books/<bookId>/content.<ext> at import, and useBookIntake.ts:249 opens that, through contentPathIn. The picked path is still kept, but it is device-local metadata and not what an open reads. A scope that expires cannot break a reopen, because no reopen consults it.

Position restore and reopening are both Shipped. The lesson worth keeping is not about scopes: it is that a row can stay Partial for a year after the reason expired, because nobody re-reads a ledger while shipping five phases.

~~Nothing gets out — except tags.~~ Closed, and kept as a worked example of how this section rots. The paragraph here said marks and cards had no door and called the asymmetry "the sharpest thing in the document". marksArchive.ts shipped one — JSON to re-import and Markdown to read, rendered from the same document so the two cannot drift — and the Annotation section has said so since 2026-08-21. A Part 4 paragraph is an ARGUMENT ABOUT the rows and nothing checks it against them, which is why it survived four passes over the rows above it.

~~The new first-ranked gap has no comparator that lacks it.~~ Also closed. This said there was no way back after a jump. core/jumpStack.ts shipped ⌘[ and ⌘], cross-book, and the footnote popover it said the gap compounded with shipped in the same phase. Both rows above have said so since 2026-08-21; this paragraph did not.

~~The first-ranked gap now is that nothing has been watched working across two machines.~~ Both halves are now closed, five weeks apart in the writing and two days apart in fact. Sync's convergence ran green on 2026-09-06; the circle's first passage crossed on 2026-09-07. Neither was blocked by missing code and both were blocked by an absent harness run, which is what this paragraph got right.

~~The first-ranked gap now is that the circle has no harness.~~ Closed the same day, 2026-09-07. scripts/circle-scenario.sh runs the crossing unattended — preflight, publish through the app's own Share control, watch the pub land on the far end, hold the person back and confirm the record, release them, put the publication back — and --falsify proves the converge step can fail. WI-24.C2.

~~The first-ranked gap now is that the far end has never published.~~ Closed 2026-09-08. the second Mac published and the passage arrived here — pub ff49a654873eac — so the circle is proved in BOTH directions, and the mute assertion's "file stays" half is a real assertion rather than a note. The far end is driven by building the debug BUNDLE here, copying it, and tunnelling its bridge back with ssh -L; that machine has no Rust toolchain.

~~The first-ranked gap now is WI-24.C3~~ — shelf disclosure and a jacket verified against its digest. Closed 2026-09-08, and this chain did not say so until 2026-09-10. dev-docs/plans/phase-24-the-evidence.md records the run: the per-person switch turned on from the Circle screen, circle/<us>/shelf.json landing on the far end with 1 962 works, and a jacket that is VERIFIED rather than merely present — 62 579 bytes whose blake3 is exactly the name it is filed under, which a build that kept whatever arrived would also have left a file for. The constraint this entry recorded is real and survives: the far end holds three books' bytes out of 1 961, because it came from a satchel sync and has records without content, so a book with no content.epub cannot be opened there and digest verification reaches only those three.

The first-ranked gap now is that the public layer has never left one process. Phases 25 and 26 landed twenty work items on 2026-09-09 — two ALPNs, a second signing key, a global provider index — and every one of them records in-process tests as its whole verification. For a transport that means two live iroh endpoints inside share/acceptance.rs, which is real evidence about the protocol and none at all about the app. There is no public-scenario.sh.

⚠️ AND THIS IS THE THIRD TIME THIS CHAIN HAS NAMED A GAP OF EXACTLY THIS SHAPE. Sync's convergence and the circle's first crossing were both blocked by an absent harness run rather than by absent code, and both took one run to close and produced a real defect apiece when they did — a satchel that never retried, and a 'muted' state modelled for four phases with no writer anywhere. sync-scenario.sh and circle-scenario.sh are the pattern, and the far Mac's three-books-with-bytes limit constrains this run exactly as it constrained WI-24.C3.

⚠️ AND WHAT BUILDING THE HARNESS FOUND IS THE ARGUMENT FOR HAVING BUILT IT. 'muted' had been modelled since relationships were designed — parsed, admitted by acceptsTransport, given retain: 'keep' on its own stated reasoning — and nothing in the product ever wrote it, so the only way to take one person off the page was Remove, which purges their passages and the pairing. No test could see it, because every test built the state it wanted directly. Trying to RUN the thing is what asked.

