docs(backlog): file BACKLOG #1460 and #1461 -- the dispatch gate names retired seats

[wshallwshall]

Files two ledger rows and changes no code. docs/BACKLOG.md is the only file touched, verified: git diff --name-only origin/main..HEAD returns that one path, and a grep of that list for .py or .yml exits 1.

Handoff: a concurrent session is implementing the code half

A separate session at worktree priceless-easley-1cb72a, branch claude/elastic-fermat-2d7bf2, is fixing the constants. Its announced intent covers CLOSING_SEAT["scorecard-rescore"] in scripts/docs/backlog_status_check.py and that dict's stale BUILDER.md line citations. I was told to stand down on the code half after I had already chosen to file only, so no fix was written on this branch and nothing was discarded.

Read this before landing that session's work, because its stated scope is narrower than the defect.

1. There are TWO constants, in two files. CLOSING_SEAT at scripts/docs/backlog_status_check.py:122 and GATED_VERDICTS at scripts/coord/dispatch_gate.py:160. The peer's announced intent names only the first. If it fixes one and not the other, 35 ledger rows keep emitting a retired seat name and nothing reports a problem. #1460 is the record of why.
2. A fourth defect is not a retired seat at all, and it is the easiest to miss because both seats it names are live. CLOSING_SEAT["code"] tells a Builder the Lander flips the banner, while the required check a PR that implements BACKLOG #N must update BACKLOG.md demands the ledger edit of that Builder's own PR.
3. The LIAISON assertions are not where they look. tests/test_coord_dispatch_gate.py:247 and :274 come from GATED_VERDICTS, not CLOSING_SEAT, because both tests drive closing-act: code, which short-circuits the CLOSING_SEAT branch. A fixer who patches only CLOSING_SEAT will see those two still passing and conclude wrongly that they are unrelated.

What is filed

BACKLOG #1460 -- the primary. Both constants, their five pinning assertions, the fourth defect, the reach measurement, and the dead BUILDER.md:253 / :148 anchors in the justifying comment. The row specifies the fix completely so whoever lands it does not re-derive it.

BACKLOG #1461 -- the vault half. Three role playbooks hold the same old assignment, including roles/BUILDER.md:216 forbidding the Builder the exact edit CLAUDE.md:286 assigns it. That is a write to a separate repository, so a Builder cannot close it. CLAUDE.md:289 gives the Lander standing authority on the vault with no per-action owner approval, and the row says so.

Nothing is filed for prose in this repository that merely names a retired seat. CLAUDE.md:274-276 already tells a reader to treat such naming as stale, and filing it would duplicate a rule that works.

The dependency that made filing-only right independently

I had already chosen to file rather than fix, before the stand-down, and the reason still matters to whoever lands the code.

The scorecard-rescore value is the 97-row half. Correcting it needs a successor for the ASVS Tracker, and the owner ruled that on 2026-09-05: the Lander performs the vault scorecard re-score. PR 929 records that ruling in CLAUDE.md section 5's Lander row. I checked, and 929 has not merged -- gh pr view 929 --json state,mergedAt returned state OPEN, mergedAt null. Until it is on main, writing that successor into a machine-read constant puts an operative instruction into shipped source citing a section that does not yet say it. The concurrent session's fix inherits this dependency. I did not edit CLAUDE.md.

The other independent parts do not depend on 929, and #1460 says which are which. Successors for the other two come straight off the roster table: Liaison becomes Console (CLAUDE.md:285), and the Dispatcher's recording half becomes Lander (CLAUDE.md:289).

Decisions this brief left open

Closing-act: banner-only on #1461. The menu is code | scorecard-rescore | owner-ruling | banner-only, and none obviously covers a write to another repository. Leaving the field off made judge() return refuse, whose docstring reserves that level for "an item whose state nobody has declared" -- false here, and the exact failure the gate exists to catch. code was wrong because it sits in BUILDER_CLOSABLE_ACTS, so the gate would tell a dispatcher a Builder closes it. banner-only is right on the merits: the work lands in the vault, so nothing reaches this repository except the banner. It now grades advise and correctly says a Builder does not close it.

That makes #1461 the first ledger row ever to declare banner-only, so the entry renders for the first time -- and what it prints names the Dispatcher, demonstrating #1460 live. #1460's reach table is dated to c57903c2c and carries a note saying this row changed its zero, rather than leaving a number that silently went stale.

The concurrent session's worktree and branch are named here and deliberately not in the ledger rows. A session path is ephemeral; a ledger row is durable, and a row citing a worktree that no longer exists is worse than one that never did.

Corrections to the survey this was built on

The survey drafting these rows recommended three items. I filed two: its item 2 asked for an owner ruling on who performs an ASVS re-score, and the owner had already ruled while the survey ran.

Two of its numbers did not reproduce. It reported the LANDER banner sentence on 120 open rows; I measure 119. It reported the sentence on 161 rows in one finding and 166 in the recommendation; 166 is right, and the row explains the one-row gap against the 167-row code census (#1343 grades advise for an unrelated reason, so it never reaches the ok path that prints the string).

