August 26, 2026

The loop emitted Seeked on every engine position report and once more on every track change, so the bus saw a signal per tick and a client watching for a discontinuity learned only that time passes. The spec is narrow: PropertiesChanged never fires for Position, and Seeked means the position moved inconsistently with the playing state.

An agent that ingests the transcript first only performs curiosity. The boundary is therefore a writer, not a prompt: append refuses any note past the watched high-water mark, and records the refusal without its body.

Cargo.toml has claimed AGPL since July with no license text beside it and no README, which is the one thing that stops the tree shipping publicly.

Read Forge through the credential helper and public authority endpoint, treat API failures as failures, and evaluate every workflow attached to the newest candidate SHA. A green source gate can no longer hide a red package rail. Include RedFlag in the deliberate repository inventory.

Run 2467 signed 0.1.r12.g6e52a78804c3 for both arches and both edge databases carry it additively. Private archive only — no public release authority has been asked for, and nothing has installed it.

Player's package.yml validates against this manifest with --producer souveraine-player. It was absent from producers, packages, and both device profiles, so the first package run would have failed the ownership gate before it ever signed anything.

pkexec pacman -Syu authorises everything pacman would do. Operations carry the resolved set now, hashed on RedFlag's own byte contract so a token minted there verifies here, and re-derived before elevation: a repository that moves while you read the prompt refuses instead of installing.

The XferCommand every repo transfers through lived unowned under /usr/local, so no update could reach it. Its hardcoded host is gone — curl already scopes a netrc to the machines it names. Unset PACKAGER is why the archive signs packages reading "Unknown Packager".

A transfer meter redraws with \r, so lines() logged the animation, not the state. Keep the last frame; cap the log at a 500-line tail. overlay was #RRGGBBAA; QML reads #AARRGGBB — it dimmed at alpha 0x01.

Cut 2 adds a verify-envelope path beside the closure-token executor. The helper parses an envelope, binds it to the independently provisioned agent identity, validates time and lifetime bounds, selects the trusted key, verifies the signed contract, checks backend payload shape, and then refuses with backend_not_migrated.

Cut 1 completes the dormant MutationEnvelope contract without changing any runtime path. Bind target_id to the provisioned agent identity, require canonical UUID v4 authorization IDs, cap authorization lifetime at the fleet TTL, and add an unsigned MutationReceipt carrying the audit join.

The old text claimed RedFlag production-hardened, a Souveraine maturity it does not have, and linked to a Codeberg that stopped being the record. Omission beats a stale claim; the greeting is not a claim and stays. Forge holds the engineering record, this file is only a window onto it.

Compile every owned Python entry point and keep the current native engine deployment outside the claim until its machine-specific build becomes reproducible.

Carry the maintained Blueline branch through the same Meson build and three-test contract that previously existed only in GitHub workflow syntax.

The source pipeline proves native and phone builds without borrowing authority over Pixel3Arch. Packaging remains with the current producer until the manifest migration.