What is genuinely Paper's, and it is more than it was. The ruler with a keyboard line advance, margin notes beside their line, a typographic grid where every size carries its own measure — and three things this audit surfaced that had no row at all: type sizes corrected for each face's measured x-height, word-boundary snapping that knows whether the pointer or the keyboard made the selection, and alignment and hyphenation collapsed into one three-state decision with the rivers measured rather than argued.

The card model — five named kinds, deliberately not notes — is closer to a Zettelkasten tool than to a reader, and no reader here has it.

The companion is built, and the provenance mark is still the original idea in it. The companion kind, its amber tint, and a wave style reserved so the reader cannot make a mark that looks machine-written — that was the part that shipped first, and phase 15 filled in the thing that produces one: a supervised local runtime, a grounded thread whose citations Paper resolves rather than the model inventing, and a gloss that defines a word in the sentence it sits in.

Both of the limits this paragraph used to state have moved. The agent routes' terms review cleared on 2026-08-23 and they ship. Read-aloud is not "deliberately absent" without qualification either — the SYSTEM voice is shipped, follows the spoken word across page turns and section boundaries, and speaks in the language the document declares; it is the NEURAL voice that is absent, because Test voice proves a model works and pretending otherwise would ship a model nothing uses. Two rows called "Read aloud" with opposite states is how a reader stops trusting a table, which is why they carry their voices in their names.

And the circle is the largest thing Paper has that this section had never argued about. It is the one feature here that changes what reading is in the product rather than how it looks: passages a named person marked, drawn in your own copy, with no server, no account and no aggregate. The three rules it holds itself to are all refusals — no aggregate is ever presented as the aggregate, nothing is discoverable that you were not given, nothing is multi-writer — and every one of them is a thing the obvious version of this feature does. The brief was "a peer-to-peer Douban" and the design's first section is why it cannot be one.

Where Paper should not chase. OPDS, catalogs, per-book settings and parallel reading pull against a reader whose whole argument is one uncluttered surface. Translation belongs on that list too: it needs a provider, a network dependency and a bill, for something a reader can do in another window. Absence there is a position, not a gap — provided it is stated, which is what this ledger is for.

Which leaves exactly one table-stakes gap, and it is reading statistics. Cross-device sync left that table on 2026-09-10 having been shipped since 09-06, and translation on the line above is a position rather than an absence. So of the three rows "Table stakes Paper is missing" was built with, one shipped and one was reclassified, and statistics is the whole of what is left. Say it here rather than making a reader subtract: nothing records a session, and a session store is a phase.

Touch stopped being a future problem and became a present one. This said "phase 9 puts Paper on a phone" as though the phone were ahead. It is here: iOS and Android both build and run their own shell, and the browser client already turns pages by tap on a device with no wheel. What is missing is narrower and sharper than the paragraph it replaces — the phone has no reader. The shell is a shelf, a card deck and a settings screen; mounting the reading core into the Reading tab is the one change that turns four tabs into an app, and long-press selection and pinch are the vocabulary that arrives with it.

The 2026-08-21 re-audit

Eleven rows had drifted. Nine of them understated the app — a ledger that reports features as missing when they ship is worse than one that is merely out of date, because it is read to decide what to build next.

Rows added that had never been recorded: word-boundary snapping and gesture provenance, the four spacing axes, brightness and contrast, x-height-corrected sizes, real cover art, the virtualised shelf, background enrichment, yielding passes, copy with citation, overlap-based mark matching, unsaved-note rescue on close, cross-document coordinates, tint derivation, alignment respecting composition, drag-to-tag, trash and undo, the presence register, relative dates, floating-surface placement, two-click removal, identity migration, and the reserved companion style.

Why this happens, and the only fix that would work. Paper's own convention is that a document in dev-docs/ is the single source of truth and must not be restated elsewhere — but this ledger restates the code, and nothing checks it. The state column and the Where column are both mechanically checkable: a path either exists or it does not. Wiring that into pnpm verify, as check-compositions already does for the capability manifest, would catch the path drift immediately and make the state drift visible at review.

Sourcing

Paper's column describes the working tree as re-audited on 2026-09-05, at 0.2.0 on main, row by row against the source. (It said 2026-08-21 on branch bookmarks until then — three passes had moved rows above and left this sentence naming a branch that is four releases behind.)

