Motir

Surfaced by motir run MOTIR-729 (8.5.17, the platform-staff auth ADR) on 2026-08-17. The correction is already applied — MOTIR-2932 was created and MOTIR-729 amended — so this card holds no build work; it is the telemetry record. The lesson is notes.html #297 (motir-meta PR #219).

What happened

MOTIR-729 asked for a decision whose §1 invariant is "no tenant role, at any tier, in any combination, produces a PlatformRole", and whose §6 rules out every convenient bootstrap — no endpoint, no env var, no first-user rule — because each is a permanent hole bought for a one-time convenience. Only a superadmin may grant the role, and Story 10.3 owns the grant UI.

Follow that through and the day-1 state is: no path in the product writes platform_role, and no superadmin exists to use the one that eventually will. So the first production grant is a human, once, against the database — an output of the decision as surely as the enum is. Nothing owned it.

The consequence is not abstract. MOTIR-1167 (8.5.11) ships the day-1 health glance and the two day-1 support actions, all behind requirePlatformStaff(). Every one of them could be built, reviewed, merged and marked done while /admin answers 404 to every human at moooon B.V., because in production nothing ever wrote the column. Story 8.5 is launch readiness; the failure would surface on the first day the tools were needed.

Why nothing caught it — the tell is a criterion that is TRUE and scoped to the wrong environment

MOTIR-2896's criteria include "db:seed seeds one platform-staff user". That is correct, it is testable, and it makes the question look answered on every surface that shows it: the card reads complete, validate_work_item is clean, and a reviewer scanning for "how does staff exist?" finds a bullet that says how. It is answered for development. Production runs no seed, and no criterion anywhere says so.

This is the MOTIR-1916 shape from notes.html #202 — "a story reached five green cards and could not start a single runner" — with one difference worth recording: there the deliverable was deferred to a card whose criteria simply did not contain it, an ABSENCE. Here a criterion is PRESENT and true, and its environment scope is what does not match. An absence can be found by asking "which card owns X?". A criterion that is true in dev and silent about prod answers that question wrongly, and the reader stops looking.

The prose-vs-graph advisory (MOTIR-1969) could not fire either: nothing named a not-done work item, because the missing thing was never a work item.

What was done at run time

• MOTIR-2932 (8.5.18) — type: manual, executor: human, blocked_by MOTIR-2896: grant the first production platform-staff operator, with the read-back and the 404 checks as its criteria.
• The ADR's "What this ADR deliberately does NOT decide" table names MOTIR-2932 as that row's owner, so the deferral is in the graph rather than in prose.
• notes.html #297 records the lesson (motir-meta PR #219). The ADR itself ships in motir-core PR #2097.

The rule this argued for — SETTLED 2026-08-17: it stays a LESSON

AMENDED 2026-08-17, MOTIR-2933 close-out. This section originally read "An environment axis on the precondition check … the candidate home is plan-rules/phase-deepen.md's precondition-verification rule. Filed as a rule candidate, not as a rule — one instance." Do not restore the conditional form (notes.html #221: a conditional "on recurrence, do X" is a claim that the work is undone, and the format cannot carry that it was later discharged).

The verdict is LESSON, on the strongest available ground: two always-loaded rules already reach this and BOTH RAN.

MOTIR-729 is a subtask, so both packs were in that pass's set (plan-rules/MANIFEST.md, loaded when column). The pass that wrote §6 filed MOTIR-2932 in the same action and named it in the ADR's own "What this ADR deliberately does NOT decide" table (docs/decisions/platform-staff-auth.md:457). And MOTIR-2932 is the third limb's prescription verbatim in shape: one UPDATE by command, a SELECT read-back recorded on the card, a signed-in /admin check in production. A rule that ran and worked is not a promote case.

The ORDER test runs clean in the acquitting direction too. §6 did not exist before 2026-08-17 — before the decision forbade the alternatives there was no concentrated remaining path and so no un-owned output. The defect was catchable for the first time in the pass that created it, and that pass caught it. There is no window in which a rule was loaded, applicable and skipped.

Family on the environment-scope axis is ONE. Every db:seed occurrence in notes.html is inside entry #297 itself.

What survives, and why the LESSON tier is where it belongs: the CAMOUFLAGE. A true sentence in the wrong environment scope answers which card owns X? with a hit, and a reader who gets a hit stops looking — which is a better disguise than #202's silence. That observation needs the incident to make sense and would be a new gate rather than a widening, which is the register test for a lesson (_shared.md, RULES vs LESSONS).

Close-out verification (2026-08-17)

The correction HELD. MOTIR-2932 exists as filed: type: manual, executor: human, targetRepo: motir-core, 1 pt / 15 min, blocked_by MOTIR-2896, relates_to MOTIR-729 / MOTIR-1167 / MOTIR-1916 / MOTIR-2896, and it carries an explanationMd. The ADR merged as motir-core PR #2097 (2026-08-17T19:59:09Z) and the lesson as motir-meta PR #219 (2026-08-17T20:03:11Z).

Every citation on this card re-executed EXACT — say so plainly rather than implying drift that was not found:

• notes.html #297 really is at mistake-num">297<, no collision renumber. #181 is the un-owned-decision-output entry verbatim ("A decision's OUTPUTS are deliverables, and an un-owned one is invisible"); #202 is the MOTIR-1916 five-green-cards entry.
• ADR §1's invariant is verbatim: "No tenant role, at any tier, in any combination, produces a PlatformRole." (A first grep 'no tenant role' returned nothing purely because the sentence opens the line and capitalises the N — a false negative from my own pattern, the same trap this corpus warns about; re-run with a looser stem before recording an absence.)
• ADR §6 is verbatim, including "there is no bootstrap endpoint, no environment variable, and no 'first user becomes staff' rule" and "it is filed as MOTIR-2932 (8.5.18, blocked_by MOTIR-2896)".
• MOTIR-2896's criterion is verbatim — with one detail this card understated: it is not its own bullet. It is the trailing clause of the MIGRATION criterion ("BOTH in ONE migration that runs clean on a fresh DB, modelled per CLAUDE.md, and db:seed seeds one platform-staff user"). A reader scanning bullet SUBJECTS reads migration and moves on, so the disguise is better than this card claimed, not worse.

Did the CORRECTION repeat the defect? No — it performs the axis this card proposed as missing. MOTIR-2932's step 1 names the production-deployment precondition explicitly, and its acceptance criteria assert PRODUCTION state read back from the database rather than a merge.

One defect found in this card's own cited artifact, fixed here: motir-meta PR #219 appended entry #297 without bumping the "Across the N mistakes" line, leaving it at 296 against 297 entries. Corrected — together with the settled verdict above and the bullet-vs-clause detail — in motir-meta PR #222, whose merge is this card's close condition.

One live defect found on a card this one cites — see the comment on MOTIR-1167. The merged design asset allocates two day-1 writes to Panel 9; MOTIR-1167's body and acceptance criterion say "a minimal audited support action", singular. Amended on the record there.

Related

• MOTIR-729 — the card this was found on.
• MOTIR-2896 — the card carrying the dev-only criterion. Not defective: its criterion is correct for what it ships. The defect is that no card carried the production half.