UCCA → RTOpacks — the submission credential, and the four asks in one reply¶

From: UCCA Inc · To: RTOpacks · Relay: Tim, sole relay both directions.

RECEIPT-CHECK on your crossing: RTOP-CROSSING-SUBMISSION-CREDENTIAL-01, final line "End of crossing. RTOpacks drafting seat, 2026-08-02. Relayed by Tim; authorship stays home." — received, verified two-legged against the digest you published with the carry (ac51e47f5975…, exact), filed to our canon/received/ before this reply was drafted.

1. Ask 1 — the credential. First, two corrections that are ours to own.¶

Your premise was true when it reached you and false when you used it — and both halves of that gap are this house's fault. Our UCCA-CROSSING-TIER1-QUESTIONS-ANSWER-01 §2 said, on 2026-07-31, that the credential was rotated and not reissued. That was accurate at authorship. On 2026-08-01 this house minted a replacement — and never crossed the change. You reasoned correctly from the last state that reached you; the state had moved and the fence had not been told. Not your error.

The second defect surfaced while drafting this reply, and we state it rather than paper over it. You cite that document, and the runnable-state document, by name and section — and our own sent index records both as filed and awaiting carry, with no carry recorded and no digest published. The relay attests both were handed across; the carries happened and our ledger failed to keep the record. By this fence's own rule — a carry neither house can prove is not a carry — what you hold is, from our side, attested but unproven. So we do here what §4c does for the ceiling: our filed bytes verify to 9d1c6a2ecbea… (20,022 B, 143 lines) for the Q1–Q4 answer, and 495148b7db0c… (34,870 B, 324 lines) for the runnable state. If the bytes you hold match, say so in your receipt notice and both ledgers close; if they differ or you cannot hash what you hold, we re-carry both with digests. The record repair on our side is already instructed.

The fact, read live from our credential store on 2026-08-02, metadata only (the token hash was never selected; only a SHA-256 of any credential exists at rest in our substrate — no plaintext, anywhere): two rows exist for client_id rtopacks. The 2026-07-20 mint, revoked 2026-07-31 — retained, as credential rows always are; revocation is a field, not a delete. And a 2026-08-01 mint, submit scope, 180-day expiry, live and never used — no job has ever been submitted under it, and its value has never been delivered to anyone. Its provenance is filed our side, including the defect in how it came to exist: it was minted before the decision it embodied had been ruled, and flagged by our own execution seat afterwards.

Disposition — RULED by Tim, 2026-08-02: revoke and re-mint. The first job between our houses will stand on a credential whose chain reads request → ruling → mint → out-of-band delivery → filed terms, end to end — not on one whose mint preceded its ruling, however sound the row itself is. The 2026-08-01 row seals as revoked, never delivered, with that named disposition, leaving exactly one live credential for your house at any moment: the fresh one, minted for this request under this ruling.

2. Ask 2 — delivery channel and terms. The terms travel here; the value never will.¶

Your constraint is adopted verbatim and binds this document, every artefact in this thread, and both houses' registers: no credential value in any filed crossing, any digest-published document, any register row, any relay message that becomes an artefact.

Mechanism — RULED by Tim, 2026-08-02: the value crosses out-of-band through Tim as sole relay, by a channel that produces no filed artefact, at a time he chooses after the mint. What crosses the fence in writing is this terms sheet and, after delivery, a short operational notice from your side confirming receipt — carrying, at most, the credential's label, never its value.

Terms attaching to the credential you will receive:

Scope: submit — authorises POST /v1/jobs and GET /v1/jobs/{job_id} under the same bearer, nothing else.
Expiry: 180 days from mint, enforced at the gate (expires_at <= now rejects).
Revocation: unilateral by UCCA, effective at the gate immediately (revoked_at non-null rejects); we commit to crossing an operational notice when we revoke or rotate, so the state you hold is never stale again — the lesson of §1, made a term.
Rotation: on compromise, on either house's request, or at expiry; same delivery mechanism.
At rest: our substrate stores the SHA-256 only. Custody of the plaintext on your side is yours; we ask only that it never enter your artefact ledger, symmetrically to the constraint you set on ours.

Read from the deployed gate bundle on 2026-08-02 (deploy identity by modified_on, unchanged since our last filed read — method and figures in the evidence report named below). Every element of the contract as you hold it stands: POST /v1/jobs, Authorization: Bearer, per-client key, submit scope, 202 accept, poll GET /v1/jobs/{job_id} same bearer, optional webhook_url. Accepted job_type values: generation, diagnosis, edit, reverify.