Verification of Paper's column is source reading plus the test suite, not a pass in the running app. That distinction matters here more than usual: this project has twice shipped a defect that every automated check passed over — the wrong filesystem permissions, and a runtime-only path scope — and both were the kind only the app can find. Rows marked Shipped mean implemented and tested; they do not all mean watched working.

Not driven in the app since they were written:

Comparator columns for Readest, Foliate, Thorium, KOReader, Readwise Reader, Zotero and Highlights were checked against current sources in August 2026 — see the links below, and note they were not re-verified in the 2026-08-21 pass, which was Paper's column only. Apple Books, Kindle and the Calibre viewer are from general knowledge of stable, long-standing products; treat those three columns as the softest in the table.

• Readest — <https://readest.com/>, <https://deepwiki.com/readest/readest>
• Foliate — <https://johnfactotum.github.io/foliate/>
• Thorium — <https://www.edrlab.org/software/thorium-reader/>
• KOReader — <https://github.com/koreader/koreader/releases>, <https://deepwiki.com/koreader/koreader/6.1-highlight-and-annotation-system>
• Readwise Reader — <https://www.marqly.com/blog/readwise-reader-review-2026>
• Zotero — <https://www.zotero.org/support/pdf_reader>, <https://www.zotero.org/blog/zotero-7/>
• Highlights — <https://apps.apple.com/us/app/highlights-pdf-reader-notes/id1498912833>

The 2026-08-23 re-audit

Two days, two phases, and a ledger that had not moved with either. Phase 13/14 landed the CSS system on 2026-08-22; phase 11's service table merged on 2026-08-23. Walked Part 1 against the working tree again.

Two rows contradicted this document's own other rows, which is the failure that matters most in a file read to settle questions:

• The side pane said eight panels and named Reading among them. The Reading pane and ⌘5 were removed on 2026-08-21 and the Reading-statistics row three sections above says so, in bold. One document, two answers. It is seven panels, and the keyboard row's ⌘1–⌘5 was wrong with it — the digits stop at ⌘4, because Companion, Library and Settings carry none.

Seven rows were missing, all for shipped work. Five are the CSS system, which is the largest single change since the last audit and had no row at all: the sheet is two static tiers now rather than 585 lines rebuilt as a string on every setting change; a setting is a property write; the base size moved to the root, where rem can follow it; non-prose has house ratios; code has a panel mixed from the reader's own ink. Two are phase 11's: ⌘Q now closes the sync journal through a real handshake, and the bundled OFL typefaces' licences travel with the build.

That last one is worth naming on its own. Four typefaces shipped in every copy of Paper under a licence that permits redistribution only with the notice and the licence text attached, and neither travelled. No test failed, no build broke, and the app worked perfectly — which is the whole shape of the defect.

Three line-numbered claims are gone (core/uiTypes.ts:150, ui/screens/BookRow.tsx:193, ui/hooks/useBookIntake.ts:249). One had already drifted by a line and one pointed at unrelated code. A line number in a document expires on the next edit to the file, and features:check could not catch it because the file still exists. Same rule now applied in both ledgers. (That gate has since been removed altogether — see the warning at the top.)

One row was checked and stayed Partial. Cross-device sync: phase 11 built the harness that drives two Macs over ssh and three runs of it unblocked three real defects, and the convergence itself finally ran green on 2026-09-06.

What was NOT re-audited: Parts 2 and 3 — the eleven comparators and the gap matrix — were researched on 2026-08-21 and have not been re-researched. This pass moved three rows out of the "missing" table because Paper had filled them, which is a claim about Paper; it did not re-check a single claim about anybody else's reader.

After phase 15

The companion runtime updated the Companion section and Part 4 as it landed, which is the practice — a phase that revises the ledger with its own work is the only version of this that scales. What it could not do is notice the three things a phase never sees about itself.

IT COLLIDED WITH A NAME. Read aloud already existed under Reading aids, Shipped, over Web Speech. Phase 15 added a second Read aloud, Absent, over the neural voice. One document, one name, two rows, opposite states — the same defect the pane count had, and the reason it is worth naming twice is that both arose the same way: a section edited by someone reading only that section. They are Read aloud, system voice and Read aloud, neural voice now, and each says the other exists.

IT MADE A ROW ELSEWHERE STALE. Dictionary lookup said Shipped (macOS) and that a platform without a dictionary shows no control. The gloss changed both halves: Look up became a three-mode control, and a Windows or Linux reader with a text model got one for the first time.

