--- r2.md
+++ docs/plans/2026-09-26_ledger-t3-source.md
@@ -3,9 +3,9 @@
 Brief only, no code. Darkwing wrote it on 2026-09-26 at Sage's request, issue
 #1506. R1 (sha256 08959a05) went to Filbert, whose review asked for
 revisions: `agents/filbert/work/ledger-t3-source-review-2026-09-26.md`, sha256
-19dda29a. This is R2. It takes every finding, and it records Sage's rulings
-on the three open questions. Section 1 has one measurement that differs from
-the review.
+19dda29a. R2 (sha256 e8300cb6) took every finding and recorded Sage's
+rulings on the three open questions. Filbert approved R2 with three nits,
+review sha256 bb02d8d3. This is R3, which takes the nits.
 
 ## Why
 
@@ -68,10 +68,10 @@
 | T3 stopped cleanly, no `-wal` or `-shm` | yes | reads, then leaves an empty `-wal` and a 32 KiB `-shm` |
 | T3 stopped cleanly | no | fails, SQLite 1544 "attempt to write a readonly database" |
 
-In every case the main file's bytes stayed the same. The last row is where
-Filbert and I differ. His review says the stopped-case read works with the
-directory read-only. In my run it failed with and without the read
-transaction. The build's test settles it. Either way a failed open is exit 1.
+In every case the main file's bytes stayed the same. Filbert's first
+review said the last case reads. His test had reused a database whose empty
+`-wal` and `-shm` were still present. On a true clean stop he also got 1544,
+and his review records the correction. A failed open is exit 1.
 
 So the accurate claim: the reader never writes the main database file. Like
 any SQLite connection, it may create or update `-wal` and `-shm` beside it
@@ -198,7 +198,9 @@
 The source is on by default (Sage's ruling). `--no-t3` turns it off, and the
 report then says T3 was not read. `--t3-db <path>` reads another database
 file instead of `~/.t3/userdata/state.sqlite`. It exists for fixtures and
-gets the same checks.
+gets the same checks. The JSON records the database path read and whether
+it was the default. When it wasn't, the text report adds one line naming the
+path, so a Gate F result can't come from a fixture unnoticed.
 
 Each of these refuses the report with exit 1, the code the ledger already
 uses for unreadable session evidence. The report never falls back to Pi logs
@@ -248,7 +250,9 @@
 fixture's temp directory. A test that forgets `--t3-db` or `--no-t3` then
 finds no database and fails closed. The existing tests aren't about T3. Each
 gets an empty fixture database at the fixture `HOME`'s default path, with
-one project row for the fixture root. So they run with the source on, and
+one project row for the fixture root. That row stores
+`fs.realpathSync(root)`, because the CLI resolves its root through realpath
+and a symlinked temp directory would otherwise not match. So they run with the source on, and
 their expected rows don't change. One test asserts that a `HOME` with no
 database exits 1 and names `--no-t3`.
 
@@ -277,9 +281,7 @@
   `--no-t3`. Skipped when the tests run as root, where the mode bits don't
   bind.
 - The stopped case in a directory that isn't writable: exit 1, naming
-  `--no-t3`, as I measured it. If the build reads there instead, the builder
-  changes this test to assert correct counts and records the correction in
-  the BUILD-LOG entry. Skipped as root too.
+  `--no-t3`. Skipped as root too.
 
 Also:
 - Each other fail-closed case in section 4 has its own test, including a
@@ -288,7 +290,9 @@
   the same counts.
 - The class fix is proven against HEAD's `messageKind`. An uppercase class
   in either preamble counts as agent after the fix and as human before it.
-- The JSON lists each seat's threads and the unmapped threads.
+- The JSON lists each seat's threads and the unmapped threads, and the
+  database path with whether it was the default. A `--t3-db` run prints the
+  path line in the text report, and a default run doesn't.
 - A read against the live database gives the counts in this brief, allowing
   for messages sent since. It exits 0 with no header conflict.
 - The ledger README's counting rules name the new source, both flags, the