neuwirth
/
epiphany
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

P13-S27 rounds 17-19: the §3/§5 sweep, its two defects, and the first clean round 

Round 17 (authored-side, 10 findings, 5 blocking) applied round 13's
could-this-pass-for-the-wrong-reason question to the two sections that had
never had it. Both yielded immediately.

Gate 6's derive alternative could never match. grep is line-oriented, so
[[:space:]]* cannot cross the newline rustfmt puts between #[derive(...,
Default)] and pub struct BundleCapabilities. Verified by running the exact
regex: the likelier violation returns 0 matches and the gate passes, while
being the sole mechanical guard on the pin-3 prohibition M4 exists for
because no test can catch it. Replaced with three checks, one of which
quotes the definition verbatim and so cannot pass vacuously.

Gate 6a was vacuous under a rename: pin 3b offered synthetic_for_fixture as
an example while the gate grepped for that exact literal. The name is now
pinned. Gates 2 and 3 named no toolchain in a repo whose CI records
1.95/1.97 lint divergence and whose default is 1.97.1; both are now
cargo +1.95.0. Gate 4's "staged list exactly §2" was unsatisfiable with a
conditional touch row, now subset-both-ways. Gate 1 requires 0 ignored,
gate 7 has a method, gate 5 quotes all three dependency tables.

Tests 1, 6, 7, 8 and 9 could all pass on a base-free bundle. Pin 5 makes
base-free the permissive case, base-bearing fixtures are the awkward ones to
build, and test 1 degenerated into test 4.

The unifying defect: a gate proving absence is only as strong as the string
it searches for. A regex that cannot match, a name that was an example, a
clause with no method -- all reporting success while checking nothing. The
remedy is §4's: require an artifact quoted and read, not a pattern matched.

Round 18 (independent, 2 findings, both blocking, both created by round 17)
caught the sweep's own defects. The base-presence rule grouped tests 8 and 9
as "the ones that commit", but test 8 introduces the base and must start
is_none() -- the rule was unsatisfiable, or satisfiable by a fixture that
made the test assert nothing. And test 6's construction was
self-contradictory: assigned the commit path while required to arrive as its
hand-built ancestor did, and bundle.rs:1866 calls craft_image_with_base at
:1869. Fixed by a per-test state table, and by swapping the routes so the
attribution becomes true rather than deleted.

Round 19 (independent): ZERO FINDINGS. The first clean round in nineteen.

Recorded so ratification is not read as vindication: 65 findings across 19
rounds, 47 blocking. Rounds 1, 2 and 17 were authored-side; the first two
produced a ratification that was withdrawn, and the third cost two defects
round 18 caught. The document's quality comes from the independent rounds.

A clean round is the criterion named at round 11 and the first convergence
evidence this contract has produced. It is not proof of correctness, and no
round has re-derived the whole document. Still open after any ratification:
M7's authority/base leg is unverifiable until S27 is implemented, those
being S27's own deliverables, and every gate, test and mutation is specified
but none has been run.

The ledger is brought current; it had stopped at round 15.

Still NOT RATIFIED, NOT DISPATCHABLE. That call is not mine to make.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
This commit is contained in:
Levi Neuwirth 2026-08-08 21:52:08 +02:00
parent fa5716ef49
commit 1316300196
No known key found for this signature in database
2 changed files with 290 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

