---
status: historical
created: 2026-08-19
archived: 2026-08-19
reason: "Stage-C evidence: the independent adversarial review of W2 (e) — the client intent listener, PR #6039 — at the build tip 2ce7cb8c7: LANDABLE-WITH-FIXES (0 BLOCKER / 1 MAJOR / 7 MINOR / 6 NIT); every finding addressed in the fix pass (w2-intent-fix-report.md)."
---

*Recovery note (fix pass, 2026-08-19): the independent reviewer's report,
landed on-branch VERBATIM below (source: the reviewer's durable copy at
`/Users/berni/labs-worktrees/w2-intent-review-report.md`; the review
worktree `/Users/berni/labs-worktrees/review-w2`, detached at
`2ce7cb8c7`). Every file:line in it is at the BUILD tip `2ce7cb8c7`,
BEFORE the rebase onto `461b01822` (review MIN-7) and the fix commits —
the code lines moved by the fixes (the check's live-set gate, the
per-entry try/catch, the per-fire watch kick) and the test file grew by
three pins. The dispositions, red/green evidence, and final suite counts
are in the companion
[`w2-intent-fix-report.md`](w2-intent-fix-report.md); the build report
the review examined is
[`w2-intent-build-report.md`](w2-intent-build-report.md), corrected in
place with dated notes.*

# Independent adversarial review — PR #6039 (labs): stage C build W2 (e), the client intent listener

Reviewer: independent, read-only (nothing pushed, nothing commented, no PR interaction).
Tip reviewed: `2ce7cb8c7` (`claude/server-exec-v2-w2-intent-listener`) in worktree `/Users/berni/labs-worktrees/review-w2` (detached).
Stated base: `461b01822` (`claude/server-exec-v2-stage-c-design`). ACTUAL merge-base: `c3ec7fc7b`. The base branch moved by one commit (`461b01822`, the W0 (d′) docs landing) after W2 branched, and the branch is NOT rebased onto it — see finding MIN-7. Every file:line below is at `2ce7cb8c7`; the diff reviewed is `c3ec7fc7b..2ce7cb8c7` (15 files, +2139/−192).

Everything stated as fact below was re-derived by reading the code/tests/artifacts or by running them; the PR body / build report were treated as claims and are marked "(claim, confirmed)" or "(claim, not re-run)" where relied upon.

---

## 1. Verdict

**LANDABLE-WITH-FIXES.**

- No BLOCKER found: I could not construct a schedule under which an intent that the OLD sink would have retired is NOT retired by the new listener, nor a lost notification the backstop does not catch, nor an OFF-arm change. The retirement paths were enumerated (§4 axis 1) and each ends in retired / retired-by-backstop (echo) / equivalent-to-old (fail-soft, loud).
- One MAJOR (latent, one-line fix): the new check can apply an already-retired id a SECOND time when an outcome subscriber re-fires synchronously on the same sidecar — the PR's self-review claims this re-entrancy is safe and it is not (reproduced, §2 MAJ-1).
- Several MINORs: a pin-coverage gap (a multi-doc notification shape survives a lossy mutation), a spec sentence that says more than the code does ("never O(history)"), the branch not rebased onto its stated base (docs conflict), the un-numbered tracked-set drain gap that hangs the durable-ack callback, a cheap watch-hardening, and the pin-10 wording being weaker than the design's.

