# What was adopted from the 19 September backlog rationalization Date: 19 September 2026. This records what was done with [the rationalization audit](EVE_TASK_BACKLOG_RATIONALIZATION_2026-09-19.md) (commit `821d795f688`), what was deliberately not done, and what the work found that the audit had not. It is a record, not a tracker: nothing here is a task. The audit's findings were checked against the database and the source before anything was changed, and every one that was tested held. Its proposed structure, 28 execution groups with all 24,822 open items re-homed into them, was not adopted: the crosswalk behind it is 55 rules over those rows, three of the groups hold 18,000 of them, and a third rewrite of the board in three days is the thing the audit itself warns against. The findings were turned into small repairs where they bind. ## Adopted | Audit finding | What was done | Commit | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | | F01, F02: no edge between families; eight dangling references never printed | The resolver reads a key (`family:ID`), an id in a named file, a lettered id one other family has, a section gate (`§45`, `§52-§54`), an id in backticks, an abbreviated id, and a group id. `./eve check` asks an eighth question. 237 edges added, none dropped, no tracker text edited. | `4bed6cf5d0e` | | F03: the board said six shipped commands were not built | The list is rendered from the CLI's own map (`lib/planned.mjs`); the page now teaches `context`, `prompt`, `docs`, `note`, `promote`, `pull`, `resolve`, `git-setup`. Two specs that pinned the stale text were corrected. | `c62726e9309` | | F09: Psyche's gateway reported its database and Redis healthy unprobed | `/ready` connects to both, answers 503 when either is down, shares one answer for five seconds, and leaks nothing about the deployment. The gateway is deployed and public. | `1cadb313d1c` | | F01, F05: 55 presentation items ready with no prerequisite | Each open item of 0.6–0.14 was read; 45 carry a dated "depends on" sentence from their own text. EI.8.00 is new: decide where authoring runs before it is built. The board offers the phase's real frontier, eight items, not 55. | `dcf49003a99` | | F04: safety-automation tasks described fixes already made | SA.1–SA.8 rewritten against the code; SA.9 added. See "Found while adopting". | `76c08aba166` | | F06: T.00.06 asked for nine ADR-0008 questions; the ADR has eleven | A dated sentence on the item names Q10 and Q11. | `df917faa4bf` | | F01, F08: 182.C.40.01 was ready while its own text named a corpus blocker | `./eve dep add` on 182.C.33.01, then `./eve park --reason corpus`. The family's other six ready items were read and left as the 18 September re-read decided. | `93954070cfd` | | F02: 56 ready items said `[later]` on their own first line | An item labelled `[later]` straight after its id is Later on both boards. `[V1.1]` and `[V1.2]` are planned releases and stay actionable. | `e0f546a566f` | | F08: OYA.G1 and OYA.G2 each named the other | G1 goes first from one statically admitted fixture model; G2's measurements depend on G1. One edge, no cycle. | `e0f546a566f` | | F09: Aphrodite's metrics were literals | The router reports the counts the discovery store already queries and a real database probe; an unmeasured series is absent in Prometheus and `null` in JSON; a failing source is reported as down. | `71dbceb6b10` | ## Found while adopting, and not in the audit 1. **`./eve dep add` did not survive an import.** It wrote only the database; the importer diffs the graph against what the trackers state and deleted the edge (measured on a copy of the real board: 0 → 1 → 0). It now writes the sentence the importer reads into the tracker, `rm` takes out only what it wrote, and a `procedure` family refuses (`4bed6cf5d0e`). 2. **The merge driver could not delete.** It took the union of both sides' edges and links and never read the base, so a merge put back the eight dangling links one commit after they were resolved (`650dde584f9`). 3. **The merge driver called a moved task a conflict.** Two sessions each shifted line numbers in one tracker; 1,557 tasks were journalled as conflicts (309,851 bytes) and forced to `ready`, parked and deferred ones included, until the next import. It now compares what a task is, not where it sits. It also wrote its output loose: 26,951,680 bytes from two boards that each passed the size check. It now compacts the file it has just created (`02f819e66ba`). 4. **The safety service's evals API fabricated its results.