Core 10 residual: delete dead _oldest_ready_item — both conformance kits now carry zero xfail; Tier-B docstrings post-RC-2; manager records

contracts/operator-surface.v2-candidate.md

@@ -6,7 +6,7 @@ target: contracts/operator-surface.v1.md
 
 **Date:** 2026-09-06
 **Author:** agent:converge-manager via proposal-drafter
-**Status:** PROPOSED — awaiting the owner's word
+**Status:** RATIFIED by owner 2026-09-06 ("Ratified") — applied to operator-surface.v1.md via PR #90 (main a8951bd)
 **Against:** `contracts/operator-surface.v1.md`, Status FROZEN, `main` @ `279a6ef`
 **Evidence source:** `.amplifier/converge/operator-surface-freeze9-review.md` — the Freeze 9
 external review (independent reviewer, not the author): pass-1 findings 4, 6, 7, 8 and 9, and

docs/workflow/CHECK-RECORD.md

@@ -12,3 +12,14 @@ One entry per integration, written by the MANAGER session in its own commit (nev
   - `sha256sum contracts/operator-surface.v1.md` = a1f304b11b17… == OSV1-000's operator-surface pin (custody pin ec4b736f… unchanged)
   - Status line still `**Status:** FROZEN`; candidate carries "Ratified by owner — 2026-09-06"; Changelog head is the v2 amendment entry; 12 rows carry the dated amendment note; OSV1 33 CONFORMS / 3 NOT-ASSERTABLE.
 - Contract reading after re-run: operator-surface.v1 **Kept** (every Core clause CONFORMS or NOT-ASSERTABLE with cadence); custody-coordination.v1 **Kept** (CCV1 rows unchanged).
+
+## 2026-09-06 14:34 UTC — merge of lane/zhv (Core 10 residual)
+- Covers: merge commit 9c6c4f7 on `converge/zhv-core10-residual` = main a8951bd + lane/zhv 0debd81 (one lane; no pair gate needed), plus manager repair commit 0e9086c (OSV1-030 prose, candidate Status line, docs/workflow).
+- Ran, in this session, on the merged tree:
+  - `grep -rn _oldest_ready_item src` → no occurrence (0 definitions, 0 calls); the earlier "2" was a counting artefact of `grep -rc` summing, re-measured with `-rn`
+  - `.venv/bin/python -m pytest ledger/checks -q` → 60 passed
+  - `make ledger-mutate` → ALL mutations proven 69 / 69; UNPROVEN: (none)
+  - `pytest tests/conformance/operator_surface/test_tier_a.py -q` → **42 passed, 0 xfailed** (was 41 / 1)
+  - `.venv/bin/pyright src tests` → 0 errors; `ruff check src tests ledger` → All checks passed!
+  - `sha256sum contracts/operator-surface.v1.md` a1f304b1… == OSV1-000 pin; contract untouched by the lane (confirmed by diff)
+- Contract reading after re-run: operator-surface.v1 **Kept** — both conformance kits now carry zero xfail markers; custody-coordination.v1 **Kept**.

docs/workflow/OWNER-RETURN-LOG.md

@@ -21,3 +21,5 @@ One entry per return of the intent steward (clock-stamped) or per unprompted bri
 - This PR: v2 candidate (6 changes, evidence = Freeze 9 review), `lvn` prose repair (OSV1-024/025 + `test_row_osv1_025` docstring), `docs/workflow/{PLAN,OWNER-RETURN-LOG}.md`.
 - Queue: `zhv` (Core 10 residual, ready), `1y2` (external), `lvn` (held → resolving on merge).
 </details>
+
+## 2026-09-06 13:30 - they came back with the word: "yes" (priority for zhv)

docs/workflow/PLAN.md

@@ -27,3 +27,4 @@ Regenerated each manager cycle from the repository's history and the shared queu
 ## Queue (work_tracker) at this cycle
 - ready: `1y2` (external, not this operation) + the Core 10 residual item filed this cycle. Held: `lvn` (this session, resolving on merge).
 - Width: 0 lanes running; nothing under width — the only lane-shaped item is the Core 10 residual, held for the owner's priority word since it is a src change on a frozen surface (kit + ledger re-derivation).
+- 2026-09-06T13:30:54Z CALL priority ANSWERED "yes" — lane zhv launched (batch hw-post-lock).

