radar: pass 18 — W1 re-test: events 5th federation consumer (agenda merge, runtime-list trust like mod); inject-fed-sx seam now 5/5

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/abstractions.md

@@ -12,6 +12,12 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why).
 
 ## Last scan
 
+- **Date:** 2026-06-07 (radar loop, pass 18)
+- **Pass 18 — W1 gate re-test.** events shipped Phase 4 federation (5th consumer): a 5th
+  divergent merge (sorted agenda + `:origin` provenance), trust-gate = runtime list
+  membership (shares mod's mechanism, not acl's). Reinforces W1's "theme not shape" — but
+  the **inject-fed-sx-transport seam is now 5/5**, strengthening "all are fed-sx
+  consumers-in-waiting." Trust sub-pattern refined: mod+events (runtime set) vs acl (rule).
 - **Date:** 2026-06-07 (radar loop, pass 17)
 - **Pass 17 — filename census declared EXHAUSTED** (see the Census-status table above).
   Examined the last unswept ≥2 recurrences (schema/engine = acl⇄mod substrate twins;
@@ -191,21 +197,27 @@ one merged file copied N times. Correct one-liner:
   | search (`fed.sx:8`) | inverted indices | relabel DocId `peer*1000+local` + union posting lists | none | none (pure merge fn) |
   | mod (`fed.sx:11-14,99`) | moderation decisions | advisory-list vs applied-list; bind iff `mod/trusted?` | **yes — runtime list** `mod/trusted? peer scope` | mock outbox / `fed-send!` |
   | acl (`federation.sx:43,56`) | Datalog delegate facts | pull facts, gate by `trust`/`level_covers` rule, re-saturate | **yes — Datalog rule** at query time | `transport` dict |
+  | events (`federation.sx`) | calendar agendas | fold trusted peers' agendas into one sorted agenda + `:origin` provenance | **yes — runtime list** `ev/trusts?` (peer-id ∈ trust-set) | injected behind `ev/peer-agenda` |
 
-- **The ONLY real commonality is the injection seam**, not extractable code: every one
-  says "the real transport is `fed-sx`'s job; inject `send-fn`/`fetch-fn`/`transport`/
-  outbox and mock it in tests." That is an architectural *convention the fleet already
-  follows*, and the trust gate (where present) is implemented two incompatible ways
-  (runtime list vs declarative rule). No shared merge, no shared trust mechanism.
+- **The ONLY real commonality is the injection seam** (now 5/5, pass 18), not extractable
+  code: every one says "the real transport is `fed-sx`'s job; inject `send-fn`/`fetch-fn`/
+  `transport`/`peer-agenda` and mock it in tests." That is an architectural *convention the
+  fleet already follows*. The merge op diverges 5 ways (dedupe / index-union / advisory /
+  fact-saturation / agenda-sort). The trust gate, where present, splits: **mod + events use
+  a runtime trust-set membership check; acl uses a declarative Datalog rule** — so even the
+  trust sub-pattern is 2-of-3, and the membership check is a trivial one-liner (below the
+  extraction threshold). No shared merge, no single shared trust mechanism.
 - **Disposition:** do NOT extract a shared "federation lib." When `fed-sx` ships its
   real transport, these 4 become its *consumers* (wiring `send-fn`/`fetch-fn`/`transport`
   to it) — that work belongs to each subsystem's loop + the `fed-sx` loop, not a
   cross-cutting extraction. Stop re-proposing on the shared name. Home: `fed-sx`.
-- **Narrower sub-claim (mod note, pass 6):** mod asserts the *fed trust/outbox* shape
-  specifically shares between mod+acl. Radar evidence above shows the **trust gate**
-  mechanism diverges (mod runtime-list vs acl Datalog-rule); the **outbox/propagation
-  envelope** may share, but that's 2 consumers (mod, acl) on different substrates →
-  Watching. Resolve at the architecture-merge point if it survives to a 3rd consumer.
+- **Narrower sub-claim (mod note, pass 6; refined pass 18):** mod asserts the *fed
+  trust/outbox* shape shares between mod+acl. Radar evidence refines this: the trust gate
+  splits by mechanism, not by subsystem pair — **mod + events** both use a runtime
+  trust-set membership check (`mod/trusted?`, `ev/trusts?`), while **acl** uses a Datalog
+  rule. So a "trust-set membership" helper has 2 consumers (mod, events) — but it's a
+  one-line `member?` and the merge it gates diverges, so still not worth extracting.
+  Resolve at the architecture-merge point if a heavier shared trust-set surface emerges.
 
 ### W2 · Per-viewer visibility / permission filter
 - **2 shipped consumers, same shape** — `filter <injected-permit> <ranked/candidate stream>`: