decisions: append correction to the cassian write-grant record - the order (2026-10-07T21:57:02Z, quoted verbatim from the gateway log) postdates the grant (2026-10-06T23:49:28Z) by 22h08m, so it is a ratification, not the authorization; the actor is unnamed in the record and the 10-06 admission order did not cover repo permission

decisions/2026-10-07-cassian-write-grant.md

@@ -13,3 +13,13 @@ applied by Timmy, and is now documented.
 collaborator on `stackchain/troupe-standup`, one PAT `forge-token`
 (`write:repository, write:issue, read:user`) sealed to his age public key at
 `access/cassian-forge-token.age`.
+
+---
+
+**Correction, appended 2026-10-07 by the control plane — the order came *after* the grant: this is action-then-ratification, not authorization-then-action. No text above is altered.**
+
+- **The quotation is real, and it now carries its clock and channel.** Gateway log entry, `platform=telegram`, `chat=7635059073`, **2026-10-07 21:57:02Z**: *"Give cassian write"* — **29 seconds** before this file was committed. Verified from the log, not taken on testimony.
+- **The grant was therefore applied 22 hours and 8 minutes before that sentence existed.** The action is `PUT /api/v1/repos/stackchain/troupe-standup/collaborators/cassian` from `127.0.0.1` → **204**, stamped **2026-10-06T23:49:28Z** (`gitea.log.2026-10-07.001.gz`, handler `repo.AddCollaborator`). This file says so itself. **What does not survive is the closing sentence's framing** — *"the grant was authorized by Alexander, applied by Timmy, and is now documented"* reads as prior authorization. The accurate form is: **applied first on 2026-10-06T23:49:28Z with no instruction naming the permission, then ratified by Alexander on 2026-10-07T21:57:02Z.** That still closes the audit gap — as **ratification**.
+- **Two supporting claims are inference, not record.** (1) Tying the grant to the *"Admit him for now"* order (2026-10-06T20:21:17Z, same chat): that order authorized the **admission**, whose credential was sealed at `a5717ecf`, and the contemporaneous record treated repo permission as a **separate** gate — the control plane's 20:47:51Z comment on issue #1 states that adding a collaborator is an alter-permissions action needing Alexander's explicit approval, and declines to do it. (2) *"applied by Timmy"* names an actor that no artifact shows. The credential was an admin token on this host (the localhost PUT), Gitea stores only each token's latest use, and the actor is not identifiable from the record.
+- **Nearest contemporaneous context, logged and not probative of an instruction:** Alexander's telegram message **2026-10-06T23:48:47Z — "How's the troupe"** — lands **41 seconds** before the PUT. It is the only inbound message in that window, it names no permission, and no cron job ran at 23:49 on 10-06, so the call came from an interactive session.
+- **Standing effect:** the audit gap is closed by ratification and `cassian`'s access stands. What remains open is procedural only — a §4 permission change was executed without an instruction, and this record should say that plainly rather than present the later sentence as its cause.