step.28.diff.txt -- narrative retro for step.28 (U5.6: THE REMOTE
                    TRINITY). Companion: step.28.gdiff.txt via
                    ../scripts/step_gdiff. Both phases CLOSED same
                    day (Phase A scripted + Phase B operator
                    ceremony, 2026-07-23).

Executed: 2026-07-23, (p1.1.2) of the user's (p1.1) plan. Commits:
WORK 01a09f6, Phase A 9984a33, CLOSE 07c6fb4, ledger 9bd8b69.
Cross-repo prerequisite: b3u UB.4 (step.53, same day).

## Plan vs actual

+---+--------------------------------------+--------------------------------------+
| # | Planned (brief)                      | Actual                               |
+---+--------------------------------------+--------------------------------------+
| 1 | CF Access transport in the client    | One seam exactly as designed:        |
|   |                                      | session default headers at __init__. |
|   |                                      | 3 hermetic tests; local behavior     |
|   |                                      | byte-identical without the env       |
|   |                                      | (trinity_gate.sh local re-run ALL    |
|   |                                      | PASS -- G-D proven live, not just    |
|   |                                      | hermetically).                       |
| 2 | Same arc oracle, remote plane        | The SAME pytest file gates both      |
|   |                                      | planes -- only the egress witness    |
|   |                                      | needed parameterizing (declared-base |
|   |                                      | assert, C-28-A). remote_gates.sh =   |
|   |                                      | env + legs, no new arc machinery.    |
| 3 | "client change ~zero" prediction     | Held: ONE __init__ block + one test  |
|   |                                      | assert. The API-is-the-seam design   |
|   |                                      | sentence (§2.8) cashed at the cost   |
|   |                                      | of 13 lines.                         |
+---+--------------------------------------+--------------------------------------+

## Surprises / genuine findings

1. **Q-28-D -- the plane was stale, and the taxonomy caught it.**
   First remote ARC run failed with `unexpected 404` on validate:
   staging still ran pre-UB.1 code (last deployed 2026-07-18; the
   validate op landed 2026-07-22 and had only ever met LOCAL
   instances). The verifier refused to call it a red gate ("a
   provider cannot fix the engine") -- the exact designed split
   between verdicts and environment defects, firing usefully in the
   wild. Fix = the standard b3u_deploy.sh re-run, state untouched.
   LESSON: a frozen contract doc does not deploy itself; staging
   redeploy joins the checklist after contract-surface changes.
2. **Q-28-E -- the relay's paste channel is the fragile link.** The
   ceremony needed three relay attempts: (i) a chat-copied paste
   arrived indented + blank-lined -> the V0 shape guard refused it,
   resumable (guard correct); (ii) the retry clipboard was clobbered
   by copying the NEXT command from chat -> a shape-valid nonsense
   proposal was accepted and cached as a DONE node, and decline
   LOOPS on resume (only failed/declined nodes re-run) -- the way
   out was the engine's own printed remedy, repairing the record
   EXECUTING -> RATIFIED; also hit (and was correctly stopped by)
   the human provider's TTY guard when trying to pipe stdin;
   (iii) the working fix: a one-shot helper that wl-copies the
   proposal and execs the run in the same motion. NAMED FUTURE: an
   optional --proposal-file flag on the human adapter (TTY-gated
   approval retained) would remove the channel's fragility without
   weakening the witness.
3. **The engine's own error text was the ops manual.** Both traps
   (no-instance resume, the record repair) printed their own next
   action, and both next actions worked verbatim. The
   refuse-loudly-with-remedy discipline paid for itself at the
   worst possible moment: mid-ceremony, operator at the keyboard.

## Scope discipline

In: the CF seam, the witness parameterization, remote_gates.sh, 3
tests, the ceremony, docs, the banner generalization. Out and named:
--proposal-file (Q-28-E's future variant); any b3u-repo change (the
Q-28-D redeploy used b3u's existing script unmodified); (p1.1.3)+
(the Test Plan inherits Q-28-D's redeploy-checklist lesson and the
409-on-resignup target). Zero contract-surface changes (C-22-D: CF
headers are transport).

## Numbers

- Suite 644 passed + 28 skipped = 672 (WORK baseline, measured
  after the last edit; +3 CF tests, +4 corpus growth) -- re-verified
  green after the ledger close edit.
- remote_gates.sh: refusal leg, then run 1 = 4/5 (Q-28-D), run 2 =
  ALL PASS (~65s whole arc, Q-28-C: 120s per-call stands).
- Ceremony: check 8/8 PASS, independently re-verified; 3 egress-
  recorded relay runs (2 failed attempts honest in the trail);
  delivery = 22 files, 4 languages, revision 1, from staging.
- The (p1.1) arc so far: b3u UB.4 (step.53) + b3ubot U5.6 (step.28)
  in one day -- the trinity is host-agnostic in fact.

End of retro.