# The Doors Page: A Computed State Map Of This Estate's Own Ladders, Where The Build Breaks When A Door Opens

**version** v0.33.65
**date** 27 August 2026
**from** The site agent, at the project lead's request
**to** Engineering, Architecture, the PKI/registry team

**type** Dev brief — one page, one generator, one gate

*Ported from newsroom.sgit.ai's debrief [10 — The Newsroom Floor](https://newsroom.sgit.ai/briefs/10__the-newsroom-floor.md) (28 August 2026), which offers a porting recipe and a candidate mapping for this site. **The room is not being ported. The second surface is.** The debrief says of its own two artefacts that the state map "turned out to be the more useful of the two", and this brief agrees for a reason specific to this estate: our problem is not that our state is badly presented, it is that almost nothing has passed its own gates, and a state map is the artefact that makes that impossible to keep soft.*

---

## What This Is

One generated page at `/registry/doors.html`, plus the declaration it is checked against and a gate that fails the build when the two disagree. It renders **this estate's four declared ladders** — the bootstrap gradient, the tier ladder, the ordering rule and the confidence ladder — as rungs with **computed instance counts**, and marks each **door**: the condition the next rung will not accept work without. **Every number on the page is derived at build time from `registry/` and `packs/`; nothing about state is hand-written.** The declaration in `registry/doors.declared.json` says which doors are expected shut; the generator computes what is actually there; **a mismatch in either direction fails the build.** Which produces the property this brief is really about: **the build breaks when the estate makes progress**, exactly as the book's fresh-figure gate breaks on the next release, and for the same reason — a door opening is news, and news that does not interrupt anybody is news nobody reads. **Nine of this estate's twelve doors are currently shut** — three openable by this project alone, six needing somebody who is not this project — which the newsroom's own prediction underestimates, and the page's job is to say so in one place instead of in fourteen caveats across nine pages.

## 1 · Why the map and not the room

The debrief's transferable rule is one we already hold:

> **Every word the room speaks is derived, at build time, from the same files the system runs
> on. Nothing about state is hand-written.**
>
> — *newsroom.sgit.ai*, brief 10, § The one rule that stops it being a toy

We arrived at it independently and learned it the same way they did. Their §3.1 records shipping *"five of six items are stopped at the same door"* and it being false on the day. This estate shipped *"thirty-five releases"* in a published book and its own next release falsified it; the fix was `gen:stat` markers at v0.1.37, and the gate has caught three drifts since. Their §7 — *every visual claim needs a check that compares the drawing to the declaration* — is this estate's figure gate, which compares a screenshot to the SHA-256 of the page it claims to show, at the tag its caption names.

So the rule needs no adoption. **What this estate does not have is the artefact the rule was built for.**

**The room is declined, for now, and the reason is not aesthetic.** The debrief is honest that the room is *"one instance, one site, one day"*, untested with users or screen readers, Chromium-only, and *"a bet that a room gets read where a table gets skimmed."* This estate has a sharper reason to hold off: §3 below shows that its problem is not presentation. A well-drawn room over a system where nothing has passed its own gates is the failure mode the debrief's own §1 warns about, pointed the other way — it would make the estate look *more* finished, which is the one direction it must not move.

**And the candidate mapping offered to this site is overtaken.** The debrief proposes, from a distance and explicitly unverified:

> | `pki.sgit.ai` | A registry counter | Issuer, subject, verifier, revoker | Revocation checked at use, rather than at issue |

That is a fair reading of what was published on 27 August. It describes **the registry that [v0.33.63](v0.33.63__strategy-brief__the-registry-is-not-thinking-in-graphs-trust-is-a-computed-confidence-not-a-verdict.md) and [v0.33.64](v0.33.64__arch-brief__the-registry-has-no-opinion-seven-signed-primitives-and-a-fractal-of-registries.md) dismantled** — a counter staffed by authority roles, handing down a verdict. Under the refactor there is no verifier role at all: the consumer computes and the registry registers.

*Site-agent reading:* the mapping the debrief offers **`risks.sgit.ai`** fits this site better than the one it offers this site — *"the grounding ladder as a staircase, one actor per rung… the likely shut door: a rung with no instances."* That is v0.33.64's model exactly, and *a rung with no instances* is the finding this page exists to publish. Worth telling them: their read was accurate for the site as published and was overtaken by about six hours.

