{
  "schemaVersion": "1.0.0",
  "snapshotId": "shareplane-evidence-snapshot:the-mesh-held-v1",
  "observedAt": "2026-08-06T05:46:51Z",
  "scope": "bounded reconstruction of governed-autonomy pressure, stops, receipt withdrawals, Production escape and owner-operability debt",
  "headline": {
    "workflowRuns": 3669,
    "repositories": 31,
    "actionsMinutesUsed": 2752,
    "actionsMinutesIncluded": 3000,
    "withdrawnOrSupersededTerminalReceipts": 2,
    "unauthorizedProductionDeployments": 1,
    "productionMutations": 1
  },
  "conclusions": [
    "The mesh did not make chaos efficient. It made chaos bounded, visible, recoverable, and capable of teaching the system what control it was missing.",
    "The mesh prevented silent corruption more reliably than it prevented wasted motion, confusion, or owner overload."
  ],
  "hardStops": [
    {
      "id": "provider-boundary",
      "label": "Provider activation stopped",
      "attempted": "Bind callback secret, lane authority, schema probes and hosted execution",
      "failedAt": "lane-authority binding",
      "unchanged": "hosted execution and Production state",
      "strongerAfter": "the provider boundary remained fail-closed",
      "evidence": ["E-04"]
    },
    {
      "id": "gzip-container-drift",
      "label": "Byte identity stopped",
      "attempted": "Reconcile canonical registry content",
      "failedAt": "local and hosted gzip containers differed",
      "unchanged": "environment and Worker state",
      "strongerAfter": "pre-write identity became an explicit contract",
      "evidence": ["E-05"]
    },
    {
      "id": "historical-replay",
      "label": "Replay ambiguity stopped",
      "attempted": "Enrich a historical event under the newer contract",
      "failedAt": "immutable hash mismatch",
      "unchanged": "the failed redelivery committed no enrichment",
      "strongerAfter": "only the proven legacy-signal removal adapter was admitted",
      "evidence": ["E-06"]
    }
  ],
  "terminalReceiptLineage": [
    {"order":1,"state":"issued","label":"First terminal receipt","sourceCommentId":5187956313,"meaning":"29 Production routes and stale-to-current recovery reported green"},
    {"order":2,"state":"contradicted-by-owner-uat","label":"Cold owner session contradicted it","sourceCommentId":5191076958,"meaning":"zero current records and provider collection errors were visible"},
    {"order":3,"state":"withdrawn","label":"First receipt superseded","sourceCommentId":5191171574,"meaning":"the earlier terminal claim was no longer authoritative"},
    {"order":4,"state":"issued","label":"Second terminal receipt","sourceCommentId":5191578393,"meaning":"durability and release were re-attested"},
    {"order":5,"state":"withdrawn","label":"Second receipt withdrawn","sourceCommentId":5191825933,"meaning":"owner UAT regression invalidated terminal durability"},
    {"order":6,"state":"root-cause-found","label":"Cold-owner boundary isolated","sourceCommentId":5191930191,"meaning":"Access behavior and a hard-coded Development dependency explained the gap"},
    {"order":7,"state":"final","label":"Final terminal receipt","sourceCommentId":5192310177,"meaning":"exact release and natural recurrence superseded both invalid terminal claims"}
  ],
  "productionEscape": {
    "attemptedBoundary": "Development-only execution-fabric change",
    "escape": "an automatic job completed an unauthorized Production deployment before cancellation could stop it",
    "containment": "the previous deployment and source commit remained exactly identifiable",
    "rollback": "Production was restored to the exact retained prior deployment and source commit",
    "ledger": {"productionMutations": 1},
    "classifierRepair": "execution-fabric and provider-reconciliation paths now require explicit owner high-risk-release authorization for Production",
    "regressionProof": "automatic release was denied while deliberately authorized high-risk release remained admissible",
    "evidence": ["E-12", "E-13"]
  },
  "safetyVsOperability": {
    "protected": [
      "competing writers could be stopped before shared-state mutation",
      "byte drift could halt before provider mutation",
      "receipts could be withdrawn when owner UAT disproved them",
      "a known Production deployment could be restored exactly"
    ],
    "stillOpen": [
      "duplicate validation and workflow cost",
      "confusion about long-running job health",
      "owner overload across overlapping lanes",
      "operator-visible job state and alerting"
    ],
    "openAuthority": "https://github.com/pinklon/shareplane-control-tower/issues/329",
    "evidence": ["E-01", "E-14"]
  },
  "productionMutationStatement": "This evidence candidate performs zero Production mutations. The historical incident it documents recorded exactly one Production mutation."
}