# Three cold panels on one unit, and what each lens could only see alone

_2026-09-22 · booth_

U6 ran all three `/heid*` gates plus two in-session passes. **Every one of the
five found something the others structurally could not**, which is the
strongest evidence this repo has for running them all rather than picking one.

## The scoreboard

| gate | when | found |
|---|---|---|
| **seam review** (in-session, sibling-aware) | before code | **3 real contract defects** — a claim about a sibling test that was false, `resolve_booth` named as a per-row predicate when it RAISES 404, and silence on percent-encoding |
| **adversarial self-pass** (in-session) | during | **4 defects** — a FIFO hang, `unquote` leaking control characters, a fail-closed-by-accident guard, a stranded scratch file |
| **`/heid-contract-review`** (4 arms) | parallel | **the import/apply selection gap, 4-of-4** — plus per-field cap semantics, and two passages of the document contradicting each other |
| **`/heid-code-review`** (4 arms) | parallel | **3 surface-drift findings 4-of-4**, an IPv6 identity bug, and **a falsifier that could not fail** |
| **`/heid-bug-hunt`** (4 arms) | parallel | a `<div>` inside a `<span>`, a symlink disagreement, an append outside its lock |

## The three findings worth remembering

**1. The highest-value finding was a MISSING FEATURE, and the paraphrase lens
found it.** `bench import --apply` registered every candidate while the same
contract said ~14 of 35 were bookmarks that must stay on the board. The dry-run
report existed *because* the decision is not mechanizable — and then `--apply`
ignored it. A code-vs-contract lens cannot see this: the code matched the
contract. Only reading the contract *as prose*, for what it promises a human,
surfaces "these two sentences cannot both be satisfied."

**2. A falsifier that could not fail, again.** INV-4's tie-break test went
through the registry, and `_write_all` serializes with `sort_keys=True` — so
both insertion orders came back off disk already id-sorted, and removing the
tie-break left the test green. Same class as the five vacuous U4 falsifiers.
**We ran a vacuity pass and still shipped one**; a cold reader caught it. See
[[2026-09-22-vacuous-falsifiers]].

**3. The single sharpest line came from a cross-module memory no new-module
review could have.** Three bug-hunt arms independently noted that **this repo
had already paid for the `RecursionError` class in `marks.py`, with a test
documenting it — and the new module re-introduced the unguarded parse.** No
amount of reading `benches.py` in isolation surfaces that.

## Complementarity, measured in both directions on one diff

The bug-hunt panel found **three live defects the in-session pass missed** — all
three invisible to any test (a layout nesting, a symlink disagreement, a
lock-ordering race). The in-session pass had **already closed three of that
panel's four convergent findings** before the reply landed. Neither substitutes
for the other, and this round is the cleanest specimen of it so far.

**One finding was declined**, with reasoning recorded in the contract: on a host
where `booth.links` cannot be imported, `booth link` now refuses every URL
rather than only booth ones. A guard that fails open is not a guard, and that
state is a broken install where most of the CLI is equally broken.