Date. 2026-08-14 · CR. change-requests/cr-2026-210-loomworks-commit-error-truth-v0_1.
State. HALTED at Step 1, nothing built (surface tree clean at 8871997), per the Operator's instruction at approval: observe the 401 vocabulary before branching on it; if the observed vocabulary differs from the CR's, halt and report rather than adjusting quietly — and count it as the third instance. This is the third instance.
The server's three spellings — probed against E0128, which is safe to probe (even a valid tap 409s on its open finding):
401 {"detail": "step_up_required"} — as the CR assumed.401 {"detail": "commit_attestation_failed: clientDataJSON missing challenge"} — as assumed.401 {"detail": "commit_challenge_invalid: challenge not found or already used"} — as assumed.The client-failure class — produced in a real browser on the live banner: the ceremony threw before any instantiate POST (rp-mismatch standing in for a cancelled tap — same class, a DOMException); "The passkey step didn't complete." rendered; no navigation. As assumed.
The divergence — a real 401 driven through api() (session cleared mid-page, commit clicked): the browser navigated to /signin, and the component's catch received ApiError("Unauthorized", 401) with no detail. The wire showed challenge → 401; the page ended on /signin. Cause, confirmed in api.ts:91-99: the 401 branch throws BEFORE the payload-parsing block, unconditionally — bypassUnauthorizedRedirect skips only the redirect; the response body is discarded either way.
§1.A branches on "401 whose detail carries commit_attestation_failed: or commit_challenge_invalid:" — but under §1.C's constraint ("No api() change — the bypass flag exists"), no 401 detail can ever reach the component. The server says the right words in the right shape, exactly as the CR assumed; the surface's own transport layer destroys them one hop before the catch. The CR's mechanism is unimplementable as ruled: with bypass on, every 401 arrives identical (detail === undefined), so a failed tap and an expired session are indistinguishable — the exact half-fix the Operator's §0.2 ruling forbids.
The instance count, stated plainly: B-96's 503 (read, wrong), B-96's 502 (read, wrong), and now CR-210's 401-detail-reaches-the-component (read, wrong) — three consecutive failure mechanisms produced by code-reading, three corrected only by producing the failure and watching. The first two were wrong about the SERVER's side of the wire; this one is wrong about the SURFACE's own transport — the discard happens in code that was read for the CR (§1.C even cites the bypass flag) and still misread, because the flag's name promises more than its behavior. How a stack fails is not visible in the stack — including one's own layer of it.
api() change (recommended): on the 401 branch, parse the body exactly as the non-401 path already does and attach it as the ApiError's detail (redirect behavior untouched; the throw keeps status 401). Small, general-purpose-honest (a 401's body stops being the only body api() discards), and it makes the CR's ruled branches implementable verbatim. Every existing 401 consumer either checks status === 401 only or returns silently — none reads detail — so the change is additive; a Step-1 sweep would verify that claim before building (and after this arc, verify means observe).api() for the two ceremony calls (raw fetch in commit-ceremony.ts): keeps api() untouched but forks the transport idiom for one caller — a second way of calling the engine, which smells like the fenced framework's evil twin (a special path instead of a general mechanism).
If (1) is ruled, the CR needs a v0.2 (§1.B gains the api() amendment; tests gain a 401-body-preservation case at the api() level plus the component-level branch tests unchanged) — a version bump, not a quiet adjustment.
Nothing built; the draft stands at v0.1; the fence intact (site 1, no helper, no mechanism). The three server spellings and both client-side behaviors are now OBSERVED facts the eventual build can rest on — the probe cost one session-mint and four curl calls, against a candidate that cannot commit by construction.
DUNIN7 — Done In Seven LLC — Miami, Florida — CR-2026-210 Step 1 halt — v0.1 — 2026-08-14 The server said the right words; the surface's own transport discarded them one hop from the catch. Third instance, counted.