---

## 2. Findings by severity

### BLOCKER — none.

### MAJOR

**MAJ-1. Re-entrant `trackIntent` inside an outcome callback makes the outer check apply an already-retired id twice (duplicate `dropped`/`errored` signal; stale memo). Regression vs the old live-set guard; the self-review's "re-entrancy is safe — `pending` is a copy" is wrong precisely because it is a copy.**
`packages/runner/src/speculation/overlay-destination.ts:976–1000` — `#checkIntents` snapshots `const pending = new Set(ids)` (:976) and `consider` (:978–987) gates on `pending.has(entry.eventId)` only. `#applyIntentEntry` (:1119) → `#notifyIntentOutcome` calls arbitrary subscribers synchronously. A subscriber that re-fires on the same sidecar (a retry-on-drop UI — exactly the hook events.md §5 mandates) calls `trackIntent` → an INNER `#checkIntents` on the same `ids` which retires X; control returns to the outer loop whose `pending` still holds X → the outer `consider` finds X's entry and runs `#applyIntentEntry(X)` AGAIN: `#untrackIntent` is a no-op, `retireIntent` a no-op, but `#settleIntentConsequence` re-memoizes a terminal outcome for X (the memo is "bounded by in-flight fires" — this entry is orphaned) and `#notifyIntentOutcome` delivers `dropped:X` / `errored:X` a SECOND time. With a retry-on-drop subscriber that is a DOUBLE re-fire of X (two fresh appends for one user action).
Reproduced with a scratch scripted test (seed entries [X, Z]; track both; subscriber re-fires once on the first outcome; one notification marks both dropped, hints Z then X): outcomes = `["dropped:Z","dropped:X","dropped:X"]`, `pendingIntentCount` 1 (the retry). The OLD `#scanIntentNotices` checked the LIVE `ids.has(...)` per entry and could not double-apply (and its `trackIntent` returned early when a sink existed, so no nested scan at all).
Latent today: no production `subscribeIntentOutcomes` caller exists (grep: only tests + the definition), so the user-visible impact is nil until a UI subscribes — but the hook is the ruled UI hook, so this should land fixed.
Fix shape (one line): in `consider`, gate on the LIVE set re-fetched from the map (the `ids` Set object can be deleted and recreated by the inner check): `const live = this.#trackedIntents.get(space)?.get(sidecarId); if (live === undefined || !live.has(entry.eventId)) { pending.delete(entry.eventId); return; }` before applying. Pin: the scratch scenario above (two marks in one check + a subscriber that re-fires) expecting exactly one outcome per id.

### MINOR

**MIN-1. Pin vacuity gap: a notification whose merged changes span TWO tracked sidecars is not covered — the mutation "record only the first wanted change per notification" (`doc-notification-listener.ts:136–143`, `break` after the first `#record`) survives every shipped pin.** Ran it: `speculation-intent-listener` 2/9, `event-append-client` 4/15, `speculation-arrival-gate` 1/6, `executor-effect-channel` 1/15 all GREEN under the mutation (8 passed / 45 steps). Under that mutation the second sidecar's intent is checked only on its NEXT own change — possibly never (its `waitForIntentConsequence` hangs; the echo still retires by W). One frame carrying a wave commit that marks two of the client's sidecars is an ordinary shape (two streams fired by one client in one wave). The TIP handles it correctly (verified with a scratch probe dispatching one notification with changes on two sidecars: both retired, 4 checks), so this is coverage, not behavior. Fix: a scripted pin that dispatches ONE notification with changes on two tracked sidecars (the harness's `deliver` takes one doc; extend it or dispatch to `scripted.subscribers` directly) asserting both retire. Note the harness's address shape (no `scope`) differs from production's (`scope: "space"` — `differential.ts:65–72`); the e2e pins 6/10 are the real witnesses of the production shape (probe MX4 below).

**MIN-2. Spec sentence says more than the code does.** `docs/specs/server-side-execution/speculation.md:123–125`: "the check runs in a microtask and is O(outstanding), never O(history)". In the code (a) the IMMEDIATE check at `trackIntent` (:832) is not in a microtask and walks the whole array for a fresh id (pin 5 itself asserts `visitsAfterTrack === 1000`; the build report §3 and the register's "Not rows" bullet :3998 admit it); (b) a notified check with no usable hint walks from the tail to the tracked entry — O(entries appended after mine), which on a busy shared stream with a stuck event is O(k) per notification, O(k²) cumulative (a plain JS walk, microseconds at k≈100, but not "O(outstanding)"). The design's own §3.3 wording ("O(outstanding + hints), degrading to a raw O(E) array walk only when a hint misses") and the ruling (item 4 says nothing about cost) are both weaker than the landed sentence. Fix: either soften the spec clause to the design's wording ("no transaction, no dependency; per notified check O(outstanding + hinted indices), a missed hint degrades to a raw tail scan") — or make the code meet it: memoize each located index into `state.hints` after the first location so later checks for the same id are O(1) (the hint machinery already exists; `#checkIntents` :988–1000), which also removes the O(k²) on busy streams. The register block is honest about this; only the spec sentence overclaims.

