Independent review against 9829ae3. Two findings, both blocking, and the
first round to reach into a mutation's mechanics rather than its
bookkeeping.
M7 did not describe a runnable observation. It told execution to construct
a base-bearing TextDocument, which bypasses parse_document entirely -- so
the parser refusal it ordered removed was irrelevant, and the demonstration
was not the import laundering it is named for. project_text_document has
the signature &TextDocument -> Result<String, _>: it is the export
direction and is not on the import path at all, so "all three sides, since
removing one leaves the others refusing and the document never reaches the
writer" was false for it. And "byte-indistinguishable from one whose base
was genuinely validated" named no comparison artifact and no comparison
method.
M7 now requires text that is parsed, not a constructed document; removes
and restores only the parser and serializer refusals; names test 10b's
construction as the comparison artifact, built with the same FileUuid and
base bytes; and requires a field-by-field enumeration of the canonical_base
SnapshotRef, the superblock's reduction version, and the header's major and
epoch -- reported rather than concluded. It is informative in both
directions: a field that does differ is a provenance signal nobody knew
existed, and that is a finding rather than something to suppress.
The round-7 deduplication was incomplete. The status block still carried
"rounds 3 and 4 are closed" while declaring the history table the sole
authority for that. Deleted.
Finding 1 is the most substantive of any round so far, because every
earlier one was about text agreeing with other text. This is about whether
the experiment runs at all, and it did not. M7 has been in the contract
since round 1 and survived seven reviews, three of which specifically
re-derived mutations, because reading it never required tracing what calls
what. An observation stated in the right register can look complete for a
long time. "Indistinguishable" was a conclusion, not an observation --
which is the exact failure mode this rung exists to eliminate, sitting
inside its own demonstration.
While amending I caught a third instance unaided: section 7 item 4a's M7
row still said "all three refusals". Fixed by pointing at M7 rather than
restating, per round 7's rule.
Still NOT RATIFIED, NOT DISPATCHABLE. Findings 9, 6, 6, 5, 4, 3, 3, 2.
Blocking 4, 4, 4, 4, 2, 3, 3, 2. Eight rounds, none clean. The M7 rewrite
is now the least-reviewed material in the contract, and its predecessor
survived seven rounds while being unrunnable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Independent review against c0d896c. Three findings, all blocking, and all
three the same defect -- a claim living in two places and fixed in one.
Section 7 item 4a was unsatisfiable. It required every mutation to name the
test it breaks, while item 1 four paragraphs above states that M4 is
observed to compile -- no test is possible, which is precisely why pin 3's
prohibition is a review rule -- and that M7's expected outcome is success.
A report obeying 4a literally could not be written, and the honest response
would have been to invent a test for one of them. 4a is now a table of what
each of the eight mutations owes, with M4 and M7 carved out.
Round 6's three-literal correction reached section 7 and not section 3.
Section 3 still said "both literals ... tidying either", so the contract
carried the fixed and the broken version of the same claim, reopening the
narrow-scope ambiguity round 6 existed to close. Section 3 no longer states
the count; it points at item 4b.
"Rounds 3, 4 and 5 were independent" went stale the instant round 6 closed,
sitting in prose beside the table whose own column records it. Deleted.
Three rounds, one lesson. Round 5 fixed the review totals and not the
amendment tally beside them. Round 6 fixed item 4b and not section 3's copy
of the same rule. Round 7 found the classification sentence duplicating the
table's column. The defect is duplication, and every previous remedy was
vigilance -- check the other sites too -- which has now failed three rounds
running.
The remedy adopted here is deletion, not diligence. Where a claim had two
homes, one is removed and replaced with a pointer: section 3 no longer
counts the literals, the history block no longer classifies the rounds, and
the status line no longer lists which rounds have closed. A copy that
cannot drift is one that does not exist.
Still NOT RATIFIED, NOT DISPATCHABLE. Findings by round 9, 6, 6, 5, 4, 3, 3
-- flattened rather than still falling. Blocking 4, 4, 4, 4, 2, 3, 3, with
rounds 6 and 7 both 100% blocking and 100% in the previous round's text.
