Blast-radius pass first (graphify explain list_booths + grep over every
mkdir and every dotfile skip), then the contract, then a caller-side seam
review against the real sibling module surfaces.
The seam review earned its place again: the contract asserted that the
upload path's filename dedupe set must gain MANIFEST_FILE or an uploaded
file could collide with the manifest. safe_upload_name strips leading
dots, so that collision is unreachable — and the UPLOAD_MARKER entry
already sitting in that set has never been able to matter either. A
scope item the contract reasoned its way into and the sibling refutes.
Operator calls settled 2026-09-22: flags on the existing new/add verbs
rather than a second announce verb; unannounced booths get a quiet
marker rather than nothing; U5 adds provenance only and does not add a
second index ordering keyed on announcement time (parked for v1.1).
Cold contract panel dispatched to heid before this landed; its findings
fold in before any code ships.
Vuong Hoang
109190b0d6