311
spec/CONTRACT_P13S27_REDUCTION_AUTHORITY.md
View File

@ -163,7 +163,10 @@ rows — read it off, do not restate it.
| round 14 | 1 | 1 | **yes** | | round 14 | 1 | 1 | **yes** |
| round 15 | 1 | 1 | **yes** | | round 15 | 1 | 1 | **yes** |
| round 16 | 4 | 4 | **yes** | | round 16 | 4 | 4 | **yes** |
| **Total** | **53** | **40** | one amendment per row | | round 17 | 10 | 5 | authored-side scan |
| round 18 | 2 | 2 | **yes** |
| **round 19** | **0** | **0** | **yes — first clean round** |
| **Total** | **65** | **47** | one amendment per row |
**This block previously read "amended three times … fifteen findings so far, **This block previously read "amended three times … fifteen findings so far,
eight of them blocking"** — the round-2 figures, left standing through rounds 3 eight of them blocking"** — the round-2 figures, left standing through rounds 3
@ -505,11 +508,100 @@ authority for the sequence and totals. **No review round has returned zero.**
Round 16 also falsified round 15's claim that its scan was complete, so no Round 16 also falsified round 15's claim that its scan was complete, so no
ratification inference may be drawn from the recent smaller rounds alone. ratification inference may be drawn from the recent smaller rounds alone.
**The known unexamined surfaces are now enumerable, but not closed:** M4 and M5b **Round 17 — 2026-08-08, the §3/§5 sweep. Ten findings, five blocking.** Round
survive the outcome scan; M7's authority/base leg **remains unverifiable until S27 13's question had been asked of §4 only. This applied it to the two sections that
is implemented**, by construction, and is carried as an execution requirement had never had it, and **both yielded on first contact.**
rather than a gap in the document. **Treat "dispatchable" as a claim requiring
evidence of convergence, not a status reached by running out of findings.** | # | Finding | Disposition |
|---|---|---|
| **1** | **Gate 6's derive alternative can never match.** Verified by running the exact regex: `grep` is line-oriented, so `[[:space:]]*` cannot cross the newline rustfmt puts between `#[derive(…, Default)]` and `pub struct BundleCapabilities`. **The likelier violation returns 0 matches and the gate passes** — and gate 6 is the *sole* mechanical guard on pin 3's prohibition | Replaced with three checks, one of which (**quote the definition verbatim**) cannot pass vacuously |
| **2** | **Gate 6a is vacuous under a rename.** Pin 3b offered `synthetic_for_fixture` as an example ("e.g."); the gate greps for that exact literal | **Name pinned** in pin 3b; gate 6a must confirm the actual name before trusting its zero |
| **3** | **Gates 2 and 3 named no toolchain**, in a repo whose CI comment records 1.95/1.97 lint divergence and whose default `stable` is 1.97.1 | Both pinned to `cargo +1.95.0`; toolchain reported with the result |
| **4** | **Gate 4's "staged list exactly §2" is unsatisfiable** — row 12 is conditional and 7a may not change | Subset both ways: every staged path in §2, every §2 row staged **or** named unused with its reason |
| **5** | **Tests 1, 6, 7, 8, 9 can all pass on a base-free bundle.** Pin 5 makes base-free the permissive case, so a fixture that silently loses its base makes each pass trivially — **test 1 degenerates into test 4** | One rule stated once: each MUST assert `canonical_base.is_some()` on the bundle under test |
| 6 | Tests 1 and 6 asserted the same outcome with no stated distinction | Kept distinct, with construction routes pinned — hand-built vs commit-path. **The probe showed construction changes bytes**, so two routes is coverage, not redundancy. If they collapse in practice, that is a finding |
| 7 | Test 4's "two different `caps` values" never asserted distinct | Inequality asserted, and the base-free precondition made explicit |
| 8 | Gate 1 required "full pass" but not **0 ignored** — an `#[ignore]`d test satisfies it while never running | Ignored count reported, must be 0 against the measured 1570/0/0 baseline |
| 9 | Gate 7 gave **no method** for "no schema major/minor moved" | Method pinned: quote the constants and show the diff empty |
| 10 | Gate 5 named no dependency tables | All three quoted — a dev-dependency would create the cycle pin 1 forbids |
**The unifying defect is that a gate proving *absence* is only as strong as the
string it searches for.** Findings 1, 2 and 9 are three faces of it: a regex that
cannot match, a name that was an example, and a clause with no method at all.
