An open PR gets its number in the ledger at the moment it opens, per the
standing correction from #171 and #215 --- #171 drifted 153 commits while
invisible here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The `/tmp/.git` diagnosis, finished properly.
**Compared on SIGNATURE, not test name**, which is what the ledger's own
CI-triage rule requires. The contaminated leg panics at
`m4_acceptance.rs:5668:5` and `:6615:5` with `.received = ""` ---
byte-identical to the gate red's own signature --- and the clean leg has
ZERO panics. Same binary, same commit, one variable.
**All nine gates pass under an isolated `TMPDIR`**: m4 168/0/3 by the
mandated command, and the 117-target `--workspace --no-fail-fast` sweep
with zero failures anywhere, `m4_acceptance` running all 171 inside it.
**The marker is left in place.** It is foreign, isolating is sufficient,
and deleting it is not this lane's call. Recorded with the constraint
that matters: the isolated `TMPDIR` must be outside `/tmp` AND outside
every git worktree, because a child of `/tmp` is not isolated ---
`/tmp/.git` is still its ancestor.
**One hazard this cost a round, worth the bullet it gets.** A libtest
filter that matches nothing prints `0 passed; 0 failed; N filtered out`
and exits ZERO. This shell is zsh, which does not word-split unquoted
parameter expansions, so `NAMES="a b"; cargo test -- $NAMES` passes one
argument, matches no test, and reports green. The contaminated leg
"passed" that way and briefly looked like the hypothesis collapsing.
The fix is to read the `running N tests` line, which is the only place
a filter's actual reach is stated --- the same family as the
`feature-census` trap already recorded two bullets above, and the same
lesson as "a probe must fail loudly".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Three documents, one finding each.
**`docs/gui-stage1-input-framing.md` -> revision 10.** Revision 9 is the
approved design and revision 10 changes none of it. It records ONE scope
correction that could not be seen from the design: P1 has a second
structural exception, for the keyboard family alone, and it is winit's
rather than this seam's. `KeyEvent` carries a `pub(crate)
platform_specific` field, so no `WindowEvent::KeyboardInput` can be
constructed outside winit. Bounded three ways rather than accepted
whole --- it does not reach the pointer families (`DeviceId::dummy()`
exists for exactly this, checked BEFORE writing the exception down), the
family's only decision is factored into `route_key_action` and witnessed
directly, and what stays uncovered is one pattern arm with no logic.
Also records that P3 is now MEASURED: deleting the whole delegation
leaves all 256 `pmacs-gpu` tests green, not merely the 13 new rows.
**`docs/active-work.md`** --- the lane moves to IMPLEMENTED with the
four commits, the shape, the verbatim-move method, and the gate result.
**`docs/agent-handoff.md`** --- the stray-marker hazard gains what this
run earned: `scripts/gate` DOES NOT ISOLATE `TMPDIR`. It isolates the
target directory and five ambient roots, so `tempfile::tempdir()` still
lands under whatever `/tmp` happens to contain, and the hazard therefore
reproduces INSIDE a gate run --- which is how it surfaced here, on a
lane that touches only `pmacs-gpu/src/main.rs`. The bullet now carries
the discriminating command pair (`TMPDIR=/tmp` 0/2 versus a marker-free
root 2/2) rather than only the narrative, because a rerun establishes
nothing about this and the pair establishes everything. Isolating
`TMPDIR` is assigned to the gate lane, not to whichever feature PR trips
over it next.
One code change rides along: `EventOutcome`'s doc comment said
`event_loop.exit()` is called in "exactly one place", which is true of
the function and false of the call sites --- there are two, both inside
`window_event`. Stated precisely now, since the whole point of the
sentence is that a reader can check it by grep.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The last four arms --- `CursorMoved`, `MouseInput` twice, `MouseWheel`
--- move to `apply_cursor_moved` / `apply_left_button` /
`apply_right_press` / `apply_wheel`. `window_event` is now 33 lines
against 655: one `route_event` call and one arm per route. The seam is
complete.
THE BUTTON DISCRIMINATION WAS THE FIND. It lived in the shape and order
of two overlapping `MouseInput` arms --- left in either state, right in
the pressed state only --- with everything else falling through a
wildcard several hundred lines below. The asymmetry is real and
deliberate (a context menu opens on the press; its release means
nothing), but it was an artefact of arm order rather than a stated
decision. `PointerRoute` names all four cases and both witnesses and
mutations now bear on them.