Seven rounds, none clean. The deduplication is the first structural remedy
for this defect and therefore the first with a reason to work, and it is
untested.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Independent review against 03c85dd. The first round where every finding
was blocking and every one was in the previous round's amendments.
The amendment tally went stale inside the block round 5 restructured to
prevent exactly that. Round 5 turned the review totals into a table and
left "amended five times ... rounds 1-4" as prose immediately above it.
There is no longer a separate amendment count: it is the number of rows.
Section 3's test-home correction was itself false. Round 5 wrote "tests 1-9
in epiphany-bundle", but test 7 is assert_reduction_serialization_stable,
which the same section names as testkit/src/roundtrip.rs. Two wrong
versions of that sentence, both written while fixing it. Replaced with a
per-crate table: 1-6/8/9 in bundle, 7 and 10b in testkit, 10a in textproj.
Section 7 item 4b protected one operand where test 10b has two. Replacing
both synthetic_for_fixture(0) and the committed base's
ReductionAlgorithmVersion(0) with the constant keeps the synthetic call
exactly where it is and fully restores the tautology -- and test 10b's Err
arm never executes in the unmutated run, so its literal cannot detect it.
Item 4b now enumerates all three fixture operands individually and requires
each quoted verbatim.
All three are one defect in different clothes: a fix applied to the site
named rather than to every site the claim covers. Sixth count-staleness
defect in six rounds; third range-correction that did not check its own
range.
The mechanism that works is structural, not vigilant. The review totals
stopped going stale when they became a table. The amendment count did not,
because it stayed prose. Item 4b stopped being under-specified when it
became a table.
Demonstrated a seventh time inside this amendment: the new table's Total
row was first written "6 amendments", a free-standing count three
paragraphs after the sentence declaring no such count exists, and already
wrong at seven rows. Caught before commit and replaced with "one amendment
per row". Prose invites a number and a table does not, so the defence has
to be the shape of the artifact rather than the attention of the editor.
Still NOT RATIFIED, NOT DISPATCHABLE. Findings by round 9, 6, 6, 5, 4, 3 --
falling monotonically. Blocking 4, 4, 4, 4, 2, 3 -- not falling. No round
has yet come back clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Independent review against df9e528. Four findings, two blocking -- the
first round in which blocking findings fell below four.
The status history still said "amended three times ... fifteen findings so
far, eight of them blocking". Those are the round-2 figures, left standing
through rounds 3 and 4 while the tables recording those very rounds sat
directly below them. Fifth count-staleness defect in five rounds, and it
was in the one block I edited every round. Replaced with a table so a round
appends a row instead of requiring a number to be found and re-derived.
Running tally is now 30 findings, 18 blocking.
Test 10b could not make the two-field assertion M5b requires. Section 3
said only "assert it opens", and under mutation that yields a bare Err or a
panic. A #[test] returning Result that returns Err asserts nothing about
that error's fields, so M5b's required observation of
CanonicalBaseRequiresRebuild { base, current } had no home in the test M5b
names. Both Result arms are now pinned, plus a third arm for the
wrong-error case -- without it an implementation returning a different
error under mutation still fails the test and the report reads as success
while observing nothing.
M5b's claim that the literals cannot be tidied without deleting the
synthetic capability was false. Keeping synthetic_for_fixture while passing
CURRENT_REDUCTION_ALGORITHM_VERSION as both its argument and the base
version preserves the fixture and fully restores the tautology. Retracted.
The protection is section 7 item 4b, the positive check that the literals
are still literals. Round 4 asserted a structural guarantee that did not
hold and thereby undercut the procedural check actually doing the work,
which is the same error as reasoning that a mutation would fail instead of
running it.
Section 3's preamble still said the tests were in epiphany-bundle after
round 4 added two that cannot be -- epiphany-bundle must not depend on
epiphany-ops, and reaching the real authority is the whole purpose of 10a
and 10b. Corrected, with each test's touch-table home named.
Still NOT RATIFIED, NOT DISPATCHABLE. Blocking findings by round are 4, 4,
4, 4, 2 -- the first movement in four rounds and the first weak evidence of
convergence, against the fact that every round since the third has found
blocking defects in text written to fix its predecessor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Independent review against 53292f6. Five findings, four blocking. Round 4
accepted pin 3's capabilities() accessor as bounded -- the first new text
any round has passed -- and rejected both halves of M5 again.
