Pin 13's APPEND opens "RESOLVED 2026-08-11"; actual resolution and landing were
both 2026-08-12, as the contract's own ratification line and amendment 1's both
say. The pinned date is the date the append text was drafted, frozen before the
dates diverged. Gate 10 rejected the artifact over exactly this character at
landing and annex §11.1 flagged it rather than settling it — the gate working.
The correction is appended to the ledger row; pin 13, annex §11.1 and the
original sentence are all left standing. The reason is the append-only
convention CLAUDE.md:12 states, not that history would otherwise change: 52fcf37
is immutable, and gate 10's observation remains true of it whatever a later
commit says. An earlier draft gave that false reason and §7.2 records it as
false, because it is the more persuasive one and would otherwise be re-derived.
This commit ratifies only. Per §7.0 the ledger correction is deliberately
UNSTAGED here and lands in the next commit, so that this commit is the immutable
oracle B1 reads both ORACLE and CORRECTION from. An oracle taken from the
working copy is not an oracle: an executor editing template and artifact together
would satisfy it.
B2's third part pins the ratification-to-landing surface exactly — one status
line swapped, four lines added for the marker, nothing else — so §7's frozen
body, including §7.3's template and this gate, cannot be edited during landing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Graph invariant 10 reported Chapter 3 and Chapter 4 failures under its own
number, through a public API. `InvariantViolation` becomes
`WellFormednessViolation` carrying a two-armed `ViolationKind`: `Invariant` for
a numbered graph invariant, `Requirement` for a normative rule named by its
`req:` label. Invariant 10 keeps only reference resolution.
`check_invariants` stays comprehensive, so every broad caller keeps its rule
coverage; `check_invariant` narrows to the invariant arm and a symmetric
`check_requirement` is added. Both are projections of the aggregate. Four rules
move to their own labels, one of which this rung mints:
`req:time:tempo-segment-shape`, stating the enforced shape/end_tempo
compatibility without resolving P13-S8. `GraphInvariant` did not move: 21
variants, unchanged.
44 suites / 1606 passed / 0 failed / 0 ignored (1586 -> 1606, 43 -> 44)
clippy -D warnings clean; fmt -p epiphany-core -p epiphany-testkit clean
core_spec.pdf rebuilt, undefined references cleared
Gates 1-16 pass; evidence in spec/EVIDENCE_P13S29_EXECUTION.md. All 54 mutations
of §3 observed, none compile-only, none passing. Amendment 1 corrected M1·C6 and
M1·C7 from one observer to two after measurement contradicted the derived cell.
Six execution faults are recorded rather than left in the transcript, none a
contract defect. Three are worth naming here because no tool would have caught
them:
- Pin 10's eleventh row was read as a note, not a test, so
`reversed_aleatoric_bounds_stay_invariant_four` was never written. M11's cell
named it, and the omission surfaced only as a radius mismatch.
- `display_renders_each_arm_exactly` carried a comment stating its pinned
fixture correctly above code that built a different one. Pin 10 had foreclosed
the choice precisely because it moves radii; with the fixture repaired the
test entered M11's cell and left M17·C1's, both as pinned.
- Pin 9's `/// 10.` rider note was the one prose row left unmigrated, naming
three labels where four were required and still filing the multiplexing as
pending. Gate 16 states these outcomes have no machine observer; eight rows
were verified by their own stale phrase, and the ninth was not there.
Gate 10 rejected the ledger append over one character: the artifact read
2026-08-12 where pin 13 pins 2026-08-11. The artifact was corrected to the pin,
and the date question is flagged for the owner as a possible administrative
amendment rather than settled here.
CLAUDE.md's baseline still reads 43 suites / 1586 tests and is not in the touch
table; it follows in a separate reconciliation commit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Edit 1 — §3's M1 row now states the measured radius: C6 and C7 each fail *both*
pin-10 order tests, and the legacy `f4` assertion fails for neither. The
superseded sentence survives exactly once, in §6.1's blockquote, where it is a
dated quotation of what was corrected.
Edit 2 — §3's preamble gains an append. Its "Four cells were measured" sentence
is left unedited: it is accurate about what was measured before ratification,
and rewriting it would destroy a true historical claim to fix a staleness. Six
cells are now measured, and the append says which two joined and why the
criterion that excluded them was wrong.
Edit 4 — the annex gains §8, equal to §6.5c's pinned source template with its
single hash slot filled. §5 and §7 are untouched and hash to the values pinned
at ratification; verified byte-identical against 29ef3af's blob, halt notice and
both mismatch marks intact. The execution record is appended to, never
reconciled — the mismatch is the evidence.