`UnusedButton` follows the keyboard family's `Release`: a middle /
back / forward / other button, and a right-button release, are CLAIMED
BY THE POINTER FAMILY AND DROPPED rather than left unrouted. Same
behaviour as the wildcard they used to reach, and Stage 1b's B4
(middle-click PRIMARY paste on Linux) lands on exactly this route.
The wheel delta is carried RAW. Converting it to lines needs the code
line height, which is `State`'s to know, so the router must not try ---
and the witness drives both `LineDelta` and `PixelDelta` to pin that.
All four bodies verified as the original arm bodies rustfmt-normalised,
by re-running rustfmt on the pre-move text at the new indent level and
diffing. `apply_cursor_moved` additionally renames `position.x`/`.y` to
`x`/`y`, 6 and 9 occurrences, counted.
Evidence --- 13 rows, 6 further mutations:
M12 right button claimed in both states -> the right-button row
M13 left button claimed only on press -> the left-button row
M14 CursorMoved axes swapped -> the cursor row (+ transcript)
M15 unused button falls through -> unused + right rows (+ transcript)
M16 harness records outbound only -> the transcript row ALONE
M17 wheel delta zeroed -> the wheel row ALONE
P3 RE-DEMONSTRATED AGAINST THE FINAL SHAPE, AND AGAINST THE WHOLE
SUITE. Replacing `window_event`'s entire body with `let _ =
(event_loop, event);` --- a GUI that responds to no input at all ---
leaves ALL 256 `pmacs-gpu` tests green, not merely the 13 routing rows.
That is the accepted structural exception measured rather than
asserted: no headless test anywhere in this crate observes the
delegation, because `ActiveEventLoop` cannot exist outside a live event
loop.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The 194-line arm moves to `App::apply_keyboard`, verified byte-identical
against `HEAD~1` modulo exactly two named conversions: the press guard
becomes the router's decision, and `event_loop.exit()` becomes a
returned `EventOutcome::Exit`.
THE OUTCOME RETURN IS THE LOAD-BEARING PART. The keyboard arm was the
second caller of `event_loop.exit()` --- an idle Escape is a local quit
--- so a body that owned the exit would have needed an
`&ActiveEventLoop`, and `ActiveEventLoop` is exactly what cannot exist
in a test. Returning the decision keeps `event_loop.exit()` in one
place, `window_event`, and leaves every body reachable in principle.
Both call sites are now inside `window_event` and nowhere else, which
is checkable by grep. Stage 1a's A4 deletes the Escape branch, at which
point `EventOutcome` has one variant and should go; the branch carries
a comment saying so.
A SECOND ACCEPTED STRUCTURAL EXCEPTION, ALONGSIDE P3, and it is winit's
rather than this seam's: `KeyEvent` carries a `pub(crate)
platform_specific` field, so NO `WindowEvent::KeyboardInput` CAN BE
CONSTRUCTED OUTSIDE WINIT and no headless test can feed one. Checked in
winit-0.30.13/src/event.rs, not assumed.
The response is to shrink what the exception covers rather than to
accept it whole. The family's only real decision --- press acted on,
release claimed and discarded --- is factored into
`route_key_action(ElementState) -> KeyAction`, which takes a
constructible argument and is tested directly. What stays unwitnessed
is one pattern arm containing a match and a call, with no logic in it.
The exception does NOT extend to the pointer families: winit provides
`DeviceId::dummy()` for exactly this purpose ("useful for unit
testing") and `CursorMoved`/`MouseInput`/`MouseWheel` are constructible.
Checked before writing the exception down, so its scope is measured.
`Release` is a route and not a `None`. The family CLAIMS a key-up and
drops it, which is a different fact from no family claiming the event;
collapsing them would hide the drop the moment a slice wants key-up
semantics. `window_event` merges the two arms because both are today
nothing to do, and says so.
Evidence --- 8 rows, 3 further mutations, each failing exactly one row:
M9 a release treated as a press -> the key-action row
M10 a press treated as a release -> the key-action row
M11 harness records outbound only -> the transcript row
`route_one` deliberately calls `route_event` and not the harness, so
the transcript row stays P2's sole owner and M11 stays surgical.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The second of the two arms with no outbound traffic. `RedrawRequested`
joins the lifecycle family and its body moves to `App::apply_redraw`.
