<!-- last-reviewed: 2026-06-01 · owner: quality-risk-director -->

Waves 3 + 4 — Four-test stratified sample & convergence-reconcile assurance

Independent anti-theater gate (master plan §1.3, R1/R11) over the Wave 3 (COO cluster) and Wave 4 (CGEO cluster) corpus, plus assessment of the org-wide Phase-2 convergence reconcile (IDENTITIES extended to all 41 roles). Run by Quality & Risk per SOP-087. Q&R edits nothing it reviews; findings are proposals routed to owners.

Independence caveat (R11). Wave 3 includes Q&R’s own unit — the Q&R charter, SOP-085/086/087, the risk register, the audit schedule. Those artifacts are sampled but explicitly marked self-review (not independent) and are recommended for External Review (third-line) assurance. Full independence applies to the other ten units.

0. Verdict (up front)

PASS WITH CONDITIONS.

The substance is real: the four interlocking seams I traced by hand (arbitration decided fan-in; CGEO→Growth→CS launch chain; the Innovation / Design-Research / CPTO gate knot; CGEO→COO launch notification) genuinely interlock in their Interface Contract blocks, and the 3 remaining pending edges are legitimately platform-launch-gated (ADR-0006), not hidden defects. The IDENTITIES extension did real work: it converted hollow-green cross-cluster seams into verbatim-matched edges.

But the headline “0 defects / 394 edges” over-reports integrity. I found a Critical defect class the gate cannot see: six declared, registered, live cross-unit edges silently fail to parse because their trigger: value carries trailing prose ((**PROPOSED** — pending Operations)). The reconciler’s EDGE_RE is line-anchored, so it drops these edges entirely — they are neither counted in the 394 nor reconciled. The entire CGEO retention/feedback subsystem (CS↔D&A health-score, Community→CS, CS→Innovation/Design-Research) is invisible to the gate while reading GREEN. This is the R-003 fan-in blind spot’s sibling: GREEN is necessary, not sufficient. Plus a recurring Medium staleness defect: post-convergence blockquotes/operating-models still label registered, matched phrases as “proposed / pending.”

Must-fix list in §7. None of the must-fixes is in Q&R’s lane to edit; all are routed.

1. Sample design (frame · size · stratification — SOP-087 §“sample-design rule”)

Frame (the named Wave-3/4 deliverable set)

Enumerated before sampling, for reproducibility:

• 2 cluster operating-models: coo-cluster, cgeo-cluster.
• 7 unit charters: delivery-pmo, operations, security-privacy, quality-risk (self), growth, customer-success, creative.
• Role manuals across coo-cluster, operations, security-privacy, growth, customer-success, creative (incl. members: SRE, security-analyst, content-strategist, video-producer, community-manager, brand-strategist, visual-designer).
• 31 SOPs SOP-071 … SOP-101 (each carrying an ## Interface Contract).
• Job aids (JA-071, JA-076, JA-080, JA-085, JA-088, JA-094…097, JA-100, JA-101); the Operations playbook.
• Operating registers: reports/risk-register.md, reports/audit-schedule.md (both self — Q&R-owned).
• 16 Phase-0 reviews (coo … visual-designer).
• 1 knowledge entry: 2026-06-01-reconciler-fan-in-blind-spot.md.
• Mechanism: docs/handoff-triggers.md (Waves 3+4 block), docs/sop/registry.md, docs/handoff-register.md, scripts/handoff-reconcile.mjs (IDENTITIES → 41 roles).

Frame size ≈ 70+ named deliverables.

Size

Sampled ~17 artifacts read line-by-line for the four tests + the two gate scripts read in full + the full register + the trigger registry + 6 Phase-0/charter cross-checks ≈ >25% of the frame, above the 20% floor. A defect-hit stratum (member SOPs SOP-095/096/097) was oversampled (SOP-087 §size “oversample on a hit”; Wave-1 precedent).

Stratification (all three dimensions hit; members oversampled)

Self-review cells (R11, not independent): quality-risk charter, SOP-085/086/087, risk-register.md, audit-schedule.md. Recommended for External Review (third line) — Q&R cannot independently assure its own anti-theater instrument.

2. Four tests — results per sampled artifact

Executability pass rate, members + Leads: 15/17 = 88% against the ≥90% target (master plan §10) — below target, driven by the SOP-095/096/097 parse defect (an edge a fresh instance would copy verbatim is silently dropped by the gate the SOP claims to satisfy). The two failing artifacts are SOP-096 and SOP-097.

Falsifiable-test detail on F-1 (SOP-091). IC block lines 17–18 correctly use requirements issued (matched, register rows 194–195). But step 6 (line 108) instructs growth metrics defined and step 8 (line 113) instructs growth requirements issued — phrases the registry explicitly folded and that appear nowhere in handoff-triggers.md. A fresh instance following the prose would emit an unregistered trigger and break the gate. Body contradicts its own block. Severity Medium (gate not broken because only the IC block is parsed, but the SOP is internally false).

