v3.0.2 — the Twin Council Forge

Kiln v3.0.2 — the Twin Council Forge

Every constitutional decision in the pipeline is now ratified by BOTH model families — and the
master plan is no longer written by any single model at the top tier.

The debate machine (T4 architecture)

• Blind critique exchange: each head critiques the other's anonymous plan; findings get
  script-assigned canonical keys; self-revision under exact disposition algebra.
• Anonymous slots are seed-derived AFTER receipts freeze — authorship is not inferable.
• Structured plan content: milestones, surfaces, confidence tiers, and executable acceptance
  criteria are head-authored structured data, script-projected with slot-namespaced identity
  (no false cross-head joins), validated fail-closed, closure-checked.
• Mechanical divergence detection feeds ONE bounded negotiation (byte-owned Codex legs,
  packet ceilings; agreed-absent selections honestly remove entries).
• The master plan is DETERMINISTIC RENDERER OUTPUT from the settled decision bundle — the
  third-model synthesis step is retired on the T4 full path (byte-preserved elsewhere); the
  rendered SC manifest is cross-checked against the compiled Law before every lock.
• Typed amendment descriptors: plan fixes apply as structural bundle amendments
  (rerender + rehash + re-ratify) — free-text rewrites are advisory only.
• Ratification binds the populated bundle: certificates carry the input bundle hash, renderer
  version, and RESULTING plan hash; selection settlement follows the ratified §6 flow.
• The deadlock ladder: still-opposed divergences go to 2×2 counterbalanced fresh-context cells
  (order and label bias eliminated); unanimity or the honest cascade — reference reduction, one
  exact-byte dual-signed rubric amendment, the reversibility rule with a mandatory exception
  ledger — and honest terminal classes throughout (twin_deadlock_resolved is never
  twin_ratified; deadlock rows are reloadably certificate-bound).
• Legacy plans (runs from before the council) get ONE retrospective blind dual ratification
  with complete binding verification — stale rows never advance a changed plan.

Earlier in this pass

• Build/validate/vision/report keystones went twin-council at T4 (receipt-attested evidence
  analysis, blind close pairs, correction councils, fidelity and signoff pairs).
• The codex transport carries cryptographic receipts end-to-end (invocation-exact
  reservation/verification cross-checks; fallback honesty).
• Conductor telegraph: story beats reach the operator transcript with exact-once resume;
  unattended stage chaining with hard stops.
• Velocity: failure-fingerprint retry routing, environment-repair honesty, probe-evidence
  reject briefs, churn-aware speculation gating.

Hardening and hygiene

• Floor receipts record failing test names; gate stdout survives process exit.
• kiln-probe lease-release now kills the whole watchdog process group — a released lease's
  surviving timer can no longer delete a replacement lease for the same run.
• A long-standing test flake (8 occurrences) was root-caused to that same watchdog race and
  eliminated.
• A generic v3.0.1 in-flight migration fixture proves old runs resume honestly under v3.0.2.
• Earn-its-place audit: prompt doctrine single-sourced, dead code removed, honest failure
  floors added (mapping zero-scout, validate goal-anchor existence), factual descriptions.

Record correction

• Earlier v3.0.2 planning records stated the C4 batch included kill-streak arithmetic scripted
  into kiln-state; that scripting did not land and is deferred to v3.1 (trim ledger #12). The
  conductor prose continues to carry it.