TRACE: Enforcement, Reachability and Coverage

Edition Three of the TRACE programme. Edition One varied the adversary; Edition Two varied the architecture and proposed that where a control attaches predicts what an architecture change does to it — edge controls are architecture-dependent, endpoint controls are not. Edition Three varies the control set, attacking that hypothesis from both sides: by applying the frame to catalogues nobody here wrote, and by building the topologies most likely to break it. The hypothesis does not survive intact. Across three ablative experiments — tools co-located in the agent's process (T9), a model deciding which agent runs next (T10), and a model deciding which peer receives authority (T11) — the endpoint controls enforced correctly every time, under both transports in T9 and under two model families in T10 and T11. In each experiment something else moved. Under T9 the guard's reachability changed: a rebind that is inert across a process boundary returns /etc/passwd in-process. Under T10 and T11 the egress control's coverage changed: the architecture grew an outbound flow to an inference endpoint that the filter exempts before consulting its allowlist. A falsification condition registered in advance — an endpoint control's coverage changes, including favourably — fired in three consecutive experiments. The correction: what is architecture-independent is a control's enforcement. What is architecture-dependent is the control's relationship to the system around it — what can reach it, and what it is expected to cover. Two further results follow from the model-decided topologies. Which model sits behind a decision is a control property no control in the set can observe: with no adversary present one model reproduced declaration order in 10 of 10 runs and another departed from it in 6 of 10, while under injection both surrendered the order completely and diverged completely in whether they withheld a decision at all. And at a handoff site with no eligibility computation, both model families transferred trusted standing to an invented principal in 10 of 10 runs, where the same class of error was refused 5 of 5 where a deterministic eligibility computation existed. Applied to external catalogues, the attachment frame classifies: of 193 atomic claims drawn from two OWASP documents under a rubric frozen before either was opened — and, for one of them, before it was published — 147 gate in frame and 90% of those receive an attachment point. The same rubric puts 11% of ISO/IEC 42001 Annex A in frame against 76% of OWASP, so it discriminates layers rather than accepting everything. Its attachment distribution is reader-dependent and is reported as such. One pre-registered prediction failed and a claim is withdrawn: caller-reading controls are common in agentic guidance, so the blindness Edition Two found in this project's tool-inventory control is a property of this control set and not of the field. The edition closes with a decision procedure that converts the correction into a worklist: given a control set and a proposed architecture change, which controls need re-examining, and would the change be visible in the evidence the system already produces. It was applied prospectively once, before its evidence existed, and returned no miss. Series. This is Edition Three of three. Edition One: 10.5281/zenodo.21426578. Edition Two: 10.5281/zenodo.21906481. Each edition applies the same method and varies exactly one thing — the adversary, the architecture, the control set.