Program-number override modes: use once (default) vs start new sequence; reserved/used = yellow, never block (systems-test fix block 3)

kerfmaster pin list · The interface — recorded intent (build later)

recordStates what the code does today. Auditable against the code — this is the only type that can go stale.

Content last changed 2026-09-01 — computed from the item itself, not typed.

Ruling B (Aristide, 2026-09-01): the operator indicates whether a typed program number is used once (the sequence does not advance -- the DEFAULT) or starts a new sequence from there (progseq restarts at it, autos continue from it). Garbage/negative was already a 400 at the door (block 2); reserved, apparently-used and sequence-rewinding numbers are YELLOW warnings, never a block -- the operator's call posts, per aid-the-operator.

• Engine: next_onum(operator, keep, mode) returns (number, source, warnings) under the shop-wide progseq lock. use_once records source 'operator (used once -- the sequence did not move)' and remembers ahead-of-sequence numbers in progseq's used_once list so the auto skips them exactly like reserved ranges (pruned once the sequence passes them). new_sequence records 'operator (new sequence from here)' and sets last = the number, warning when that rewinds behind the last used (future autos will re-issue). A KEPT number re-warns a reserved range on every re-post.
• Warnings ride the ruled callout path: nc_warn.audit_and_inject grew extra_findings -- stage-level findings the audit cannot know, injected as top-of-file (CONTAINS N WARNINGS) callouts with no spot markers; the transparency recheck still compares the audit's own anomalies only. Recorded in post.json / postnest.json under onum.warnings, counted into the stage's yellow + flagged status, rendered as yellow rows in the drawer. The audit's own findings list stays the audit's -- onum warnings never masquerade as audit results.
• API: body onum_mode = 'use_once' | 'new_sequence', validated at the door in honest words (garbage or a mode with no onum = plain 400, touching nothing). Both post and postnest (sheet 1) take it.
• UI: an override-mode select beside the program-number input on both Post-tab sections, use-once default; the drawer note states the mechanism; onum yellow rows render beside the program line.
• Verified: test_robust.py 37 -> 50 controls (poison case dead, auto skips use-once numbers, rewind warns, door validation, in-file callout) + systest_block3_live.py on the running service (13 checks: reserved O9500 posts warned with the sequence unmoved and the callout in the served NC, kept number re-warns, new-sequence advance, nest post same mechanism) + verify_onum.js (6 live browser checks). All ten suites pass.