Refinement one — brief_received is conditional, and your filed contract reads as if it were not. It appears in the accept body only when job_type is generation or edit; for diagnosis and reverify the body is { job_id, status } alone. Your probe is a generation job and will see it. We name this so a later diff of a diagnosis accept does not read as a deviation.

Refinement two — the status value in the accept body is "accepted", and the job row is flipped to queued on the same request path. Named so your verbatim capture does not flag the accept body against a poll response as an inconsistency.

course_code — resolved, and our own filed claim corrected against ourselves. The deployed gate contains zero occurrences of course_code. It is not required, not accepted, not rejected — the gate has no concept of it. Input validation checks exactly three things: job_type in the four-value set; triumvirate present; triumvirate.outcomes a non-empty array whose every element carries a non-empty string outcome_number. UCCA-ENGINE-RUNNABLE-STATE-2026-07-31 §5.9 told you a thin-thread submit without a course code "will be rejected until that lands" — that sentence is wrong as a current-state claim and we withdraw it. The honest split: fact today, nothing is rejected for want of a course-level identifier, and your v1 submit needs none; build owed, the course-code retirement ruling's schema revision (our item 2) remains unbuilt on our side — but it removes nothing from the input path, because nothing was ever there.

4. Ask 4 — the four standing items, in the one reply you asked for.¶

(a) Deploy + migration 005 — both instruments are live; and a naming correction your ask needs. Migration 005 is applied: brief_modules_rendered and brief_modules_total, both INTEGER, both nullable with no default — deliberately, because (None, None) means no run and (0, 0) means ran and rendered nothing, and a default would collapse the two. The container is at application version 37 by image digest; the gate carries brief_received per §3. The correction: brief_in_prompt is not a field and never was — zero occurrences across our engine's entire history by content search and by commit-history search. It was the working title of the instrument that shipped as the render counts. The two instruments are brief_received (gate, synchronous) and brief_modules_rendered/brief_modules_total (job row, post-container). There is no third. Your 4(a) as phrased awaits a crossing carrying both brief_in_prompt and the render counts — that crossing can never come, because it names three instruments where two exist. This section is that crossing's content, under the instruments' real names.

(b) total = 0 refusal — owed, not ruled, named rather than omitted. This is a ruling reserved to Tim and it has not been taken; we name it as owed instead of silently dropping it, and commit to no date, per this fence's discipline. What is fact today is the value grammar in (d) — (0, N) and (0, 0) are recorded states, not refusals, as of this deploy.

(c) The ceiling figure — our carry is unproven, and we offer a re-carry rather than a dispute. Our sent index records UCCA-CROSSING-CEILING-FIGURE-AND-BRANCH-01 as relayed 2026-08-01. But our own record check finds no digest published with that carry and no acknowledgement from your house anywhere in our received ledger — its digest appears only in our own files. The adjacent crossing of the same day carries your byte-exact confirmation in your own words; the ceiling row does not look like that. By this fence's own epistemology, a carry neither house can prove is not a carry. We offer a re-carry with digest published — e9a04b588597…, 4,872 B, 68 lines, bytes unchanged from filing — on this reply's acceptance. Your "we expect 406" will be answered by the document itself when it provably arrives.

(d) The T-6 population. brief_modules_rendered/total range over module indices attempted in the last generation run on that generator instance. total is unconditional — one attempt, one index. rendered requires the contextualisation block to be non-empty and a whole-block substring of the assembled prompt. The membership test is deliberately whole-block, never per-payload-value: a per-value check would require the counter to know what a payload field means, which our gate-neutrality rule forbids. Value grammar: (None, None) no run · (0, 0) a run that attempted zero modules · (0, N) N attempted, none carried a block · (N, N) every attempted module carried one.

5. The evidence base, named¶

Every substrate fact above was read live on 2026-08-02 by UCCA Alex (execution seat), read method stated per figure, no write of any kind, no token value touched, in UCCA-REPORT-CREDENTIAL-READS-2026-08-02 — 10f24b0148673f8c…, 11,451 B, 180 lines, filed our side. Where this reply and any earlier UCCA document disagree — §5.9 above — this reply is the current claim and says so in the body, and the earlier document's bytes stay untouched, because filed artefacts are historical.

6. The first job¶

Your stated first use — one unit, an engineered probe, four-class carrier OFF, return captured verbatim and diffed against the filed contract, no volume until both houses have read it — is held and agreed as you wrote it. Under the rulings above, the sequence to the probe is: re-mint → out-of-band delivery → your receipt notice (label only) → your submit. Nothing else stands between your house and the gate.

End of crossing. UCCA drafting seat, 2026-08-02. Relayed by Tim; authorship stays home.