<!-- sections: [Summary, Findings, Friction log, Observations and patterns, Engineering-level reading] -->
<!-- completed: [Summary, Findings, Friction log, Observations and patterns, Engineering-level reading] -->

---
cycle: 370
role: alpha
issue: "https://github.com/usurobor/cnos/issues/370"
date: "2026-05-17"
merge_sha: "0d9f7498"
base_sha_origin_main: "704365d23378fcbfcf1e33679025809af6b81100"
head_sha_cycle_at_merge: "846800e8"
verdict: APPROVED (R2)
rounds: 2
---

# α Close-out — #370

## Summary

Two-round cycle delivering `src/packages/cnos.cdd/skills/cdd/COHERENCE-CELL-NORMAL-FORM.md` (435L, additive). Kernel-layer companion to `COHERENCE-CELL.md` (#364) and `RECEIPT-VALIDATION.md` (#367); names the substrate-independent recursion algorithm of a coherence cell at scope `n` as five typed steps, pins the evidence-binding rule, types the four closed-cell outcomes by `(verdict × decision)`, separates within-scope (repair-dispatch) and cross-scope (scope-lift) recursion modes, and names the three scope-lift projections with the β/γ-no-upward-projection clause. Phase 1.5 of #366's executability roadmap.

Authored across nine α commits on `cycle/370`: scaffold + §Preamble (`5b772567`), §Kernel (`254f3daa`), §Cell Outcomes (`a1b9ae40`), §Recursion Modes (`b028dcd5`), §Scope-Lift (`f1913eb9`), §Two-Layer Separation + §Non-goals + §Closure (`dd3f92a8`), §Gap + §Skills (`77ddbd9c`), §ACs (`a86167bb`), §Self-check + §Debt + §CDD-Trace (`10b41762`), §Review-readiness (`aa10f902`), R2 rename (`846800e8`). β REQUEST CHANGES R1 (F1 — mechanical convention drift); α one-commit fix at `846800e8`; β APPROVED R2; merged at `0d9f7498`.

Surface containment held exactly: one new doctrine file + five cycle-evidence files under `.cdd/unreleased/370/`. No edits to `COHERENCE-CELL.md`, `RECEIPT-VALIDATION.md`, `CDD.md`, `schemas/cdd/`, `cn-cdd-verify`, `operator/SKILL.md`, `gamma/SKILL.md`, `epsilon/SKILL.md`, `ROLES.md`, or CI workflows.

## Findings

α-side cycle findings, factual only:

**F1 — `alpha/SKILL.md` §2.5 lists the section as `§CDD-Trace` (hyphen); `cn-cdd-verify:495` greps `^## CDD Trace` (space).** The validator's literal grep is the binding contract; the SKILL.md prose carries a shorthand that contradicts it. α faithfully copied the SKILL.md enumeration verbatim into `self-coherence.md`'s section header and manifest comment, producing `## CDD-Trace`. Build CI surfaced the mismatch on R1 review SHA `aa10f902` (run `25990518085`, job `CDD artifact ledger validation (I6)`); β raised F1; α renamed to `## CDD Trace` in one commit (`846800e8`); R2 green.

Surfaces carrying the drift between SKILL.md prose and the validator's literal grep:

- `src/packages/cnos.cdd/skills/cdd/alpha/SKILL.md:217` — `**§CDD-Trace** — CDD Trace through step 7` (the §-shorthand uses a hyphen; the in-prose description uses a space)
- `src/packages/cnos.cdd/skills/cdd/alpha/SKILL.md:352` — `Sections: [Gap, Skills, ACs, Self-check, Debt, CDD-Trace, Review-readiness]` (resumption protocol enumeration)
- `src/packages/cnos.cdd/commands/cdd-verify/cn-cdd-verify:480` — `# Required sections: Gap, Mode/Skills, ACs/AC Coverage, Self-check, Debt, CDD-Trace` (validator's own *comment* uses the hyphen form, while its grep at L495 and L573 uses the space form)
- `.cdd/releases/docs/2026-05-15/367/self-coherence.md` (released convention precedent) — `## CDD Trace` (space)

Class: validator-literal-vs-skill-prose drift. α-side gap: α read `alpha/SKILL.md` §2.5 as the section enumeration authority and did not cross-check the validator source. Convention precedent on `origin/main` (#367) uses the space form, but α did not read prior-cycle released artifacts as authoring constraints — the SKILL.md was treated as the canonical source. No prior cycle has surfaced this class in α-side close-outs that I read.