⚠️ AND THAT PARAGRAPH IS ITSELF STALE — kept as the worked example, because this is the second time this one row has gone quietly wrong. The system-dictionary hand-off is deleted: Look up has ONE mode, the gloss, and the no-regression rule it used to carry is deliberately broken on macOS, where a fresh install now has no lookup until a model is downloaded. Nothing went red either time, and there is now even less that could: features:check read the Where column and never read prose, and it no longer runs at all. The Look up row states the current behaviour and the regression together; this note exists to say the row has been wrong twice, for the same mechanical reason, and will go wrong a third time unless it is rewritten in the commit that changes the behaviour.

IT LEFT A MATRIX CELL BEHIND. AI assistance over the text was ◍, a stub, and Part 1 said Shipped in four rows. Nobody owns a comparator cell, which is how it stayed. It is ● with a note on what kind.

One row added: the work line on the shelf (WI-15.12). The library status bar's third rung had no row at all, and its default — NO_WORK_LINE — is what keeps a build without inference drawing the bar it always drew.

NOT re-audited: Parts 2 and 3 remain the 2026-08-21 research. One cell moved here, and that cell is a claim about Paper; nothing in this pass re-checked a claim about another reader.

Not in this document, deliberately: Settings → Local models threw CapabilityError on open the day this merged, because the look-up mode was a kernel setting and a capability's settings handle is confined to its own namespace. That is a defect and its fix is a commit, not a row — the ledger describes what Paper has, and a row per bug would make it a changelog. It is mentioned here only because the Look up row's wording depended on the seam that fixed it — a dependency that has since gone, along with the mode, the setting and the accessors the seam was built to reach them through.

The 2026-09-05 re-audit

Twelve days since the last full pass, three phases (21, 22, 23), three releases (0.1.2, 0.1.3, 0.2.0), and a failure mode this document had not seen before.

THE DRIFT WAS NOT IN THE ROWS. IT WAS THAT THERE WERE NO ROWS. Every previous pass found rows that had gone stale — a Partial that had shipped, a path that moved with the kernel carve. This one found three whole surfaces with no entry of any kind: the circle, the phone and the browser client. Two of those had been shipping for a week and one for two.

Thirty-one rows added, twenty-one of them the circle's.

Why a whole section can go missing when a row cannot. The convention this document runs on is that a phase updates the ledger with its own work — the practice "After phase 15" named as the only version that scales. It scales for a phase that CHANGES something described here. It fails silently for a phase that adds a surface nobody has written a heading for: there is no stale row to notice, no path to go red, and the table of contents reads exactly the same as it did. A missing row looks like a document that is finished.

gen-feature-ledger.py cannot help — it renders what is here and validates the state words. It would have refused a typo in a State cell and had nothing to say about three absent sections. This is the same shape as features:check and check-service-docs, one step worse: those gates checked that what is written is true, and nothing at all checks that what is true is written.

The seven rows that had gone stale

One of those is worth naming on its own. The Annotation export row carried a paragraph in bold announcing a user-visible regression and asking for the trade to be "re-argued rather than inherited" if a gated spike did not happen. The spike happened, the capability came back, and the warning sat there for five days telling readers of this document that marks are discarded. A ledger that announces a regression which has since been fixed is worse than one that is merely behind — it is read to decide what to build next, and this one was advertising work that was already done.

Part 4 was arguing from rows that had moved

Four paragraphs, and the two loudest were the two most out of date: "nothing gets out — except tags", called "the sharpest thing in the document", when marks and cards export had shipped on 2026-08-21; and "the new first-ranked gap has no comparator that lacks it", about a jump stack that shipped the same day.

Both are kept, struck through, with what closed them — the same treatment the Look up note gets, and for the same reason. Part 4 is an ARGUMENT ABOUT the rows, so nothing in a row's own update touches it, and it will rot again unless it is read as a section rather than skipped as prose. It is now the last thing to check in a pass, not the first thing to skip.

What was NOT audited

Parts 2 and 3 are still the 2026-08-21 research, for the fourth pass running. One row was added to Part 3 — the circle's — and its ten comparator cells are the softest claims in this document, placed from general knowledge and flagged as such where they sit. Paper's own cell there is ◐ rather than ● on purpose.

Nothing was driven in the running app in this pass. Every state above is source reading plus the suite, which is what "Shipped" has meant here since the Sourcing note was written — and the gap it warns about is wider now than it has ever been, because the two largest additions since the last pass are a phone with no reader and a peer protocol nobody has run between two peers.

