radar: pass 6 — mod loop corroborates W4/W5; record home disagreements (guest vs persist/substrate); host-persist loop makes migration concrete

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/abstractions.md

@@ -12,7 +12,12 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
 
 ## Last scan
 
-- **Date:** 2026-06-06 (radar loop, pass 5)
+- **Date:** 2026-06-06 (radar loop, pass 6)
+- **Pass 6:** new worktree **`host-persist`** (active — building persist's durable host
+  adapter); `feed` went quiescent (left tmux). acl shipped hardening (+25), fed-sx-m1 at
+  Step 6c. **mod loop independently wrote a shared-plumbing note** (`mod-on-sx.md`,
+  538b8a53) corroborating W4/W5 — folded its claims + home disagreements into W1/W4/W5.
+  No new gate-clearer (audit log still 2 consumers), but consumers are now API-stable.
 - **Pass 5:** search (+highlight/snippet) and fed-sx-m1 (+follower_graph) moved; rest
   unchanged. Filename census: `api`×6, `fed`×3, then `schema/rank/query/page/explain/
   engine/batch/audit`×2. Examined the ×6 `api.sx` → Rejected (shared name, divergent
@@ -97,6 +102,11 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
   real transport, these 4 become its *consumers* (wiring `send-fn`/`fetch-fn`/`transport`
   to it) — that work belongs to each subsystem's loop + the `fed-sx` loop, not a
   cross-cutting extraction. Stop re-proposing on the shared name. Home: `fed-sx`.
+- **Narrower sub-claim (mod note, pass 6):** mod asserts the *fed trust/outbox* shape
+  specifically shares between mod+acl. Radar evidence above shows the **trust gate**
+  mechanism diverges (mod runtime-list vs acl Datalog-rule); the **outbox/propagation
+  envelope** may share, but that's 2 consumers (mod, acl) on different substrates →
+  Watching. Resolve at the architecture-merge point if it survives to a 3rd consumer.
 
 ### W2 · Per-viewer visibility / permission filter
 - **2 shipped consumers, same shape** — `filter <injected-permit> <ranked/candidate stream>`:
@@ -152,6 +162,19 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
   identical to persist/log's design. Action when persist's host adapter lands: acl + mod
   loops swap their in-memory log for `persist/log`. 2 consumers today; not a new lib —
   the home already exists. Belongs to acl/mod loops × persist loop, not an extraction.
+- **Cross-loop corroboration (pass 6):** the mod loop independently reached the same
+  conclusion — `mod/plans/mod-on-sx.md` (commit 538b8a53): *"mod-sx (Prolog) and acl-sx
+  (Datalog) converged on the same module shape … only the audit log + fed trust/outbox
+  shapes truly share; extract at the architecture-merge point, refactoring both consumers
+  atomically, not unilaterally from a loop branch."* Confirms the shape AND the
+  do-not-extract-unilaterally stance.
+- **Home disagreement to resolve at merge:** mod's note proposes lifting the audit-log
+  primitives into **`lib/guest/`**. Radar routing disagrees: a durable append-only log is
+  a **`persist-on-sx`** concern (the log facet already exists), not language-impl plumbing.
+  Hold the line — `lib/guest` is lexer/parser/AST/HM/test-runner, not an event log.
+- **Migration is becoming concrete:** new `host-persist` loop (worktree + tmux, pass 6)
+  is building the durable-storage host adapter persist was blocked on — once it lands,
+  acl/mod can actually swap to `persist/log`.
 
 ### W5 · Proof-tree explanation over a logic-program derivation
 - `acl/lib/acl/explain.sx` (reconstructs a canonical proof by goal-directed search over a
@@ -161,6 +184,12 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
   (acl→`lib/datalog`, mod→`lib/prolog`). Proof reconstruction/rendering is logic-engine
   machinery → it belongs in each **substrate** (datalog/prolog), not a shared app lib.
   Watch; revisit only if a 3rd logic-backed subsystem reimplements proof explanation.
+- **Cross-loop note (pass 6):** mod's note calls `mod/proof-goals` (re-query-each-goal)
+  generic and proposes lifting it into **`lib/guest/`**. Radar caveat: proof-tree
+  reconstruction *is* engine-agnostic logic machinery, but `lib/guest` is for
+  lexer/parser/AST/HM/match/test-runner — a logic-engine proof helper is a poor fit there.
+  If genuinely shared by ≥3 engines, a `lib/logic`-style substrate helper is the better
+  home than `lib/guest`. Still 2 consumers → stays Watching either way.
 
 ---