**F2 — AC3 signature variant is deliberate, not drift.** Issue-body AC3 oracle lists `γₙ.close(contractₙ, matterₙ, reviewₙ)` (3 args) and `V(contractₙ, receiptₙ, evidenceₙ)` (3 args). Doc commits to `γₙ.close(contractₙ, matterₙ, reviewₙ, evidenceₙ)` (4 args) and `V(contractₙ, receiptₙ)` (2 args). Authoring rationale: V taking `evidenceₙ` as a separate input contradicts the evidence-binding rule's "γ binds evidence into the receipt at close-out as typed references; V dereferences from the receipt." If V re-reads evidence outside the receipt, the receipt is not the canonical handoff. The strengthening makes γ.close typed (evidence is γ's binding input) and V self-contained (V dereferences from the receipt). α recorded the variant explicitly at doc lines 110–116 and in §Debt #2 ("this is deliberate: the gap is exactly what this cycle exists to close"). β recorded as observation #1 in R1, not a finding. Class: issue-body oracle prose vs kernel-coherence — when the kernel's evidence-binding rule wants a different arity than the AC oracle's notation lists, α resolved by strengthening the doc and surfacing the variant in artifact. γ-PRA decides whether to reconcile the issue-body notation with the doc's, or treat the doc as the load-bearing claim Phases 2–7 cite.

**F3 — Length overage (435 vs 200–400 target) is part-structural, part-authoring expansion.** Kernel slice: 275 lines (within target). Non-kernel sections: 160 lines (Preamble + Two-Layer Separation + Non-goals + Closure). Structural floor from binding ACs: AC2 (predecessor citations + draft-doctrine framing), AC8 (four realization peers with kernel/realization framing), AC9 (non-goal enumeration), plus the §Closure phase-inheritance table (load-bearing for the cycle's stated impact per the issue body, though not an AC). Minimum-viable non-kernel content for these is roughly 100–120 lines. α landed 160 lines; the ~40-line delta is concentrated in Preamble's four framing subsections ("Companion, not replacement", "What this document is", "What this document is not", "Authoring discipline") — three of which restate predecessor positioning from slightly different angles. A tighter draft would have collapsed the four into two without losing AC2 evidence. α self-identified the overage as §Debt #1 with the structural-floor framing; this finding refines that with the part-structural / part-expansion split.

**F4 — identity-truth drift during the close-out re-dispatch.** This close-out session opened in `/root/cnos` (the main worktree). `git config --list --show-origin` shows `extensions.worktreeConfig=true` is enabled at the shared `.git/config` layer; sibling worktrees `/root/cnos-cycle-369` and `/root/cnos-cycle-370` each carry their own per-worktree `config.worktree`. α ran `git config user.name "alpha" && git config user.email "alpha@cdd.cnos"` at session start; the initial verification (`git config --get user.email`) returned `alpha@cdd.cnos` correctly. Between session start and the close-out commit, the shared `.git/config` was overwritten — by the time of the first commit attempt, `git config --get user.email` returned `gamma@cdd.cnos`. The resulting commit (`ff20c95b`, pre-amend) carried author `gamma <gamma@cdd.cnos>`, violating the role-identity-is-git-observable property (`alpha/SKILL.md` §2.6 row 14, `CDD.md` §1.4). α applied path (a) retroactively: `git config --worktree user.name "alpha" && git config --worktree user.email "alpha@cdd.cnos"` to pin the identity at worktree scope (avoiding the shared-config overwrite class), then `git commit --amend --reset-author --no-edit` to rewrite the commit's author to `alpha <alpha@cdd.cnos>`. Verified `git log -1 --format='%an <%ae>'` returns `alpha <alpha@cdd.cnos>` before push. Class: same as β R1 row 1 (worktree-config-leak; cycle #301 O8 repeat; β-closeout #370 §Process Observations #3). β surfaced the leak inside the merge-test recipe; α surfaced it inside the close-out re-dispatch. Both surfaces sit inside `extensions.worktreeConfig=true`'s blast radius. Convention now established across two roles in one cycle: explicit `--worktree` flag from the first config write, not from the recovery commit.

**F5 — none beyond F1, F2, F3, F4.** AC1, AC4–AC9 all PASS with no authoring frictions worth surfacing. Surface containment held exactly. γ-scaffold's nine pre-flagged failure modes all addressed during authoring (substrate leakage, AC7-awk-pattern-conformance, evidence-binding rule, four-outcome shape, recursion-mode separation, scope-lift projection structure, β/γ-no-upward-projection, two-layer separation, surface containment).

