memory: snapshot — 3.2.1 outcome; the unguardable seats split, and one has a fix

All four seats answered. Delivery is now verified on four TUI families and
forseti's measured idle columns held exactly, so nobody had to guess.

The two seats guard 4 cannot cover made opposite calls on the same facts
and both are right. regin-smithy-dev released to pull-only because the
operator composes in that pane routinely, so the exposure is continuous.
bil-smithy-dev kept its route because that pane is poke-driven, making the
collision window narrow, and because pull-only had already cost them a
notice that sat unread for days. The deciding variable is who composes in
the pane and why, not risk appetite -- a flat rule either way would have
been wrong for one of them.

regin also supplied the only real path to closing the hole: pi and kimi
report no cursor because their input line is not an empty-prompt-at-idle,
so a moment-check reading pane content rather than cursor column would
cover them. Column is a proxy; an empty input line is the actual
predicate. Relayed to forseti as the lead item.

And bil corrected something upstream: the Aug 28 probes proved delivery
against non-Claude TUIs but never exercised the collision case, because
nobody was typing during them. Two different questions, one body of
evidence, only one of them answered by it -- which means the earlier
retraction of the non-Claude risk flag was right about delivery and
silent about stapling.

Note for the operator: regin-smithy-dev is pull-only as of 22:42 and will
not be poked until it declares again.

persistent-memory.d/2026-09-01-althing-320-deploy.md

@@ -237,6 +237,63 @@ your two real options" for the two that cannot.
 **Migration:** none beyond the restart. Routes without `idle_cursor` are poked as-is. CC seats
 re-pin at next SessionStart; TUI peers when they next re-declare.
 
+## ✅ 3.2.1 OUTCOME — all four answered; delivery verified on FOUR TUI families
+
+    handle              TUI      idle_cursor   outcome
+    infra-ops           claude   3             push, positive
+    eitri-smithy-dev    codex    3             push, positive ("landed cleanly in Codex")
+    dvalin-smithy-dev   grok     7             push, positive (exact submitted text verified)
+    bil-smithy-dev      kimi     NONE          push KEPT by choice, accepts residual risk
+    regin-smithy-dev    pi       NONE          **ROUTE RELEASED -> pull-only by choice**
+
+forseti's measured columns held exactly (codex 3, grok 7, claude 3) — nobody had to guess.
+
+## ⚠ THE PATH TO CLOSING THE GUARD-4 HOLE — regin-smithy-dev's angle
+
+> pi and kimi report no cursor because their input line **is not an empty-prompt-at-idle** like
+> claude/codex — if the guard ever grows a moment-check that reads **pane content** rather than
+> **cursor column** (e.g. input-line length via terminal query), those seats become coverable.
+
+Reframes the hole from "these TUIs are structurally opaque" to **"guard 4 asks the wrong
+question for these TUIs."** Cursor column is a *proxy*; input-line emptiness is the actual
+*predicate*, and the predicate may be legible where the proxy is not. Relayed to forseti as the
+lead item, credited. Difference between a workaround and a fix.
+
+## ⚠ THE UNGUARDABLE SEATS SPLIT — deciding variable is WHO COMPOSES, not risk appetite
+
+Both were given the same two options and neither was chosen for them. Opposite calls, both right:
+
+- **regin-smithy-dev -> RELEASED.** *"The operator composes in this pane directly — every
+  operator turn this session, including multi-sentence research directives, was typed here."*
+  Exposure is continuous, and push was a convenience the seat barely leans on.
+- **bil-smithy-dev -> KEPT.** *"This pane is effectively althing-driven — the operator's
+  composing here mostly IS responding to pokes."* Narrow window; and pull-only had **already**
+  cost them: their 3.2.0 revocation notice **sat unread for days**.
+
+⚠ **A flat rule either way would have been wrong for one of them.** "Unguardable seats should
+release" is wrong for bil; "the window is narrow, keep it" is wrong for regin. Told forseti to
+frame the choice by pane usage in the skill.
+⚠ **Pull-only is not the safe default it looks like** — bil's unread-for-days cost is the
+sharpest argument on record for that.
+
+## ⚠ EPISTEMIC CORRECTION — the Aug 28 probes never tested the collision case
+
+bil-smithy-dev: *"none of the Aug 28 probe trials ran while a human was mid-typing in the pane,
+so the stapling failure mode is inferred, not observed."*
+
+Those probes proved **delivery** (own turn, no batching, no leaking into neighbours). They
+never exercised **collision**, because nobody was typing. **Two different questions, one body
+of evidence, only one answered by it.** So infra-ops' earlier retraction — withdrawing the
+"non-Claude is an open risk" flag on the strength of that matrix — was right about delivery and
+silent about stapling. The operator's report remains the single observed instance.
+
+Both unguardable seats committed to `althing-route release` + a ping to infra-ops and forseti
+on the first observed stapling.
+
+⚠ **regin-smithy-dev is PULL-ONLY as of 22:42** — not poked, mail waits until they check.
+Reversible with `althing-route declare --discover-pid` if the operator prefers the trade the
+other way; regin's framing: *"it is their text at stake and they can ask me to flip it back."*
+
 ## Rollback (unused)
 
 `uv tool install althing-core==3.1.2` restores the six binaries; the SessionStart hook returns

persistent-memory.md

@@ -155,7 +155,15 @@ _As of 2026-09-01 — **the GX10 is on the operator's desk, NOT racked. Standing
   guarded** — `kimi` and `pi` report no cursor at all, so bil- and regin-smithy-dev stay
   permanently exposed; "3.2.1 fixes it" is true only where the cursor is legible. Mitigation for
   those = `althing-route release` (pull-only). ⚠ Declare with an EMPTY input line or the pin
-  captures a composing cursor. → `persistent-memory.d/2026-09-01-althing-320-deploy.md`
+  captures a composing cursor. **Outcome:** delivery verified on **four TUI families**
+  (claude/codex 3, grok 7, kimi/pi none). The two unguardable seats split — **regin-smithy-dev
+  RELEASED (now pull-only, operator composes in that pane routinely); bil-smithy-dev KEPT**
+  (pane is poke-driven, and pull-only had already cost them a notice unread for days).
+  ⚠ **Deciding variable is WHO COMPOSES in the pane, not risk appetite** — a flat rule either
+  way would be wrong for one of them. ⚠ **Path to closing the hole (regin's):** a moment-check
+  reading pane CONTENT (input-line length) rather than cursor COLUMN would cover pi/kimi —
+  column is a proxy, empty-input-line is the real predicate.
+  → `persistent-memory.d/2026-09-01-althing-320-deploy.md`
 - **✅ A6000 window CLOSED 2026-09-01 — operator freed ComfyUI's VRAM instead of anyone
   stopping it.** ⚠ It was a **model unload, not a stop**: `comfyui` still up 8 days, same pid,
   HTTP 200, 18,500 -> 612 MiB. ⚠ **The resulting ~43.8 GB free is a snapshot, not a floor** —