The 2026-09-06 pass

Narrow by design. One day, five commits, 0.2.0 → 0.2.1, and no new surface — so this was not a sweep. The commits: a renderer fix for this document's own drift table (5fb3920), the format corpus (411cb0e, already in its row before the merge), the MCP bridge ACL (2022ef7), messageOf moved into the kernel (5f02ef4), a jacket fixture shrunk from 512 KiB to 2 KiB (d039d7c), and vitest 4 (62688a5). Four of the six change no capability a reader can reach.

What this pass did instead was read the code behind a row it had just written. The Sync row was given the Stage B transcript on 2026-09-05, hours after the run. It was a faithful transcription — and it inherited the harness's inferences along with its measurements, which is a failure mode this document has not recorded before.

⚠️ A TRANSCRIPT IS EVIDENCE; THE SENTENCES AROUND IT ARE AN ARGUMENT, AND ONLY THE FIRST SURVIVES BEING COPIED INTO A ROW. Every number above is real and correctly recorded. What travelled with them and should not have is the reading — wedged, behind, stopped. This is the same shape as Part 4 arguing from rows that had moved, one level down: a row arguing from a run whose instrument could not see the thing it was being asked about.

The check that would have caught it costs nothing and was never run: open the module whose behaviour the row is about, before writing the sentence that explains the measurement. Four source files, twenty minutes, no second machine.

What this does not close

The Sync row stayed Partial through this pass, because nothing in it had been observed in a running pair — it was source reading, which is what "Shipped" has meant here since the Sourcing note.

✅ AND THEN IT DID NOT STAY PARTIAL. Later the same day the convergence ran green, 22 steps and 0 failures, and the row is Shipped. Worth keeping the two notes next to each other: the source reading named the mechanism and the run confirmed it, and the run was possible only because the mechanism had been named first. The hypothesis this section said the next run would have to falsify is the one it went and falsified.

The circle, end to end was not touched. Stage C has not run, and nothing in this pass bears on it.

The 2026-09-09 pass

0.2.1 → 0.3.0. Forty-three commits and one merge: the circle's rounds, an audit of every deferred finding, and three evenings on a pairing that did not work. Most of those commits updated their own rows as they landed, which is the practice this document wants. This pass is for the two things a phase cannot see about itself, and they turned out to be the same thing twice.

Both rows claimed more than had been observed

The second is the drift these passes keep describing, in its purest form: Part 4 recorded the closure the same day the crossing happened, and the row did not. One cell, both states, and nothing between them but the reader's attention.

"Shipped" cannot see a cold path

The pairing row is the sharpest example this document holds of what the Sourcing note means. Every test was green and stayed green — including two_shelves_complete_a_circle_pairing_and_still_compare_a_sas, written for exactly this capability. The protocol was correct. What was broken was underneath it, and no test in this tree could reach it.

⚠️ AND THE FIRST MEASUREMENT AGREED WITH THE TESTS. A harness dialling every five seconds reported 10–11 of 12 and the number was written down as "about one in six". It was an artefact: five seconds apart keeps the network path warm, and a warm path is reliable. Dialled 60 s apart — which is what pairing actually is, two readers who have never talked, one offer, one dial — 1 of 4 got through.

A measurement of a peer-to-peer capability that loops without an idle gap reports the reassuring number. That belongs beside the 09-06 pass's lesson rather than under it: that one was a row inheriting a harness's inferences, this one is a row inheriting a harness's cadence. Both survive being copied because both look like data.

What the fix was, and what it cost

The shelf sends nothing between receiving a hello and its human answering, so a joiner cannot distinguish you never heard me from your human is still deciding. A lost hello therefore raised no error at all — it left the joiner holding a connection it believed was healthy for 150 seconds. So the joiner now asks: a second connection beside the first after five seconds, whichever is heard wins.

The price is in the ledger's own terms — every successful pairing now opens two connections and the far end refuses one, so peer_status.droppedInbound climbing on the offering side is the design. Removing it needs an ALPN bump, deliberately not taken.

Three instruments, and why they belong in a ledger

None of these is a feature, and the pairing row could not have been written without them:

• accept_loop lost inbound connections to two bare returns. A machine that dropped a connection and one that was never dialled gave byte-identical answers to every question. peer_status.droppedInbound now separates them.
• reason_of discarded the cause one line before the only place it could be read, so every transport failure reached the reader as the word io.
• Paper.log held eight seconds under an app that had been up for three minutes — iroh logs one line per UDP datagram and the default rotation is 40 KB. The first fix's own evidence was rotated away before it could be read, and its absence looked exactly like the fix never firing.