M5b cited the wrong value, and this one is mine. roundtrip.rs:367 sits in
assert_score_serialization_stable, not assert_reduction_serialization_stable,
and it versions an acceleration snapshot, not a canonical base. The latter
has no base at all, because pin 3c suspended it. So the value round 3 told
the implementer not to touch was irrelevant to the authority check, and
mutating it could not have failed anything. Round 3 grepped
ReductionAlgorithmVersion across testkit/src/, saw a roundtrip.rs hit, and
attributed it to the function it was already thinking about without
resolving the enclosing item -- the same shape as section 0.4's .commit(
miscount, which round 1 had already recorded as a lesson. Recording a
defect is not the same as not committing it. The tautology diagnosis
stands; only its evidence was wrong.
M5b left the instrument unchosen. Round 3 said "the rung picks one" and
named two routes, one of which does not exist for the nominated crate:
craft_image_with_base is a private fn inside epiphany-bundle's cfg(test)
module. Now chosen, through public API only: build with
synthetic_for_fixture(0), commit a base carrying the literal 0, take the
bytes, reopen under the real constant. The operands are provably
independent and neither can be tidied into the other.
M5b had no test that could assert the error fields.
assert_reduction_serialization_stable returns () and reopens with .expect,
so a mismatch panics instead of yielding a matchable
CanonicalBaseRequiresRebuild { base, current }. Test 10b added, named and
returning a matchable Result.
M5a violated section 7 item 4a -- the rule round 3 added in the same edit.
It named no test, and its natural assertion compares
CURRENT_REDUCTION_ALGORITHM_VERSION with itself, which holds for every
value. Test 10a added, asserting against a deliberate literal. Round 3
diagnosed M5b's tautology and wrote the identical tautology into M5a in the
same edit, then added a rule and immediately broke it.
Both literals are load-bearing as literals. Section 7 item 4b now requires
confirming neither was rewritten as the constant -- tidying either makes
its mutation vacuous while every test stays green.
Minor: status prose said the pins were open to round 3's findings after
round 3 closed.
Still NOT RATIFIED, NOT DISPATCHABLE. Defect rate 9, 6, 6, 5 -- not
converging, and every blocking finding in rounds 3 and 4 was in text
written to fix the previous round.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Independent review against b842975. Six findings, four blocking. Every
blocking finding was a defect in text rounds 1 and 2 wrote.
Pin 3a still carried the rationale round 2 retracted. Section 0.4 says
there is no in-tree production base writer; pin 3a still said "0.4 shows
production code minting a stale document". The contract asserted a claim
and its negation. Rewritten onto the footing that survives: commit and
commit_versioned are public API and guard out-of-tree callers, not an
in-tree path. This is the third occurrence of fix-one-site-leave-the-
others -- round 1 fixed one spelling of a count, round 2 fixed section 0.4
and left the Rung type paragraph and touch row 2.
M5a had no observation mechanism. Pin 3 required the capability be stored
and nothing exposed it; Bundle has 17 public accessors and none for
capabilities, so no textproj test could inspect it. Bundle::capabilities()
is now pinned. That is new scope and is flagged as such for round 4.
M5b could not fail. If the supplied capability and the base version both
derive from CURRENT_REDUCTION_ALGORITHM_VERSION -- the natural
implementation, since roundtrip.rs:367 hardcodes ReductionAlgorithmVersion(0)
today -- both operands move together and the comparison passes for every
value of the constant. That is section 0.1's own tautology reproduced
inside the mutation built to detect it. The base version must now come from
a source that does not track the authority, and both operands' provenance
must be reported.
M6's replacement named a scenario with no test. Test 6 stops at opening, so
nothing asserted that an unrelated commit succeeds; an implementation
rejecting every post-base commit passed tests 2/5/6/8 and the broadening
had nothing to break. Test 9 added.