**Every one reported success while checking nothing.** The remedy applied
throughout is the same as §4's: **require an artifact to be quoted and read, not
a pattern to be matched** — a definition, a table, a command's output.
**Findings 5–7 are §3's version of the same thing:** a test asserting a
*permissive* outcome passes when its fixture degenerates into the permissive
case. That is not hypothetical — base-bearing fixtures have been the awkward ones
to build for this whole interval, so degenerating is the path of least resistance.
**This round was authored-side, not independent**, and it is recorded as such in
the table. **It found more than any round since the first**, in the two sections
nobody had scanned. **There is now no unscanned section: §0 through §7 have all
been swept or amended.** That is the first time that has been true — and it is a
statement about coverage, **not** a claim that the sections are clean. **Treat
"dispatchable" as a claim requiring evidence of convergence, not a status reached
by running out of findings.**
**Review round 18 — 2026-08-08, independent, against the uncommitted round-17
sweep.** **Two findings, both blocking, both in round 17's new §3 text.**
| # | Finding | Disposition |
|---|---|---|
| 1 | **The base-presence rule demanded the opposite of what test 8 is for.** It required `is_some()` before the commit for tests 8 and 9 alike — but **test 8 introduces the base**, so it must start `is_none()`. Requiring otherwise makes it unsatisfiable, or satisfiable by a fixture that already has a base, in which case the commit introduces nothing and the test asserts nothing | Rule split into a per-test table: 1/6/7 `is_some()` before; **8 `is_none()` before, `is_some()` after**; 9 `is_some()` both, base unchanged |
| 2 | **Test 6's construction was self-contradictory.** Round 17 assigned it the **commit** path while also requiring its fixture to "arrive the way" its ancestor's did — and that ancestor, `opening_a_major_1_bundle_that_already_carries_a_base_is_refused` (`bundle.rs:1866`), **hand-builds** via `craft_image_with_base` at `:1869` | **Routes swapped**: test 6 hand-built, test 1 commit-path. That makes the attribution **true** instead of deleting it |
**Finding 1 came from grouping by mechanism instead of by purpose.** Tests 8 and
9 were bracketed together as "the ones that commit" — which is true and
irrelevant. **Test 8 commits a base into a bundle that has none; test 9 commits
something unrelated to a base already there.** They are opposites that share a
verb, and a rule written from the verb inverted one of them.
**Finding 2 is the round-17 sweep's own version of the citation defect this
contract keeps producing:** an attribution asserted without opening the file it
attributes to. Reading `:1866` takes one command, and it says
`craft_image_with_base` in plain sight.
**Both were introduced by round 17 and neither pre-existed it** — the authored-side
sweep bought coverage of two unscanned sections at the cost of two new defects in
what it wrote. That is the trade the history table now shows for every large
amendment.
**Review round 19 — 2026-08-08, independent, against the round-17/18 working
tree. ZERO FINDINGS. The first clean round in nineteen.**
It confirmed the per-test state table distinguishes test 8's base *introduction*
from test 9's unrelated commit, that the route swap is consistent with
`craft_image_with_base`'s actual use in test 6's ancestor, and that the revised
gate mechanics are internally consistent.
**What a clean round does and does not establish.** It is the criterion named at
round 11 — *"treat dispatchable as a claim requiring evidence of convergence, not
a status reached by running out of findings"* — and it is the first evidence of
that kind this contract has produced. **It is not proof of correctness.** Round 19
reviewed the amendment rounds 17 and 18 produced; it did not re-derive the whole
document, and no round has.
**What remains open after ratification, and is not closed by it:**
- **M7's authority/base leg is unverifiable until S27 is implemented**, by
construction — `BundleCapabilities` and `CURRENT_REDUCTION_ALGORITHM_VERSION`
are S27's own deliverables. It is an **execution requirement**, not a document
gap, and the scratch probe is evidence for its prerequisite only. **Do not cite
the probe as having demonstrated laundering; it carried no base.**
- **Every gate, test and mutation is specified but none has been run.** The