3. Convergence-reconcile assessment (the headline claim)

Claim under test: the IDENTITIES extension exposed 47 hidden cross-cluster seams (previously hollow-green) which were resolved to 0 defects / 394 edges / 3 pending.

(a) The 3 remaining pending — legitimately platform-launch-gated ✓

Register rows 247, 248, 250 — all Analytics Engineer → Design Research, trigger usage data ready (SOP-049/051/053). Verified legitimate: docs/units/data-analytics/manuals/analytics-engineer.md contains no ## Interface Contract block, and the reconciler scans only docs/sop/ + exemplar (defaultFileSet(), scripts/handoff-reconcile.mjs:198-217) — so the Analytics Engineer is not among authored owners and these edges correctly reconcile pending (counterparty not yet authored) per R3. Substantively, these are telemetry feeds that cannot exist pre-launch (no runtime telemetry; ADR-0006). Conclusion: the 3 pending are real gates, not hidden defects. They are NOT in the parse-dropped class of §6 — they parse correctly and are visibly pending.

(b) Spot-check — do the newly-wired cross-cluster seams actually interlock?

Traced by hand (SOP-087 test 4 — do not defer to GREEN, R-003):

1. COO arbitration decided fan-in (rows 143–146). SOP-072 emits four point-to-point outputs (Q&R, Process Engineer, Security Director, Project Manager). For each to read matched (fan-in) the consumer must declare a placeholder-producer sink on the same trigger. All four sinks exist and resolve: SOP-085:11 (Q&R), SOP-077:12 (Process Engineer), SOP-081:11 (Security Director), SOP-075:13 (Project Manager) — each ← from <COO / Principal> · "arbitration decided". The identity model resolves each consumer string correctly (Process Engineer listed before Operations(SRE), :120-121). Genuine interlock — not a hollow sink. ✓

2. CGEO→Growth→CS launch chain. CGEO SOP-088:14 product brief delivered → Growth; Growth SOP-091:13 declares the matching input (row 186 matched). Growth SOP-091:19 audience handed to retention → CS; CS SOP-095:14 declares ← from Growth Director · "audience handed to retention" (row 196 matched point-to-point). Acquisition→retention seam genuinely interlocks. ✓ Caveat: the return leg of the chain (CS health-score → D&A) is in the §6 dropped-edge class — the chain interlocks up to CS, then goes dark at the gate.

3. Innovation / Design-Research / CPTO gate knot. CPTO SOP-042:12 input gate package ready ← Innovation ↔ SOP-044:67 output (row 67 matched); CPTO SOP-042:15 de-risk commissioned → Design Research ↔ SOP-049 evidence returns gate evidence ready → CPTO (SOP-042:13 input; rows 78/95 matched); seam-arbitration SOP-043 review passed mirrors (rows 61/62, 245/246). The knot closes both directions verbatim. ✓

4. CGEO→COO launch notification received (row 187). SOP-088:15 output → SOP-071:17 input, both verbatim — matched point-to-point. This is exactly a seam that was pending (hollow) before CGEO was authored; the convergence wired it real. ✓

Convergence verdict: the IDENTITIES extension did genuine work — the four sampled seams interlock with verbatim triggers and mirrored direction. The “47 hidden seams exposed” narrative is credible. However, the “0 defects / 394 edges” total is incomplete: §6 shows ≥6 declared live edges never entered the 394 because they fail to parse. GREEN here means “every parsed edge interlocks,” not “every declared edge interlocks.” That gap is the must-fix.

4. N/A / non-edge justification sample (R11)

Per SOP-087 step 5 — a disguised empty slot is a defect; a transparently-declared non-edge is acceptable.

Finding: the justifications are honest (no disguised empties), but the CGEO cluster has adopted a bad habit of writing prose into the trigger: field instead of using a registered phrase or a clean self/placeholder. When the prose sits on an edge that is genuinely a live registered handoff (SOP-095/096/097 PROPOSED lines), it becomes C-1 (a dropped real edge). When it sits on a true non-edge (SOP-097:15/:20), it is merely untidy. Either way the trigger: field should never contain free prose.

5. Scripted-gate confirmation + break test (R-006 disclosure)

Execution limit disclosed (R-006): Q&R’s environment exposes file tools but no shell; I could not execute node scripts/handoff-reconcile.mjs. The result below is a logic-trace against source + spec, labelled a trace, not an execution. Operations/PMO must paste literal stdout (incl. the RED break-test) into the Wave-3/4 checkpoint record to machine-attest the headline.

