Pre-existing lint debt blocks the local dispatch gate's kanon-lint step from ever passing

[forkwright]

Finding

utilities/gate-repo.sh's dispatch gate (run on the fleet build box to stamp a
Gate-Passed trailer) treats any kanon lint warning as a gate failure — 0 error(s), N warning(s) still reports FAIL kanon lint and the branch is refused a trailer regardless
of what the branch itself changed. Nine pre-existing violations, present on main before
any dispatch branch touches them, make that step permanently red for this repo. No commit
on main has ever carried a Gate-Passed trailer (git log on the last 10 main
commits shows an empty trailer for all of them).

Evidence

Confirmed against origin/main directly (not a local clone) — every line below is
byte-identical between origin/main and the branch that surfaced it:

• DECISION.md:323 [WRITING/elegant-variation] — data/content/payload cycle in "## 11.
  Key rotation is revocation..."
• README.md:48,53,71,94 [WRITING/em-dash] — four em-dash characters in prose
• Cargo.toml:64 [TOML/inline-table-too-long] — the rand_core inline table exceeds 80
  columns
• Cargo.toml:114 [TOML/cargo-section-order] — [[test]] appears after
  [dev-dependencies]
• .github/workflows/gate-attestation.yml [SHELL/unpinned-action] — uses: forkwright/.github/.github/workflows/hybrid-gate.yml@main is ref-pinned, not SHA-pinned
• tests/known_answer_vectors.rs:1 [RUST/file-too-long] — 840 lines against the 800-line
  limit

A full-repo kanon lint --all scan (not scoped to the gate's subset) additionally surfaces
34 more pre-existing findings across AGENTS.md, CLAUDE.md, README.md (semicolons,
passive voice), DECISION.md (reference-must-compress, purpose-in-technical-doc), and
RUST/pub-visibility + TOPOLOGY/shallow-module + PERFORMANCE/missing-complexity-docs
findings across src/hybrid.rs, src/rotate.rs, src/seal.rs, src/envelope.rs — 43
total. The 9 above are only the subset the gate's own file-scoped pass happened to touch.

Why this matters

The dispatch flow's fast path depends on a genuinely-reachable green gate: a
trailer-stamped commit skips the slower GitHub-hosted fallback rebuild
(gate-attestation.yml's header states this explicitly). With this step permanently red,
every future dispatch branch against this repo pays the full rebuild cost with no way to
earn the fast path, and a contributor reading a red kanon lint step has no way to tell
"pre-existing debt, ignore" from "your branch broke something" without doing the
line-by-line origin/main diff this issue already did.

Desired correction

Clean the 43 findings (or the subset the gate step actually enforces, at minimum) so the
gate step can pass on an unrelated branch. tests/known_answer_vectors.rs needs an actual
split to clear RUST/file-too-long (840 vs. 800 lines) — the rest are single-line
formatting/prose fixes. Scope this as its own PR; it touches documentation, manifest
formatting, and public-API visibility calls (the RUST/pub-visibility findings on
src/rotate.rs and src/seal.rs flag several pub fn/pub struct items that may be
deliberately public API surface, not oversights — that needs a read of each site, not a
blanket edit).

Done when: kanon lint --all against this repo returns 0 warnings and 0 errors, and
~/gate-repo.sh sphragis <any-unrelated-branch> reaches GATE PASSED with a stamped
Gate-Passed trailer.

[forkwright]

Reopening: Done-when clause 2 is unmet, and is now unobtainable as written.

~/gate-repo.sh sphragis <any-unrelated-branch> reaches GATE PASSED with a stamped
Gate-Passed trailer.

No commit on origin/main carries a Gate-Passed trailer — not before PR #39, not after, and
not on any of the 15 most recent commits including the #39 merge itself. The mechanism this issue
asked to be proven working has no evidence of ever having been exercised. Squash-merge is not a
substitute: this fleet's own doctrine is that a GitHub squash-merge bypassing the local gate is not
precedent.

Clause 1 is met and independently verified: lint_check against a fresh origin/main worktree
(f2f4a35) returns 0 Error, 0 Warning, 1 Info (a missing RUNBOOK, unrelated to the 43 findings).
All 9 cited findings confirmed fixed in-tree — gate-attestation.yml:89 SHA-pinned, README
em-dashes gone, rand_core a full table, [[test]] blocks ahead of [dev-dependencies], and
known_answer_vectors.rs split 840 → 349 lines.

Why it is now unobtainable: gate-repo.sh ran on the build box, which is gone and whose IP has
been re-let. There is no host to mint a trailer from. Clause 2 needs re-scoping to something
achievable rather than left standing as a condition nothing can satisfy — a gate condition that
cannot pass teaches every reader to skim past it.