From 9153623aa11962050c464e5410e13e256cbebf5d Mon Sep 17 00:00:00 2001 From: Levi Neuwirth Date: Sun, 9 Aug 2026 15:39:50 +0200 Subject: [PATCH] Post-S27 docs: scope the supersessions properly in handoff and S16 contract MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up review found the previous reconciliation half-done in two places. Documentation only; the accepted S27 code is untouched. spec/HANDOFF_2026-08-07.md -- it declared CLAUDE.md the sole origin for the green baseline and then stated the number twice anyway, once in its own update table and once in §3.5. Both replaced by pointers; the figure now exists in exactly one file. The §1.2 marker also said everything following it was pre-S27 while two post-S27 notes sat inside that section. The notes are deleted and their substance folded up into the top block's table rows -- the permanent acceleration_snapshots warning onto the conformance row, the "may not degrade to read-only" carry-over onto the errors row -- so §1.2 is now purely a dated record. The marker is also scoped to §1.2 rather than "everything after," which would have wrongly claimed §1.4 onward. spec/CONTRACT_P13S16_PROJECTION.md -- pin 0 still carried live pre-S27 instructions: no authority exists, no mechanism detects a stale base, ids.rs:288's catalog claim is false, this rung cannot execute, the ledger stays blocked on P13-S27, and file S27. A status-and-ledger update did not reach any of them. - Pin 0 now carries a discharge marker BEFORE the pin, not only after it, so a top-down reader meets the correction before the false claims. - The discharge answers each falsified claim individually in a table, and replaces all three numbered requirements. Pin 0's deliberate narrowing -- that no history audit was done, so the stronger "never detectable" claim must not be written -- survives and still binds. - Requirement 3 inverts rather than disappears: stale bases are now rejected and S27 owns those tests, so this rung must not add a second detection path; what it must do instead is bump CURRENT_REDUCTION_ALGORITHM_VERSION to 1. - Pin 11's live "File P13-S27 in the same edit" instruction is struck inline, not only in its preamble, and the retained reasoning is properly blockquoted with every claim in it marked false. - §6 report requirement 2a required confirmation that nothing was added detecting stale bases -- the opposite of what is now correct. Rewritten to require the version bump with its Bumps-list entry, no second detection path, and the unchanged operation_catalog.tex rebuild note. - "The P13-S16 row is marked blocked on P13-S27" corrected; "does NOT move to RESOLVED" is retained, since it is still true and is the distinction that matters -- unblocked, dispatchable and resolved are three different states. Line-number citations throughout the S16 contract predate S27's 795-line bundle.rs change and are NOT re-derived here; that is recorded as part of ratification rather than silently patched. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x --- spec/CONTRACT_P13S16_PROJECTION.md | 115 +++++++++++++++++++++++++---- spec/HANDOFF_2026-08-07.md | 33 +++------ 2 files changed, 112 insertions(+), 36 deletions(-) diff --git a/spec/CONTRACT_P13S16_PROJECTION.md b/spec/CONTRACT_P13S16_PROJECTION.md index 243d89b..ef4f5cb 100644 --- a/spec/CONTRACT_P13S16_PROJECTION.md +++ b/spec/CONTRACT_P13S16_PROJECTION.md @@ -148,6 +148,16 @@ There are 20 invariants (`invariants.rs:149`, count guard `:6064`). 21 is free. ## §1. Pins +> ### PIN 0 IS DISCHARGED — read this before the pin. P13-S27 landed 2026-08-09. +> +> **Everything in pin 0 below is a dated record of the pre-S27 tree.** Its central +> claims — that no constant names the current reduction semantics, that no mechanism +> detects a stale base, that `ids.rs:288`'s catalog claim is false, and that **this rung +> therefore cannot execute** — are **all now false**, and its three numbered +> requirements are superseded. **The discharge, with each claim answered individually +> and the replacement requirements, is at the end of this pin.** Read the pin as history; +> do not execute it. + **Pin 0 — declare the reduction-semantics break; do not pretend it is containable.** @@ -226,6 +236,55 @@ S27's disposition. What pin 0 still requires of the eventual rung: rejected; nothing rejects them. The break is recorded, not guarded, and the contract says so plainly rather than implying coverage. +--- + +### PIN 0 IS DISCHARGED — P13-S27 LANDED 2026-08-09 (`4df8e25`) + +**Everything above in pin 0 is a dated record of the pre-S27 tree and MUST NOT be +executed as written.