contract's claim is that they *can* be run and that their results *would* be
evidential — nineteen rounds went into that claim, and execution is what tests
it.
**The defect record, stated plainly so ratification is not read as vindication:**
65 findings across 19 rounds, 47 blocking. Rounds 1 and 2 were authored-side and
their ratification was withdrawn. Round 17 was authored-side and cost two defects
round 18 caught. **The document's quality comes from the rounds that were
independent, and that is the argument for the execution report being reviewed the
same way.**
(Was: DRAFT, BLOCKED on the format-epoch rung, (Was: DRAFT, BLOCKED on the format-epoch rung,
`spec/CONTRACT_FORMAT_EPOCH_MAJOR1.md`, which at the time was ratified and in `spec/CONTRACT_FORMAT_EPOCH_MAJOR1.md`, which at the time was ratified and in
@ -1080,8 +1172,21 @@ that document could not have been opened in the first place, and refusing here
would make an unrelated commit the site of the diagnosis. would make an unrelated commit the site of the diagnosis.
**Pin 3b — synthetic capabilities are named, so the choice is not a judgement **Pin 3b — synthetic capabilities are named, so the choice is not a judgement
call.** Provide a clearly-named constructor for fixture use, e.g. call.** Provide a constructor for fixture use named **exactly**
`BundleCapabilities::synthetic_for_fixture(v: u32)`, whose doc states it is for
```rust
BundleCapabilities::synthetic_for_fixture(v: u32)
```
> **The name is PINNED, not illustrative. ROUND 17.** This read *"a clearly-named
> constructor … **e.g.** `synthetic_for_fixture`"*, leaving the name to
> execution — while **gate 6a greps for that exact literal**. Any other name and
> the gate returns **0 matches and reports a pass**, having checked nothing.
> **A gate that proves absence is only as good as the name it searches for**, so
> the name it searches for cannot be an example. Renaming it requires amending
> this pin and gate 6a together.
whose doc states it is for
format and container fixtures deliberately exercising arbitrary wire values and format and container fixtures deliberately exercising arbitrary wire values and
**must never appear in a production composition path**. Production paths wrap **must never appear in a production composition path**. Production paths wrap
`epiphany_ops::CURRENT_REDUCTION_ALGORITHM_VERSION`. `epiphany_ops::CURRENT_REDUCTION_ALGORITHM_VERSION`.
@ -1268,7 +1373,51 @@ widening — **state in the report which file each landed in**, since a test pla
outside its row silently drops out of the commit. outside its row silently drops out of the commit.
1. **`open_succeeds_when_base_and_current_reduction_versions_match`** ### Every base-bearing test MUST assert the base is present. ADDED IN ROUND 17
**Tests 1, 6, 7, 8 and 9 all describe base-bearing scenarios, and none of them
required checking that a base was there.** Pin 5 makes base-free the **permissive**
case — a bundle with no canonical base **opens at any authority** — so a fixture
that silently ends up base-free makes every one of those tests pass **trivially**,
asserting nothing. **Test 1 degenerates into test 4.**
**That is not a hypothetical fixture slip.** `create` rejects a base-bearing
manifest outright (`bundle.rs:234`), and for the whole S28 → S27 interval a
base-bearing `Bundle` has been **unconstructible** through the public API (§1.2).
Base-bearing fixtures are the awkward ones to build, so **the failure mode is the
path of least resistance**.
**Each of tests 1, 6, 7, 8 and 9 MUST assert the base's presence explicitly, on
the bundle under test.** The required assertion is **not the same for all of
them** — **CORRECTED IN ROUND 18**, which caught this rule demanding the opposite
of what test 8 exists to do:
| Test | Before | After |
|---|---|---|
| 1, 6, 7 | `canonical_base.is_some()` | — (no commit) |
| **8** | **`is_none()`** — it **introduces** the base; that is the whole test | `is_some()` |
| 9 | `is_some()` — it opens a base-bearing bundle | `is_some()`, and the base **unchanged** |
> **Round 17 wrote "before *and* after for tests 8 and 9, which commit",
> collapsing two opposite fixtures because both happen to commit.** Test 8
> commits a base **into a bundle that has none**; test 9 commits something
> **unrelated to a base that is already there**. Requiring `is_some()` before test
> 8's commit would make it **unsatisfiable** — or, worse, satisfiable by a fixture
> that already had a base, in which case the commit introduces nothing and the