## Friction log

**1. AC7 section-bounded oracle pulled forward into per-section authoring.** The AC7 recipe (`awk` kernel-slice extract + word-bounded `rg` substrate scan) was designed as a review-time oracle. α used it as a per-section generation constraint: after each of `## Kernel`, `## Cell Outcomes`, `## Recursion Modes`, `## Scope-Lift` landed as its own commit, the kernel-slice scan ran against the cycle-branch HEAD. The single substrate-term leak this cycle — the `[#369](https://github.com/...)` URL in §Cell Outcomes — was caught on the first run after that section landed and replaced with a bare `#369` reference in the same commit. The friction was that the SKILL.md does not prescribe pulling AC oracles forward into per-section authoring; it was a one-off decision driven by the kernel's substrate-independence being the load-bearing claim. The discipline paid here; whether it generalizes to other AC oracles is the question γ-PRA may surface.

**2. Convention-shorthand-in-SKILL drift was invisible during authoring.** F1's `CDD-Trace`-vs-`CDD Trace` mismatch was invisible at every α-side pre-review gate row except row 10 (branch CI green). α ran every other row's check locally; only the validator's literal grep would have surfaced the drift, and α did not run `cn-cdd-verify --unreleased` against the new self-coherence file before signaling review-readiness. The friction was that α's authoring discipline treated `alpha/SKILL.md` §2.5 as the section-name authority and did not cross-reference the validator source. β's R1 finding closed the gap mechanically; the authoring-time gap remained until CI failed.

**3. The AC3 signature variant decision point was load-bearing but invisible to the issue-body's oracle.** The issue body's AC3 oracle lists Positive case ("Five steps present in order; evidence-binding rule stated; β's signature explicitly excludes evidence; δ's signature explicitly excludes evidence") and Negative case ("β consumes evidence directly; δ re-reads evidence; the kernel collapses γ.close and V into a single step"). The variant α landed satisfies every binding property in both cases — but it changes the *arities* of γ.close and V from what the oracle's prose-form notation lists. α made the variant explicit at doc lines 110–116 with the justification ("V's signature shows two inputs, not three. The receipt carries the evidence references; V does not take an unbound `evidenceₙ` argument. This is the canonical form of evidence-binding…"). The friction was that the oracle's Positive/Negative cases test for properties, not for literal arity; α's variant met the property test, but the deviation from the prose notation is a divergence-of-record that γ-PRA owns reconciling.

**4. Length-target as soft constraint when AC floor approaches upper bound.** The 200–400 target is doctrine-tight by design. With AC2 + AC8 + AC9 + the §Closure phase-inheritance table summing to a ~120-line minimum, the authoring budget for kernel content was ~80–280 lines. The kernel slice landed at 275 lines, near the upper margin of that range. When the kernel section bumped near the upper bound during authoring (esp. §Recursion Modes' same-operator framing + non-mode guardrails), the temptation was to under-explain the kernel rather than trim the Preamble. α chose to keep the kernel tight against its own structural requirements and accept the Preamble overage. The friction was that the length budget pulls against the kernel's load-bearing role rather than against the scaffolding around it; in retrospect, the trim should have come from the Preamble.

## Observations and patterns

**O1 — Pattern: validator-literal-vs-doctrine-prose drift class.** When a validator's contract is a literal `grep` against a section header (`cn-cdd-verify:495,573` → `^## CDD Trace`) and the doctrine surface enumerates section names in a `§Name` shorthand that uses a different separator (`alpha/SKILL.md:217,352` → `§CDD-Trace`), α may copy the doctrine shorthand verbatim into the artifact and fail the validator. The drift is invisible to every authoring-time discipline except (a) running the validator or (b) cross-checking against released-cycle precedent on `origin/main`. This cycle is the first I read where this class surfaced; the validator's own comment at `cn-cdd-verify:480` carries the same hyphen form, so the drift extends through three files. Same class as the kind of friction `eng/{language}` skills resolve with mechanically-checked invariants; here the invariant exists (the literal grep) but is not surfaced as a generation constraint in the doctrine surface that names the section.

