Edit 1 — §3's M1 row now states the measured radius: C6 and C7 each fail *both*
pin-10 order tests, and the legacy `f4` assertion fails for neither. The
superseded sentence survives exactly once, in §6.1's blockquote, where it is a
dated quotation of what was corrected.
Edit 2 — §3's preamble gains an append. Its "Four cells were measured" sentence
is left unedited: it is accurate about what was measured before ratification,
and rewriting it would destroy a true historical claim to fix a staleness. Six
cells are now measured, and the append says which two joined and why the
criterion that excluded them was wrong.
Edit 4 — the annex gains §8, equal to §6.5c's pinned source template with its
single hash slot filled. §5 and §7 are untouched and hash to the values pinned
at ratification; verified byte-identical against 29ef3af's blob, halt notice and
both mismatch marks intact. The execution record is appended to, never
reconciled — the mismatch is the evidence.
A1 §3 correction, superseded sentence occurring exactly once
A2 discharged by the dated transcripts in annex §5.3 and §5.4; not re-run
A3 no implementation, test or fixture change attributable to the amendment;
commit touches exactly two spec files; workspace at 44/1604/0/0
A4 §8 equals the template; §5 and §7 byte-identical to the oracle
A5 §6 in its ratified form; pin 12's transitions untouched
M1 is complete. C4, C5, C8, C9 and C10 matched their dispatched cells; C6 and C7
match the corrected cells. The mutation sequence resumes at M2, and its
transcripts land in annex §9 — §5 is closed at M1 by the digest gate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Execution of P13-S29 halted at M1 on a radius mismatch. §3 pinned M1·C6 and
M1·C7 as failing "their pin-10 test alone"; measured, each fails both pin-10
order tests. The tree is correct and the cell is not.
Pin 10 builds both tests from `two_segments(seed, (2, 3), (1, 2))` and pins a
fourth assertion — the aggregate's invariant arm is empty. It also establishes
that this fixture emits C6 *and* C7, and expressly rejects the end-before-start
segment that would separate them. So re-tagging either condition puts an
Invariant violation into both fixtures and the sibling's fourth assertion fails.
§3's cell reasoned about the legacy `f4` observer — correctly; `f4` is in neither
radius — and never asked the same question of the tests this contract writes.
The one-hop correction, inside a single table cell. §3 measured four cells
because they reached tests the contract did not write; C6 and C7 reach tests it
did write, which is why they were derived and why the derivation was trusted.
Authorship of a test is not knowledge of its fixture's reach.
C4, C5, C8, C9 and C10 were measured in the same pass and matched exactly, so
the correction is not generalized: C4/C5 and C8/C9 also share labels and show no
cross-talk. The operative property is a shared fixture, not a shared label.
This commit ratifies only. It carries §6 in its frozen form and the
pre-amendment annex — §1–§7, no §8 — which §6.5c-bis names as the oracle for the
byte-identity gate. §5 and §7 record what was expected, what was observed and
why execution stopped; they are appended to, never reconciled, because the
mismatch is the evidence.
annex §5 sha256 40ce82a70339159024c69dd5e280d8bd6846efbeb1eecd5b7971a2737826f74b 134 lines
annex §7 sha256 cdd9bfd91da5091174201b1bc16aea6a5f162cc5f6d8553f6d58d7c56aacccd8 76 lines
Edits 1, 2 and 4 follow in their own commit, then A1–A5, then M2.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Graph invariant 10 reported Chapter 3 and Chapter 4 failures under its own
number, through a public API: check_invariant is pub and re-exported, and
Display rendered a tempo rule as "invariant 10 (CrossCuttingRefsResolve)
violated". Disposition (b), type-neutral: InvariantViolation becomes
WellFormednessViolation carrying a two-armed ViolationKind. check_invariants
stays comprehensive, so every broad caller keeps its rule coverage; the
deliberate behaviour change is that check_invariant narrows to the invariant
arm, with a symmetric check_requirement added. GraphInvariant does not move --
21 variants, unchanged, and no new negative generator or shrink obligation.
req:time:tempo-segment-shape is minted for the one rider that had no label,
stating the enforced shape/end_tempo compatibility without resolving P13-S8's
canonical-form question, so the label survives whichever spelling S8 ratifies.
Eighteen review rounds. Four mutation radii were measured against disposable
implementations rather than derived, and every one of the four differed from
what static reading predicted: M2a by ten false positives and seventeen
omissions, M17-C1 by naming seven where eighteen fail and including a test that
belongs to C2, M17-C2 and C3 by predicting observers that measurement put at one
and zero. Two of those measurements first produced a compile error reporting
zero failures -- a compile error observes nothing -- and one misread cargo test's
"error: test failed" as a compilation signal; only the third method is pinned.
Several defects were structural rather than arithmetic. Both selectors could
have matched their arm while ignoring their payload, satisfied by every fixture
presenting a single variant or label. A complete third ViolationKind arm, or a
fully implemented 22nd GraphInvariant omitted from all(), compiles and leaves
every gate green -- a variant nothing enumerates is a variant nothing observes.
The accidental tests identified their rule by a witness suffix this rung
deletes, so a selector-only migration would have left two negatives green and
vacuous. And invariants.rs:8 carries the old type name in retained header prose,
which would have made gate 6 unsatisfiable.
Prerequisite review scaffolding, applied earlier under a narrow authorization
and committed here because ratification is what changes its staging state: one
temporary DISCUSSED_NOT_CITED row for req:time:tempo-segment-shape, deleted by
pin 3 when the requirement lands, with landing gates for its absence and for the
baseline being green because the label is defined rather than still allowlisted.
Baseline unchanged at 43 suites, 1586 passing; no implementation target has been
modified.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Levi Neuwirth