The gating watcher — parking, and the cause it measures

Every Store/Plugin hub runs PluginGating.AddPluginGating: on activation and on every REAL change in its subtree it re-seeds the plugin's access shape — the root grants, the per-child denies, the _Policy — idempotently, so a steady-state pass writes nothing. Two things can go wrong with that promise, and they are different in kind.

A write that did not become durable is PARKED

Each candidate is verified before it is written (a targeted fresh read decides whether the write is still needed) and read back after. A path whose post-write read shows the write did not land goes into GatingSummary.Unlanded, and the watcher parks it: SeedGating stops queuing it for this hub's lifetime, until the next real subtree change (a preInstalled flip, a publicSegments edit, a new child — or the provisioning that finally creates the partition) clears the parking (PluginGate.Park / ClearOnRealChange). Parking on the post-write read, never on "we wrote this before", is what keeps a write that merely landed late from being suppressed.

The cause is measured, not asserted

Until 2026-09-13 the parked line stated "the known cause is a package listed by the registry but never PROVISIONED on this mesh" — at Error, on every pass. The diagnosis was usually right and never measured, and because a GitSync burst is a real subtree change, every merge to the package's repo cleared the parking, rewrote, failed to land, and logged it again: on memex-cloud the control instance retained 11,878 occurrences for 2026-09-12 across exactly three registry-listed packages with no partition among the mesh's 116 (LearningRoadmap, DeepSign, Voice), each occurrence a pair stamped the same millisecond — the "did NOT become durable" line and a "NOT CONVERGING … check the snapshot, then the predicates" line for the same path. That volume is what buried a genuine snapshot race for a month (MeshWeaver#1246's first life).

Now the watcher asks every registered IPartitionStorageProvider whether the plugin's top-level partition has a backing store (PartitionExists, a read-only probe; on Postgres a definitive false means no schema) and folds the answers the way the write guard does — a provider only knows its own store, so one true outranks every false, and a null makes the fold indeterminate (PluginGate.ClassifyParkedCause):

the providers say	classification	logged
every provider: no store	Unprovisioned — a listed package nobody installed here; operator configuration	Warning, once per hub lifetime; later passes over the same missing store at Debug
any provider: the store exists	Provisioned — a provisioned partition lost a write; a storage or routing fault	Error, every time
a `null`, or no providers	Undetermined — nothing was measured	Error, saying exactly that — never the unprovisioned diagnosis the watcher cannot back

And the second line of the pair is gone by construction: PluginGate.GenuineRepeats excludes a rewrite that this pass's own post-write read already explains. NOT CONVERGING is reserved for a path that landed and was rewritten anyway — the predicate/snapshot alarm the line's own instructions are about.

What this does not do

It does not provision anything, retry anything, or lower any level for diagnostic reasons. The ops half — provision LearningRoadmap, DeepSign and Voice on memex-cloud, or unlist them — is the operator's, and it is the only thing that empties the parking for good. Pinned by PluginGateTests.ParkedCause_IsFoldedFromTheProvidersAnswers_NeverGuessed and GenuineRepeats_ExcludeWhatThisPassCouldNotLand.