**MIN-3. The "tracked-set drain" gap deserves a NUMBERED row now, not "recorded, not a row" (`verification-coverage.md:3988–3997`).** The consequence is not only `waitForIntentConsequence` hanging: `cell.ts:1655–1680` (the `waitForIntentConsequence` await at :1670) routes the caller's durable-ack `onCommit` through `overlay.waitForIntentConsequence`, so a never-draining intent hangs the CLI verb dispatch / webhook-forwarder ack forever. Today it is unreachable only because OW24 compaction is unbuilt (verified: the watermark is recomputed from the contiguous consequenced frontier, so `eventWatermark ≥ seq(e)` implies the mark is present; nothing else removes an entry). The builder's fix shape (~10 lines, record `seq` at first sight; treat `eventWatermark ≥ seq` with the entry gone as consequenced) is right; the row should be minted with OW24 as its trigger so the compaction PR cannot land without it. Not a hole today.

**MIN-4. The sidecar watch is a single best-effort kick; a transient `sync` failure at the first fire on a stream leaves that stream's intents unretired (NO frames arrive at all) until the set drains and a later fire re-creates the state.** `overlay-destination.ts:858–889` (`#watchIntentSidecar`, called only when `#intentSidecarStates` lacks the key, :826–829). Probe MX5 (watch never established) shows the watch is LOAD-BEARING: e2e pins 6 and 10 time out ("the sidecar to arrive at the client" / "the consequenced mark to arrive") — the event-append path itself does not put the sidecar doc in the client replica. Equivalent to the old code (`cell.ts:2765` — one `if (!this.synced) this.sync()` kick), so not a regression, and the arm is loud (`intent-watch-failed`). Cheap hardening: re-kick `sync` on EVERY `trackIntent` (a covered watch is a replica no-op via `#watchSelectorTracker.getSupersetSelector`, `v2.ts:3286`; a failed pull deletes its tracker entry, :3359, so the re-kick retries), or retry on `result.error`.

**MIN-5. Pin 10 as landed is weaker than the design's pin 10.** Design §3.4 #10: "the check has run by the time `storageManager.synced()` / `idle()` resolve after a frame". The landed e2e pin asserts "by the time the mark is visible on a MACROTASK poll" (`speculation-intent-listener.test.ts:597–606`). The microtask check is ordered after whatever microtasks the frame's dispatch queued earlier (a `synced()` resolver queued before the notification would run before the check), so code that does `await synced(); read intent state` has no guarantee — the landed pin does not claim one, the design sentence does. Either restate the design/register row to the landed guarantee ("within the same macrotask turn") or add the stronger pin if it is actually wanted. NIT-adjacent, but it is a spec-vs-pin mismatch the register presents as covered.

**MIN-6. `wants`-shape mismatch between the scripted harness and production is invisible to the scripted pins.** `speculation-intent-test-utils.ts:130` builds change addresses WITHOUT `scope`; production's differential always sets `scope: "space"` (`differential.ts:65–72`, `normalizeCellScope`). Probe MX4 (`wants` accepting only `scope === undefined`) keeps all scripted pins GREEN and is caught only by e2e pins 6/10. Fine as long as the e2e pins exist; worth one line in the harness (`scope: "space"`) so the scripted seam matches the wire.

