M7 C4 first-post runbook — draft artifact tracked, §7 recheck-window justification corrected

[GodSpeed313]

Brings docs/m7_c4_first_post_runbook_2026-08-21.md under version control and corrects one defect found in review before signature. Two commits, one file, 285 lines added against main.

The runbook remains Status: DRAFT and the C4 row at docs/m7_operator_go_checklist.md:143 remains blank in all four fields. This PR tracks and corrects an artifact; it signs nothing, amends no numbered section of the transport spec, the envelope doc, the GO checklist, or any ruling, and authorizes no transmission — GO-2 does that.

5ea17a1 — draft artifact tracked

The runbook was authored 2026-08-21 and had remained untracked in the working tree with no object anywhere in the repository. Follows the C1/C3 precedent of a standalone dated artifact rather than a row-embedded decision.

a993f9e — §7 recheck-window justification corrected

The note under §7 step 7 asserted that steps 6 and 7 "execute back-to-back with no intervening human action" and described them as "only two near-instant function calls." Both are false under every execution model §3 permits. §3 requires the send to run inside an interactive session and names as one permitted form "an interactive script that pauses for operator input at the send call itself" — a pause located exactly at the 6→7 boundary. The "two near-instant function calls" shape is the fire-and-forget execution §3 expressly rules out at :57-58.

The governance conclusion the note exists to support is unaffected: the step 2–5 rechecks do satisfy checklist §E rows 1–2 (docs/m7_operator_go_checklist.md:218-219). Only its stated basis was wrong, and a stronger code-grounded basis was available — send() calls kill_switch.check_write() before any network call, and check_write() is by contract the final outbound-boundary enforcement, so step 3's confirmation is re-enforced in code at the instant of transmission.

Also made explicit, since the new wording invites the question: §E row 2 carries two obligations. Its first clause is discharged by steps 2–5; its second — a reachable activate_manual path open during the send — is a standing condition discharged by step 7's operator presence. A scoping note records that engaged is not pinned for the whole of step 7, since the captcha-suspension-risk trigger can engage it during verification, and that verification gates publication rather than transmission.

Version binding, carried from the commit message verbatim

VERSION BINDING: this edit adds four moltbook/transport.py anchors —
:448-450, :495, :1447-1448, :1472-1474 — verified against transport.py at
52a8c9c, byte-identical at 5ea17a1 and in the working tree (blob 7e42220).
§10 binds this document to the transport implementation at 52a8c9c, so the
anchors are covered by that binding, and §10's non-inheritance clause is what
handles drift: the document does not inherit forward across a material change
to any of the three things §10 binds.

An earlier version of this commit message stated that §10's binding does not
cover transport.py and that the anchors were unpinned, and gave the count as
five. Both were wrong — §10 was cited without being read, and the anchors were
never counted. Amended before merge rather than left to be corrected on main.

Correction notice

An earlier revision of this PR body carried a paragraph asserting that §10's version binding does not cover transport.py, so the new anchors were unpinned and would drift. That was wrong. §10 reads: "Bound to the transport implementation at 52a8c9c (main, post-C3), to docs/m7_first_live_post_governed_envelope.md §5 as quoted at §5.3 and §5.4 above, and to docs/m7_operator_go_checklist.md's §D and §E as quoted. Does not inherit forward across a material change to any of them." The anchors are covered. The same paragraph also miscounted them as five. The commit message carrying the claim has been amended (44e6a0e → a993f9e, tree unchanged at 79a1149) and this body corrected, both before merge.

Review notes

• All four new transport.py anchors verified against blob 7e42220, identical at 52a8c9c, 5ea17a1, and the working tree.
• Both quoted strings from transport.py checked byte-exact; the :448-450 quote is a partial, beginning at "called" and dropping the source's "must be."
• Line numbers within the runbook shifted +15 (270 → 285). §8 246→261, §9 255→270, §10 265→280. Any external note citing the old numbers is stale.
• Sweep completed against the committed tree: the phrase "no intervening human action" appears nowhere in the repository. Two unrelated hits ("human-paced" in the cadence ruling, "unattended" in C1/TODO.md) are different subjects, not leaks.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NhiZnaN2DHPCASC31pjEaE