step.26.diff.txt -- narrative retro for step.26 (U5.4a: the
                    foreign-workspace arc + guard). Companion:
                    step.26.gdiff.txt via ../scripts/step_gdiff.

Executed: 2026-07-22, same session as steps 22-25. WORK commit b86005a.

## Plan vs actual

+---+--------------------------------------+--------------------------------------+
| # | Planned (brief)                      | Actual                               |
+---+--------------------------------------+--------------------------------------+
| 1 | "b3ubot drives one complete UoW in   | Probing sharpened it: tmp-workspace  |
|   | a repo that is not itself" (the      | arcs were ALREADY M1-proven; the     |
|   | amendment's original phrasing)       | real gaps were the state store's     |
|   |                                      | workspace-blindness and a foreign    |
|   |                                      | arc WITH a plane verdict + real      |
|   |                                      | closure. Both delivered.             |
| 2 | Ledger amendment                     | Done through the ENGINE'S OWN        |
|   |                                      | add-row (rehearsed on a copy; the    |
|   |                                      | machinery placed the row past        |
|   |                                      | U5.4's note block correctly) and     |
|   |                                      | closed through `ledger close` --     |
|   |                                      | the amendment path, dogfooded both   |
|   |                                      | directions.                          |
+---+--------------------------------------+--------------------------------------+

## Surprises / genuine findings

1. **The state store was workspace-blind** -- records keyed by UoW id
   alone in one shared data home meant project B's `verify U1.1`
   would silently read project A's record. The (p2) hazard exactly.
   The guard stamps at start_state, refuses on POSITIVE mismatch
   only (unstamped legacy records pass -- the engine never invents
   provenance it did not record, C-26-C), and names the per-project
   $B3UBOT_HOME remedy in the refusal.
2. **The measure-don't-sum rule fired the same day it was written**:
   this step's first-draft totals said 658; the run said 657 (my
   reconciliation sum was off by one). The step file now records its
   own correction -- rule enforcement as a lived habit, two steps
   running.
3. **U2.3-era machinery earned its keep on its own repo**: add-row
   placed a row after a note-block-bearing row correctly on the
   first real invocation -- the exact operation whose hand-edited
   equivalent broke step.24.
4. The hermetic foreign arc asserts b3ubot's own porcelain
   byte-identical before/after (C-26-D) -- the "not one dropping"
   claim is now a regression test, not a hope.

## Scope discipline

In: the amendment row (via the engine), the guard, the foreign proof
(hermetic + live). Out and named: per-workspace data-home
NAMESPACING (the richer future; the guard makes the hazard loud
today), retroactive stamping (never -- invented provenance), U5.5.
Zero b3u-repo changes; zero CLI-surface changes.

## Numbers

- persistence.py: +1 field, +1 param, +1 guard; 5 stage entries
  threaded (drafting also stamps).
- New tests: 7 hermetic + 1 live; suite 647 -> 657 collected (8 new
  + 2 own-corpus step.26.txt), 632 passed + 25 skipped, 0 failed --
  measured after the last edit, corrected once against a hand-sum.
- p5_gates: live 13 -> 14 legs; hermetic twin 56+13 -> 63+14; ALL
  PASS first post-extension run.
- Ledger: U5.4a added AND closed by the engine's own CLI.

End of retro.