**MIN-7. Branch hygiene: not rebased onto the stated base; docs-only conflict.** `git merge-tree --write-tree HEAD 461b01822` → CONFLICT in `docs/plans/server-execution-v2.md` (both sides edited the coordination block); `stage-c-design.md` auto-merges; no code overlap (461b01822 is docs + w0-dprime-raw only). A rebase with a hand-merge of the plan block is owed before merge. Every hunk of `c3ec7fc7b..HEAD` belongs to (e) (per-commit file audit: 8 commits, all (e) files); no `deno.lock` churn; the foreign stash `stash@{0}: On recipe-dx` is intact and nothing of it is in the diff. The (b) scratch commit `e91194469` (interim narrowed sink) sits in history and is fully reverted by `8212c0fac` (no remnant of the narrowed schema in the tree) — fine under squash, a smell under merge-commit.

### NIT

- **N-1.** Spec/register "pins 1–11, each with its mutation" (`speculation.md:127`): pins 3/4 are folded into pin 1's step and pin 11 has no mutation (the OFF witness) — say "each with its mutation or witness".
- **N-2.** `#checkIntents` has no per-entry try/catch; the old path ran inside a scheduler effect whose catch logged `schedule-error`; a throw now escapes the microtask (uncaught). In practice nothing in `#applyIntentEntry` can throw (`resolveVerdict` is a promise resolver; subscribers are try/caught) — held, but a `try { this.#applyIntentEntry(...) } catch { warn }` around the one call would keep the remaining pending ids of that check from being stranded by a future regression.
- **N-3.** Backward (tail-first) scan vs the old forward scan changes WHICH twin's mark is read when a T25 duplicate coexists with its consequenced original (e.g. original `consequenced+error` at i, duplicate unmarked at j>i): the new code waits for the duplicate's own mark (`skippedIdempotent` → `consequenced` without error → signals `consequenced`), the old read the original's `error`. Arguably more correct (this fire's own consequence), but it is a behavior change in a corner the PR does not mention.
- **N-4.** Numbers' wording: the PR body's "loads 2.0–5.5" for the W0 gate understates the in-run peak — b1 (baseline) hit 6.12 on the 1-min average mid-series (`runs/b1-note-on/load-samples.txt` 07:04:59Z), e1 ≤ 5.0, a1 5.98 at the end. The baseline arm ran under the highest load of the four, which inflates the ratio slightly; the flat-vs-monotone SLOPE is the robust signal and is unaffected.
- **N-5.** `intent-echo-retired-by-backstop` counts ECHO entries swept by W, not missed marks: the chat witness's 2/25 coexists with 25/25 `overlayIntentsByConsequenceOf` — the arrival sweep (synchronous inside `applySessionSync`, `v2.ts:5075–5089`) can retire the echo before the mark's microtask check runs. Worth one sentence in the register's counter bullet so nobody reads 2 backstops as 2 lost notifications.
- **N-6.** The re-seamed `event-append-client` pin's first `feed` uses the default `[[]]` whole-doc path; fine, but it means that pin exercises only the tail-scan arm (the hinted arm is pinned in the new suite).

---

## 3. Mutation-probe table

All probes applied by editing the source, running the named suites FOREGROUND with `--no-lock` and the package preload, then `git checkout --` the file; tree clean after each (`git status --short` empty).