Trace of the live register. The committed docs/handoff-register.md headline is GREEN — 84 files, 394 edges, 0 defects, 53 triggers. Tracing EDGE_RE (:237-238) over the SOP-095/096/097 contracts: each trigger: value carrying a trailing (**PROPOSED** — pending Operations) fails the line-anchored …(?:"…"|…)\s*$ match and the line is continue-skipped (:255-256). Confirmed by grep: community signal raised and field-feedback routed produce ZERO rows in the register (no match in docs/handoff-register.md), and there is no CS→D&A health-score requirements issued row. So the trace reproduces the dropped edges — GREEN is real for the 394 parsed edges but the population is short by ≥6.

Break test (falsifiable, SOP-087 step 6):

• Trigger mutation → RED (works). Mutating a parsed matched edge’s trigger to an unregistered string (e.g. SOP-088:15 launch notification received → launch notified) yields UNREGISTERED TRIGGER (:298-302) and a GAP — dangling dependency on SOP-071:17 → exit 1, RED. The gate catches a real mis-wire. ✓
• The blind spot that does NOT turn RED (R-003 + new C-1 sibling). (i) Deleting a fan-in producer leaves the sink GREEN (the known R-003 hole). (ii) New: appending (**PROPOSED**…) to a trigger removes the edge from the population entirely — so a dropped handoff reads GREEN not because a sink absorbed it but because the parser never saw it. C-1 is strictly worse than R-003: R-003 hides a vanished producer; C-1 hides a present, declared, registered edge.

KM-index gate (scripts/km-index-check.mjs) not exercised this sample (no KM deliverable in the Wave-3/4 frame beyond the one entry, which is correctly dated and self-describing as non-expiring). Operations/PMO to attest if run.

6. The Critical finding in full (C-1) — parse-dropped live edges

Defect: six declared Interface-Contract edges carry trailing prose after the backticked trigger, which the line-anchored EDGE_RE rejects, so the reconciler silently drops them from the population (not counted, not reconciled, not flagged). Every one of these phrases is registered in docs/handoff-triggers.md (Waves 3+4 block, lines 135–137) and has an authored counterparty — they SHOULD reconcile matched / matched (fan-in). Instead they are invisible behind GREEN.

Impact. The CGEO retention + field-feedback subsystem — learner-health instrumentation (CS→D&A), community-signal escalation (Community→CS), and the product/research feedback loop (CS→Innovation/Design-Research) — is entirely absent from the reconciled register while the register reads GREEN with 0 defects. This is precisely the failure mode the reconciler-fan-in-blind-spot knowledge entry warns of (“GREEN is necessary, not sufficient”), realised in production by a second mechanism (parse-drop) the entry did not anticipate.

Note for the fix owner (Operations / Process Engineer, NOT Q&R): the remediation is in the SOP authors’ lane (strip the trailing (**PROPOSED**…) annotations — the phrases are already registered, so the notes are not just stale, they are breaking the gate) and optionally a reconciler hardening to warn on a trigger: line that contains a backticked phrase followed by non-whitespace (a parse-suspicious line), so a future prose-on-trigger silently-dropped edge is caught. Q&R does not author either fix; routed below.

7. Must-fix list (file + section + owner)

Conditions to clear PASS-WITH-CONDITIONS → PASS: (1) C-1 remediated and (2) the reconciler re-run shows the six edges matched with a re-attested edge count and a machine-attested GREEN/RED break-test in the checkpoint record. F-1/M-1 remediate in the current quarter (Medium); they do not block, but they extend the same unremediated staleness gap already open since Wave 2 (G-W2-1/2) and should not be allowed to become standing.

8. Routing & logging (SOP-087 step 8)

• Findings are proposals, routed to owners above — Q&R edited nothing it reviewed.
• New control-gap rows to add to reports/risk-register.md control-gap registry (SOP-086) at the next maintenance pass: G-W34-1 (C-1, Critical), G-W34-2 (F-1, Medium), G-W34-3 (M-1, Medium — links G-W2-1/2). Logged here; the register update is a separate SOP-086 action.
• R-003 (fan-in blind spot, risk register) should be broadened: its current text covers deleted-producer GREEN; C-1 shows a second hollow-GREEN mechanism (parse-drop of a present edge). Recommend the compensating-control note (CC-1, the producer-presence CI complement) also assert no trigger: line carries un-delimited trailing text — proposal to Process Engineer.
• review passed emitted to wave owners (COO / CGEO / affected Directors); this report handed to the Archivist (artifact approved) on approval.
• Self-review items (SR-1) flagged to the Principal/COO for an External Review commission — Q&R should not be the sole assurer of its own gate.

Verdict restated: PASS WITH CONDITIONS — convergence interlock is genuine and the 3 pending are legitimate; clear the conditions by remediating C-1 and re-attesting a complete-population GREEN.