This is the arm P2 was written for. With `CloseRequested` it makes the
pair a harness built on protocol traffic could not see at all: neither
one sends the daemon a byte, so "did this arm get handled?" has no
answer in a transcript of daemon traffic. The transcript row now drives
five events of which two are silent.
The lifecycle family's criterion is stated properly here rather than
left as the accident of which three arms happened to be smallest:
events about the WINDOW ITSELF --- closing, resizing, repainting ---
as against a gesture aimed into the document. `ModifiersChanged` is the
one exception and is documented as one, since it is a bare state
mutation with no gesture of its own and no body to extract.
Evidence --- 7 rows, 2 further mutations:
M7 `RedrawRequested` -> no family -> the redraw row (+ transcript)
M8 harness records outbound only -> the transcript row ALONE
M8 is M4 re-run now that a second silent arm exists: the mutation
discards both `Exit` and `Redraw` and keeps only the resize, and still
fails exactly one row, because the per-variant rows assert `feed`'s
return value and the transcript row alone owns P2.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
GUI Stage 1-pre. `App::window_event` decided and performed everything
in one 655-line match, and nothing below it could be witnessed without
a display: `ActiveEventLoop` is non-constructible outside a live event
loop, and the arms that matter reach a GPU surface or a socket.
This is the seam, given its shape on the three smallest arms before the
194-line `KeyboardInput` one.
Deciding is `route_event(&WindowEvent) -> Route`, a free function over
the event alone, composing one decision function per family ---
`route_lifecycle` is the first. Performing stays on `App`: the `Resized`
body moves verbatim to `App::apply_resize`.
A route names its LOCAL EFFECT, not merely the family that claims it,
and the harness records routes rather than outbound protocol traffic.
That is deliberate and load-bearing: `CloseRequested` exits and sends
the daemon nothing, so a transcript of daemon traffic alone cannot tell
a handled arm from a dropped one. `RedrawRequested` is the second such
arm and lands next.
The zero-extent clamp moves into the router with the decision. wgpu
rejects a zero-extent surface configuration and a minimize delivers
0x0, so `.max(1)` is a rule rather than defensive padding --- and
deciding it in a pure function is what makes it witnessable with no
surface at all.
No behaviour change. The router is not yet reached for the families
still inline in `window_event`; each subsequent commit moves one, and
when the last goes the match collapses to the router call.
Evidence --- 6 rows, 5 mutations, each failing its own row and no other
beyond a stated dependency:
M1 `CloseRequested` -> no family -> the exit row (+ transcript)
M2 `Resized` -> `Exit` -> both resize rows (+ transcript)
M3 clamp dropped -> the zero-extent row ALONE
M4 harness records outbound only -> the transcript row ALONE
M5 `ModifiersChanged` drops the state -> the modifiers row (+ transcript)
The transcript row is the only one that fails under M4, because the
per-variant rows assert `feed`'s return value; that row alone owns P2,
which is what makes M4 discriminating rather than a blanket failure.
P3 --- that `window_event` DELEGATES rather than deciding for itself
--- is the framing's accepted structural exception, and it was
demonstrated rather than assumed: deleting the whole delegation, which
would leave the GUI unable to close, resize, or track a modifier, left
all six rows green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The obligation this PR owes, discharged before any code lands so the
scope Stage 1 is implementing is the scope both records describe.
Meta/Super forwarding was mapped to Stage 1a. Forwarding it there would
turn platform Command/Super shortcuts into daemon Meta chords BEFORE
capability-aware and local-binding policy exists --- so the OS
reservation currently in the tree is a deliberate, tested decision
rather than an omission, and Stage 1 keeps it.
Both records are amended, not one. The arc's §2.5 mapping table and the
standing backlog's input bullet each claimed Stage 1a, and a mapping
that lives in two files drifts unless both move together --- which is
the failure class the Stage 0 lane spent seven review rounds retiring.
The same row also recorded command/minibuffer chord forwarding as
outstanding when `bc32332` shipped it. Marked shipped rather than left
to imply work that does not exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The framing and the lane are this branch's FIRST commit, which is the
arc's §5 rule for every PR in it and the reason this branch exists
before any code: revision 9 was approved as an untracked file, and an
approved framing that lives in one worktree is not portable.