> test asserts nothing. **Grouping by mechanism (both commit) rather than by
> what each is for is what produced the error.**
**A test that cannot state which bundle it asserted this on has not made the
assertion.**
*(Stated once here rather than repeated per test — round 7's rule. The tests below
do not restate it.)*
1. **`open_succeeds_when_base_and_current_reduction_versions_match`** — **the
commit construction route. ROUTES SWAPPED IN ROUND 18.** Create a bundle with
synthetic `caps(N)`, commit a canonical base carrying `N`, take the bytes, and
reopen under `caps(N)`. It shares test 8's setup and asserts a different thing:
test 8 asserts the **commit** succeeds, test 1 asserts the **reopen** does.
2. **`open_rejects_a_valid_stale_canonical_base`** — base and superblock agree 2. **`open_rejects_a_valid_stale_canonical_base`** — base and superblock agree
with each other, `caps.current` differs. Must return with each other, `caps.current` differs. Must return
`CanonicalBaseRequiresRebuild { base, current }` with **both fields `CanonicalBaseRequiresRebuild { base, current }` with **both fields
@ -1277,7 +1426,11 @@ outside its row silently drops out of the commit.
pin-6 path, asserted to be the *existing* malformed error and **not** pin-6 path, asserted to be the *existing* malformed error and **not**
`CanonicalBaseRequiresRebuild`. `CanonicalBaseRequiresRebuild`.
4. **`a_bundle_with_no_canonical_base_opens_at_any_reduction_version`** — run at 4. **`a_bundle_with_no_canonical_base_opens_at_any_reduction_version`** — run at
two different `caps` values. two `caps` values that the test **asserts are unequal**. **ROUND 17:** it
previously said only "two different values"; if they coincide the test proves
nothing about *any*, and nothing would say so. Assert the inequality, and
assert the fixture is base-free — this is the one test whose scenario requires
`canonical_base.is_none()`, the mirror of the rule above.
5. **`committing_a_stale_canonical_base_fails_and_leaves_the_prior_generation_reopenable`** 5. **`committing_a_stale_canonical_base_fails_and_leaves_the_prior_generation_reopenable`**
— the pin-3a writer test, and the one this contract's first draft omitted — the pin-3a writer test, and the one this contract's first draft omitted
entirely. Create a bundle, commit a good generation, then attempt a commit entirely. Create a bundle, commit a good generation, then attempt a commit
@ -1298,6 +1451,38 @@ the ruling recorded beside it.)*
to real validation. Its sibling is test 2, which is the same path when the to real validation. Its sibling is test 2, which is the same path when the
authority *disagrees*. Both branches must exist; the format rung's own review authority *disagrees*. Both branches must exist; the format rung's own review
found a draft that closed only one. found a draft that closed only one.
**How this differs from test 1, which asserts the same outcome. ROUND 17
flagged them as possible duplicates; they are kept distinct, and here is the
distinction they must actually carry. ROUTES SWAPPED IN ROUND 18.**
**Test 6 builds its image by hand**, with
`craft_image_with_base(1, 0, ReductionAlgorithmVersion(N), ReductionAlgorithmVersion(N))`,
and exercises `open` in isolation from any commit path. **Test 1 reaches the
same state by the commit path.**
> **Why this way round, and not the way round 17 had it.** Test 6 is the
> *conversion* of `opening_a_major_1_bundle_that_already_carries_a_base_is_refused`
> (`bundle.rs:1866`), and **that test hand-builds its image** — it calls
> `craft_image_with_base(1, 0, ReductionAlgorithmVersion(0), ReductionAlgorithmVersion(0))`
> at `:1869`. Round 17 assigned test 6 the **commit** path while also requiring
> its fixture to "arrive the way that test's did", **which are contradictory**:
> the test it converts is hand-built.
>
> Swapping the routes makes the attribution **true** rather than deleting it.
> Test 6 keeps its ancestor's construction and changes only its *assertion* —
> refusal becomes validation, which is exactly what "conversion" should mean.
> `craft_image_with_base` takes `format_major` as its first argument, so it
> builds the major-1 image test 6's name requires.
**The two construction routes are the point, and the probe is why.** The
scratch probe established that **how an artifact is constructed changes its
bytes** — a hand-built and a committed bundle are not interchangeable, and one
can be a fixed point where the other is not. Two routes into the same