Cleanup: touch row 7 listed generators.rs as "call sites, real authority"
though it has zero Bundle::open/create calls, and its rng.range(0, 8)
versions are exactly the arbitrary wire values pin 3b assigns to synthetic
capabilities -- split to row 7a. Section 7's call-site attribution credited
round 1 where rounds 1 and 2 are both load-bearing.
The pattern is legible now and it is not about counts. Round 1 found stale
text, round 2 found unexecutable mutations, round 3 found that three
separate mutations were unrunnable in three different ways: M5a could not
observe, M5b could not fail, M6 had nothing to break. A mutation is only as
good as the test it breaks. Section 7 item 4a now requires, for every
mutation, the named test it breaks and the provenance of each operand.
Still NOT RATIFIED, NOT DISPATCHABLE, pins not frozen. Defect rate across
three rounds is 9, 6, 6 -- not converging. The newest text has had zero
adversarial passes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Round 1 claimed ratification after a single round. Round 2 then found four
more blocking defects against the supposedly frozen text, two of them
introduced by round 1's own amendments. A ratification a later round
falsifies that quickly was not one, and leaving the claim standing would
make the status field mean nothing.
Status is now NOT RATIFIED, NOT DISPATCHABLE, pins NOT frozen, awaiting an
independent review round 3 against b842975. Freezing follows ratification;
it does not precede it and does not survive a withdrawal. No execution work
may begin -- not implementation, not staging, not partial work against "the
settled pins."
Also disambiguated the two senses of dispatchable that round 1 conflated.
Unblocked means the dependency chain cleared, true since bc06706.
Dispatchable means ratified and frozen and ready to execute, false. Reading
the first as the second is how this came to be ratified after one round.
Both prior rounds were run by the same agent that authored the amendments
under review. Round 3 is the first that will not be.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Round 1 ratified after a single round. Round 2, run against the frozen
contract, found four more blocking defects -- two of which round 1 created.
Ratification was premature and the status now says so.
Blocking:
The call-site correction was applied to section 0.4's table only. The "Rung
type" paragraph still said 57, and touch row 2 still said bundle.rs has 35
opens -- a figure that was never bundle.rs alone (it was bundle.rs plus
fuzz.rs, which has its own row) and is stale besides. bundle.rs has 23. The
reconciliation section 7 requires was impossible against those numbers.
Fixing one spelling of a count and leaving two others is the same defect
round 1 reported as finding 5.
Section 0.4 called project.rs:936 a production bundle writer. cfg(test)
starts at project.rs:630 and every Bundle call in the file is below it --
create at :983 and :1122, open at :1147. The writer-path correction stands
on serialize.rs alone, whose create and commit_versioned are above its own
cfg(test) at :284. Round 1 verified the editor-core claim in that paragraph
and inherited its neighbours.
M5 was unexecutable. serialize_document refuses base-bearing documents at
serialize.rs:151, before Bundle::create, so its output is necessarily
base-free; pin 5 and test 4 require base-free bundles to open at any
authority. Changing the constant cannot make a textproj production test
fail. Split into M5a (production wires the constant) and M5b (the authority
is load-bearing where a base exists, via testkit's restored base coverage).
M6's second half was unexecutable. open rejects a stale base, create
rejects a base-bearing manifest at bundle.rs:234, and commit validates what
it emits, so no caller can hold an open Bundle with a stale inherited base.
Replaced by broadening pin 3a rather than narrowing it, which is reachable.
The unreachability is itself reported: pin 3a's scope is forced, not
chosen, which is stronger than what the mutation was written to obtain.
Non-blocking: pin 3a's justification, that production code mints a
self-consistent stale document without calling open, is false in-tree --
zero production paths stage a base, since the format rung's pin 3b closed
the only one. It now rests on guarding the public commit_versioned API
against out-of-tree callers. And serialize.rs:157 is dead code orphaned by
the :151 guard, recorded as a finding and explicitly not repaired here.
Two of these were introduced by round 1: ruling M7's refusal permanent is
what made M5 unexecutable, and test 8 was added on the write side without
re-deriving M6 against the same reachability. An amendment is a change to
the system, not a patch to a line.