A1 §3 correction, superseded sentence occurring exactly once
A2 discharged by the dated transcripts in annex §5.3 and §5.4; not re-run
A3 no implementation, test or fixture change attributable to the amendment;
commit touches exactly two spec files; workspace at 44/1604/0/0
A4 §8 equals the template; §5 and §7 byte-identical to the oracle
A5 §6 in its ratified form; pin 12's transitions untouched
M1 is complete. C4, C5, C8, C9 and C10 matched their dispatched cells; C6 and C7
match the corrected cells. The mutation sequence resumes at M2, and its
transcripts land in annex §9 — §5 is closed at M1 by the digest gate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Execution of P13-S29 halted at M1 on a radius mismatch. §3 pinned M1·C6 and
M1·C7 as failing "their pin-10 test alone"; measured, each fails both pin-10
order tests. The tree is correct and the cell is not.
Pin 10 builds both tests from `two_segments(seed, (2, 3), (1, 2))` and pins a
fourth assertion — the aggregate's invariant arm is empty. It also establishes
that this fixture emits C6 *and* C7, and expressly rejects the end-before-start
segment that would separate them. So re-tagging either condition puts an
Invariant violation into both fixtures and the sibling's fourth assertion fails.
§3's cell reasoned about the legacy `f4` observer — correctly; `f4` is in neither
radius — and never asked the same question of the tests this contract writes.
The one-hop correction, inside a single table cell. §3 measured four cells
because they reached tests the contract did not write; C6 and C7 reach tests it
did write, which is why they were derived and why the derivation was trusted.
Authorship of a test is not knowledge of its fixture's reach.
C4, C5, C8, C9 and C10 were measured in the same pass and matched exactly, so
the correction is not generalized: C4/C5 and C8/C9 also share labels and show no
cross-talk. The operative property is a shared fixture, not a shared label.
This commit ratifies only. It carries §6 in its frozen form and the
pre-amendment annex — §1–§7, no §8 — which §6.5c-bis names as the oracle for the
byte-identity gate. §5 and §7 record what was expected, what was observed and
why execution stopped; they are appended to, never reconciled, because the
mismatch is the evidence.
annex §5 sha256 40ce82a70339159024c69dd5e280d8bd6846efbeb1eecd5b7971a2737826f74b 134 lines
annex §7 sha256 cdd9bfd91da5091174201b1bc16aea6a5f162cc5f6d8553f6d58d7c56aacccd8 76 lines
Edits 1, 2 and 4 follow in their own commit, then A1–A5, then M2.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Graph invariant 10 reported Chapter 3 and Chapter 4 failures under its own
number, through a public API: check_invariant is pub and re-exported, and
Display rendered a tempo rule as "invariant 10 (CrossCuttingRefsResolve)
violated". Disposition (b), type-neutral: InvariantViolation becomes
WellFormednessViolation carrying a two-armed ViolationKind. check_invariants
stays comprehensive, so every broad caller keeps its rule coverage; the
deliberate behaviour change is that check_invariant narrows to the invariant
arm, with a symmetric check_requirement added. GraphInvariant does not move --
21 variants, unchanged, and no new negative generator or shrink obligation.
req:time:tempo-segment-shape is minted for the one rider that had no label,
stating the enforced shape/end_tempo compatibility without resolving P13-S8's
canonical-form question, so the label survives whichever spelling S8 ratifies.
Eighteen review rounds. Four mutation radii were measured against disposable
implementations rather than derived, and every one of the four differed from
what static reading predicted: M2a by ten false positives and seventeen
omissions, M17-C1 by naming seven where eighteen fail and including a test that
belongs to C2, M17-C2 and C3 by predicting observers that measurement put at one
and zero. Two of those measurements first produced a compile error reporting
zero failures -- a compile error observes nothing -- and one misread cargo test's
"error: test failed" as a compilation signal; only the third method is pinned.
Several defects were structural rather than arithmetic. Both selectors could
have matched their arm while ignoring their payload, satisfied by every fixture
presenting a single variant or label. A complete third ViolationKind arm, or a
fully implemented 22nd GraphInvariant omitted from all(), compiles and leaves
every gate green -- a variant nothing enumerates is a variant nothing observes.
The accidental tests identified their rule by a witness suffix this rung
deletes, so a selector-only migration would have left two negatives green and
vacuous. And invariants.rs:8 carries the old type name in retained header prose,
which would have made gate 6 unsatisfiable.
Prerequisite review scaffolding, applied earlier under a narrow authorization
and committed here because ratification is what changes its staging state: one
temporary DISCUSSED_NOT_CITED row for req:time:tempo-segment-shape, deleted by
pin 3 when the requirement lands, with landing gates for its absence and for the
baseline being green because the label is defined rather than still allowlisted.
Baseline unchanged at 43 suites, 1586 passing; no implementation target has been
modified.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Levi Neuwirth