`verification/tk11326/dtd/codex-debate.txt`

9 lines

**PROSECUTOR:** A bypasses the hourly safeguard without evidence that 21/hour exists solely for scheduling. A 500/day ceiling does not prevent burst overload. Its proposed boundaries also conflict: Codex permits at most 462 remaining authorized candidates, while Qwen explicitly tests 463. Checking the date only at startup would permit unauthorized activation after midnight; restarting the command could replenish an invocation-local allowance. Two available voters agreeing does not establish safety.

**DEFENDER:** A authorizes a narrowly bounded pacing exception, not expanded eligibility. Qwen’s 463-candidate expectation is incorrect: available daily capacity cannot enlarge the authorized cohort. Activation must satisfy all three limits: remaining authorized candidates, remaining daily capacity, and the 462 ceiling. Date/ticket binding and fresh guards must be checked before each activation, with durable accounting across restarts and the singleton lock preserved. Default runs retain 21/hour; Gemini calls remain zero. The supplied evidence establishes no separate burst-safety requirement that this exception would violate.

**JUDGE:** The prosecutor exposes a defective regression expectation and implementation hazards, but neither defeats the constrained proposal. The decisive distinction is between removing hourly pacing and removing authorization limits. A permits only the former. The 463-candidate test must therefore reject the excess candidate.

FINAL: KEEP

Keep A as the date- and ticket-bound exception described by Codex: at most 462 remaining authorized candidates, further limited by available capacity under 500/day, with durable accounting, per-activation date checks, singleton protection, all fresh guards, and zero Gemini calls. Qwen’s 463-candidate expectation is rejected. These constraints answer the concrete authorization and rollover objections; the supplied record does not establish that hourly pacing is an independent safety limit.