⚠️ THE THIRD ONE IS THE WARNING WORTH KEEPING. Two of the three were found only because a fourth thing was fixed first. A silent instrument does not report that it is silent, and every explanation built over one is unfalsifiable — which is what three evenings of confident wrong answers about a "dead far end" actually were.

What this does not close

The circle, end to end stays Partial, and for the reason it already gave: WI-24.C3, the shelf and jacket half, has not run. Pairing being reliable is a precondition for that run, not a substitute for it.

Nothing here was re-audited outside the circle. Reading, Annotation, Cards, Companion, Navigation, Shell, Other surfaces and Data were not read against the tree in this pass — the branch touched the circle, the peer plugin and one UI hook, and claiming a sweep would be the same overclaim this pass exists to record.

The 2026-09-10 pass

At 0.3.1. Three commits since the 09-09 pass: two closing the whole of a 215-finding audit of the phase 25/26 branch, and the version bump.

The finding is the same one the 09-05 sweep made, and it is the largest since: two whole surfaces with no row at all. Public sharing and public annotations landed on 2026-09-09 — twenty work items across two plans, two ALPNs, a second signing key, a global provider index, a new capability composed on every platform that has a peer — and this document did not carry one row for any of it. Not a row that drifted. A section that was never written.

Twenty-one rows added under "The public layer". Two of them are Partial for a reason this section states once and every row inherits: nothing in either phase has crossed two machines or been driven in the running app. Every work item in both plans records in-process tests as its whole verification, and for the transport that means two live iroh endpoints inside one process, which is real evidence about the protocol and none at all about the app.

Why the state is Partial and not Shipped

The circle's own row spent four phases in exactly this position, and the temptation each time is the same: the tests are green, the code is complete, the pieces demonstrably work. The 09-09 pass was written about two rows that gave in to it — Admission: two shelves pair said Shipped over a capability that failed three times in four for a real reader, with twenty green protocol tests over it. Twenty green protocol tests are what this section has.

So "Publishing to strangers, end to end" is Partial with the absence named rather than Shipped with the tests cited, and the section's own preamble says to read it the way the circle's row was read before 2026-09-07.

The two rows that had gone stale

What the audit changed that a row cannot show

The 215 findings were mostly not about capabilities, so they belong here rather than in Part 1. Three that a reader would notice:

• A stranger's mark was drawn exactly as a friend's. The audience was encoded in a string prefix that only the producer read, so the painter was told nothing and labelled every public mark with the circle's kind. It has its own row now, because it is a thing a reader sees.
• The receiving half of phase 26 did not exist. The plugin had answered paper/share-notes/1 since the phase landed and no device ever asked, so the store the overlay draws from had no production writer. Built on 09-10 with a two-endpoint acceptance test, and recorded in the plan as WI-26.8 — a work item the plan never had.
• The Linux Secret Service session was unencrypted, recovery phrase included. crypto-rust had been measured as blocked by a gate that has since stopped running the check that blocked it, and nobody re-read the note where the blockage was recorded.

What this does not close

pnpm features:check still does not exist, and this pass is the fourth to be needed because nothing holds these rows to the tree. Twenty-one rows for phases that landed the previous day is what "maintained by hand" costs when a phase does not update its own rows as it lands.

Nothing outside the public layer and the circle was re-audited. Reading, Annotation, Cards, Companion, Navigation, Shell, Other surfaces and Data were not read against the tree — the branch touched the public capability, the peer plugin, the kernel's public and circle cores, and the reader's overlay path. Claiming a sweep would be the overclaim the previous pass exists to record.

Parts 2, 3 and 4 were not revisited. Public sharing is a capability no comparator has, and the gap matrix does not know about it yet — "What Paper has that most do not" is where it would go, and putting it there means re-reading ten comparators rather than adding a line.

The 2026-09-11 pass

At 0.3.2, and it is the first pass to read what the 09-10 pass said it had not. Two commits since: the ledger gate itself (2fb1e83) and the version bump. No capability changed, so nothing here is staleness against new code — every finding below was already false when pnpm ledger:check first ran green over this document. That is the point of the pass: the gate answers three questions and this is what is left over when all three are satisfied.

pnpm ledger:check is green before and after, both times: 195 rows, 320 path claims, 0 findings, 122 declared names all covered. It could not have seen any of this.

