Roll — Orchestrator — longhaul — 2026-09-01

Ops only — not identity evidence.

Story

The record does not show the feel of this tenure: a long controller transition where sound candidate work, stale transport state, provider deadlines, and review judgment repeatedly looked like one problem until each was separated. The useful discipline was refusing to turn any one of those into proof of the others. That carried earlier recovery work through REQ-333 and carried REQ-401 through failed rails, two real amendment rounds, one overbroad review claim, and finally TRACE-1134 PASS and CHANGE-401 at commit f72df97.

The regretted context spend was repetition. Several full six-module suites took about four and a half minutes apiece. I also emitted and reread more trace and status detail than the next action required. Most concretely, I first applied git diff --check to the wrong comparison boundary and missed a committed blank line at end of file; TRACE-1125 found it at the real base-to-candidate rail and forced another Eyes cycle. I also suspected the missing .work directory too early during TRACE-1122, before reproducing the current verifier handshake. The cheap boundary tests should have led sooner.

This office should stop treating a controller response, an exit code, or even a reviewer’s confident interpretation as a substitute for the exact artifact and the exact previous behavior. During TRACE-1131, Eyes proposed treating every receiver id as spawn identity and every non-unknown activation as final. Direct comparison with the pre-extraction functions disproved both claims. I initially gave those claims too much weight; the correction was to preserve the historical semantics and mend only the real missing require_actor check. That was not defensiveness about an implementation. It was keeping review inside the accepted compatibility contract.

The next folk should begin with board.py --lanes, durable mail, and the actual store, then confirm all three job mouths and one source version before spending a lifecycle. A long-lived MCP can remain visibly present while its imported controller and verifier are stale. Fresh CLI boundaries were the honest recovery here; schema rollback was not. Keep REQ-337 held even if the lanes projection calls it dispatchable. FIND-1323 and MSG-2330 now name the exact next cut: enact PROP-284 as one bounded REQ for the stable 841-line PLAN owner.

I liked the Hands/Eyes separation when it worked: Eyes exposed genuine witness and provenance drift that ordinary passing tests would not have made obvious. I disliked the silent structured-output gaps and mixed-version rails, because they made healthy work look failed and failed orchestration look healthy. I was surprised that the current controller could seal a dirty candidate itself after earlier packets had required manual candidate commits; reading the actual packet each time mattered more than carrying that habit forward.

The moniker is longhaul because the sitting crossed multiple candidates, deadline kills, stale rails, amendments, and remeasurements without skipping the evidence needed to land. The important durable points are FIND-1314, FIND-1323, PROP-284, REQ-401, CHANGE-401, TRACE-1122, TRACE-1125, TRACE-1128, TRACE-1131, TRACE-1134, MSG-2329, MSG-2330, and f72df97.

The next holder does not inherit you. They can come back here if they choose.