** S27 built the machinery whose absence pin 0 documented, so the +pin's premises, its conclusion, and all three of its numbered requirements are +superseded. They are retained because the *reasoning* is what motivated S27, and because +`operation_catalog.tex`'s rebuild note still has to be written. + +**Which of pin 0's factual claims are now FALSE**, stated individually so none is left +standing by implication: + +| Pin 0 said | Now | +|---|---| +| "no constant or accessor naming the implementation's current reduction semantics" | **`epiphany_ops::CURRENT_REDUCTION_ALGORITHM_VERSION`** (currently `0`), plus `Bundle::capabilities()` as the accessor | +| "`ids.rs:288`–`:289` … asserts a false fact about another crate" | **Made true** by S27's pin 8 — the same doc comment now names the real location and mechanism | +| "the current implementation has **no mechanism** to detect a reduction-semantics change" | A mismatch is refused with `CanonicalBaseRequiresRebuild { base, current }` on **both** the read path (`open`) and the write path (`commit`/`commit_versioned`) | +| "**this rung cannot execute**" | **It can.** This contract is UNBLOCKED — see the status block. It is still a DRAFT and needs ratification, which is a different bar | + +**Pin 0's narrowing survives and still binds.** *This inspection does not establish that +no reduction-semantics change in the project's history was ever detectable* — S27 did +not perform that history audit either, and the stronger sentence still must not be +written into the ledger. + +**What replaces the three requirements:** + +1. **State the break** in `operation_catalog.tex`'s Revision History exactly as written + above — canonical bases materialized before this rung must be **rebuilt**, not + reused. **Unchanged.** But the ledger half is superseded: the P13-S16 row is + **UNBLOCKED, not blocked on P13-S27** — see pin 11, amended the same day. +2. ~~**File P13-S27**~~ — **DISCHARGED.** S27 has its own row, its own ratified + contract, and its own `RESOLVED — IMPLEMENTED 2026-08-09 (pin 10)` marker. Nothing + here is left to file. +3. **Assert nothing it cannot enforce** — **the principle stands; its application + inverts.** Stale bases *are* now rejected, and S27 owns the tests that prove it. So + this rung must not re-assert S27's guarantee, and must not add a second detection + path. **What it MUST do instead is bump `CURRENT_REDUCTION_ALGORITHM_VERSION` to + `1`**, because it changes `CreateStaffGroup`'s reduction verdict. **No mechanism can + detect a missed bump** — S27's authority doc is explicit that the discipline is the + entire guarantee — so the bump is this rung's obligation and nothing will catch its + absence. + +> **Line-number citations in this contract predate S27 and have NOT been re-derived.** +> S27 changed `bundle.rs` by 795 lines, so `bundle.rs:989`, `:396` and `ids.rs:288` +> above — and every other `bundle.rs` reference in this document — are stale as +> locators even where the claim about them is historical. **Re-deriving them is part of +> ratification**, not something this supersession did. + **Pin 1 — refuse a non-empty carried `members`, using the existing helper.** In `create_staff_group` (`reduce.rs:4458`), before the liveness loop, refuse a carried non-empty `members` with `container_not_empty()`. Match the idiom and @@ -406,24 +465,38 @@ unnecessary), the base-ingest hazard, the `t8b` inversion, the `t6`/`t7`/`t9` revisions, and — per pin 0 — that canonical bases materialized before this rung must be rebuilt rather than reused. -**File P13-S27 in the same `spec/PASS13_CANDIDATES.md` edit** — it is a -prerequisite discovered by this rung, not independent ledger cleanup, and the -two rows must land together so the blocking relation is visible from either end. -Its claim, at the scope §0's inspection supports: the reduction-version -machinery is **self-referential** — `reduction_version_for` (`bundle.rs:989`) -sources a new superblock's version from the canonical base's own self-report, -and `open` (`bundle.rs:396`) checks only that the two agree — so **the current -implementation has no mechanism comparing either against the semantics it -actually implements**, and `core_spec.tex:11614`'s rebuild requirement is -unenforced. Supporting: no constant or accessor names the current semantics, and -`ids.rs:288`'s claim that the catalog lives in `epiphany-ops` is false — a -second instance of **P13-S26**'s pattern. +~~**File P13-S27 in the same `spec/PASS13_CANDIDATES.md` edit**~~ — **DISCHARGED +2026-08-09; do not execute.** S27 was filed, contracted, ratified, implemented and +landed at `4df8e25`, and its row carries `RESOLVED — IMPLEMENTED 2026-08-09 (pin 10)`. +The blocking relation this instruction existed to make visible from both ends is now a +*resolved* relation recorded at both ends. **The reasoning below is retained as the +record of why S27 was filed, not as work to do.