Revision 9 landed after EIGHT rejected revisions. The through-line of
those rounds is worth carrying: each early draft turned a fresh source
audit into SCOPE LABELS --- "DroppedFile", "translate_key completion",
"no behaviour change" --- and review kept asking the same question,
which is what the label means when someone has to test it. Revision 9 is
a contract/witness/mutation matrix over every numbered clause, split
into CHANGE clauses that fail today and PRESERVATION clauses that pass
and must keep passing.
Several findings only existed because the contracts were written down.
"Send Detach before exit" was unexecutable against an outbox whose
`enqueue` rejects once closed. A one-slot terminal reservation
contradicted the FocusLost-before-Detach ordering two sections above it.
"Terminal result after the commit resolves" was not total over a
pipeline with three legitimate exits that never commit --- a claimed
listener, a cleared handler slot, and the default handler's `open_async`
returning immediately. None of those are visible from a scope label.
This branch is 1-pre ALONE: the input seam, no behaviour change. Its
evidence is a headless routing harness recording routing decisions,
outbound events AND local effects, with production `window_event` as a
thin call-through. P3 is recorded as an accepted structural exception:
a headless test cannot construct `ActiveEventLoop`, so the delegation
itself is a code-review invariant rather than a tested one, and saying
so is better than a mutation that cannot exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The governing pre-PR gates apply to documentation-only branches too.
Replace the reduced fmt-and-diff declaration with the complete suite,
while recording that there is no touched acceptance suite for this lane.
The recovery authority contradicted itself in the direction that
matters: the floor said `9a26ac8` while the operative check said
`e67ad07`, so the stated floor would have ACCEPTED a tree missing
everything since 2026-08-08. Floor and check are now both `e67ad07`.
The exercise claim is corrected rather than quietly inherited. That
paragraph argued its own value --- advancing the base is exactly when
the procedure must be re-run --- and then presented a 2026-08-08 run at
`9a26ac8` as if it covered today's base. It is now marked as the LAST
exercise, with the advance to `e67ad07` recorded as an OUTSTANDING
obligation. What is unverified is the procedure against the new base,
not the SHA.
The grading rule was not total. `Weak` required a non-empty blocker list
and `Partial` named blockers, which left a real state ungraded:
criterion 1 passing, blockers empty, criterion 3 failing or unassessed.
The rule now turns on criterion 1 alone --- pass is `Partial`, fail is
`Weak`, all-pass is `Strong` --- so every usable state is covered by
exactly one grade. Criterion 1 is the right discriminator because it is
the only one measuring the GPU AGAINST THE TUI; the others measure it
against its own goals. Today's grade is unchanged and now derives.
The listview counts were wrong because I used `grep -c`, which counts
comment mentions. Four executable calls in `lsp.lua`, one in `git.lua`
--- not five and four. The claim those numbers support is untouched:
listview is no longer LSP-only.
Two status claims corrected: the lane understated its own commits (15,
actually 16), now stated AS OF a SHA so it cannot rot on the next
commit; and the handoff said "Stage 0 in PR" when no PR exists ---
"ready for PR (not yet opened)".
The inference ruling is recorded where the flags live: they do not block
this docs PR, they must be closed before the table is first enforced as
a gate, 3(c) and 9 can change the deficit set, and 6(c) cannot change
step 6 today but still owes evidentiary closure.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
P1, and the worst of them: the AUTHORITY BLOCK was stale in four ways
while this lane's whole purpose was retiring stale ledger state. The
canonical base said `122b8e8` (actual: `e67ad07`), protocol said
`v6..=v22` (actual: v23, #228), the recovery threshold accepted
`9a26ac8` --- far older than the base above it, so the check it defines
would pass on a tree missing everything since --- and this lane's own
entry named base `0e4c58d` and declared itself PARKED beneath a heading
saying ready-for-PR. A ledger that contradicts itself defeats its own
cross-machine purpose. All four corrected; the park bullet is replaced
by what actually happened.
"Exactly two journey deficits" was stronger than the evidence permits,
and the table said so three paragraphs below itself: GPU 3(c) and 9 are
INFERRED, so a third failure cannot be ruled out. Now "known failures at
two steps; exact set pending verification". GPU 6(c) is inferred too and
is noted as unable to change step 6, which 6(e) already floors.
