A plane's validation status — not just its enable flag — decides whether it may enter the live recall SELECT. Flag-alone must never admit an unvalidated plane. One small, mechanical, fail-closed gate on enabledPlanes.
Owner coord-build-recall-b (MAIN RULING 2) · 2nd-verify wick-capture · consumer claude-revive (composition-wire A2) · lands standalone before any completion-plane enable.
export function enabledPlanes(env){ return REGISTRY.filter( p => p.enabled(env)); // flag only }
completion-rs-lagrange is tagged open-store-fill-gated — real-data leg still OPEN.FORGE_WICK_PLANE_COMPLETION=1.validation tag is never checked.the code comment even admits it: "the tag is honest metadata, the flag is the gate."
export function enabledPlanes(env){ return REGISTRY.filter( p => p.enabled(env) && planeValidated(p, env)); }
open-store-fill-gated also needs a separate declared _VALIDATED signal.proven-synthetic is excluded unconditionally — no env clears it.signature unchanged → claude-revive's A2 wire composes by construction.
planeValidated(p, env)An exhaustive per-tier switch. The earlier draft's generic "non-proven ⇒ needs a validatedFlag" was the loophole all three SEED panelists caught: it would have let a synthetic plane serve via an env override. Fixed by making each tier explicit.
validatedFlag AND env?.[validatedFlag]==="1" (plus the enable flag) → true only when both present, else falseproven-real via code + real-data re-validation → return falsefunction planeValidated(p, env){ switch (p.validation){ case "proven-real": return true; // flag suffices case "open-store-fill-gated": return p.validatedFlag != null // declared + && env?.[p.validatedFlag] === "1"; // signal set case "proven-synthetic": return false; // NEVER serves default: return false; // fail-closed } }
Registration is a wiring act with no behavioral claim. Eligibility (this gate) is separate from registration.
| Plane | Enable flag | Validation tier | Post-gate: what admits it |
|---|---|---|---|
intuition-ppr | FORGE_WICK_PLANE_PPR | proven-real | enable flag |
completion-rs-lagrange ⚠️ | FORGE_WICK_PLANE_COMPLETION | open-store-fill-gated | enable flag + …_COMPLETION_VALIDATED=1 |
l1-hierarchy | FORGE_L1_HIERARCHY_RECALL | proven-real | enable flag |
l2-grassmann | FORGE_GRASSMANN_RECALL | proven-real | enable flag |
l3-fisher | FORGE_PLANE_L3 | proven-real | enable flag |
⚠️ completion-rs-lagrange is the one at-risk plane today — the only non-proven-real entry in the registry, and the concrete vector the gate closes.
// NEW additive optional field interface RecallPlane { // …existing… readonly validatedFlag?: string; }
Explicitly declared — never auto-derived. Set only on open-store-fill-gated planes eligible for real-data validation. proven-real/proven-synthetic carry none.
makeFlagPlane( "completion-rs-lagrange", "FORGE_WICK_PLANE_COMPLETION", "open-store-fill-gated", "FORGE_WICK_PLANE_COMPLETION_VALIDATED")
The validated env is a distinct name from the enable flag → two independent operator signals, one labelled _VALIDATED.
| # | Scenario | Env | Expected |
|---|---|---|---|
| US-1 | open-store-fill-gated plane, flag only | COMPLETION=1 | EXCLUDED — the fix |
| US-2 | same, flag + validated (escape valve) | COMPLETION=1 + …_VALIDATED=1 | INCLUDED |
| US-3 | proven-real plane, flag on (no regression) | PPR=1 | INCLUDED |
| US-4 | validated signal WITHOUT enable flag | …_VALIDATED=1 only | EXCLUDED — both required |
| US-5 | all flags off | — | empty ⇒ byte-identical legacy path |
| US-6 | signature stability | — | functions unchanged; additive optional field |
| US-7 | proven-synthetic, flag + any validated | SYN=1 + anything | EXCLUDED — unconditional |
| US-8 | new/unknown non-proven tier, no declared flag | any | EXCLUDED — fail-closed default |
enabledPlanes(env)→RecallPlane[] and registeredPlanes() signatures are unchanged; the only shape change is an additive optional validatedFlag?. claude-revive's A2 composition-wire consumes RecallPlane[] reading only id/enabled/rank/validation → composes by construction. pipelineActive derives from enabledPlanes().length and inherits the gate for free.
proven-real plane reaches the live SELECT on a flag alone, and that a proven-synthetic plane can never serve. The _VALIDATED env asserts a real-data validation was done; F1 is the mechanical gate, not the evidence-verifier (that's the separate real-data NC that justifies flipping it).
enabledPlanes unchanged there). claude-revive's composition-wire consumes the landed gate whenever it wires; correct in either land order. Out of scope: the ContentRouterSelect impl, the completion plane's real-data validation itself, and any rank impl.