** + +> It is a +> prerequisite discovered by this rung, not independent ledger cleanup, and the +> two rows must land together so the blocking relation is visible from either end. +> Its claim, at the scope §0's inspection supports: the reduction-version +> machinery is **self-referential** — `reduction_version_for` (`bundle.rs:989`) +> sources a new superblock's version from the canonical base's own self-report, +> and `open` (`bundle.rs:396`) checks only that the two agree — so **the current +> implementation has no mechanism comparing either against the semantics it +> actually implements**, and `core_spec.tex:11614`'s rebuild requirement is +> unenforced. Supporting: no constant or accessor names the current semantics, and +> `ids.rs:288`'s claim that the catalog lives in `epiphany-ops` is false — a +> second instance of **P13-S26**'s pattern. +> +> *(**Every claim in this quoted block is now false** — S27 built the machinery, +> `ids.rs:288` was made true by its pin 8, and `core_spec.tex:11614` is enforced. It is +> kept verbatim as the filing that produced S27, not as a description of the tree.)* **Do not write the stronger historical claim** ("no reduction-semantics change has ever been detectable"); §0 does not establish it. **The P13-S16 row does NOT move to RESOLVED in this edit.** It records the -disposition-A plan, names this contract, and is marked **blocked on P13-S27**. +disposition-A plan, names this contract, and is marked ~~**blocked on P13-S27**~~ +**UNBLOCKED — S27 landed `4df8e25`** *(corrected 2026-08-09)*. **"Not RESOLVED" still +holds** and is the part that matters here: this rung has not been implemented, and +unblocked, dispatchable and resolved are three different states. --- @@ -543,8 +616,20 @@ its evidence at `invariants.rs:69`–`:71` must stay intact. 1. The nine mutations (M1–M9), each with verbatim failure output. 2. The nine gate results, each with its command. -2a. For pin 0: confirmation that **nothing** was added claiming to reject or - detect stale canonical bases, and that the break is recorded only in prose. +2a. **REWRITTEN 2026-08-09 — it required the opposite of what is now correct.** It read: + *"For pin 0: confirmation that **nothing** was added claiming to reject or detect + stale canonical bases, and that the break is recorded only in prose."* That was right + while nothing rejected them. **S27 now does**, on both the read and write paths, so a + report obeying the old text would confirm the absence of a guarantee that exists. + **As rewritten, the report must state:** + - that **`CURRENT_REDUCTION_ALGORITHM_VERSION` was bumped to `1`**, with the bump's + entry added to the constant's own "Bumps" list — this rung changes + `CreateStaffGroup`'s reduction verdict, and **nothing can detect a missed bump**; + - that **no second detection path was added.** S27 owns the check and its tests; a + rung that re-implements the guarantee it depends on has built a duplicate that can + disagree with the original; + - that the rebuild break is recorded in `operation_catalog.tex`'s Revision History, + **which is unchanged from the original requirement.** 3. The staged file list, and the test-count delta with its cause. 4. The four pin-8 verdicts, and the `t6`/`t7`/`t9` revisions with what each asserted before and after. diff --git a/spec/HANDOFF_2026-08-07.md b/spec/HANDOFF_2026-08-07.md index 864ec2d..2bc75ef 100644 --- a/spec/HANDOFF_2026-08-07.md +++ b/spec/HANDOFF_2026-08-07.md @@ -14,11 +14,11 @@ unpushed commits on any branch. > | Section | Said | Now | > |---|---|---| > | **§1.2 the live constraint** | no bundle anywhere may carry a canonical base | **LIFTED.** A base is accepted when its `reduction_algorithm_version` matches the running authority and refused with `CanonicalBaseRequiresRebuild { base, current }` when it does not — read side in `open`, write side in `commit`/`commit_versioned` | -> | §1.2 conformance criterion 4 | canonical-base wiring **suspended** | **RESTORED.** Both lapsed assertions are back and the suspension marker is gone from `testkit/src/roundtrip.rs` | -> | §1.2 the third error | `ReductionAuthorityUnavailable`, temporary | **DELETED**, replaced by `CanonicalBaseRequiresRebuild`. The two permanent repack errors are unchanged | +> | §1.2 conformance criterion 4 | canonical-base wiring **suspended** | **RESTORED.