diff --git a/.githooks/validate-a2ml.sh b/.githooks/validate-a2ml.sh
index 5020c8306..96fa5572d 100755
--- a/.githooks/validate-a2ml.sh
+++ b/.githooks/validate-a2ml.sh
@@ -245,7 +245,7 @@ validate_a2ml() {
     fi
 
     # The structured A2ML tree. Everything under a repo's machine tree —
-    # `machine-readable/` canonically, `.machine_readable/` in the legacy
+    # `.machine_readable/` canonically, `machine-readable/` in the minority
     # layout — is a typed agent-readable doc (CLADE, ANCHOR, STATE, ECOSYSTEM,
     # bot_directives/{debt,coverage,methodology}, ai/AI, policies/*,
     # integrations/*, …). Per the RSR convention these carry identity
@@ -256,10 +256,12 @@ validate_a2ml() {
     # positives on every repo built from the canonical template. Files outside
     # the machine tree are still validated.
     #
-    # The machine tree is named `machine-readable/` canonically (un-hidden
-    # 2026-08); `.machine_readable/` is the LEGACY name. BOTH are matched: the
-    # canon, scaffoldia, the julia variant and ~300 minted repos still carry the
-    # dotted form, while rsr-template-repo has moved. Matching only one name
+    # The machine tree is named `.machine_readable/` canonically (owner ruling
+    # 2026-09-17); `machine-readable/` is the minority spelling that
+    # rsr-template-repo adopted when it un-hid the tree in 2026-08 and has now
+    # reverted. BOTH are matched, and must stay matched: the canon, scaffoldia,
+    # the julia variant and ~300 minted repos carry the dotted form while ~9
+    # carry the hyphenated one. Matching only one name
     # makes whichever half of the estate has not migrated fail this check with
     # 16 spurious "missing identity field" errors -- which is exactly what
     # happened when the template renamed its tree and this action, being a
diff --git a/canon.lock b/canon.lock
index a4f4b7579..c894605e9 100644
--- a/canon.lock
+++ b/canon.lock
@@ -7,7 +7,7 @@
 # ---------------------------------------------------------------------------
 # WHY THIS FILE EXISTS
 #
-# rsr-template-repo's machine-readable/rsr-profile.a2ml currently declares its
+# rsr-template-repo's .machine_readable/rsr-profile.a2ml currently declares its
 # conformance with:
 #
 #     spec             = "rsr-criteria-v2"
@@ -42,9 +42,9 @@
 # ---------------------------------------------------------------------------
 # WHO READS IT
 #
-#   rsr-template-repo/machine-readable/rsr-profile.a2ml  [canon] block
+#   rsr-template-repo/.machine_readable/rsr-profile.a2ml  [canon] block
 #   rsr-template-repo/build/just/repo-init.just          writes PROVENANCE.a2ml
-#   minted repos' machine-readable/PROVENANCE.a2ml
+#   minted repos' .machine_readable/PROVENANCE.a2ml
 #   hypatia  ->  Hypatia.Rules.RsrConformance
 #   scaffoldia
 #   scripts/check-canon-lockstep.sh        (canon CI, Gate A)
diff --git a/docs/AFFIRMATION.adoc b/docs/AFFIRMATION.adoc
index bb4d4fe72..e0815f521 100644
--- a/docs/AFFIRMATION.adoc
+++ b/docs/AFFIRMATION.adoc
@@ -47,15 +47,20 @@ Binding now. Each item is checkable against the anchor below.
   fails Gate A assertion 2.
 . *Licence and SPDX are manual-only.* No agent has edited, swept or relicensed
   `LICENSE` or any SPDX header in this repository.
+. *Ruling R-A is settled: the machine tree is `.machine_readable/`.* The
+  hyphenated `machine-readable/` spelling is the minority form, not an
+  alternative canonical one, so this repository does not migrate. The census in
+  rsr-template-repo's `docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc` — **48
+  repositories dotted against 9 hyphenated** at the 2026-08 divergence — shows
+  the spine's 2026-08 un-hiding was the minority position. This confirms Ruling
+  10 of `STANDARDS-CRITICAL-PATH.adoc`. Both spellings still *resolve* in every
+  shared tool; neither is rejected.
 
 == We intend
 
 Committed next actions. **Not yet true.** Listed in execution order below; the
 release conditions they serve are enumerated in link:AUDIT.adoc[AUDIT.adoc].
 
