[finding] a live liveness row whose evidence is entirely FOREIGN gets no gate in either direction — live-elsewhere is used on 1 row while 120 cross-repo declarations sit at live #19063

Reading taken 2026-09-18T14:59Z. Code line numbers and ledger greps are against origin/main@221dabb72; the row census is a seat-built probe whose limits are stated below.

Defect

#13483 established that a key enforced only in a sibling repo cannot be graded from this checkout, and PR #14056 answered it with a fifth verdict plus a gate that can actually fail: live-elsewhere must carry a foreign pointer, a declared cross-repo scope, and a dated attestation, and its attestation expires — elsewhereMalformed and elsewhereExpired are both in the failed expression, and the code says why in as many words: expiry failing the build "is the only mechanical event this repo can generate about a claim it cannot re-measure locally".

That gate is keyed on the status:

:502  const EVIDENCE_SCANNED_STATUSES = new Set(['live', 'planned', 'experimental', 'live-elsewhere']);
:887  if (status === LIVE_ELSEWHERE_STATUS && led !== null) { ... checkElsewhereEntry ... }

The four evidence checks (existence, line bound, symbol anchor, key mention) run over the LOCAL bucket only — the file states it: "Cross-repo attribution never reaches this list: checkEvidence only resolves the LOCAL bucket" (:1317-1318).

So a row that makes the same claim under status: "live" gets nothing in either direction: no local resolution (there is no local path to resolve), no shape check (checkElsewhereEntry never runs), and no expiry (report.verification.errors — a malformed date — is in the failed expression; verification.stale is a printed report line, and verifiedAt is optional to begin with). live + foreign evidence is an unchecked spelling of the thing the fifth verdict was built to gate.

Measurement

Ledger greps (git grep -o … origin/main -- 'packages/spec/liveness/*.json', unit = occurrences):

• "live-elsewhere" → 1 (manifest.json, the runtime row from Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483 itself).
• "cross-repo" → 120.

The verdict that carries the gate is used once; the scope declaration that describes the same situation appears 120 times.

Row census (seat probe, unit = ledger rows): 39 ledgers, 922 rows in the props trees, 707 at a scanned status (live 688, planned 13, experimental 5, live-elsewhere 1).

• zero local evidence path after the realm split: 306
• lit control: ≥1 local path, i.e. rows the existing checks CAN fail on: 401

Breakdown of the 306:

The sharpest sub-class is the 62: they declare cross-repo scope under a live verdict. They state the condition #13483 named unfalsifiable, in the field #14056 added for it, while sitting at the one status that skips its gate.

Instrument, and its limits

The shared checkout has no installed dependencies, so scanEvidence from packages/spec/scripts/liveness/evidence.mts could not be imported; the seat re-implemented its realm split in plain node and self-tested it on three cases before use:

• cloud @cb8ee7ff: packages/service-ai/src/agent-runtime.ts#listAgents … → 0 local, 1 foreign ✓
• packages/core/src/x.ts:12 reads it → 1 local ✓ (lit)
• objectui: packages/a/b.ts; packages/core/src/y.ts → 1 local + 1 foreign ✓ (realm scope ends at ;)

Three enumerations disagree about the population, and none of them is the gate's:

The gate walks the SCHEMA at "one-level walk granularity … plus the ADR-0010 protection envelope" (state-counts.md), not the ledger file tree, which is the likeliest source of the spread. Settling the population is part of this card's work, and no row count here should be quoted as the gate's own reading. What does not depend on the enumeration: the code paths quoted above, the single live-elsewhere row, and the 120 cross-repo declarations — all plain greps on a named ref.

Dedup words

liveness foreign evidence unfalsifiable, cloud realm marker resolve, evidenceScope cross-repo attestation, live-elsewhere used once

Adjacent — read, and not the same subject

• Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483 → created the verdict, closed by PR feat(spec): live-elsewhere — fifth liveness verdict with gate-executable criteria (#13483) #14056. It asked "what evidence shape does a non-local pointer take"; it did not ask what stops a row from making the claim at another status.
• [finding] spec-property-retirement skill predates the live-elsewhere verdict — its ledger-verdict discipline never names the never-remove cross-repo case #14058 → the spec-property-retirement skill's prose half of the same verdict.
• spec: re-derive the liveness ledger before its dead / live-elsewhere verdicts start warning authors — view.json list.tabs re-read plus a sampled audit of the 90 dead rows (ledger half of #16094) #16362 → re-derivation of the dead / live-elsewhere rows before they warn authors.
• check:liveness 的 stale-evidence 检测只 ⚠ 不判红 —— ADR-0087 证据路径可以静默腐烂,且摘要行的 “N resolved” 数的是路径总数不是解析成功数 #5623 → stale-evidence ⚠→red and the "N resolved" miscount; about LOCAL paths that rot, not paths that were never local.

Provenance

Out-of-scope finding from the os-dev report on #18304 (PR #19059). The seat re-measured it before filing and narrowed the claim: the dev's "no gate can ever fail on them in either direction" is true of the 305 non-live-elsewhere rows but not of live-elsewhere itself, where a shape check and a 180-day expiry both red the build. Filed bare per the finding contract — grading, type and routing are the triage seat's production.

Generated by Claude Code