In facilitator.mode auto the landing's merge gate waits for a review receipt naming the records commit, but the loop never mints one from its own validation: lane-1 of run-2610310228179894 passed round 4 (ruthless-reviewer SHIP, security-reviewer APPROVE at 45a7ce2c5) and the landing still held PR #1301 unarmed at its records commit 28611e181 until a fresh reviewer pair was run and recorded by hand with abcd land --record-review.

In facilitator.mode auto the landing's merge gate waits for a review receipt naming the records commit, but the loop never mints one from its own validation: lane-1 of run-2610310228179894 passed round 4 (ruthless-reviewer SHIP, security-reviewer APPROVE at 45a7ce2c5) and the landing still held PR #1301 unarmed at its records commit 28611e181 until a fresh reviewer pair was run and recorded by hand with abcd land --record-review.

Seen again on 2026-11-01: three build lanes under facilitator.mode auto (PRs #1313, #1314 and #1315) each stopped at their land stage with the records commit as head and no review receipt naming it, and each armed only after a second review pair over that one-line delta was recorded by hand with land --record-review; an unattended run stalls at every such lane. The closing lane, whose records commit also closes the spec, ingests the audit and adds Delivers:, and any lane that resolves a capture, carry model-composed text no reviewer read, so they stay on the hand path.

Bounds a security review on 2026-11-01 set for a self-minted receipt, which covers only a mark-only lane: the commit's own diff against its parent is exactly one modified path, the open spec, with exactly one added '- landed:' line on the lane's step and nothing else added, removed, renamed or re-moded (decided from that diff, never from the lane's state flags, and catching anything swept in by git add -A or a hook); require exactly one parent, equal to the full validated sha in the lane's state, with the landed line's value a prefix of it; apply the same check to a records commit found after a killed call; and have the receipt cite the validated head's passing review pair, written only when that evidence exists.