What is not built

Stated plainly, because a document that describes only what works is not a description of a system.

The end-of-campaign merge. Deep mode lands each piece on the campaign's branch. Getting that branch onto main at the end is a person's job, behind a checkpoint nobody has built. It binds deep mode only; in wave mode nothing accumulates.

A human-only approval surface. Approvals and waivers require a human, and no control surface yet distinguishes a human from an agent. A permission prompt is not that surface, and must not be treated as one.

A verifier that the enforcement floor is installed. A hook file present on disk proves nothing, and a settings entry pointing at a path that no longer resolves proves nothing. Until something checks registration, every claim here about deterministic enforcement is a claim about a file rather than about a running system.

Bookkeeping owed to the board that draws these pieces. Fourteen pieces carry no pull request link, one carries a bare commit identifier instead of a link, and twenty-two created before the step field existed carry no step. None of this blocks the landing floor, which no longer depends on any of it, but the board cannot draw the right picture without it. Separately, the pre-door population measured on 2026-09-08 — thirty live pieces carrying stage state with no entry record — is owed the adoption batch: a human runs adopt on each grandfathered tree root so the provenance refusals land on new work without bricking old work (adoption, not amnesty: the stamp says "predates the doors", never fakes an entry).

One known gap between two closers. A periodic job closes any piece whose pull request has merged, provided the piece is at review or integrate. The landing floor closes pieces only at delivery, and only after proof. The two never close the same piece, so there is no clash — but a piece still sitting at review whose pull request merges gets closed without ever passing through the landing floor. Nothing then records that it landed, and a container above it could count that piece as finished when nothing proved it.

One risk being carried rather than closed. In wave mode a leaf waits at delivery until a person merges, refusing on every pass, and that refusal is deliberately not counted as a failed attempt so the piece cannot be abandoned as broken. That is the intended design, and it has not yet been watched through a real unattended run.