** Both lapsed assertions are back and the suspension marker is gone from `testkit/src/roundtrip.rs`. **§1.2's warning against re-homing the snapshot to `acceleration_snapshots` stands permanently** — it was never about the suspension | +> | §1.2 the third error | `ReductionAuthorityUnavailable`, temporary | **DELETED**, replaced by `CanonicalBaseRequiresRebuild { base, current }`. The two permanent repack errors are unchanged, and **§1.2's "none may degrade to read-only" rule carries to the new error verbatim** — a stale base is the wrong materialization, not a restricted-but-correct view | > | §1.4 chain state | `P13-S27 (UNBLOCKED) → P13-S16 (blocked on S27)` | `P13-S27 (LANDED)` → **`P13-S16 (UNBLOCKED, DRAFT — needs ratification)`** | > | §2.6, §4.3 collision | T1b and P13-S27 must not fly together | **RESOLVED** — S27 has landed. **T1b is NOT thereby free:** it remains blocked on Ruling B blocker (ii), versioned decode — see §2.3, which is still accurate | -> | §3.5, §4.2, §4.3 baseline | 1570 passing | **1577 passing, 0 failed, 0 ignored, 42 suites.** `CLAUDE.md`'s *Green baseline* is the single origin; this document no longer repeats the figure | +> | §3.5, §4.2, §4.3 baseline | 1570 passing | **Moved when S27 landed. The count is in `CLAUDE.md`'s *Green baseline* and is deliberately not stated here, or anywhere else in this document** — it was kept in three places and went stale in all three | > | §4.3 item 7 | dispatch P13-S27 | **done** | > | §4.3 item 9 | P13-S16 dispatchable the moment S27 lands | **unblocked — but its contract is a DRAFT and needs ratification before dispatch** | > @@ -142,10 +142,10 @@ Normative text: `core_spec.tex` §"The Container Epoch" + ### 1.2 The live constraint — LIFTED 2026-08-09 by P13-S27 (`4df8e25`) -> **This section is a dated record, not a live rule. See the POST-S27 UPDATE at the top -> for the state that replaced it.** The constraint below held only until S27 landed, and -> S27 has landed. Bases are now validated against the running authority rather than -> refused categorically. **Everything after this marker describes the pre-S27 world.** +> **This section is a dated record, not a live rule.** The constraint it states held only +> until S27 landed, and S27 has landed. **The rest of §1.2 — down to §1.3 — describes the +> pre-S27 world and must not be followed.** What replaced it is in the **POST-S27 UPDATE +> at the top**, which is the only place that state is given; it is not restated here. **Until P13-S27 lands, no bundle anywhere may carry a canonical base** — not in production, not in tests, not in the conformance suite. Four rules compose to @@ -161,10 +161,7 @@ Consequences you will hit immediately if you forget: superblock bytes directly through the public `encode()`s. - Two refusal tests are unit tests over `Manifest`, not end-to-end, for exactly this reason, and say so in their doc comments. -- *(**POST-S27: no longer suspended.** S27 restored both assertions and deleted the - marker. The warning below about re-homing the snapshot to `acceleration_snapshots` - stands permanently — it was never about the suspension.)* - Conformance criterion 4's canonical-base wiring is **suspended**, marked in +- Conformance criterion 4's canonical-base wiring is **suspended**, marked in `crates/epiphany-testkit/src/roundtrip.rs` with a comment naming P13-S27. Its serialize → load → decode → reserialize cycle still runs via a direct `ChunkRef` read. **Do not "restore" it by re-homing the snapshot to @@ -178,12 +175,6 @@ both name **repack**), and `ReductionAuthorityUnavailable` (temporary, names **P13-S27**, must **not** say repack — a major-1 container is already the right epoch). -> **POST-S27:** the two permanent errors are unchanged. **`ReductionAuthorityUnavailable` -> no longer exists** — S27 deleted it and put `CanonicalBaseRequiresRebuild { base, -> current }` in its place, which is a real capability check rather than a placeholder. -> The "may not degrade to read-only" rule carries over to it verbatim: a stale base is -> the wrong materialization, not a restricted-but-correct view. - ### 1.3 Text projection lost a capability, deliberately Base-bearing documents no longer round-trip through text. All three sides refuse @@ -494,10 +485,10 @@ cargo fmt -p epiphany-bundle -p epiphany-textproj -p epiphany-testkit --check ``` **The expected count lives in `CLAUDE.md`'s *Green baseline* and is NOT repeated here — -changed 2026-08-09.** This document stated `1570` in three places; S27 moved it to -**1577**, and a figure kept in four places goes stale in three of them. If the observed -count differs from `CLAUDE.md`'s, reconcile that **before** starting new work — this -thread's whole method depends on a known-green baseline to mutate against. +changed 2026-08-09.** This document stated it in three places and S27 moved it, so all +three went stale together; a figure kept in four documents goes stale in three of them. +If the observed count differs from `CLAUDE.md`'s, reconcile that **before** starting new +work — this thread's whole method depends on a known-green baseline to mutate against. ---