-. Resolve ruling *R-A*: `machine-readable/` or `.machine_readable/`. This repo
-  uses the dotted form in 97 files; the spine's `root-allow.txt` and this
-  repo's own `check-rsr-profile.sh` both treat the hyphenated form as canonical.
 . Resolve ruling *R-B*: `.a2ml` or `.deed`. The DEED grammar is **DRAFT, not
   ratified**; the criteria SSOT is currently authored in the superseded record
   dialect.
diff --git a/docs/AUDIT.adoc b/docs/AUDIT.adoc
index f298a2eb7..a58617c31 100644
--- a/docs/AUDIT.adoc
+++ b/docs/AUDIT.adoc
@@ -91,12 +91,17 @@ open at the anchor in link:AFFIRMATION.adoc[AFFIRMATION.adoc].
 | # | Finding | Severity
 
 | F2
-| The machine-readable root is under two contradictory rulings.
-  `STANDARDS-CRITICAL-PATH.adoc` Ruling 10 says correct the spine to
+| The machine-readable root was under two contradictory rulings.
+  `STANDARDS-CRITICAL-PATH.adoc` Ruling 10 said correct the spine to
   `.machine_readable/`; `root-allow.txt` and this repo's own
-  `check-rsr-profile.sh` both say `machine-readable/` is canonical. 97 files
-  are affected.
-| *Blocking*
+  `check-rsr-profile.sh` both said `machine-readable/` is canonical. The
+  contradiction was never resolvable from the tooling — each side cited the
+  other. It is resolved from the census: `rsr-template-repo`'s
+  `docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc` records **48 repositories on
+  the dotted form against 9 hyphenated** at the 2026-08 divergence. The spine
+  was the minority. Ruling 10 stands; the hyphenated form is the minority
+  spelling and must still resolve, never be rejected.
+| *Closed 2026-09-17*
 
 | F3
 | The criteria SSOT is authored in the a2ml record dialect, which has been
diff --git a/docs/STANDARDS-CRITICAL-PATH.adoc b/docs/STANDARDS-CRITICAL-PATH.adoc
index 50483d3f1..0db497749 100644
--- a/docs/STANDARDS-CRITICAL-PATH.adoc
+++ b/docs/STANDARDS-CRITICAL-PATH.adoc
@@ -218,7 +218,7 @@ Ruling 2 gates task #12's pass criterion and every layout migration below.
 | 7 | The eNSAID five-tier taxonomy — supersede, or admit as a profile? | Task #23
 | 8 | The `contractiles-v1` four-file validation profile — same question | Task #23
 | 9 | The Antifile proposal — ratify, park with a date, or reject? | Task #23
-| 10 | Third layout root: `rsr-template-repo` uses `machine-readable/` (hyphen, no dot), matched by **1 file estate-wide**. Correct it to `.machine_readable/`? | Lane A
+| 10 | Third layout root: `rsr-template-repo` uses `machine-readable/` (hyphen, no dot), matched by **1 file estate-wide**. Correct it to `.machine_readable/`? — **RESOLVED: yes.** Owner ruling 2026-09-17, on the census (48 dotted vs 9 hyphenated), which makes the spine the minority. | Executed
 |===
 
 === One loose end, re-surfaced
@@ -256,9 +256,11 @@ Ordered so that the cheap, verifiable work proves the tooling before the
 expensive work uses it.
 