| probe | mutation (file) | builder's claim | observed | verdict |
|---|---|---|---|---|
| M1 | `#ensureIntentListener()` never called in `trackIntent` (overlay :833) | red: pins 1,2,5,7,8,9 + e2e 6,10 | RED exactly those 8 steps; pin 11 green (0 passed 1 step / 2 failed 8 steps) | confirmed |
| M5a | full forward scan, hints ignored (overlay :988–1000) | red: pin 5 (visits 1 001) | RED pin 5 only: `Actual 1001 / Expected 1` | confirmed |
| M5b | the check mints a tx (`runtime.edit()` swallowed, overlay :968) | red: pins 1 + 5 | RED pins 1, 5 | confirmed |
| M7 | immediate check skipped (overlay :832) | red: pins 5 + 7 | RED pins 5, 7 AND e2e pin 6 (`intentCheckCount ≥ 2`) | confirmed (superset) |
| M9 | dispatch inline from `next` (listener :160–167 → call `onNotify` synchronously) | red: pins 8 + 9 | RED pins 8, 9 | confirmed |
| MX1 (mine) | `break` after the first wanted change per notification (listener :142) | — | ALL GREEN: intent-listener 2/9, event-append-client 4/15, arrival-gate 1/6, effect-channel 1/15 (8 passed / 45 steps) | **gap — MIN-1**; tip behavior verified correct by a scratch two-sidecar probe |
| MX4 (mine) | `wants` accepts only `scope === undefined` (overlay :896–898) | — | scripted pins GREEN (harness sends no scope); e2e pins 6, 10 RED | e2e pins are real production-shape witnesses; harness shape mismatch — MIN-6 |
| MX5 (mine) | `#watchIntentSidecar` never syncs (overlay :858) | — | RED pins 1, 7 (`syncs` asserted) AND e2e 6 ("timed out waiting for the sidecar to arrive at the client"), 10 ("…the consequenced mark to arrive") | the watch is load-bearing; pins 6/10 are real witnesses of item 8 |
| MX-reentrancy (mine, scratch test) | none — tip code | self-review: "re-entrancy … is safe" | outcomes `["dropped:Z","dropped:X","dropped:X"]` | **MAJ-1** |
| MX-multidoc (mine, scratch test) | none — tip code | — | one notification on two sidecars → both retired, 4 checks | tip correct; coverage gap only (MIN-1) |
| "read the captured `after`" | structurally excluded: the listener never passes `after` (only paths); no pin asserts the raw read count (`scripted.reads` collected, never asserted) | — | — | held; NIT-level (contract point 4 has no direct witness beyond the reset case) |

---

## 4. Axes held / worked

**Axis 1 — retirement completeness (the schedules).**
- Mark lands BEFORE `trackIntent` (T25): the immediate raw check (:832, before install) resolves it; pin 7 real (M7 kills it). ✓ retired.
- Mark lands AFTER: install is synchronous in the same call (:833); nothing async between check and install; the relay (`subscription.ts` `StorageNotificationRelay`, manager-owned `v2.ts:772/989`) delivers; `wants` = live-set lookup; microtask check; hint `["value","entries","<i>","consequenced"]` verified (differential array/object branches `differential.ts:139–243`: append → `["value","entries"]`, key-add → leaf). ✓ retired.
- Notification while a coalesced dispatch is pending: `#record` appends paths to the SAME record (:169) and the microtask reads `due.paths` at run time — nothing dropped. Two notifications on one doc → one check over the union. A notification arriving DURING `onNotify` (record already deleted :163) → a new record + new microtask. ✓
- Release on set-empty while a dispatch is queued: release happens only when NOTHING is outstanding anywhere (:1197) → every queued dispatch is for a doc with nothing to check; a later `trackIntent` does an immediate check and installs a fresh listener (`#intentListener` is set undefined before `release()`, :932–934; `ensure()` on a released instance is a no-op by design, the overlay never reuses one). ✓
- Intent tracked after release: new listener. ✓
- Mark via a different path: client's own writes never mark; overlay layers never touch the sidecar; replay on reconnect → `Provider.#syncRequests` replay (`v2.ts:2071–2076`) re-arms the watch on the replacement replica; the relay is manager-level so the subscription survives replacement; `reset` (only emitted from `replaceProvisionalReplica`, `v2.ts:2069/3740–3764`) is relayed as "everything in the space dirty" and the subsequent pull notification re-checks. ✓
- Shadowed foreign value under an own pending write (`v2.ts:4984–5025`): the sidecar pending layer is an APPEND PATCH re-applied over the new confirmed base, so a mark integrating under it is visible and diffed; parked accepts apply before the differential (:5048–5054). ✓ (machinery unchanged by W2.)
- Fail-soft install (`subscribe` throws): loud `intent-listener-failed`; the echo retires by W; the tracked set drains only on the next `trackIntent`'s immediate check — identical posture to the old `intent-sink-failed`; unreachable with the production `StorageManager` (`subscribe` is `Set.add`). Held, equivalent.
- Watch failure: MIN-4 (equivalent to old, loud).
- Compaction-removed entry: not reachable today (OW24 unbuilt); MIN-3.
- Conclusion: every schedule I could construct ends retired, retired-late-by-backstop (echo only, counted), or equivalent-to-old-and-loud. No NEVER.