ledger/checks/test_operator_rows.py

@@ -557,9 +557,17 @@ def test_row_osv1_005() -> None:
 #: that as the failure to avoid, because two censuses disagree silently.
 EXEMPTION_REGISTER: frozenset[str] = frozenset(
     {
-        "webapp.py:1127",  # flex:{n} 1 0            -- state-bar segment ratio
-        "webapp.py:1823",  # width:{today_w}px       -- throughput bar, today
-        "webapp.py:1826",  # width:{prior_w}px       -- throughput bar, prior 6d
+        "webapp.py:1111",  # flex:{n} 1 0            -- state-bar segment ratio
+        "webapp.py:1807",  # width:{today_w}px       -- throughput bar, today
+        "webapp.py:1810",  # width:{prior_w}px       -- throughput bar, prior 6d
+        # -16 lines on 2026-09-06 (was 1127/1823/1826), the SECOND re-pin of the
+        # same three sites and for the same reason as the +182 note below: an
+        # edit higher in webapp.py moves a line-number pin. work_item_pipeline-zhv
+        # deleted the 16-line dead `_oldest_ready_item` (webapp.py:902-917), which
+        # sits above all three. RE-MEASURED, not transcribed: the census observed
+        # exactly {webapp.py:1111, 1807, 1810} and 16 is exactly the deletion, so
+        # all three are accounted for and none is a NEW site. Same eight sites,
+        # same three expressions -- the register did not grow.
         # +182 lines on 2026-09-05 at the wave-4 union (was 4197/4216/4223 on
         # main @065da04), and RE-MEASURED here rather than transcribed from any
         # lane: three lanes each inserted CSS ABOVE these three sites in the same
@@ -1183,11 +1191,15 @@ def test_row_osv1_014() -> None:
     }
 )
 
-#: A helper that makes an unbounded listing call but is reached by NO route.
-#: Dead code is not "reached from a view", so the clause as written does not
-#: condemn it -- but the exemption is re-earned every run below, by proving it
-#: is still dead.
-_UNREACHED_UNCAPPED = ("_oldest_ready_item", WEBAPP)
+#: THE UNREACHED-UNCAPPED EXEMPTION IS GONE as of 2026-09-06. It named one
+#: helper -- `webapp._oldest_ready_item`, an unbounded listing call reached by
+#: no route -- and this probe re-earned it every run by proving the function
+#: was still dead. work_item_pipeline-zhv deleted the function, so there is
+#: nothing left to exempt and nothing left to re-earn. What replaced those two
+#: assertions is STRONGER and carries no name: the census below now runs over
+#: EVERY listing call in the route modules, reached or not, and requires an
+#: explicit limit on all of them -- so a future dead-code exemption has to be
+#: argued for rather than inherited.
 
 
 def _module_int_constants(path) -> dict[str, int]:  # type: ignore[no-untyped-def]
@@ -1299,6 +1311,30 @@ def view_listing_calls() -> list[tuple[str, int, str, object]]:
     return found
 
 
+def all_listing_calls() -> list[tuple[str, int, object]]:
+    """`(module, line, limit)` for EVERY listing call in the route modules --
+    reached from a view or not.
+
+    The census `view_listing_calls` cannot be: it scores what a GET handler
+    reaches, which is what Core 10's own wording asks, and that is precisely
+    why a limit-less call in dead code slipped past it for two waves. This
+    reading has no reachability step to argue with, so it also has no
+    exemption to re-earn.
+    """
+    found: list[tuple[str, int, object]] = []
+    for path in ROUTE_MODULES:
+        tree = ast.parse(read(path))
+        consts = _module_int_constants(path)
+        for node in ast.walk(tree):
+            if (
+                isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Attribute)
+                and node.func.attr in _BOUNDED_READS
+            ):
+                found.append((path.name, node.lineno, _limit_passed(node, consts)))
+    return found
+
+
 def test_row_osv1_015() -> None:
     """Core 10 CONFORMS: every adapter listing call a read-only route reaches
     passes an explicit, finite limit -- MEASURED here, not asserted from a
@@ -1312,6 +1348,13 @@ def test_row_osv1_015() -> None:
     `limit=0` is bd's own "unlimited" (`adapter.Beads.list`'s docstring says
     so outright) and an omitted `limit` leaves bd's default in place
     implicitly -- the clause asks for an EXPLICIT bound, so both are failures.
+
+    RETARGETED AGAIN 2026-09-06 (work_item_pipeline-zhv). The two assertions
+    that re-earned the `_oldest_ready_item` exemption every run are gone with
+    the function they guarded, replaced by `all_listing_calls()`: a source-wide
+    census of the route modules that requires an explicit limit on EVERY
+    listing call, reached or not. Strictly stronger than what it replaced, and
+    it names no function -- an exemption cannot be inherited from it.
     """
     calls = view_listing_calls()
     assert any(m == "webbrowse.py" and h == "project_view" for m, _, h, _ in calls), (
@@ -1328,16 +1371,23 @@ def test_row_osv1_015() -> None:
         + "\n This surface re-renders every 20 seconds; an unbounded read here runs "
         "three times a minute per open tab."
     )
-    name, module = _UNREACHED_UNCAPPED
-    app = read(module)
-    assert app.count(name) == 1, (
-        f"OSV1-015 (Core 10): `{name}` now has {app.count(name) - 1} caller(s). It "
-        f"calls `bd.list(...)` with NO limit at all -- being reached by nothing was "
-        f"the only reason it did not violate this clause. Give it a bound or delete it."
-    )
-    assert contains(WEBAPP, 'items = bd.list(lane=A.LANE_WORK, status="open")'), (
-        "OSV1-015 (Core 10): the uncapped `bd.list` in `_oldest_ready_item` is gone -- "
-        "welcome, and the row's exemption just changed. Re-derive."
+    everything = all_listing_calls()
+    assert everything, (
+        f"OSV1-015 (Core 10): the source-wide census now matches NO listing call at "
+        f"all in {[p.name for p in ROUTE_MODULES]} -- a census that finds nothing "
+        f"passes forever while proving nothing. Re-derive this row."
+    )
+    unbounded = [c for c in everything if c[2] is None or (isinstance(c[2], int) and c[2] <= 0)]
+    assert not unbounded, (
+        "OSV1-015 (Core 10): a listing call in a route module passes no explicit, "
+        "finite limit:\n  "
+        + "\n  ".join(f"{m}:{ln} -> limit={lim!r}" for m, ln, lim in unbounded)
+        + "\n\nThis is the STRONGER reading, adopted 2026-09-06 when "
+        "work_item_pipeline-zhv deleted `_oldest_ready_item`. Reachability is what "
+        "Core 10's own wording scores, and it is asserted above; this second pass "
+        "asserts there is no limit-less call left for a reachability argument to "
+        "excuse. If a new one is genuinely unreachable, do not re-open an exemption "
+        "here -- bound it or delete it."
     )
 