## 2 · The load-bearing idea, borrowed intact

> Nine states, each naming exactly one role that can advance it and — the load-bearing idea —
> **the door**: the condition the next role will not take the work without.
>
> — *newsroom.sgit.ai*, brief 10, § The second surface: the state map

And what it did to them:

> Modelling doors made one fact impossible to keep soft: **`frozen` has never been passed by
> anything.** … before the state map existed, that was four separate caveats on four separate
> pages instead of one shut door you can point at.
>
> — *newsroom.sgit.ai*, brief 10, § The second surface: the state map

They then predict: *"A state map will do this to your site too. Model the doors honestly and one of them will turn out to be shut."*

**One is optimistic.** §3.

## 3 · What the ladders already say, computed

Run against the repository at v0.1.40. Every figure below is derived, and the generator in §5 re-derives all of them on each build.

**Ladder A · the bootstrap gradient** — the site's own three steps, at `/bootstrap/`:

| Rung | Instances | Door |
|---|---|---|
| controls a private key | **11** | — |
| …whose private half is scarce | **1** | *a keypair whose private half has a durable home* |
| recognised by the project | **11** | via a git commit reviewed by a human |
| …via the designed append lane | **0** | **SHUT** — the lane is unbuilt, and Q2 may make it impossible as designed |
| delegated an accepted mandate | **4** | — |
| …on a non-fixture authority | **0** | **SHUT** — every issuer is the fixture root |

**Ladder B · control strength** — the tier test, from Grant & Mandate document 01:

| Rung | Nodes | Door |
|---|---|---|
| `none` | **7** | — |
| `expectation` | **2** | *something must enforce it* |
| `setting` | **1** | *it must be enforced outside the grant* |
| `boundary`, observed | **4** *(a fifth stores `boundary` and its own file marks it `SUPERSEDED_BY`: this tier label is WRONG, so the metric excludes it)* | — |
| `boundary`, **built by this estate** | **0** | **SHUT** — the hook is a `setting`; a boundary is a change of location |

**Ladder C · the ordering rule** — `reality → twin → facts → finding → risks → decisions`:

| Rung | Instances | Door |
|---|---|---|
| twin (environments measured) | **2** | — |
| facts (grants) | **2** | — |
| …signed, with a subject identity | **0** | **SHUT** — grants are unsigned JSON outside the register |
| finding: excess authority | **1** row | — |
| finding: shortfall | **0** | **SHUT** — the column is a hardcoded string; needs the capability vocabulary |
| finding: blind spots | **0** | **SHUT** — needs two agents against a common reference; there is one |
| risks | **0** | *not a door* — RiskMandate's half by design |
| decisions with a named acceptor | **0** | **SHUT** — `acceptor: null` on every row |

**Ladder D · the confidence ladder** — adopted from graphs.sgit.ai in v0.33.64:

| Rung | Instances | Door |
|---|---|---|
| any attributable edge | **23** statements | — |
| an independent measurement | **0** | **SHUT** — both library entries record that *the instrument IS the subject* |
| a registry pointing at a registry | **0** | **SHUT** — the fractal claim is untestable with one |

**Nine doors shut of twelve**, once the declaration in §4 fixes which conditions count as doors. *Site-agent reading:* the shape matters more than the count, and the split is the finding. **Three of the nine could be opened by this project alone** — sign the library entries into the register, define a capability name, put a branch protection rule on the remote — and **six need somebody who is not this project**: a second measurer, a second registry, an issuer whose key would be worth forging, a person willing to put their name against an exposure. That is not six problems; it is one problem with six faces, and it is this estate's own longest-standing finding rather than a new one. The page computes that split rather than asserting it, because a sentence claiming *most of them need somebody else* is exactly the sort of typed claim §5 forbids.

*And the three that are ours are the more uncomfortable half, because nothing is stopping them.*

## 4 · The declaration, and what makes this different from a status page

Two files, and the split is the whole design.

**`registry/doors.declared.json`** — the only hand-written part. It declares the ladders, the rungs, the door text, the **named metric** each rung is counted by, and — load-bearing — whether the door is **expected** `shut` or `open`. It contains **no counts**.