** The golden-set run scored each example's expected answer as the answer, the adversarial run scored a canned refusal chosen by the prompt's expected behaviour, and the app wired a framework that returned `passed: true` whatever it was given. No system was ever queried, every route answered 200 with a 100% detection rate, and all 156 tests passed. Neither this audit nor the 18 September rewrite saw it; the audit marked the routes' premise as met. It is now a fail-loud seam: no system under test, no run, and 503 `not_configured` on all eleven routes (`76c08aba166`). SA.9 binds something real. 5. **Two specs had been failing on main**: one pinned `promote` as unbuilt, one pinned the Docs Center at exactly 3,121 pages (`c62726e9309`). ## Not adopted, and why - **The C01–C28 re-homing and `task-dispositions.tsv` as board structure.** The groups are a reading aid. Waves 0 and 1 are what the repairs above deliver; C17–C19 are containers, as the audit says of C19 and C20 itself. - **An option register for Isis A.03.05, E.01.07, E.04.05, E.06.04, F.03.05 and L.07.01.** All six were already parked on 18 September, each with a dated sentence stating its trigger. Moving them changes nothing the board does. - **Expanding the Isis tracker's 43 heading-level `Dependencies:` lines into edges.** Each is qualified prose about whole sections ("T.01 per family"). Expanded mechanically they would hold about 200 items behind every open item of several sections. An item that waits says so in its own body. - **Retiring P2 §§59–72, consolidating the companion tracker, merging the old agentic-content ledgers.** Each is a judgement about what work is still wanted, which is the owner's. The §-gates those re-verification items state are now real edges, so none is handed out early. - **Deferring `[V1.1]` and `[V1.2]` items.** They are planned releases; putting V1.0 first is a ranking decision, not a deferral. - **The evidence bundle as a living check.** Its `--check` is pinned to the board's bytes and has failed since the first change after it, as its README says it should. It is a snapshot of `e6a64111e3a`. ## Decided by the owner later the same day The four questions this record first left open were put to the owner and answered. 1. **The failing Eve SOTA gate: fix it here.** Tasks 5.30–5.35, added to the ledger by another session without their record, now have explicit dependencies and proof scopes, the matrix owns them, and `verify-gap-task-evidence-exit.mjs` reports 211 task owners on an acyclic graph. Measured before re-pinning: the ledger before the addition hashes to the previous pin, all 205 existing requirements and states are unchanged (`36d5e1ebf4e`). 2. **The board's size budget: 32 MiB stays.** The note beside it is corrected (a zero freelist is not an empty file; what took the board over 25 MiB was the two merge defects), and `./eve check` now also reports growth of more than 512 KiB since the committed board, because both defects arrived as one jump that only the old budget noticed. 3. **EI.8.00: authoring is a local-operator capability.** Decision 6 of `authoring/four-surfaces-architecture.md`, with a file and line for each fact. Checking them found the read side has the same gap and a cheaper fix, so EI.5.06 and EI.8.07 were added (`a4b5dec53a9`). 4. **SA.9, delegated ("go with what you think is best"): the family is deferred.** Nothing calls the service and none of its fleet is deployed, while the shipping product has its own measured red-team programme. It now refuses to start in production outright, naming SA.5, SA.7 and SA.9, where a flag nothing read used to let it through (`bf00c3d834c`). Closing EI.8.00 found one more defect the audit had named only as a risk (F03): every `./eve import` reset a held task to `ready` and left its claim row, so the task could be neither closed nor re-claimed until the lease ran out (`2fa86516576`). ## Still open - **The 1,557 false `merge-conflict` events are still in the journal.** They were withdrawn once, with a `merge-conflicts-withdrawn` event recording why, and the next merge brought them back: the journal is a union by design, so a deletion on one branch cannot stick while another carries the rows. They are wrong but harmless (every one has the same status on both sides). - **Other verifiers in `tools/eve-everywhere` fail for reasons none of this touched**, and did before it: `verify-release-scope-dual-provider-free` and `verify-reliability-slo-contract` hash the whole ledger file and have been stale since before 15 September; `verify-deep-completion-matrix` reports a 4.2 label drift; `verify-operator-labor-accounting` pins an open 13.2 box; `verify-planning-fleet-lifecycle` pins source text that has moved. - **The fallback JWT secret is fleet-wide.** Six `apps/lilith/svc-*` services register `process.env.JWT_SECRET || ''`. None is deployed.