**O2 — Pattern: deliberate kernel-strengthening of an issue-body oracle's prose notation creates a divergence-of-record.** When α's reading of an AC's *property* (evidence-binding rule + β/δ-no-evidence-input) entails a different typed signature than the AC oracle's *notation* lists (γ.close 3-arg vs 4-arg; V 3-arg vs 2-arg), α has three resolution paths: (a) follow the notation literally and break the property, (b) follow the property and disclose the variant in-artifact, (c) round-trip with γ pre-review to amend the AC notation. α chose (b) this cycle, with the justification visible at doc lines 110–116. β read it as a coherent strengthening; γ-PRA owns the reconciliation decision. Pattern: the issue's Positive/Negative oracle is property-based, but the surrounding notation in the AC body is prescriptive-looking. The notation is not a contract; the property is. α's authoring discipline must surface the variant explicitly when the two diverge.

**O3 — Pattern: structural-floor-near-upper-target makes length discipline pull against the kernel.** When binding ACs (AC2 + AC8 + AC9 + cycle-impact-driven §Closure table) require ~120 lines of non-kernel content and the upper length target is 400 lines, the kernel budget is 280 lines. If the kernel's own structural requirements (five steps + evidence-binding + four outcomes with explicit preconditions + two recursion modes + three projections + non-projection guardrails) consume that budget tightly, the length-discipline pressure comes from the scaffolding around the kernel, not from the kernel itself. The authoring instinct ("trim the section I'm currently writing") pulls against the kernel content first, which is exactly backwards. Pattern: when an AC floor approaches the upper length target, the authoring discipline must explicitly protect the kernel content and direct trim pressure outward to the scaffolding. This cycle's overage (160 vs 120 non-kernel lines) reflects the friction without the discipline.

**O4 — Pattern: AC oracles repurposed as per-section authoring constraints catch drift earlier than review-time.** AC7's `awk + rg` recipe was designed as a review-time check on the full doc. α ran it after each of the four kernel sections landed as its own commit (`254f3daa`, `a1b9ae40`, `b028dcd5`, `f1913eb9`). The single substrate-term leak (the GitHub URL in §Cell Outcomes) was caught immediately after `a1b9ae40` landed, before §Recursion Modes was authored, and before §Review-readiness signaled β polling. The cost was one re-run per section commit (≤2s each). The benefit was that the kernel slice was substrate-clean at every intermediate state, not only at the final commit. Pattern: per-AC oracles that can run against incremental commits become authoring constraints rather than review-time checks. Same class as #367's O3 (γ-scaffold-as-generation-constraint); this cycle's AC-oracle-as-per-section-check is the per-AC analogue. The pattern generalizes to AC1 (`test -f`), AC2 (`rg -c 'token'`), AC9 (`git diff --stat`) — all mechanical oracles whose cost-per-run is bounded.

**O5 — Pattern: `extensions.worktreeConfig=true` plus a non-`--worktree` `git config user.email` write produces identity drift that survives the initial verification.** When a repo enables `extensions.worktreeConfig=true` and one or more sibling worktrees carry per-worktree `config.worktree` files, plain `git config user.email X` (no `--worktree` flag) writes to the *shared* `.git/config` layer. The write succeeds and the immediate `git config --get user.email` returns X. But any subsequent process (a sibling worktree's command, a hook, an unrelated tool) that writes to the shared `.git/config` overwrites the value, and the next read returns the overwriting role's identity. β surfaced this class at R1 row 1 inside the merge-test recipe (β-closeout §Process Observations #3, citing cycle #301 O8); α surfaced it inside the close-out re-dispatch (this cycle, F4). Two roles, two surfaces, same shared-config blast radius. Pattern: when `extensions.worktreeConfig=true` is enabled at the repo level, every role's identity write must use `--worktree` from the first command, not from the recovery commit. The class is detectable mechanically: `git config --get extensions.worktreeConfig` returns `true` → identity writes must carry `--worktree`. This generalizes the worktree-config discipline beyond β's merge-test recipe to every role's session-start identity assertion.

**O6 — Pattern: γ-scaffold's failure-modes list operates as the authoring checklist (confirmed, second cycle).** γ-scaffold §"Failure modes to guard against" pre-flagged nine α-side failure modes. α treated each as a generation constraint during authoring (substrate leakage → kernel-slice scan after each section; AC7 awk-pattern conformance → header-string discipline; verdict/decision/action separation → typed signatures with explicit exclusions; two-layer separation → directional citation rule in §Two-Layer Separation; etc.). This pattern was already O3 in #367's α close-out. Confirming in this cycle: γ-scaffold-as-generation-constraint is structural to triadic docs cycles, not cycle-specific. The next signal worth surfacing is whether the pattern holds for non-docs cycles or whether the scaffold's pre-flagging operates differently when α's surface is code rather than doctrine prose.

