docs(board): the gated delete is built, and a shared-checkout incident

master sc delete --manifest exists: dry-run by default, identity verified in
BOTH directions (a permalink that now resolves to a different sc_id is a
refusal, not a warning), public tracks refused, a reason required per entry
because a deletion without provenance is not allowed, batch capped before any
API call, and a receipt that keeps every field plus the on-disk paths of the
archived artwork and the source FLAC. The old test-namespace gate was not
widened — a second gate was added beside it, and a test proves the old one is
unreachable from the new path.

Dry run: 14 deletable, 0 refused. All private, all uploaded in the same minute
on 2026-08-12, and every one still has its FLAC in Opal26_master/tracks/, so
deleting them loses a URL and not a recording. --go is NOT approved yet.

Two caveats recorded loudly rather than buried. The delete TRANSPORT is
unproven: no DELETE has ever been issued from this codebase against api-v2, and
a clean dry run is not evidence the deletes will land. And the generator's first
version lined stale uploads against the newest cut BY TRACK NUMBER — dropping
Desire renumbered REVOLUTION from 15 to 14, so the manifest confidently compared
Desire against REVOLUTION's duration. An unnamed reference, again.

Also logged: four of my own commits landed on a concurrent session's branch
because the shared checkout moved under me, and 'git push origin master' from a
non-master HEAD is a silent no-op that exits 0. Recovered via worktree
cherry-pick without touching their branch or the live tree. The worktree rule in
CLAUDE.md has no orchestrator exemption, which is what I had assumed.

    two sessions, one working tree,
    and a push that said yes to a question
    it had never actually been asked.

TASKS_DUMP.md

@@ -1746,3 +1746,80 @@ timecode is carried through unchanged rather than guessed at or dropped. The pag
 currently documents the set **as performed** (15 tracks). Should it stay that way,
 or drop to the 14 released tracks so the page matches what a visitor can actually
 go and listen to? Not a machine call.
+
+### ✅ The gated delete EXISTS — `master sc delete --manifest` (tidal-ears `ab3285b` on `main`)
+
+The "explicit, separate call" that `scwrite.py`'s refusal message had been
+promising since August. `_is_test()` and `delete()` are **byte-for-byte
+untouched and unreachable** from the new path — a test proves it. The old gate
+was not widened; a second gate was added beside it.
+
+The allowlist is a **manifest**, not a permalink pattern, because a pattern gate
+cannot protect `/wap` from `/opal26-wap`. Guards, each proven refusing against
+the live account:
+
+| guard | behaviour |
+|---|---|
+| dry-run **default** | `--go` required to delete anything |
+| identity, **both directions** | manifest names `permalink` AND `sc_id`; if the permalink now resolves to a different id, **REFUSE** — not warn |
+| `public: true` | refused unless `--allow-public` (proven on `/au-revoir-lord-toyota`) |
+| missing/short `reason` | refused — a deletion without provenance is not allowed |
+| `--max` (default 20) | refuses an over-size manifest **before any API call** |
+| wrong account | aborts the whole run before planning |
+| receipt | per entry: title, duration, created_at, artwork_url, genre, license, sharing + on-disk paths of archived artwork and source FLAC, existence re-checked at run time |
+
+Generator: `armada/tide-table/build_delete_manifest.py` (`bd3a680`) turns the
+lens verdicts into the manifest; it refuses to emit anything marked `OK`, anything
+from `coincidences_discarded`, or any entry without an `sc_id`.
+
+**Dry run is clean: 14 deletable, 0 refused.** All 14 are private, all uploaded
+2026-08-12T21:17:43Z, and **every one resolves to a FLAC still present in
+`Opal26_master/tracks/`** — deleting them loses a URL, not a recording. 8 of 14
+have their original artwork already archived in `sc_pull_2026-09-05/artwork/`.
+
+⚠️ **`--go` IS NOT YET APPROVED.** Awaiting PLN on the list.
+
+🔴 **The delete transport is UNPROVEN.** Reads are fine (132-track walk, 14 GETs,
+no DataDome), but **no DELETE has ever been issued from this codebase against
+api-v2**, and `POST /tracks` 400s forever on that path — which is the whole reason
+`scform` exists. If `--go` returns a 403 with a captcha body, the fix is already
+anticipated: `delete_manifested()` takes a `deleter` callable, to be backed by
+`scbrowser.Browser.api("DELETE", …)`; it just is not wired to a `--transport` flag
+yet. Do not read a clean dry run as evidence the deletes will land.
+
+🐛 **A real bug caught in the generator, and it is `feedback_name_the_reference`
+again.** The first version lined stale uploads up against the newest cut **by
+track number**. The Aug-12 cut had 15 tracks and v4 has 14, so dropping *Desire*
+renumbered *REVOLUTION* from 15 to 14 — and the manifest shipped
+`"#14 Desire, 388.1s vs v4 205.6s"`, where 205.6 s is REVOLUTION's length. Fixed
+to key on the title slug; a track absent from the newest cut now says so instead
+of borrowing a neighbour's duration.
+
+📉 **`/me`'s `track_count` says 70 while the account holds 132 tracks** — it counts
+public only. Any tool sizing a walk from `track_count` under-counts by 47%.
+
+🔧 `master.py` swallowed every subcommand's return code (`args.func(args)`), so
+refusals reported success to `$?`. Nonzero ints now propagate — this also fixes
+`form-album`'s exit status.
+
+### 🔴 PROCESS INCIDENT — four commits landed on another session's branch
+
+Sound/Tidal is a **shared checkout** and a concurrent session switched it from
+`master` to `claude/rig-streamline` between two of my commits. Four then landed
+there, and I did not notice because **`git push origin master` from a non-master
+HEAD is a silent no-op**: it pushes the local `master` ref, which was already up
+to date, prints nothing, exits 0. The "PUSHED" in my own log was self-issued.
+
+Recovered by cherry-picking the four onto `master` in a temporary worktree
+(`eefd706`→`1b03cb0`, `111c903`→`577767a`, `84e37fe`→`d429f16`, `719e09a`→`dcbf355`),
+touching neither `claude/rig-streamline`'s tip nor the live working tree — another
+agent and PLN were both active in it. The other session's `361a05b`
+("fix(midi): cut the surface's direct leg to SuperCollider") is theirs and was
+left alone.
+
+The global CLAUDE.md already prescribes worktrees for shared repos; I had applied
+that to delegated subagents and exempted the orchestrator — which is the session
+that commits most. There is no exemption. Banked as memory
+`feedback_shared_checkout_moves_under_you`: verify HEAD before every commit, and
+verify the push moved the remote (`git rev-list --left-right --count
+origin/master...master` must read `0 0`) rather than trusting exit 0.