 

ledger/reconcile-report.md

@@ -2245,7 +2245,33 @@ no `docs/VISION.md` byte and no `contracts/custody-coordination.v1.md` byte was
 touched; `LAST_RUN.json` was neither regenerated nor edited; the live service
 was never contacted. No item was filed and none closed.
 
+## 2026-09-06 zhv
+
+- **Core 10's last residual is closed by deletion, not by argument.**
+  `work_item_pipeline-zhv` deleted the dead `webapp._oldest_ready_item`
+  (webapp.py:902–917, 16 lines, zero callers, an uncapped `bd.list`), so
+  `OSV1-015` no longer holds CONFORMS partly by a reachability argument;
+  `make test-conformance-a` went **41 passed / 1 xfailed → 42 passed / 0
+  xfailed / 0 XPASS / 0 failed**, the Tier-A good half `test_antigoals_enforced`
+  now runs undeferred, and **neither conformance kit carries a deferral**.
+  Disposition unchanged (CONFORMS). `test_row_osv1_015`'s two exemption
+  assertions are replaced by a stronger, name-free source-wide census
+  (`all_listing_calls()`: every listing call in the three route modules carries
+  an explicit finite limit — 4 of 4 measured); `OSV1-006`'s three webapp.py
+  register pins re-measured −16 (1127/1823/1826 → 1111/1807/1810), same eight
+  sites, register did not grow. Tier-B kit docstrings for Conformance 1 Bad,
+  3 Bad and 4 Good+Bad re-quoted to the post-RC-2 contract text (docstrings
+  only; no assertion changed). Residual, not fixed here and out of this lane's
+  scope: `OSV1-030`'s notes still say Tier-A's `test_antigoals_enforced` is
+  "the one remaining deferral in either kit" — true when written, false as of
+  this line.
+
 ## Changelog
+- **2026-09-06 — Core 10 residual closed (`work_item_pipeline-zhv`).** Dead
+  `webapp._oldest_ready_item` deleted; `OSV1-015` stays CONFORMS with its
+  exemption paragraph replaced by a dated note and its probe retargeted onto a
+  source-wide limit census; Tier-A runs 42 passed / 0 xfailed / 0 XPASS. See
+  §"2026-09-06 zhv".
 - **2026-09-06 — AMENDMENT, `contracts/operator-surface.v1.md` v2 applied to
   the LOCKED text, mandatory full re-review.** Owner's word, literal:
   *"Ratified"* — the sibling proposal `operator-surface.v2-candidate.md` was

ledger/rows.yaml

@@ -2653,14 +2653,44 @@
     covers the truncation note; both were confirmed to go red against
     `limit=0` and against a removed `limit=` before this row was flipped.
 