The product subgrade had criteria but no GRADING RULE --- three closure
conditions distinguish closed from not-closed, which does not derive
`Weak` rather than `Partial` or `Missing`. A rule is now stated, and the
distinction it turns on is worth having: `Partial` would mean the GPU is
merely unfinished; `Weak` means it is BEHIND a frontend shipping in the
same binary. Criterion 3 is marked NOT ASSESSED --- §3.2's register is
seeded empty --- rather than being quietly counted as a pass.
The framing REQUIRED a handoff §6 cross-reference and there was none;
only the Lean 4 numbering note existed. Added, carrying the facts a
cross-machine reader needs first: the product subgrade, the P2 start
gate, and that "Arc 8" means Lean 4.
Three more scorecard-versus-ground-truth drifts, the same class this
lane exists to close: row 14 said listview has 4 call sites "all LSP
panels" (it has 5 in `lsp.lua` and 4 in `git.lua` since #227, so it is
no longer LSP-only); row 15 said "no git integration at all" while §15
records status and diff; and §9's plane table said no builtin opens
`*lsp*`, though `M-x lsp.status` does (`lsp.lua:3533`) --- it has no
BINDING, which is the distinction this document now draws everywhere
else.
Finally, §20 physically placed the arc after Priority 5 while its prose
said after Priority 1. In a *Recommended Priority Order* position is the
schedule, so the block moves to sit directly after P1, and now states
its interleaving with P2-P5 explicitly rather than leaving it to
position alone.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The three remaining Stage 0 items, and the first is the one that
justifies the arc existing.
§16 now carries TWO subgrades. Architectural stays Strong; Product is
Weak. The single grade was true and was answering the wrong question ---
the protocol is excellent AND the GUI is not yet a daily driver, and one
cell could not hold both, so the product half was invisible. That is how
a frontend the reporter would not choose came to sit inside the
healthiest concern in this document.
The product subgrade has criteria, not adjectives: GPU >= local TUI at
every journey step (currently FAILS at 5 and 12, per §2b); the
daily-driver blocker list empty (currently nine); every surviving
divergence declared. The GUI arc is what moves it, and it should be
re-graded when the arc closes, not before. The scorecard row now POINTS
at §16 instead of carrying a grade, which is the "no orphan scorecard
row" ruling from revision 3 --- criteria and ground truth first, pointer
second.
§20 places the arc: Half A after Priority 1, with reaching Stage 4b as a
P2 START GATE. No later GUI stage begins until P2 has an approved
framing and an opened lane; the gate is on STARTING P2, not finishing
it, so the arc is never blocked on work nobody has begun and cannot
outrun the model it depends on.
Arc 8 retires as a GUI label (Q#GA4). "Arc 8" now unambiguously means
the LEAN 4 arc, which is the numbering that stays; the roadmap's "Arc 8
--- GPU structural parity" scope is Half B of the GUI arc, which is a
name and not a number. Recorded in `docs/agent-handoff.md` beside the
Lean 4 entry too, because that is where a cross-machine reader meets the
number first. Landed framings that say "Arc 8 adjacent" keep their text
--- they are dated records, and this is the disambiguation for anything
written from here on.
Also swept while in §16: its ground truth still said
`SUPPORTED=[6..=21]`. Same stale-range class as the scorecard row fixed
earlier in this lane, one section deeper, and found only because the
subgrade work required reading the section rather than the row.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Purpose and the activity indicator SHIPPED; accountable owner and
hierarchy did NOT. Six sites still described the world before #232 and
are rewritten together rather than one at a time.
Scorecard row 5 said workers "lack owner/purpose/hierarchy and any
indicator"; row 9 graded "Mechanism without identity" on the same
premise. §5's prose said the activity indicator is absent. §9's identity
layer said `PendingJob` has "No purpose string" --- while `purpose:
String` is non-optional at src/async_runtime.rs:429, enforced by
`JobSpec` having no `Default`, so a dispatcher that omits it does not
compile. Presence is a TYPE OBLIGATION now, not a convention, and that
is the fact the old wording inverted.
§9's grade moves to "Mechanism with purpose, without ownership" ---
evidence-backed per §25, not aspirational. The distinction that survives
is recorded where the grade lives: a purpose says what a job is DOING;
ownership says WHO ASKED. #232 shipped no `owner` deliberately, because
populated from static per-subsystem constants it would have been an
ORIGIN and would have misattributed third-party work to a builtin.