What was checked, mechanically, and came back clean

Stated so the findings below are read as the residue of a real sweep rather than as whatever happened to be noticed.

Five findings, and four of them are one shape

The shape is a claim that is true of one surface and written about the app. Not drift — none of these was ever right — which is why no pass looking for what changed found them.

Two smaller ones, both in Where cells: Space between CJK and Latin pointed at Paragraphs and the control is the last row of Spacing; and Content-derived book identity named core/marks.ts, which re-exports the sampling geometry the row is Partial for and explains in a comment that it lives in contentIdentity.ts. And a count: word-boundary snapping said 12 modules and the directory has never held 12 — ten on 2026-08-19, thirteen since the gloss added three on 08-24.

What running it found

The check was run the same day it was recorded as never having been run, and it did four things no reading of the tree could have done.

1. It passed. The book rendered and #paper-isolation-verdict still held its default. A false pass was ruled out before the result was believed — the script parses under node --check, every probe is try/catched, and the write that would replace the paragraph is the script's last statement.

2. The mechanism was not the CSP. scriptCount in the book's own document is 0. A CSP blocks execution and leaves the element; bookScripts.ts strips it at the loader. That file is honest about being "defence in depth" behind the CSP — this document was not, and named the wall that never got the chance to act.

3. The fixture cannot tell its two layers apart, and cannot while stripping works. On the desktop make-hostile-epub.py can only ever return SCRIPT DID NOT RUN. That is worth knowing before the next person reads a pass from it as evidence about the CSP: it is evidence about the strip.

4. The two defences are one door with two locks. Measured from inside the book's document, which nothing had ever done:

The internals object is the IPC channel and the fixture lists it as a breach. So withGlobalTauri: false removes the convenience global and not the route. A row that names two mechanisms should not be read as two walls.

And scripts/csp-effect.mjs was run, for what is probably the first time in a while. It passes, with the control that makes it worth trusting: the strict policy blocks inline, external and framed script in WebKit and Chromium, and the deliberately widened policy reports RAN on all three. ⚠️ It weighs paper-webhost's policy, not tauri.conf.json's — the browser client's wall — and nothing in verify or CI invokes it. Five comments cite it; no runner does.

Two traps the run hit, which are why it had never been run

⚠️ THE CHECK CANNOT RUN BESIDE A RUNNING PAPER, AND THE SECOND PROCESS EXITS 0. single_instance is registered before every other plugin and before setup, deliberately — a newcomer hands its argv to the first process and exits there. A second build therefore never opens a window, never reaches the library lock, and reports success. pnpm tauri dev spent 3m55s compiling, ran target/debug/app, and exited 0 with nothing to show, which is the exact shape of actool and screencapture in AGENTS.md wearing a fourth hat.

⚠️ AND PAPER_TEST_DATA_DIR DOES NOT ISOLATE THE BOOK VAULT. The Rust side honours it — peer/identity.key and inference/ landed under the scratch root. The vault did not: opening the fixture wrote books/book_28d0dc6…/ into the real library, with an entry in index.json and a line in sync/journal.jsonl, where a real shelf would have replicated it. The override is paper-data-root's, read by Rust; the vault resolves $APPDATA through the fs plugin, which never consults it. A scratch root that isolates half of the app is worse than none, because it is believed.

⚠️ AND IT IS DELIBERATE, WHICH THE FIRST WRITING OF THIS PARAGRAPH DID NOT SAY. src-tauri/src/atomic.rs has carried the reason all along: the kernel's root is the fs plugin's AppData "deliberately — the kernel reads every file it writes back through that plugin, so a write that landed anywhere else would be a write the kernel could not read", and the override "moves the peer plugin's files and not the kernel's (the trap WI-8.6 recorded) … that discrepancy is noted, not hidden." So this is a decision with a stated cost, not a defect, and there is no way to give the vault a scratch root at all. Written down because the first version of this note implied a fix was pending, which would have sent the next person to repair a decision — the same error this pass found five times in the rows above, committed in the act of recording them. Removed through paper book remove, which is the app's own path and leaves a correct tombstone rather than a dangling index entry.