 . **Fix `rsr-template-repo`'s root** (ruling 10): `machine-readable/` →
-  `.machine_readable/`. One repo, six verbs, and it is the cleanest
-  implementation in the estate — the natural upstream once corrected. Low cost,
-  no downstream blast radius (only 1 file estate-wide shares that root).
+  `.machine_readable/`. **DONE** — 108 files, one commit, on the spine; blocked
+  only on a write credential at the time of writing. One repo, six verbs, and it
+  is the cleanest implementation in the estate — the natural upstream once
+  corrected. Low cost, no downstream blast radius (only 1 file estate-wide
+  shares that root).
 . **#6 — pilot on `vexometer`.** It is flat-only and carries the 132-cluster
   body, so it is representative of the largest class. Close the held
   `SATELLITES.adoc` links in the same pass.
diff --git a/scripts/check-canon-lockstep.sh b/scripts/check-canon-lockstep.sh
index 82137aab6..4300197da 100644
--- a/scripts/check-canon-lockstep.sh
+++ b/scripts/check-canon-lockstep.sh
@@ -263,10 +263,12 @@ echo "[3] spine declares the same criteria hash"
 if [ -z "$SPINE" ] || [ ! -d "$SPINE" ]; then
   skip "no --spine DIR given (set --strict in CI release jobs)"
 else
-  PROFILE="$SPINE/machine-readable/rsr-profile.a2ml"
-  [ -f "$PROFILE" ] || PROFILE="$SPINE/.machine_readable/rsr-profile.a2ml"
+  PROFILE="$SPINE/.machine_readable/rsr-profile.a2ml"
+  # Hyphenated is the minority spelling, not a rejected one: this branch stays so
+  # the ~9 repos still carrying it keep resolving.
+  [ -f "$PROFILE" ] || PROFILE="$SPINE/machine-readable/rsr-profile.a2ml"
   if [ ! -f "$PROFILE" ]; then
-    softfail "spine has no rsr-profile.a2ml at either machine-readable/ or .machine_readable/"
+    softfail "spine has no rsr-profile.a2ml at either .machine_readable/ or machine-readable/"
   else
     WANT="$(toml_hash criteria)"
     GOT="$(grep -E '^[[:space:]]*criteria_sha256[[:space:]]*=' "$PROFILE" \
@@ -325,12 +327,19 @@ echo
 # ASSERTION 5 — the canon satisfies its own law
 # ===========================================================================
 echo "[5] the canon scores Gold on its own applicable set"
-# Mirror scripts/check-rsr-profile.sh's own convention: the canonical machine
-# tree is machine-readable/, but the LEGACY dotted form is still accepted
-# "because the canon, scaffoldia, the julia variant and ~300 minted repos all
-# still carry it". This repo is one of them until the rename lands.
-CANON_PROFILE="$CANON/machine-readable/rsr-profile.a2ml"
-[ -f "$CANON_PROFILE" ] || CANON_PROFILE="$CANON/.machine_readable/rsr-profile.a2ml"
+# The canonical machine tree is `.machine_readable/`. This comment previously
+# said the opposite — that the dotted form was "LEGACY" and tolerating it was a
+# temporary shim. That was backwards. The census recorded in rsr-template-repo's
+# docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc at the 2026-08 divergence is 48
+# repositories on the dotted form against 9 on the hyphenated one, and the
+# "~300 minted repos" this comment used to cite as the reason for tolerating
+# dotted are that same majority.
+#
+# So both branches below are permanent, not a shim. Dotted is canonical;
+# hyphenated must still RESOLVE, never be rejected — a repo pinned to the
+# minority spelling is not a repo with a broken gate.
+CANON_PROFILE="$CANON/.machine_readable/rsr-profile.a2ml"
+[ -f "$CANON_PROFILE" ] || CANON_PROFILE="$CANON/machine-readable/rsr-profile.a2ml"
 if [ ! -f "$CANON_PROFILE" ]; then
   softfail "the canon has NO rsr-profile.a2ml — it cannot be scored by the checker
        it ships (scripts/check-rsr-profile.sh exits 2 on this repo).
diff --git a/scripts/check-rsr-profile.sh b/scripts/check-rsr-profile.sh
index b64436e51..7e93b1eaf 100755
--- a/scripts/check-rsr-profile.sh
+++ b/scripts/check-rsr-profile.sh
@@ -22,13 +22,21 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 GATES="${RSR_GATES:-$SCRIPT_DIR/../.machine_readable/template-capability-gates.toml}"
 REPO="${1:-.}"
 LIVE_REPOSITORY="${2:-${RSR_REPOSITORY:-}}"
-# The machine tree is `machine-readable/` (canonical since 2026-08). The dotted
-# `.machine_readable/` form is the LEGACY location and is still accepted, because
-# the canon, scaffoldia, the julia variant and ~300 minted repos all still carry
-# it; flipping in one move would strand every one of them on the same day.
-# Remove the legacy branch once the estate migration completes.
-PROFILE="$REPO/machine-readable/rsr-profile.a2ml"
-[ -f "$PROFILE" ] || PROFILE="$REPO/.machine_readable/rsr-profile.a2ml"
+# The machine tree is `.machine_readable/` — canonical estate-wide by owner
+# ruling (2026-09-17), and the spelling this repository has always used.
+#
+# This comment previously called the hyphenated form canonical "since 2026-08"
+# and the dotted form LEGACY. The direction was wrong. The census in
+# rsr-template-repo's docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc records 48
+# repositories on the dotted form against 9 hyphenated at the 2026-08
+# divergence: un-hiding a quarter of one repo did not move the estate, and
+# this file's own tolerance branch was the only evidence ever offered for it.
+#
+# The hyphenated branch is KEPT deliberately. It is not legacy scurf to be
+# deleted once "the migration completes" — roughly 9 repos still carry it, and
+# this checker is shared, so it must resolve both rather than fail either.
+PROFILE="$REPO/.machine_readable/rsr-profile.a2ml"
+[ -f "$PROFILE" ] || PROFILE="$REPO/machine-readable/rsr-profile.a2ml"
 