**Axis 2 — the check itself.** Raw read: `storageManager.open(space).replica.getDocument(id,"space")` (:958–962) = `visibleDocument` = confirmed + cached pending materialization (`v2.ts:2833–2839, 5694–5716, 455–490`) — no tx, no proxy, no clone per call; no `runtime.edit` (pin 5's `edit` throws-and-counts = 0; M5b kills it); no CFC probe (no tx); no scheduler node (pin 6, M6 not re-run by me — M1's e2e reds and the graph filter make the witness real). Hints: verified by `eventId` (:981–986), cleared on consume (:990), wrong/stale hint → tail scan (pin 5's "moved" case ✓). `intentCheckVisits` is honest (counts every `consider` incl. the O(E) immediate walk — pin 5 asserts 1000 for it). The two RULED guards: "never a dependency on HISTORY" is structural (no tx ⇒ no dependency log; pin 5/6); "W ≥ seq(e)" is enforced for the ECHO by `#sweep` (:1504–1512 log + the unchanged W coverage), NOT for the tracked set (MIN-3). `overlayIntentsByConsequenceOf` counts `#applyIntentEntry` retirements — real.

**Axis 3 — the sidecar "stays watched via the schema-less sync": wire/replica term.** `Provider.sync` → `replica.sync` → `pull` → `enqueueWatchRefresh` → `refreshWatchSet` → `session.watchAddSync` (`v2.ts:1983–2010, 2604–2628, 3199–3330, 3766–3869`): a STANDING watch (a session watch root with the `{path:[], schema:false}` selector — the same selector `syncInstance`/`syncCell` use, `v2.ts:1657–1662` and `1595–1604` — `schema: schema ?? false`), deduped against covering selectors, replayed on replica replacement. Per sidecar change the server pushes `SessionSyncUpsert` with the WHOLE doc (unchanged from the old `cell.sink`→`syncCell` path — same selector, same frame); the replica does a pointer swap + `materialized = undefined` (O(1)) and the differential deep-compares before/after O(E) (no pointer sharing across two parsed frames) — computed once per frame whether or not the listener exists (the scheduler is subscribed; `hasNotificationSubscribers` `v2.ts:5803`). So: the SCHEDULER term is gone (the W0 flat `scheduler/run` is the witness); the WIRE (O(E) bytes per change) and DIFFERENTIAL (O(E) compare per change) terms are unchanged by W2, linear in history, and bounded only by compaction (OW24) — exactly the design's §3.6 residual. The a1/e1 series (E ≈ 80–100 entries at n=20) cannot see them; they will show at E in the thousands. Stated, not a regression.

**Axis 4 — effects channel on the listener (item 13).** Separate `CoalescedDocListener` instance (`effects-channel.ts:223–233`), own subscription, own `#pending`; no cross-coalescing with the intent listener is possible. Reconcile logic byte-identical (:262–360), now from a microtask over the raw session instance (`getDocument(EFFECTS_ID,"session")`, :241–244, resolved from the replica's own identity like the old `scope:"session"` cell). `EffectIntentTarget` is a plain `{space?,id,path,scope?}` object (`memory/v2.ts:489–494`), not a sigil link, so the raw read equals what the proxy delivered. Own ack → commit notification → reconcile sees `acks[nonce]` in the pending layer → skip; a rejected ack → `#acking` cleared on error → re-ack on the next delivery. LT8 (`executor-effect-channel.test.ts:928–1043`) is real: life 2 is constructed AFTER the intent commits, so it can only learn of it via the explicit `sync` → `#reconcileFromReplica` (:185–200) — exercised; 15/15 green under my run (and under MX1). A subscribe failure now leaves the space un-subscribed and retryable (:210–213). Held.