What this pass actually establishes

UNFINISHED_PANE_IDS hides a PANE, and this document has been reading it as a policy. AGENTS.md states the rule as "the only edit required, because the rail, the palette, the digit accelerators and the Settings band all read one rule" — four surfaces, every one of them the desktop's. src/app/mobile/ and src/main.web.tsx read none of it and never have. So an unfinished panel is hidden on one of three shells, shipping one is not a one-line edit, and the sentence that says it is appears in the project's tracked instructions where every agent reads it.

The gate cannot see any of this and should not be asked to. Findings 1 and 2 are a document asserting a property of code it does not name; 3 is a state cell disagreeing with its own prose; 4 and 5 are one part of this file disagreeing with another. The nearest thing to a mechanical check is the last two: a row whose State cell and How to confirm cell contradict each other is findable, and Book content cannot reach native carried "Shipped" beside "has not been run" through four passes.

What this does not close

Parts 2 and 3 are still 2026-08-21 research and are now demonstrably the weakest half of this document. Two of the three notes attached to its two matrices were arguing from states that had moved — the circle's, and the AI assistance ● whose justification is a panel behind ⌘⌃⌥D. Neither was found by re-reading the matrix; both were found by reading Part 1's rows and then looking for anything else that cited them. The ten comparator columns have not been re-checked since the day they were placed.

Public sharing still has no row in any matrix, which the 09-10 pass named and this one did not close either, for its reason: putting it in "What Paper has that most do not" means re-reading ten comparators.

Nothing was driven in a running app. Every finding here is from the tree and from this document. The claims a pass like this cannot reach are exactly the ones finding 3 is about, and the public layer's whole section inherits the same limit by its own preamble — nineteen Shipped rows under a header saying nothing below has crossed two machines. That reading is deliberate and stated, so it is left standing rather than re-graded here; it is written down so the next pass decides it on purpose.

The 2026-09-12 pass

At 0.3.4, after a whole-codebase audit and the twelve fixes it produced. Two releases since the last pass, and this is the first one driven by code that MOVED rather than by re-reading rows against a tree that had not. Thirteen commits: twelve fixes and the version bump.

pnpm ledger:check is green before and after — 195 rows then, 198 now, 0 findings both times, 122 declared names covered. Not one of the findings below was visible to it, which is the same lesson the 09-11 pass drew: the gate asks whether a path resolves, whether a state cell is one of five, and whether every registry name appears somewhere. It cannot ask whether a sentence is true.

Four rows the new code moved under

Four rows that were already stale when the gate went green

Two of them are the same defect the 09-11 pass named — a row edited in isolation while the row it argues with was left alone.

1. Receiving somebody else's notes was Partial because "nothing has driven it in the app". scripts/public-drive.mjs presses Look for some in the running app, and the row two above it records eight records crossing between two Macs on 2026-09-11, driven through the app's own controls. One edit flipped that row and left this one saying the opposite. Partial → Shipped.
2. The Publish pane carried the same void half. Its OTHER half — no capture — survives, so the state stands and the reason is narrowed to the half that is true.
3. Two pairing kinds, two grants said "Both circle services"; there are five, and line 505 of this same document already said five.
4. A second endpoint, on a second key listed the routes that start the share endpoint and omitted resume_share, which starts it at launch. The row's conclusion survives, because it returns early with nothing offered.

Three controls a reader operates that had no row at all

Every one is a decision a person makes in the app, and every one was covered only as machinery underneath it:

• Silencing a voice, and hearing them again. The row above it names the same file and describes the BINDING. This is also the behaviour that changed: the reversal was not one until 2026-09-12.
• Where do your books live? — the shelf/satchel choice. Described elsewhere as a fact of the sync protocol, never as a control. It is a decision a reader makes once and cannot change after pairing.
• Let this device make changes — the per-peer grants. Counted as one of the thirty-one operations; never described as the switch it is.

What this pass did not re-grade

The public section's preamble still reads "nothing below has crossed two machines" over rows that now have. Row 432 records the 2026-09-11 crossing and two rows in that section have been re-graded on it, which leaves the preamble arguing against its own rows. The 09-11 pass saw this and left it deliberately, to be decided on purpose rather than in passing; it is still the largest thing in this document that one pass should settle, and it is still not settled.

And the other five audit fixes touched nothing this document claims. Circle re-admission, markStore.rekey, recordStamp, the library-lock fsync and the dropped kernel re-exports all repair defects no row described either way. A ledger that had a row for each would have been a ledger nobody could read; that they are absent is not a gap.