 [ -f "$GATES" ] || { echo "ERROR: gates file not found: $GATES" >&2; exit 2; }
 [ -f "$PROFILE" ] || { echo "ERROR: no profile at $PROFILE" >&2; exit 2; }
@@ -181,7 +189,7 @@ if [ "$fail" -ne 0 ]; then
 rsr-profile check: FAIL — scaffold does not match declared capabilities.
 Fix one of:
   * remove the vestigial module, OR
-  * declare the capability in machine-readable/rsr-profile.a2ml (with a
+  * declare the capability in .machine_readable/rsr-profile.a2ml (with a
     [rationale] line), OR
   * add the missing module.
 MSG
diff --git a/scripts/check-standards-map.sh b/scripts/check-standards-map.sh
index dbcabc77a..dbf5b7e7f 100644
--- a/scripts/check-standards-map.sh
+++ b/scripts/check-standards-map.sh
@@ -16,7 +16,7 @@
 #        absence fails.
 #    The second half is the important one. … A one-directional allowlist only
 #    ever ratchets open."
-#                                     — rsr-template-repo/machine-readable/root-allow.txt
+#                                     — rsr-template-repo/.machine_readable/root-allow.txt
 #
 # That comment was written after a root cleanup left stale PERMISSIONS behind,
 # so the allowlist had "quietly become a licence for the very drift it was
diff --git a/standards-map.toml b/standards-map.toml
index 59b3f590c..901c87ca8 100644
--- a/standards-map.toml
+++ b/standards-map.toml
@@ -16,7 +16,7 @@
 #
 # GENERATED RENDERINGS - one map, two readers
 #   index.adoc per district  (human)   <- rendered from this file
-#   machine-readable/map.a2ml (machine) <- rendered from this file
+#   .machine_readable/map.a2ml (machine) <- rendered from this file
 #
 # FIELDS
 #   from         current path at time of writing (the migration source)
@@ -344,7 +344,7 @@ canonical   = true
 canon_slot  = "contractile-spec"
 canonical_doc = "hyperpolymath/contractiles/index.adoc"
 gate        = "check-mustfile-structure"
-note        = "absorbs machine-readable/contractiles/; own linter is estate task #19"
+note        = "absorbs .machine_readable/contractiles/; own linter is estate task #19"
 
 [[entry]]
 from        = "deed"
@@ -892,16 +892,16 @@ note        = "licenses/ and LICENSES/ both exist; audits/ vs docs/audits/ both
 
 [[entry]]
 from        = ".machine_readable"
-target      = "machine-readable/"
+target      = ".machine_readable/"
 district    = "5-machine"
 kind        = "index"
 files       = 97
 lifecycle   = "generated"
 canonical   = true
 canon_slot  = ""
-canonical_doc = "machine-readable/index.adoc"
+canonical_doc = ".machine_readable/index.adoc"
 gate        = "registry-verify"
-note        = "F2: spine's root-allow.txt says machine-readable/ is canonical (un-hidden 2026-08). This repo still uses the retired dotted form in 97 files."
+note        = "F2 CLOSED — MIGRATION CANCELLED. This entry used to point at machine-readable/: the spine un-hid its tree in 2026-08 and its root-allow.txt called the hyphenated form canonical, so this repo was to adopt it. The owner ruling of 2026-09-17 settles R-A the other way, and the census backs it: rsr-template-repo's docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc records 48 repos on the dotted form against 9 hyphenated at the divergence. The spine was the minority; this repo's spelling was always the majority. target is now the identity path: the canon does NOT move."
 
 [[entry]]
 from        = ".github"
@@ -1599,4 +1599,4 @@ canonical    = false
 canon_slot   = ""
 canonical_doc = ""
 gate         = "standards-map-verify"
-note         = "NEW. The map of this repository: one record per top-level entry, all 118. Checked bidirectionally by scripts/check-standards-map.sh (Gate D). index.adoc per district and machine-readable/map.a2ml are GENERATED from this file."
+note         = "NEW. The map of this repository: one record per top-level entry, all 119. Checked bidirectionally by scripts/check-standards-map.sh (Gate D). index.adoc per district and .machine_readable/map.a2ml are GENERATED from this file."