The gating watcher — parking, and the cause it measures

Every Store/Plugin hub runs PluginGating.AddPluginGating: on activation and on every REAL change in its subtree it re-seeds the plugin's access shape — the root grants, the per-child denies, the _Policy — idempotently, so a steady-state pass writes nothing. Two things can go wrong with that promise, and they are different in kind.

🚨 Every judgement below is only as good as the READ behind it, and until 2026-09-17 that read was a query. MeshQueries.FindNode answered one node's content out of a process-lifetime synced collection, so a first answer taken while a replica was cold was replayed as "absent" for the life of the process — and a re-write of an unchanged node is a no-op at the store, which publishes nothing, so nothing corrected it. That is what produced the live residue of MeshWeaver#1246: nine of the ten samples retained on 2026-09-16 name a node that was durably present, in the shape the pass wanted, for days. The lookup now asks a listing for EXISTENCE and the node's OWNER for CONTENT — A one-node lookup reads the owner has the measurement and the shape.

A shape the partition will not keep is PARKED — on TWO signals, never on a re-read

Each candidate is verified before it is written: a targeted read of that path decides whether the write is still needed. What decides whether it STAYED is deliberately not a read taken straight afterwards — every read seam here can replay a cached last-known value, so a post-write re-read legitimately answers with the PRE-write state, and parking on that is what reported nodes that had been durably present for days as writes that "did NOT become durable" (MeshWeaver#1246). Two signals park a path instead:

signal	what it says	who can say it
`GatingSummary.Unlanded`	the OWNER, answering this very write, still reports the shape missing	the write itself — `CreateOrUpdateNode` emits the node as its owner then holds it
a genuine REPEAT (`PluginGate.GenuineRepeats`)	this hub wrote the path, the owner took it, and a LATER pass's fresh read found it missing again	only a later pass — this is the DURABLE statement, and no single pass can make it

Both join parked, so SeedGating stops queuing them for this hub's lifetime, until the next real subtree change (a preInstalled flip, a publicSegments edit, a new child — or the provisioning that finally creates the partition) clears the parking (PluginGate.Park / ClearOnRealChange). The cost of taking the durable signal one pass later is exactly that: the alarm arrives one real subtree change after the first wasted write, and it is true when it arrives.

The cause is measured, not asserted

Until 2026-09-13 the parked line stated "the known cause is a package listed by the registry but never PROVISIONED on this mesh" — at Error, on every pass. The diagnosis was usually right and never measured, and because a GitSync burst is a real subtree change, every merge to the package's repo cleared the parking, rewrote, failed to land, and logged it again: on memex-cloud the control instance retained 11,878 occurrences for 2026-09-12 across exactly three registry-listed packages with no partition among the mesh's 116 (LearningRoadmap, DeepSign, Voice), each occurrence a pair stamped the same millisecond — the "did NOT become durable" line and a "NOT CONVERGING … check the snapshot, then the predicates" line for the same path. That volume is what buried a genuine snapshot race for a month (MeshWeaver#1246's first life).

Now the watcher asks — for BOTH parking signals — every registered IPartitionStorageProvider whether the plugin's top-level partition has a backing store (PartitionExists, a read-only probe; on Postgres a definitive false means no schema) and folds the answers the way the write guard does — a provider only knows its own store, so one true outranks every false, and a null makes the fold indeterminate (PluginGate.ClassifyParkedCause):

the providers say	classification	logged
every provider: no store	Unprovisioned — a listed package nobody installed here; operator configuration	Warning, once per hub lifetime; later passes over the same missing store at Debug
any provider: the store exists	Provisioned — a provisioned partition lost a write; a storage or routing fault	Error, every time
a `null`, or no providers	Undetermined — nothing was measured	Error, saying exactly that — never the unprovisioned diagnosis the watcher cannot back

And the pair is gone by construction: one path produces one line, because GenuineRepeats excludes a rewrite this pass already reported as unlanded and both signals now end in the same classified message. The Error line reads "the gating shape is NOT STAYING … although the partition HAS a backing store" and carries the diagnostic order the old NOT CONVERGING line carried: the READS first (SnapshotQueries, MeshQueries.FindNode — a read answering from a cache the write never reached makes a present node look missing), the predicates only after that.

What this does not do

It does not provision anything, retry anything, or lower any level for diagnostic reasons. The ops half — provision LearningRoadmap, DeepSign and Voice on memex-cloud, or unlist them — is the operator's, and it is the only thing that empties the parking for good. Pinned by PluginGateTests.ParkedCause_IsFoldedFromTheProvidersAnswers_NeverGuessed and GenuineRepeats_ExcludeWhatThisPassCouldNotLand.