**Axis 5 — pin vacuity.** See §3. Builder's M1/M5a/M5b/M7/M9 reproduced and match (M7 kills one more pin than claimed). Gap: MIN-1 (multi-doc notification). Harness-shape caveat: MIN-6. The re-seamed `event-append-client` pin drives the notification seam (its old `getCellFromLink().sink` stub is gone; under M1 the whole scripted family is red, so the re-seam is real).

**Axis 6 — OFF byte-identity.** The overlay is constructed only in `#speculationDestination` (`runtime.ts:1922–1927`: `serverExecution !== true → undefined; servingPosture → undefined`), the effects channel only under the same gate (`runtime.ts:1357–1370`); `CoalescedDocListener` is imported only by those two; `trackIntent` is reached only in `cell.ts`'s flag-ON branch (:1581–1611). The only OFF-reachable changed files are test/harness (`clock-preload.ts`, `cfc-browser-helpers.ts` — counters that read logger keys, 0 OFF). Pin 11 is a real (if weak) witness: it wraps `manager.subscribe` AFTER construction and asserts 0 subscriptions on a fire + no overlay + local handler result. "OFF suites byte-identical" = the runner suite runs OFF-posture and is green (1213/6728, re-run by me); no OFF benchmark bracket was run (the builder says so). Held.

**Axis 7 — numbers' evidence trail.** Raw artifacts EXIST and support the numbers: `/private/tmp/claude-501/-Users-berni-looms-primary/0e87bf81-…/scratchpad/w2bench/` — `tip-{base,b,a}.txt` = `c3ec7fc7b` / `e91194469` / `7a5481d14`, `sha-on-*.txt` = `7a9157db3ec36ef0` / `c262190bda9fed13` / `7964711e835ea16f` (match the report), `runs/{b1,e1,a1}-note-on/` and `runs/ca1-chat-on/` each with `meta.json` (`gitSha` matching, `shellServerExecutionDefine:"true"`), `load-samples.txt` (10-s cadence), `per-note.txt`, `test.clean.log`, `toolshed.log` (one `No default model available` line each), `stats-pre/post.json`, `store/`. `per-note.txt` reproduces the quoted series verbatim (b1 `839 1660 3230 … 13948`; e1 `182 115 107 … 158`; a1 `101 91 82 … 80`; createToView columns likewise; the sink column `(0, 0, 0)` on a1). Chat churn line in `ca1/test.clean.log`: `overlayIntentChecks=75 overlayIntentsByConsequenceOf=25 overlayIntentEchoBackstops=2` / `10 3 0`, `actionRuns=2540` / `851` — as reported. Apples-to-apples in CLASS: same harness, same workload, same counters, ON binaries from adjacent commits, adjacent hours; loads are NOT equal (b1 peaked highest — N-4), so the ratio is indicative; the slope (monotone 0.84→14–20 s vs flat ≤0.33 s) is robust. The note runs' test step 1 is red on the pre-existing `splitDefinitions` console gate in all three (claim, consistent with the logs' `FAILED | 1 passed (1 step)`); the n=20 series completed (20 rows each). Not re-run.