Round 3 is warranted before dispatch. The defect rate has not fallen -- 9,
then 6 -- and dispatchable is a claim requiring evidence of convergence,
not a status reached by running out of findings.
Documentation only; no code reads .md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
The contract had reached "dispatchable" with zero ratification rounds on
record, against the standing rule that contracts go through adversarial
review before dispatch. The format-epoch rung had four, and its fourth is
what produced pin 3c. This is S27's first.
Blocking:
Inherited obligation 2 -- M8's laundering demonstration -- was in neither
the test section nor the mutation plan, while that section's preamble
claimed all three inherited obligations were "stated as tests so they
cannot be discharged by prose". It was also ambiguous between temporarily
lifting the text refusal and permanently restoring the capability, which
differ by four touch rows and a COMPANION_VERSION bump. Ruled a mutation:
the refusal is permanent, and the demonstration is now M7, with its
expected outcome recorded as success rather than failure.
Section 0.4 claimed "commit has 57 sites (including 2 in
epiphany-editor-core)". That crate depends on core, ops and layout-ir --
not bundle -- and the word Bundle appears in its lib.rs zero times. The two
hits are self.commit(...) resolving to its own method. A textual .commit(
grep counted a same-named method in a crate that cannot reach Bundle. That
is the third instrument failure recorded in that one section, and it was
committed in the same paragraph as the method note warning about the
second.
Three independent stale list-counts: the test section's header said "names
all four" over seven items, gate 1 said "four tests added", and three
report items named five mutations, seven gate results and four tests. All
replaced with "every item in section N". The delta was never a simple
addition anyway -- three tests convert or extend existing format-rung
tests, which nets zero.
testkit/tests/requirement_labels.rs was absent from the touch table while
pin 9 may move CORE_REQUIREMENT_COUNT from 213. Pin 9 must now decide
explicitly whether it mints a label; touch row 12 carries the file
conditionally. This is the escapee CLAUDE.md names, and it escaped the
format-epoch rung too.
Non-blocking: locator drift since 381c498 (bc06706 grew bundle.rs by 338
lines; correction table added, and pin 5's own :396-:399 confirmed
unmoved); pin 2a's corpus evidence superseded by the 2 -> 0 rebuild;
Bundle::open( 57 -> 60, create confirmed still 32; gate 6a widened to
epiphany-testkit, which touch row 7 gives the real authority; and a missing
commit-side positive test, added as test 8 -- obligation 1 warns that
converting one branch leaves a hole, and that branch had none.
Pins are now frozen. Documentation only; no code reads .md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
The status header still read "BLOCKED on the format-epoch rung ... has not
yet landed". That rung landed at bc06706 (fix be244df), and the ledger row
has said UNBLOCKED since. Corrected, recording the prior status rather than
erasing it.
Fixing only the header would have left the contradiction it points at. Pin
10 instructs the ledger writer that P13-S16's row opens only "unless 2a is
ratified and tested within this rung" -- but pin 2a's own prohibition
forbade being amended into a disposition from inside this contract, so the
only route it permitted was resolution from outside, which is what the
format-epoch rung's pin 8 did. The clause's literal condition could never be
satisfied by the one path 2a allowed, and read literally pin 10 would record
S16 as still blocked on a settled disposition.
Amended so ratification is sourced correctly. The "tested" half is
deliberately NOT waived: no other rung exercises this authority, so testing
is discharged by S27's own inherited obligations -- converting both interim
refusals to real capability validation -- and the ledger row may not record
S16 as open until those land with this rung.
Pin 2a's original analysis stays verbatim; its resolution block says so
explicitly. Touch row 11 already carries PASS13_CANDIDATES.md for pin 10, so
the amendment adds no touch row. Documentation only -- no code reads .md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
FORMAT_MAJOR becomes 1 and FORMAT_MINOR restarts at 0. The decoder
stops being exact-major-only: it classifies three ways through a named
FormatEpoch carried on FixedHeader, so major 0 is decoded deliberately
as legacy rather than refused. Old readers already fail closed on an
unknown major, so that half needed no mechanism — which is why the major
is the right carrier, and why the header's immutability, fatal to
FORMAT_MINOR as a provenance field, is what makes it sound as an epoch
field.
