Execution of P13-S29 halted at M1 on a radius mismatch. §3 pinned M1·C6 and
M1·C7 as failing "their pin-10 test alone"; measured, each fails both pin-10
order tests. The tree is correct and the cell is not.
Pin 10 builds both tests from `two_segments(seed, (2, 3), (1, 2))` and pins a
fourth assertion — the aggregate's invariant arm is empty. It also establishes
that this fixture emits C6 *and* C7, and expressly rejects the end-before-start
segment that would separate them. So re-tagging either condition puts an
Invariant violation into both fixtures and the sibling's fourth assertion fails.
§3's cell reasoned about the legacy `f4` observer — correctly; `f4` is in neither
radius — and never asked the same question of the tests this contract writes.
The one-hop correction, inside a single table cell. §3 measured four cells
because they reached tests the contract did not write; C6 and C7 reach tests it
did write, which is why they were derived and why the derivation was trusted.
Authorship of a test is not knowledge of its fixture's reach.
C4, C5, C8, C9 and C10 were measured in the same pass and matched exactly, so
the correction is not generalized: C4/C5 and C8/C9 also share labels and show no
cross-talk. The operative property is a shared fixture, not a shared label.
This commit ratifies only. It carries §6 in its frozen form and the
pre-amendment annex — §1–§7, no §8 — which §6.5c-bis names as the oracle for the
byte-identity gate. §5 and §7 record what was expected, what was observed and
why execution stopped; they are appended to, never reconciled, because the
mismatch is the evidence.
annex §5 sha256 40ce82a70339159024c69dd5e280d8bd6846efbeb1eecd5b7971a2737826f74b 134 lines
annex §7 sha256 cdd9bfd91da5091174201b1bc16aea6a5f162cc5f6d8553f6d58d7c56aacccd8 76 lines
Edits 1, 2 and 4 follow in their own commit, then A1–A5, then M2.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Graph invariant 10 reported Chapter 3 and Chapter 4 failures under its own
number, through a public API: check_invariant is pub and re-exported, and
Display rendered a tempo rule as "invariant 10 (CrossCuttingRefsResolve)
violated". Disposition (b), type-neutral: InvariantViolation becomes
WellFormednessViolation carrying a two-armed ViolationKind. check_invariants
stays comprehensive, so every broad caller keeps its rule coverage; the
deliberate behaviour change is that check_invariant narrows to the invariant
arm, with a symmetric check_requirement added. GraphInvariant does not move --
21 variants, unchanged, and no new negative generator or shrink obligation.
req:time:tempo-segment-shape is minted for the one rider that had no label,
stating the enforced shape/end_tempo compatibility without resolving P13-S8's
canonical-form question, so the label survives whichever spelling S8 ratifies.
Eighteen review rounds. Four mutation radii were measured against disposable
implementations rather than derived, and every one of the four differed from
what static reading predicted: M2a by ten false positives and seventeen
omissions, M17-C1 by naming seven where eighteen fail and including a test that
belongs to C2, M17-C2 and C3 by predicting observers that measurement put at one
and zero. Two of those measurements first produced a compile error reporting
zero failures -- a compile error observes nothing -- and one misread cargo test's
"error: test failed" as a compilation signal; only the third method is pinned.
Several defects were structural rather than arithmetic. Both selectors could
have matched their arm while ignoring their payload, satisfied by every fixture
presenting a single variant or label. A complete third ViolationKind arm, or a
fully implemented 22nd GraphInvariant omitted from all(), compiles and leaves
every gate green -- a variant nothing enumerates is a variant nothing observes.
The accidental tests identified their rule by a witness suffix this rung
deletes, so a selector-only migration would have left two negatives green and
vacuous. And invariants.rs:8 carries the old type name in retained header prose,
which would have made gate 6 unsatisfiable.
Prerequisite review scaffolding, applied earlier under a narrow authorization
and committed here because ratification is what changes its staging state: one
temporary DISCUSSED_NOT_CITED row for req:time:tempo-segment-shape, deleted by
pin 3 when the requirement lands, with landing gates for its absence and for the
baseline being green because the label is defined rather than still allowlisted.
Baseline unchanged at 43 suites, 1586 passing; no implementation target has been
modified.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Levi Neuwirth