The first independent review of the staged execution returned five findings,
three blocking. The pins were frozen at ratification, so these are an
amendment with its own review round rather than patches.
Section 0.4 never counted Bundle::create_versioned -- a third public
constructor whose signature this rung changes, three sites, and zero
mentions across nineteen review rounds. It searched Bundle::open( and
Bundle::create( and concluded about "the writer surface". That is the fourth
instrument failure recorded in that one section, and the same shape as the
first three: a count taken from one spelling and generalised. The first
could not see a propagating path, the second asserted a universal negative
from head-truncated output, the third resolved a method name without
resolving its type, and this one enumerated two of three constructors.
That omission was the root cause of the second finding. testkit/gminor.rs
calls only create_versioned, so it never appeared in any surface count and
never got a touch row. Gate 4 failed during execution and caught it, along
with three more files in no row: bundle/src/lib.rs, whose re-export pin 3
makes unavoidable since 92 converted sites in three crates cannot name a
type the crate does not export, and the two crate-root capability helpers.
Touch rows 13 through 16 added.
production_caps() was unpinned design scope, not merely a missed path, and
in epiphany-testkit it landed as new public API. Ruled under pin 3b:
sanctioned, name pinned, visibility pinned per crate. pub(crate) in
epiphany-textproj, a production crate whose five uses are all in-crate, so
this rung adds no public API there. pub in epiphany-testkit, a test-support
crate whose integration tests and benches are external consumers and cannot
reach pub(crate). The direct-construction alternative is recorded as
considered and rejected: it adds no API but repeats the same wrap 23 times,
and "explicit" was never the same thing as "repeated".
Row 12 named one counter where a label addition necessarily moves three:
core requirements, suite requirements, suite labels. Execution found the
other two through four failing tests in that file.
The new writer comment was false, and this is the finding to carry because
it is a false rationale attached to correct behaviour. It said
self.manifest.canonical_base is always None at the commit-side check, but
test 9 deliberately performs an unrelated second commit on an inherited Some
base. What actually holds is narrower: an inherited base can be present but
never stale, because open refuses a stale one and create refuses a
base-bearing manifest. So narrowing pin 3a to "any stale inherited base" is
unobservable while broadening it to "any base-bearing commit" is very
observable and wrong. The scope is forced on one axis and a real choice on
the other, and the comment collapsed the two. Corrected in the staged code.
The contract itself never made the claim -- section 7 item 10 says "stale
inherited base", which is exactly right.
Review confirmed M7 internally coherent against the final tree: B_raw
requiring one normalisation step matches the probe history, and the
mismatched-base control reaches the staged writer check and produces the
required error. No additional M7 contradiction found.
The staged implementation is NOT accepted. This amendment needs another
independent pass first. The implementation remains staged and uncommitted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ps1szk2mSfgp4Cz21eVH9x
Levi Neuwirth
faea317d4a