The lens registry
A lens is a question, not an area (§7.3.1). The registry is an allowlist: a project may extend it, never shrink it — removing a lens retroactively declares a blind spot covered. Every card below is rendered from the engine export; nothing on this page is typed.
L1 contract
Does the code match the Contract's §-sections?
L2 persistence-concurrency
Locks, atomicity, crash consistency, lost updates.
L3 error-surface
Does failure surface correctly, and does the exit-code gate hold?
L4 behaviour-idempotency
Trace a user journey end-to-end. Is a re-run idempotent? What does a partial failure leave behind?
L5 data-correctness
Is what we write semantically right — right parent, right label, right round — not merely written without crashing?
L6 security-secrets
Can a credential or PII reach a place with a wider audience? Can hostile input from one side corrupt the other?
L7 operator-experience
Under stress, does the tool tell the truth? Is the documented recovery procedure real?
L8 test-quality
Would these tests fail if the invariant broke?
L9 enforcement-integrity
Is the guard/invariant itself sound, complete, and fail-closed — or correct only on the shapes it already knows?
L10 reachability
Is every declared capability traced to an operator entry point, or is it dead surface?
L11 performance-resource
Time, memory, file handles, unbounded growth, N+1 work.
L12 packaging-environment
Does it install, import, and run outside the author's machine?
L13 free-sweep NEVER CLOSES
Deliberately NOT the lens of the last N rounds (§7.7 tunnel signal).
The free sweep never closes. A bare CLEAN from it is inadmissible: a no-finding verdict must enumerate the surface it actually traversed (§7.3.2). Remove this row and the registry becomes exactly the fail-open enumeration §6.5 forbids.