STAGING-STATE: reconcile against the host, and close DIV-005 as recorded backwards

DIV-005 is withdrawn. It claimed requirements-cad.txt declared a CAD dependency set that was not installed. Verified in CT 100 today: cadquery and OCP both import from the venv. build123d does not, and correctly so - requirements-cad.txt names it as a viable alternative on the same OCCT kernel, not as an installed package. The file declares one requirement, cadquery greater-or-equal 2.4, and it is satisfied. The manifest and the container agree.

The false statement was in HANDOFF section 5, which said no CAD kernel is installed and that cadquery, OCP and build123d are all absent. True when written on 19 AUG, carried forward by hand for three weeks. STAGING-STATE section 5 recorded cadquery 2.8.0 in the venv for the same period. Two documents, each stating it as fact, disagreeing, and neither noticing.

The entry was recorded backwards: it named the manifest as diverging from the container when the container matched the manifest and a third document was wrong about both. Its evidence was a session record rather than an observation, which is why it carried do-not-close, and that marking is the only reason this was checked instead of acted on. The index note is corrected from three-of-six to two-of-six.

A roadmap item was deprioritised on the same false premise. HANDOFF section 4 listed STEP export as needing a CAD kernel that was not installed. It is installed.

STAGING-STATE section 5 opened with a transcribed repository block: HEAD at the seed commit c7e32d8, tests 3 passed and 236 skipped, and absent the Shapely port itself. All three were true on 18 AUG and none after 20 AUG, while the checklist directly below was kept current. Facts three weeks apart in one section, the maintained half lending credibility to the stale half. Removed rather than corrected. One line in it was still accurate - the venv cadquery 2.8.0 - and it was the only correct statement about the CAD kernel in the repository when it was deleted.

Section 3a said Kane Fabric is where SASE, HOA Diagnostics, the Mechanical Compiler and other SASE-consuming projects are implemented. Nothing here is implemented on Kane Fabric. Each project has its own FQDN and container and they share the bridge, the hub and the proxy. SASE was used and never defined anywhere in this repository. Section 3a also said no interface between the two projects exists and none is assumed; IDENTITY-CONTRACT.md specifies one.

Section 4 gave AllowedIPs on the hub peer entry for srv-b as 10.110.0.0/22, four paragraphs after correctly giving it as 10.110.0.12/32. The 22 is srv-b own AllowedIPs for the hub, recorded in section 1. The two ends of one tunnel were conflated, in the paragraph describing the security boundary. WORK-ORDER-004 section 0 settles it: all twenty peers carry a 32.

Also: the toolchain image box is ticked, verified present in CT 100. The baseline result is marked overdue against DIV-006. The Shapely port gates nothing. HANDOFF rewrap owed from 61b8f1e is applied.

Read-only verification was run before writing, per PROCESS section 2. Had it not been, this commit would have deleted the one true CAD statement and left the false one standing. Suite 643 passed, oracle intact. Documentation only.

docs/DIVERGENCES.md

@@ -217,6 +217,26 @@ DIV-004, and the third instance of a manifest describing an unbuilt architecture
 
 **Owed by.** Two cheap reads before anything else.
 
+**Resolution 2026-09-13 — NOT A DIVERGENCE. Closed.**
+
+Verified in CT 100: `cadquery` and `OCP` both import from
+`/var/www/mechcomp/venv`. `build123d` does not, and correctly so —
+`requirements-cad.txt` names it as a viable alternative on the same OCCT kernel,
+not as an installed package. That file declares exactly one requirement,
+`cadquery>=2.4`, and it is satisfied. The manifest and the container agree.
+
+The false statement was in `HANDOFF.md` §5: *no CAD kernel is installed in
+CT 100; `cadquery`, `OCP` and `build123d` are all absent.* True when written on
+19 AUG, carried forward by hand for three weeks, and corrected in the same
+commit as this line. `STAGING-STATE.md` §5 had recorded `cadquery 2.8.0` in the
+venv throughout.
+
+**This entry was recorded backwards.** It named the manifest as diverging from
+the container, when the container matched the manifest and a third document
+disagreed with both. Its evidence was a session record rather than an
+observation — which is why it carried *do not close*, and that marking is the
+only reason this was checked rather than acted on.
+
 ---
 
 ## 6. DIV-006 — conformance has not been re-run since the host changed
@@ -259,10 +279,15 @@ believed to cover.
 | DIV-002 | Specified service architecture never built | yes, `app.py` | a decision | open |
 | DIV-003 | Instance public against three REQs | yes, `WORK-ORDER-004` | a decision | open |
 | DIV-004 | Eight declared config keys unread | yes, `app.py` | documentation | open, blocked on DIV-002 |
-| DIV-005 | `requirements-cad.txt` vs CT 100 | **no** | verification first | open — **do not close** |
+| DIV-005 | `requirements-cad.txt` vs CT 100 | yes, 2026-09-13 | — | **closed — recorded backwards** |
 | DIV-006 | Conformance not re-run since host changed | documents only | one run | open |
 
-**Three of six — DIV-002, DIV-004 and DIV-005 — are the same shape:** a manifest
-or specification describing an architecture that was not built, with nothing
-recording the difference. That pattern is the reason this file exists, and it is
-worth watching for in anything written next.
+**Two of six — DIV-002 and DIV-004 — are the same shape:** a manifest or
+specification describing an architecture that was not built, with nothing
+recording the difference. That pattern is the reason this file exists.
+
+DIV-005 looked like a third and was not. The manifest was honest, the container
+matched it, and a third document was wrong about both. The pattern is real, and
+matching a new observation to it without checking is how that entry came to be
+written backwards — which is worth watching for in anything written next at
+least as much as the pattern itself.