the environment that described itself wrongly

The platform reports, about each account it holds, whether that account is live. The programme had been treating the flag as a fact about the world. It is not: one of the accounts it was pointed at was the rehearsal environment with the flag set the permissive way, and an operator-facing note had to be written to stop anyone reasoning from the flag again. Identity was settled by an explicit ruling that named which account was which, written so that the flag would stop being treated as evidence at all, and a second account with no continuing purpose was closed rather than left ambiguous.

Then came a constraint that shaped the architecture. The platform would not grant a second environment of the same kind, so two separate books had to share one, with a switch between them by configuration. Two books in one place can see each other by accident, so each got an isolated session and its own state, and the switch was defined as a configuration change plus a full re-run of the admission gates, never a silent flip.

The seam that made this possible is an interface with two implementations behind it, chosen per book, so the same logic runs against either side without knowing which it is talking to.

The cost is real. Every switch carries a verification sequence, and the two books cannot be exercised at the same time.

What it proves is that the flag was demoted from evidence, and that sharing an environment is designed for rather than discovered in operation.