**Axis 8 — spec/register honesty.** Items 5/6's sentence (`speculation.md:105–117`) matches the ruling (carrier sanctioned; `consequenceOf` not on the wire; tracked-entry-only; never HISTORY; W/eventWatermark backstop; item 9 folded). Item 8 (:118–122) matches ("keeps a stream subscribed while it has intents outstanding"; home named beside step 2 — the design left it to the build). Item 4 statement (:122–125) overclaims cost — MIN-2. Item 7 (`events.md:391–399`) matches the ruling; the server fact is plausible by inspection (`#sealEventConsequenceNotice` `space-server.ts:2163–2205` stamps an event-handler-kind tx with `eventId` + `streamEntry`, which also writes `consequenced:true` via `stampServerRun` :1224–1243, so drop/error notices carry the mark the client's arms read). "Stated honestly" phrase swept to mechanism-neutral (`speculation.md:164–167`) ✓. Register block (`verification-coverage.md:3856–4001`): every coverage row names a pin that exists; pin 10's row inherits MIN-5; OW40 (:3805, :3984) re-read and correctly still owed; the drain gap is recorded honestly but should be numbered — MIN-3; item 10 (scopes.md §9) correctly left to W1 (server-side text). The "(b) did NOT ship" statement is true (no narrowed schema in the tree).

**Axis 9 — branch hygiene.** MIN-7. Per-commit audit: every commit touches only (e) files; no foreign hunks; no lockfile churn; stash intact.

**Axis 10 — ordinary correctness/perf.** `CoalescedDocListener`: `#pending` Map keyed `${space}\0${id}` cleared on release; one microtask per (space, doc) per burst (bounded by wanted docs, not by changes); `#next` is O(changes) `wants` lookups with no allocation except `[...path]` per WANTED change; `release()` idempotent, unsubscribes with optional chaining (a manager without `unsubscribe` self-cancels on the next `next` via `{done:true}` :128); a released instance cannot be re-armed (documented; the overlay constructs anew). The relay iterates a live Set (`subscription.ts:38–46`); the listener never unsubscribes from inside `next`. Overlay: `#intentSidecarStates` deleted with the last id; `#intentListener` dropped on release/close; `close()` (:1542) releases + clears; `runtime.dispose` calls `close()` on both (`runtime.ts:1734–1737`). Exceptions in the dispatch path: N-2. The `#intentConsequenceMemo` unboundedness is pre-existing (lens report). No listener leak across spaces (one per overlay; `wants` filters by space). Microtask storms: impossible beyond (#wanted docs) per burst.

---

## 5. Suites / probes run; tree-clean confirmation

All FOREGROUND, every `deno test` with `--no-lock`, the package preload (`--preload=test/clock-preload.ts`, i.e. the `realClockFiles` list incl. `speculation-intent-listener`), explicit `timeout` caps ≤ 595 s per call.

- `packages/runner` full suite (the package task's exact flags + `--no-lock`): **1213 passed (6728 steps) / 0 failed** (9m02s, exit 0) at `2ce7cb8c7` — matches the builder's count; log at the session scratchpad `review-runner-suite.log`.
- Targeted at the clean tip: `speculation-intent-listener` 2/9, `event-append-client` 4/15, `speculation-arrival-gate` 1/6, `executor-effect-channel` 1/15, `executor-events-down` 1/13 → **9 passed (58 steps) / 0 failed** (34 s).
- Mutation probes: M1, M5a, M5b, M7, M9 (builder's), MX1, MX4, MX5 (mine), each run against the targeted suite(s); two scratch probe tests (re-entrancy, multi-doc) written under `packages/runner/test/zz-review-probe-*.test.ts`, run, and DELETED.
- `deno check --no-lock` on the three changed `src/speculation/*.ts` + the new test: clean. `deno fmt --check` on the 9 touched files: clean. `deno lint` on the 5 code/test files: clean. `tasks/check-docs-history-index.ts`: 120 entries / 163 documents (matches). `deno task check-docs` NOT re-run (it has `--allow-write`; builder's 548-blocks claim not verified).
- Benchmarks NOT re-run (per instructions); artifacts inspected as above.
- Tree: `git status --short` empty after every probe and at the end; no `deno.lock` churn; the foreign `stash@{0}` untouched (no `git stash` used); worktree `/Users/berni/labs-worktrees/review-w2` left detached at `2ce7cb8c7`.