The matrix: a major-0 bundle with no base may open; one carrying a base
is refused; one attempting to add a base is refused and told to repack.
That last row is the non-inheritance rule. Three errors, none of which
degrades to read-only: two permanent legacy/repack errors, and
ReductionAuthorityUnavailable, which is temporary, names P13-S27, and
must not say repack — a major-1 container is already the right epoch.
Until P13-S27 lands, both major-1 base boundaries are closed: opening a
major-1 bundle that already carries a base, and committing one into it.
Neither may be left open while the epoch asserts a validation that never
ran.
Text projection cannot mint a base. serialize_document staged a carried
base into a fresh bundle and build_manifest wrote it, so an old or
hand-authored document could be laundered straight through the boundary.
All three sides now refuse: projection, parsing, and a new dedicated
SerializeError variant — none of which existed to be "retained".
COMPANION_VERSION moves to 0.14.0 and the corpus is rebuilt to 20
vectors and ten rejection classes, with canonical_bases reach dropping
2 -> 0. That is a real capability loss and is recorded as one.
Corruption keeps precedence in both epochs: a corrupt major-1 base fails
as malformed, never as the temporary authority error a user would
reasonably retry.
All 11 mutations were run and observed, not reasoned about. M4 is the
signing one — with the legacy commit refusal removed, a legacy container
gains a base in place, which is exactly the counterexample that killed
FORMAT_MINOR. M11 confirms the third error is distinct while test 3
stays green, proving the mutation stayed inside the major-1 branches. M7
fails on both epoch halves. M8 falls through to
SerializeError::Bundle(ReductionAuthorityUnavailable), confirming the
text layer's own refusal is what the test asserts.
Two touch-table gaps surfaced during execution, both the same shape: a
.tex requirement addition moves hardcoded counts in
requirement_labels.rs, and the companion bump moves a second normative
version literal spelled version~0.13.0 rather than (0 13 0). Neither
file was in any touch table; the second was caught only because a test
exists for exactly that failure.
P13-S27 is unblocked — its pin 2a is resolved from outside, as its own
prohibition required — and inherits three obligations: both interim
refusals converted to validation, M8's deferred laundering
demonstration, and pin 3c's two suspended conformance assertions.
P13-S16 remains blocked on S27.
Workspace green at 1569.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjsEnYhm1gPpf6ii2iFxFV
The reduction-version check is a tautology: reduction_version_for seeds
a superblock from the canonical base's self-report, and open compares
the base against that superblock. Both operands descend from the same
source. It catches a corrupt base disagreeing with its superblock, and
necessarily passes for a conformingly propagated stale one.
Rulings: a typed BundleCapabilities required at both constructors and
carried on the Bundle, with no default; outright rejection on mismatch
via CanonicalBaseRequiresRebuild, not read-only and not an anomaly.
Storing the capability keeps all 57 commit sites unchanged; only open
(57) and create (32) move.
Pin 2a stays an open question. Baseline zero does not preserve the
corpus, and after S16 moves the authority to one, a pre-S27 base that
happens to carry one is indistinguishable from a legitimately rebuilt
S16 base. A raw u32 has no provenance. Four candidate dispositions are
recorded, including FORMAT_MINOR as a carrier, which is rejected here
for two independent reasons: the header never changes after creation
(core_spec.tex:10799) so a legacy bundle that commits a validated base
keeps its old minor forever, and a minor change may only append
append-safe discriminants (core_spec.tex:12258), not alter acceptance
semantics — while current readers ignore minor entirely, so the
boundary would bind only readers that already comply.
What survives: provenance must be carried by a container property old
readers cannot silently accept and a later commit cannot inherit
unchanged. That is a format-epoch design, filed next as P13-S28.
Three claims of mine died while scoping this, all recorded in the
contract: a constructor-grep that could not see a propagated value, a
head -14 truncation behind a universal negative, and reading
`format_major != FORMAT_MAJOR` for the half that supported the
proposal. A contract about unobservable defects should carry its own.
Docs only. Not dispatchable. S16 and S27 both remain blocked.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QjsEnYhm1gPpf6ii2iFxFV
Levi Neuwirth