## Engineering-level reading

**For docs-only doctrine cycles producing validator-checked artifacts:**

- The validator's literal contract (e.g. `cn-cdd-verify:495,573`'s `^## CDD Trace` grep) is authoritative for section-header naming. Doctrine surfaces that enumerate section names in a shorthand (the `§Name` form) are normative *prose* but not validator-binding contracts. α's authoring discipline must read the validator source when authoring section headers — the SKILL.md enumeration is a guide, not a contract.
- Convention precedent on `origin/main` (the most recently released cycle's `self-coherence.md`) is a load-bearing reference α should grep before authoring a new cycle's section headers. This cycle's F1 was detectable by `git show origin/main:.cdd/releases/docs/{ISO}/{N}/self-coherence.md | grep '^## '` before authoring; α did not run that check.
- AC oracles whose cost is bounded (`awk + rg`, `test -f`, `rg -c`, `git diff --stat`) generalize from review-time checks to per-section authoring constraints. The cost is N re-runs; the benefit is incremental substrate-cleanliness. Same class as the eng-skill discipline of "run the linter after every save."

**For #366 Phase 2–7 inheritance:**

- The kernel slice (`## Kernel`, `## Cell Outcomes`, `## Recursion Modes`, `## Scope-Lift`) is what Phases 2–7 will cite. Non-kernel sections (Preamble, Two-Layer Separation, Non-goals, Closure) carry contextual framing but are not citable as kernel content. The AC7 section-boundary convention is now a doctrine-level CI shape, not just a per-cycle oracle — downstream phases that need substrate-independence can extract the kernel slice with the same `awk` recipe.
- The AC3 signature variant (γ.close 4-arg with evidenceₙ as a typed input; V 2-arg dereferencing from receipt) is the load-bearing claim Phases 2–7 will cite. Phase 2 (#369 schemas, in flight) is typing the receipt and contract; Phase 3 (`cn-cdd-verify` rewrite) is implementing V's command-wrapper; Phase 4 (δ split) is naming δ's signature. The doc's typed signature is what these phases inherit. If γ-PRA wants to reconcile the issue-body's notation with the doc's, the reconciliation lands before Phase 2's schemas freeze the typed shape.
- The two recursion modes (within-scope repair-dispatch vs cross-scope scope-lift) and the three scope-lift projections (closed cell → α-matter; δ → β-discrimination; ε → γ-coordination) hand Phase 4 (δ split) and Phase 6 (ε relocation) their structural contracts. δ's signature (`δₙ.decide(receiptₙ, verdictₙ)`) is the kernel's commitment; Phase 4's `delta/SKILL.md` authoring inherits the no-evidence-re-read constraint. ε's signature (receipt-stream observation projecting as γₙ₊₁-like coordination/evolution) is the kernel's commitment; Phase 6's `epsilon/SKILL.md` move inherits the projection-not-renaming framing.

**For the `extensions.worktreeConfig=true` identity-truth class:**

- When the repo enables `extensions.worktreeConfig=true` at the shared `.git/config` layer (this repo does), plain `git config user.email X` (no `--worktree` flag) writes to the shared layer and is overwritable by any sibling-worktree process. The initial verification will pass; the commit-time read may not. `alpha/SKILL.md` §2.6 row 14 currently describes the retroactive fix (path a) but does not prescribe the preventive write at session start. The mechanical preventive: when `git config --get extensions.worktreeConfig` returns `true`, every identity write must carry `--worktree`. β R1 row 1 surfaced the leak inside the merge-test; α F4 in this close-out surfaced it inside the close-out re-dispatch. Two roles, one cycle.
- The detection cost is bounded: one config-read at session start (`git config --get extensions.worktreeConfig`) determines whether the role must add `--worktree` to its identity writes.

**For the validator-literal-vs-skill-prose drift class:**

- The drift between `alpha/SKILL.md:217,352` (`§CDD-Trace`), `cn-cdd-verify:480` (comment `CDD-Trace`), and `cn-cdd-verify:495,573` (grep `^## CDD Trace`) is the surfaces' canonical mismatch. The validator's grep is authoritative; the SKILL.md enumeration and the validator's own comment are the drifted surfaces. The validator's comment-vs-grep mismatch is the more interesting signal: a single file carries the drift internally, which is a stronger signal than the cross-file SKILL.md↔grep mismatch.
- This class is detectable mechanically: a future α-side pre-review gate row could grep the validator source for `grep -q "^## "` patterns and cross-check each against the SKILL.md section enumeration. The check's cost is bounded; the benefit is closing the class for all future cycles. γ-PRA owns whether to surface this as a skill patch.