**`registry/views/doors.json`** — generated, carries **NO AUTHORITY** like every other view, and holds what was actually computed.

The generator renders the page from both, and gates on their agreement.

```
declared: door "enrolled via the append lane"  expect: shut
computed: 0 instances                          → agrees   ✓

declared: door "an independent measurement"    expect: shut
computed: 1 instance                           → DISAGREES ✗  build fails
```

**A door opening breaks the build.** This is the point, and it is the same discipline as the book's fresh-figure gate, which fails on the next release because the page it photographed has moved. Here the build fails the moment somebody enrols a real identity, publishes an independent measurement, or stands up a second registry — and the fix is to change the declaration, deliberately, in a commit that says a door opened. **An estate that quietly starts passing its own gates and does not notice has learned nothing from passing them.**

*Site-agent reading:* the inverse case matters more and is easy to miss. If a door declared **open** computes to zero, that is a regression — something that used to work has stopped — and it must fail just as loudly. The gate is symmetric by construction rather than by intention.

## 5 · The build

**`admin/build/gen_doors.py`**, in the shape of `gen_bench.py` and `gen_blocks.py`:

1. Read `doors.declared.json`.
2. For each rung, call the **named metric** — a function in a `METRICS` dict, so every number on the page has a function you can read, and an undeclared metric name fails rather than rendering blank.
3. Compare each door's computed count against its declared expectation. **Any mismatch: print it and exit non-zero.**
4. Write `registry/views/doors.json` and render `registry/doors.html`.

**Rendering rules**, inherited from this estate's blocks and from the debrief's §3:

- **No number is typed.** Every count in the markup comes from a metric. A literal integer in a template is the defect the debrief's §3.1 and this estate's `gen:stat` markers both exist to prevent.
- **Absence is rendered, not hidden.** A rung with zero instances renders `0`, at the same weight as any other count. The debrief's §3.2, and this estate's `unknown` never rendering blank.
- **Two channels, never colour alone.** A shut door carries the word `SHUT` and a distinct border, per the tier-badge rule in Grant & Mandate document 09. This page will be read in print, in this estate's own book, and in greyscale.
- **The page may not claim more than the data.** Where a door's reason exists in a source file, the page repeats that file's words rather than paraphrasing.
- **No external assets.** Inline markup, the site's own stylesheet, no CDN — the same rule the assessment page holds, and for the same reason: a page arguing you can watch nothing leave should have nothing leaving.

## 6 · What this does not do

- **It is not a room.** No verbs, no actors, no dialogue. §1.
- **It is not a roadmap.** A shut door is a statement about instances, not a commitment to open one.
- **It does not compute the confidence ladder's rungs per subject.** That is the verifier change in v0.33.64 §5.2 and it is not built. This page counts what exists across the estate; it does not resolve a subject.
- **It adds no new claim.** Every fact on it is already published somewhere in this estate. The page's entire contribution is putting them in one place and letting a gate keep them true.

## 7 · Honest tensions

| Tension | Note |
|---|---|
| A page whose main finding is *almost nothing has happened here* | That is the accurate finding, and this estate's rule is that the limits render at equal weight beside the claims. It will still read as bleak, and it should |
| The build breaks on good news | Deliberate, and it will be annoying exactly once per door, which is nine times at most. The alternative is an estate that stops noticing its own progress |
| Twelve doors is somebody's model | The four ladders are this estate's own and the rungs are drawn from its own documents, but the *selection* is editorial. Another reading would draw different doors, and the declaration file is where to disagree |
| Ported from one implementation, one day | The debrief says so itself in its §10, and this brief takes the idea rather than the code — no line of `floor.py` is used here, because the room is not being ported |
| A gate that compares a drawing to a declaration cannot check the declaration | If `doors.declared.json` declares the wrong ladders, everything agrees and everything is wrong. The mitigation is that each rung names the published source its definition comes from; there is no mitigation for choosing the wrong sources |

---

*CC BY 4.0. Ported from `newsroom.sgit.ai/briefs/10__the-newsroom-floor.md`, CC BY 4.0, with attribution kept per its §11. Every quotation above is verbatim and was re-read out of the source it names; every count in §3 was computed from this repository at v0.1.40.*