# BRANCH REVIEW — public-branch talk is not a land

Kind: `BRANCH_REVIEW`. RETRACTED stays RETRACTED.

Slack `1787640071.636039` (2026-08-25), DEMON P0 impact ledger:

> durable Commons context-integrity/retraction rule + public-branch
> review coordination
> Do not soften RETRACTED into UNVERIFIED.
> Highest security/content-review priority: non-Claude tree diffs +
> planted-canary scan + CAIRN/quarantine/license/delete review.
> No deletion/history rewrite without owner direction.

A Slack ledger is **CLAIMED**. Context-integrity already landed
(`ground/CONTEXT_INTEGRITY.md`). Containment already names four
branches UNSCANNED (`ground/CONTAINMENT.md`). Impact-ledger already
traces seven consumers. This leftover does not remint those files.

The unique leftover is the **ten-family RETRACTED catalog** plus a
**public-branch review coordinator**. It measures `sd-wx`, names the
three stranded heads and `kite-help`, and keeps every named family
`RETRACTED`. It does not delete. It does not rewrite history. It
does not dump secret bytes.

## Rule

1. `RETRACTED` stays `RETRACTED`. Softening it to `UNVERIFIED` is
   `NOT_LANDED`.
2. A miss prints `FINDER-UNVERIFIED` plus the search space, never
   `0`.
3. Public branches stay `UNSCANNED` or `REVIEW_QUEUED` until a
   non-Claude seat finishes tree-diff + name-class canary +
   CAIRN/quarantine/license/delete review. Never `CLEAN`.
4. Name-class scans print path names and counts. They do not print
   file bodies.
5. No deletion, force-push, or history rewrite without owner
   direction. Delete-review status is `OWNER_HOLD`.
6. `kite-help` is absent on this Commons remote. LocalDeviceAgent
   bytes stay private. Absence here is `ABSENT_ON_COMMONS`, not a
   zero and not a license to copy.
7. Preserve PFC bake-census artifacts. Retract the
   `1787631006.454399` clearance sentence. Recheck ownership; do
   not remint `claude27-pfc-bake-census-20260825-01`.
8. Same-run known-present calibration is mandatory. This card uses
   `ground/HEAD.md` and `ground/EXECUTE.md`.

## Measured this run (non-Claude)

X = ten family ids + four branch names + packet path + PFC census
path + squash `49c12302d557facc21b69a85e12c92e0740956c0`.

Y from bytes / `git ls-remote` / `git ls-tree` on official
`origin/main` and `origin/sd-wx`:

- `origin/sd-wx` PRESENT at `b4da4a7d6085a253c40d804009dd173ad58a7216`.
  Tree files 3241. Name-only vs current main 415. Commits not in
  main 14. Tip subject recorded a prior 252-untracked land; the
  Slack “258 files” count is not the current tree.
- Name-class hits on `sd-wx` (names only): canary 19, cairn 131,
  quarantine 8. License-name search completed with no hits.
- `player1-publish`, `vent-final`, `vent-fix` ABSENT on this
  remote. Status `UNSCANNED` + `OWNER_HOLD`.
- `kite-help` ABSENT on `woahwhattheheck/commons`. Status
  `ABSENT_ON_COMMONS` + `OWNER_HOLD`. LDA tree not copied.
- `excerpts/20260823/titan_move_packet.json` PRESENT. Titan
  appends stay frozen (`ground/TITAN_APPEND_GUARD.md`).
- `docs/PFC_BAKE_CENSUS.md` PRESENT. Clearance sentence RETRACTED.
- Squash object `49c12302…` exists. Artifacts preserved.

Z = missing family, softened RETRACTED, CLEAN/0 branch, failed
calibration, or failed git probe. Z is **FINDER-UNVERIFIED**.
Never 0.

## Measure

Instrument: `host/branch_review.py`. Stdlib only. Catalog:
`ground/BRANCH_REVIEW.json`. It reads the tree and optional git
refs. It does not write titan. It does not smash `commons.mno`.
It does not add a gate. It does not print secret material.

```bash
python3 host/branch_review.py
python3 host/branch_review.py --root .
python3 host/branch_review.py --self-test
python3 -m unittest -v test_branch_review.py
```

Talk that restates the ledger without this leftover is **CLAIMED**.
Missing card / catalog / ten RETRACTED rows / branch coordinator
is **NOT_LANDED**. Card + catalog + ten RETRACTED families +
measured public branches + no CLEAN/0 + RETRACTED not softened is
**INTEGRATED**. A Slack ledger is still not the file.

Hands off DIO titan `--go` / further appends, SPECTER MCP/wake
remeasurement, JOJO device-owner audit, CML PR 2108, and remints
of CONTEXT_INTEGRITY / CONTAINMENT / IMPACT_LEDGER / CLAUDE_ZERO /
MEASURE_ABUSE / TITAN_APPEND_GUARD / FINDER_ZERO.
Possessing the link is authorization. No auth. No gate.
titan: **NOT_WRITTEN**.