guarantee is real coverage, not redundancy.
**If execution finds the routes collapsing into the same construction, that is
a finding**: say so rather than quietly writing one test twice.
7. **The two restored conformance assertions** (format-rung pin 3c), in 7. **The two restored conformance assertions** (format-rung pin 3c), in
`assert_reduction_serialization_stable` (`testkit/src/roundtrip.rs:241`): `assert_reduction_serialization_stable` (`testkit/src/roundtrip.rs:241`):
`verify_canonical_chunks` covering the base again, and the reopened manifest `verify_canonical_chunks` covering the base again, and the reopened manifest
@ -2030,17 +2215,68 @@ the finding is that it succeeds *silently*. Do not report it as a passing gate.
**1570**. Give the count in three buckets — net-new, converted-from-existing, **1570**. Give the count in three buckets — net-new, converted-from-existing,
restored-assertions — and if they do not sum to the observed delta, **that is restored-assertions — and if they do not sum to the observed delta, **that is
a finding, not an arithmetic error to be papered over**. a finding, not an arithmetic error to be papered over**.
2. `cargo clippy --workspace --all-targets -- -D warnings` → clean. **Also report the ignored count, which MUST be 0. ROUND 17:** this required a
3. `cargo fmt -p epiphany-ops -p epiphany-bundle -p epiphany-testkit -p "full pass" and said nothing about ignored tests, so an `#[ignore]`d new test
epiphany-textproj --check` → clean. **`cargo fmt --all` is forbidden.** satisfies it **while never running** — and could still be counted as net-new.
4. `git diff --cached --check` clean after staging; staged list exactly §2. The measured baseline is **1570 passed / 0 failed / 0 ignored across 42
5. **`epiphany-ops` has NOT gained an `epiphany-bundle` dependency** — check suites**; any nonzero ignored count is a finding.
`crates/epiphany-ops/Cargo.toml` directly. 2. `cargo +1.95.0 clippy --workspace --all-targets -- -D warnings` → clean.
6. **`BundleCapabilities` implements no `Default`**, by exact query with an **The toolchain is part of the gate. ROUND 17.** This named none, in a repo
expected count of **zero**: whose CI comment records that *"1.97 rejects a bare `2.0` that 1.95 accepts"*
`grep -rnE "impl +Default +for +BundleCapabilities|derive\\([^)]*\\bDefault\\b[^)]*\\)[[:space:]]*(pub )?struct BundleCapabilities" crates/epiphany-bundle/src/` — and whose default `stable` is **1.97.1**, not the pinned **1.95.0** that CI
→ **0 matches.** Run it against production source only; report the count, not gates on. **A clippy result that does not say which toolchain produced it says
a verdict. nothing.** Report the toolchain with the result.
3. `cargo +1.95.0 fmt -p epiphany-ops -p epiphany-bundle -p epiphany-testkit -p
epiphany-textproj --check` → clean, **on the same pinned toolchain and for the
same reason**. **`cargo fmt --all` is forbidden** (it crosses into `spikes/`
through path dependencies).
4. `git diff --cached --check` clean after staging. **The staged list is a SUBSET
of §2, not an equality. ROUND 17.** It read "staged list exactly §2", which is
**unsatisfiable**: row 12 is explicitly conditional and row 7a may legitimately
not change. Read literally it fails whenever a conditional row is correctly
unused — or invites staging an unchanged file to satisfy it. **Instead:**
every staged path must appear in §2, **and** every §2 row must be either
staged or **named in the report as unused, with its reason.** Neither
direction may be silent.
5. **`epiphany-ops` has NOT gained an `epiphany-bundle` dependency** — read
`crates/epiphany-ops/Cargo.toml` directly and **quote all three dependency
tables** (`[dependencies]`, `[dev-dependencies]`, `[build-dependencies]`).
**ROUND 17:** it said only "check directly", naming no tables — and a
dev-dependency would satisfy a reader checking only the first while still
creating the cycle pin 1 exists to prevent.
6. **`BundleCapabilities` implements no `Default`. REWRITTEN IN ROUND 17 — the
previous query could not detect the likelier violation.**
> **What was wrong, verified by running it.** The old regex was
> `impl +Default +for +BundleCapabilities|derive\([^)]*\bDefault\b[^)]*\)[[:space:]]*(pub )?struct BundleCapabilities`.
> `grep` is **line-oriented**, and `[[:space:]]*` cannot cross the newline
> rustfmt puts between an attribute and its item. Run against a real
> `#[derive(Debug, Clone, Default)]` above `pub struct BundleCapabilities`, it