I also could not confirm one thing my brief told me. It said the survey "refuted the stronger claim that this is a required gate". The refutation I read says the opposite on that half: it re-verified that tests/test_coord_dispatch_gate.py is in tooling_manifest.txt:84, that tooling is in ci-gate's needs, and that CI gate is a required context. I re-measured branch protection myself and CI gate is live among 13 contexts. What the survey actually refuted was a different claim -- that patching CLOSING_SEAT alone would red the LIAISON assertions, which it does not. The constants and their assertions must still move in one PR, and the concurrent session needs that, not the brief's summary of it.

Verification

Every number in both rows was re-derived here from a clean checkout at c57903c2c, not carried in from the survey. Controls that could have fired and did not:

• Reach loop with live-seat needles (Steward, Regulator, Console): 0 rows, against 132 for retired names.
• Placeholder swap over both constants: 0 of 670 levels moved. Positive control on the same experiment -- emptying BUILDER_CLOSABLE_ACTS moved 166. This is what holds the item at P2: the staleness misdirects a reader, it does not change a verdict.
• Ledger duplicate census: CLOSING_SEAT 0 and 0, against a same-corpus "banner" control of 513 and 57 and a dead needle at 0 and 0. GATED_VERDICTS returns 3, all inside #1334, which covers a different question.
• Contention scan over 67 open PRs (gh pr list --limit 200, asserted strictly below the limit): 0 touch the three code files, while 64 touch docs/BACKLOG.md on the identical loop.

One instrument of mine was broken and I am recording it rather than quietly dropping it: gh api --paginate "repos/:owner/:repo/pulls?state=open" returned 6 PRs where gh pr list returned 67. I used the second.

Both rows parse under parse_items as open, unduplicated, and scored. #1460 grades ok, #1461 grades advise.

Checks

check	result
ruff check .	passed
ruff format --check .	passed, 1256 files
mypy messagefoundry (strict)	passed, 268 source files
pytest on 8 backlog/ledger/dispatch modules	202 passed
scripts/docs/backlog_status_check.py	OK, 673 items
pre-commit at commit time	all applicable hooks passed
non-ASCII census over added lines	only U+00B7 middot (x4, the house score separator) and U+1F522 (x2, the sanctioned open banner)

The pytest modules were test_coord_dispatch_gate, test_backlog_status_check, test_backlog_citation_check, test_backlog_dependency_census, test_backlog_hygiene_claim_extraction, test_backlog_score_advisory, test_ledger_check and test_backlog348_cancel_dirty_release.

Skipped: the full pytest suite, and every hosted-runner-only leg. Since this changes one Markdown file and no code, the legs worth reading after merge are a PR that implements BACKLOG #N must update BACKLOG.md and the backlog-hygiene workflow. The pre-existing advisory warning on #1426 in the status check comes from main (PR 806), not from this branch.

Rebased on origin/main at 5b2bd59f0, clean, no ledger conflict. Auto-merge is not armed.

Generated with Claude Code (https://claude.com/claude-code)

[github-actions]

@wshallwshall

This pull request is green and nobody has marked it read.

Every check that has reported is passing and the reviewed label is absent, so
a reviewer has read this is the only thing between it and a merge. Nothing else reports that, which is
why this comment exists (BACKLOG #1413).

To clear it, IN THIS ORDER:

1. If the branch is behind main, update it FIRST: gh pr update-branch --repo MEFORORG/MessageFoundry 936.
   That push fires synchronize, and synchronize REMOVES the reviewed label. Labelling
   before updating throws the label away and costs a round trip.
2. Read the diff.
3. gh pr edit 936 --repo MEFORORG/MessageFoundry --add-label reviewed

DO NOT TRIAGE THIS FROM mergeStateStatus. It returns one value with precedence, so BEHIND,
DIRTY and UNSTABLE each mask the missing check -- the requirement is invisible until you act on
something else. This check never reads that field; see scripts/ci/check_unread_prs.py.

A seat can find every pull request in this state in one call: gh pr list --label unread.
The label is withdrawn automatically once this pull request leaves the state.

The reviewed label is a PROCESS gate. It records that a step happened. It does not
establish that an independent party looked, and nothing here should be read as saying it does.

[wshallwshall]

Superseded by #940, which merged at 11:52 CT as 89b2574c. This pull request's row (BACKLOG #1460 and 1461) is on main now, byte-identical to what was filed here.

Closed by the Lander, not rejected. Eight ledger-only pull requests were consolidated into one so that nine filings cost one merge cycle rather than eight. Under strict branch protection each of these would have re-dirtied the other seven.

The consolidation merged each branch rather than cherry-picking, so every number arrived carried by a real merge parent, and it re-applied only this branch's own sections onto main's current file. That mattered: taking any of these branches wholesale would have silently reverted #1426, #1440, #1454, #1455 and #1456. Final state verified at 443 rows against a target computed before building, 678 additions and zero deletions, no duplicate numbers.

Nothing here needs re-filing.