-    THE OTHER UNCAPPED CALL, AND WHY IT IS STILL NOT SCORED: webapp.py:909,
-    inside `_oldest_ready_item`, calls `bd.list(lane=A.LANE_WORK,
-    status="open")` with no `limit` at all -- but the function has ZERO
-    callers (the only occurrence of the name in `src/` is its own definition).
-    Dead code is not "reached from a view", so the check as written does not
-    condemn it. Unchanged from seed, and the probe still re-earns that
-    exemption every run by proving the function is still uncalled -- the
-    instant it gains a caller, this row goes red.
+    THE OTHER UNCAPPED CALL IS GONE -- 2026-09-06, work_item_pipeline-zhv.
+    From seed until this date this row carried a named residual: webapp.py:909,
+    inside `_oldest_ready_item`, called `bd.list(lane=A.LANE_WORK,
+    status="open")` with no `limit` at all. It was never scored, because the
+    function had ZERO callers and dead code is not "reached from a view", and
+    the probe re-earned that exemption every run by proving it was still
+    uncalled. The dead function was deleted instead (webapp.py:902-917, 16
+    lines; grep confirmed one occurrence in `src/`, its own definition, before
+    the deletion and none after). Disposition does not move: it was CONFORMS
+    before and is CONFORMS now -- what changed is that the clause no longer
+    holds by a reachability ARGUMENT anywhere in these three modules.
+
+    WHAT THE DELETION BOUGHT, measured on this tree:
+      * `make test-conformance-a` 42 passed, 0 xfailed, 0 XPASS, 0 failed (was
+        41 passed / 1 xfailed). The Tier-A good half `test_antigoals_enforced`
+        was the LAST deferral in either kit; its `xfail(strict=True)` named
+        this residual by name and is deleted, in this same change, exactly as
+        the marker's own reason instructed.
+      * This probe's two exemption assertions went with the function they
+        guarded and are replaced by something STRONGER and name-free:
+        `all_listing_calls()`, a source-wide census of webapp.py/webbrowse.py/
+        webtrust.py requiring an explicit finite limit on EVERY listing call,
+        reached or not. Measured population: webapp.py:3848
+        (`attention_items_from_rows`), webapp.py:4743 (`recent_activity_feed`),
+        webbrowse.py:412 (`bd.list`), webbrowse.py:719 (`bd.activity`) -- all
+        four explicit, zero unbounded. The reachability audit is unchanged and
+        still runs first; this is the second pass that leaves no limit-less
+        call for a reachability argument to excuse.
+      * Product-side, `tests/unit/test_view_query_bounds.py` lost its
+        `_UNREACHED_EXEMPTIONS` register and the test that re-earned it, rather
+        than keeping a guard that iterates an empty set -- which would pass
+        forever while proving nothing.
+
+    KNOCK-ON, recorded because it is a line-number pin and not a re-derivation:
+    deleting 16 lines above them moved OSV1-006's three webapp.py register
+    entries by -16 (1127/1823/1826 -> 1111/1807/1810). Re-measured from the
+    census, not transcribed; same eight sites, same three expressions, the
+    register did not grow.
 
 - id: OSV1-016
   title: the theme choice is persisted in localStorage and applied at first paint
@@ -3539,6 +3569,12 @@
     THE HOUSE PRECEDENT this follows: the custody family's CCV1-023 recorded
     discrimination by REVERTING each fix in turn and observing exactly the
     matching bad half go red while every good half stayed green.
+    TRUED UP 2026-09-06 (integration of work_item_pipeline-zhv): the sentence above calling
+    Tier-A's `test_antigoals_enforced` "THE ONE REMAINING DEFERRAL IN EITHER KIT" was true
+    when written and is false as of this commit -- the dead `_oldest_ready_item` is deleted
+    and both kits now carry ZERO xfail markers (Tier-A 42 passed / 0 xfailed). Kept as dated
+    history; the probe never asserted the claim, so nothing was red.
+
 - id: OSV1-031
   title: >-
     Freeze 5 -- every Core clause reads CONFORMS or NOT-ASSERTABLE

src/amplifier_work_tracker/webapp.py

@@ -899,22 +899,6 @@ def _global_oldest(summaries: list[A.ProjectSummary]) -> tuple[str, float] | Non
     return max(candidates, key=lambda c: c[1])
 
 
-def _oldest_ready_item(bd: A.Beads) -> A.Item | None:
-    """The single oldest ready (open, tagged `LANE_WORK`) item in one
-    project -- used only for the hero's attribution line (which real item
-    is the N-day-old one). One extra, project-scoped `bd list` call; never
-    a workspace-wide fan-out. Returns `None` (never a guess) if the project
-    can't be read or has no dated ready item."""
-    try:
-        items = bd.list(lane=A.LANE_WORK, status="open")
-    except A.BeadsError:
-        return None
-    dated = [i for i in items if i.created_at is not None]
-    if not dated:
-        return None
-    return min(dated, key=lambda i: i.created_at)  # type: ignore[arg-type,return-value]
-
-
 def _ledger_hero_html(ready_total: int | None, n_projects: int, burn_days: float | None) -> str:
     """The overview's restrained ready-count hero -- READY TO CLAIM, at
     `--fig-size-ledger` (62px), a deliberate 3.8x demotion from the