> returns **0 matches** — **the gate passes.** Only the explicit `impl` form
> was ever caught. **`#[derive(Default)]` is the likelier way someone adds it**,
> and gate 6 is the *sole* mechanical guard on pin 3's prohibition — M4 exists
> precisely because **no test can catch a `Default` that callers then use.**
**Three checks, all required. Report all three outputs, not a verdict.**
a. `grep -rn "impl Default for BundleCapabilities" crates/epiphany-bundle/src/`
→ **0 matches.**
b. `grep -rn -B4 "struct BundleCapabilities" crates/epiphany-bundle/src/ | grep -i derive`
→ **report every line**, and confirm none names `Default`. The `-B4` is what
crosses the newline the old regex could not.
c. **Quote the complete definition of `BundleCapabilities` verbatim in the
report** — the struct, its attributes, and every `impl` block on it.
**(c) is the one that cannot pass vacuously.** (a) and (b) are greps for
absence, and **a grep for absence is defeated by a rename** — the same defect
that made gate 6a vacuous (see pin 3b). A quoted definition is read, not
matched, so it cannot be satisfied by searching for the wrong string.
**If (c) cannot be produced because the type does not exist under that name,
that is a pin 3 violation and a finding — not a gate that passed.** Zero
output from (a) or (b) means "no `Default`" **only when (c) shows the type is
there to have one.** Report (c) first, so (a) and (b) are read against a type
known to exist.
6a. **No production composition path uses the fixture constructor.** *(Scope 6a. **No production composition path uses the fixture constructor.** *(Scope
widened in review round 1: this checked `epiphany-textproj` only, while touch widened in review round 1: this checked `epiphany-textproj` only, while touch
row 7 gives **`epiphany-testkit`** the real authority too — so a row 7 gives **`epiphany-testkit`** the real authority too — so a
@ -2052,7 +2288,38 @@ the finding is that it succeeds *silently*. Do not report it as a passing gate.
must instead be justified against §0.4's rule: **only production composition must instead be justified against §0.4's rule: **only production composition
paths wrap the real constant**, and `roundtrip.rs` / `bundle_harness.rs` carry paths wrap the real constant**, and `roundtrip.rs` / `bundle_harness.rs` carry
both kinds. Name which kind each site is; an unclassified site is a finding. both kinds. Name which kind each site is; an unclassified site is a finding.
7. `spec/vectors/decode_vectors.txt` unmodified; no schema major/minor moved.
**This gate is vacuous if the constructor is not named `synthetic_for_fixture`.
ROUND 17.** It greps for that exact literal, and pin 3b offered the name as an
example until round 17 pinned it. **Any other name returns 0 matches and this
gate reports a pass having checked nothing.** Before trusting the count,
**confirm the constructor's actual name against pin 3b and quote its
signature** — a zero here means "no leaks" only if the string searched for is
the string that exists.
7. `spec/vectors/decode_vectors.txt` unmodified — `git diff --cached --stat --
spec/vectors/decode_vectors.txt` is **empty**; and **no schema major or minor
moved**, by the method below. **ROUND 17: the second clause named no method,
so it could be satisfied by not being checked.**
**Compare values, not diffs.** Quote the working-tree value of each of
`FORMAT_MAJOR` (`header.rs:47`), `FORMAT_MINOR` (`header.rs:53`) and
`Manifest::SCHEMA` (`manifest.rs:601`) beside its value at `HEAD`:
```
grep -n "pub const FORMAT_MAJOR\|pub const FORMAT_MINOR" crates/epiphany-bundle/src/header.rs
grep -n "const SCHEMA" crates/epiphany-bundle/src/manifest.rs
git show HEAD:crates/epiphany-bundle/src/header.rs | grep -n "pub const FORMAT_M"
git show HEAD:crates/epiphany-bundle/src/manifest.rs | grep -n "const SCHEMA"
```
→ the two sides **identical**. Report all four outputs, not the conclusion.
> **A diff-based check was written here first and withdrawn in the same round.**
> Grepping `git diff` for the constant names goes non-empty when the constants
> merely *move* — a comment added above them is enough — so it **fails on a
> change that did not happen**. A value comparison cannot. **Pin 3's rung type
> asserts no schema major or minor changes; this is the only item that checks
> that assertion, and until round 17 it named no method at all.**
--- ---

2
spec/PASS13_CANDIDATES.md
View File

File diff suppressed because one or more lines are too long