Phase 8 — Access truth: a bridge that cannot hear must not read as healthy

The UI phase built a surface that derives everything from evidence and never reads a stored enum — and then a bridge sat on it reading connected for nine and a half hours while deaf. Four facts, all healthy, all true, and none of them measuring the thing that was broken.

This phase adds the fifth fact: did the join actually succeed? Liveness travels the agent-key path, which resolves an agent and never touches a channel, so it can only ever prove the process. Membership is a different question, and until something asked it, a bridge that could not hear was indistinguishable from a healthy one.

Several findings had to be established first, and one of them reversed an assumption the whole program had been carrying: a re-sent join is re-checked, so retrying in place actually works. The chain as the code truly evaluates it turned out to differ from how it had been written down — only post visibility refuses a join, while membership and the channel ACL govern the reply — and that correction was made in the earlier phase’s doc rather than quietly folded in here.

Two more, both about legibility rather than logic: the ACL form is not silent, but its default is a no-op, so an operator can complete it and grant nothing; and an error envelope carries no id and no channel id, so it cannot be attributed to what caused it. That last one is why fixing one link and retrying looks identical to the fix not working.

This was a real fork, and the operator’s own leaning was the one that lost — so the argument is recorded rather than the conclusion alone.

The case for fatal, stated at its strongest: a bridge that exits gets restarted by the supervisor, while a bridge that is merely deaf never does. It is about five lines of change, it reuses a failure policy that already exists and is tested, and the cost is bounded — five attempts on a doubling backoff, about sixty cents, once. The supervisor already lifts the child’s output into the error field, so the refusal would even reach the screen. That is a good argument, and it was not dismissed.

It loses on four measured points:

• Restarting cannot perform the repair. The repair is a human clicking Add in a form, possibly hours later. Restarting five times over thirty minutes performs it zero times — and because give-up is sticky by design, by the time the human makes the grant the bridge has stopped trying. They would then have to discover that a second, unrelated action in a different tier is needed to undo a give-up caused by their first action being late. The grants are manual by decision, so the design must make the manual act sufficient.
• Exiting destroys the reporting channel at the exact moment there is something to report. The bridge is the only party that knows the join was refused and what the server said. If it exits, that signal must be reconstructed from a log tail — the very file flagged as a privacy hazard because it contains verbatim chat. Fatal routes the phase’s central signal through the one channel the program had already condemned.
• Failing closed buys nothing here. The gate self-test is fatal because running without an approval gate is dangerous. A deaf bridge is useless, not dangerous: it receives nothing, so it spawns nothing, so it spends nothing. The analogy borrows the gate’s authority without its reason.
• The economics invert. A deaf bridge costs nothing per hour. Each fatal restart costs about twelve cents for a self-test that was already passing. A join retry on the held connection costs nothing and is rate-limited server-side.

The counter-argument — that a merely-deaf bridge never gets restarted — is correct, and it is why the retry half alone would have been wrong. It is answered by making the state visible, not by exiting: once the screen says not joined, access denied, since 08:12, the bridge is not pretending anything. Fatal is an argument about observability, and the right fix for an observability problem is observability.

⚠ With the condition stated plainly: if the visible fifth fact were ever cut, the retry half must become fatal. Retry-in-place without it is the original outage with extra steps.