Two consequential residuals the same sweep found: the §9 conclusion
still called purpose a PREREQUISITE for the unified view, and §20's
priority item 5 still listed purpose and the indicator as work to do.
Both now name only the ownership half, which is what is left.
§25 also applies to a correction I made earlier in this lane. My §9
bullet had APPENDED a retraction beneath the fact it corrected ("this
bullet previously read…"), which is exactly the log-shaped growth §25
forbids: prune superseded facts, this is a briefing. Pruned. The
retractions in `docs/ci-red-signatures.md` and in the SUPERSEDED journey
table stay --- that file is an occurrence ledger by design, and that
table is explicitly historical, so §25's briefing rule does not reach
either.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The previous commit claimed to sweep this class. It grepped
`M-x-only|advertised|undiscoverable|no binding` --- the phrasings
already seen --- and therefore could not find "no key to reach them",
"no key reaches any of this", or "no keybinding of its own". Sweeping
for the WORDING rather than for the CONCEPT is the same mistake as
matching a CI signature on its byte count: it finds recurrences of what
already happened and nothing else.
Re-swept on `no key|keybinding|key to reach|bound to no|unbound`:
:705 and :847 --- the `help.*` family. Both said no key reaches it. The
family IS advertised: the welcome names `M-x help`, which indexes it.
What it lacks is a DIRECT binding, and it lacks that BY DESIGN pending
the help-prefix decision --- which the second site already said two
lines later while its own first clause contradicted it.
:1207 --- `*workers*` "has no keybinding of its own". Mine, written
before the opens-it distinction existed, and missed when the other five
sites were corrected because it used a sixth phrasing.
Two survivors are correct and stay: the help family "stays unbound by
design", which is now qualified by the advertised route; and the context
menu's "no keyboard path IN", which is already the opens-it distinction
stated precisely.
The retraction note in §4 is moved after the complete beginner
inventory sentence. It had been inserted mid-sentence, splitting
"menus △" from "(right-click only, 11 items)" --- a correction that
damaged the text it was correcting.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Three review rounds have each surfaced one more instance of the same
false claim, so this commit greps the class rather than fixing the site
that was reported.
§4's beginner inventory carried THREE, in a single bullet: "neither is
advertised anywhere but the keymap", "terminal ✓ but M-x-only", and
"build ✓ but M-x-only with empty prompt". All three are false. `C-x C-f`
and `C-c t` and `C-c c` are in the welcome's key table DIRECTLY, `C-x d`
is advertised transitively, and the build prompt is prefilled from the
detected project kind. Every one was answered by the welcome buffer and
by those two bindings --- the same fixes the paragraph after §2's audit
quote already records as landed. They survived because a level-by-level
inventory was never re-run against them, which is the failure mode this
document is otherwise good at naming.
A fourth was MINE. The superseded table's step 11 row said `*workers*`
has "no keybinding"; I wrote that two commits ago, before the
route/binding/opens-it distinction existed, and it did not get corrected
when the other four sites did. Now: no binding that OPENS it, with
`C-c C-k` noted as working buffer-locally once inside.
One "M-x-only" is left standing because it is TRUE: project.search has
no binding that invokes it. Its `RET`/`n`/`p` bindings are buffer-local
inside the results buffer --- exactly the inside-versus-opens shape that
`*workers*` has, checked rather than assumed while sweeping.
The pattern across all seven sites is one thing: "advertised" had no
definition in this document until §2b needed one, so nothing could be
measured against it and every claim about it drifted. Defining the term
is what made them findable, and the first act of a checkable claim is to
fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Step 7's evidence said `M-.`/`M-?`/`C-c o` are "advertised nowhere".
Under the transitive-help contract this document now states explicitly,
that is false: being BOUND, they are named by `help.list-keybindings`,
which the welcome's advertised `M-x help` reaches --- which is exactly
why §2b grades step 7 `Works`. Corrected in place; the historical
verdict beside it stands, per the rule that a historical grade may
remain while a false statement about the tree may not.
A second instance was found while fixing the first, in the onboarding
dependency list: "find a file --- the mechanism is fixed since #162/#165
but is advertised nowhere except the keymap". False at BOTH levels ---
`C-x C-f` is in the welcome's key table directly, not only transitively.
That clause has been wrong since the welcome shipped and survived every
pass over this file, including four of my own this session, because
nobody was grading against it. The transitive contract is what makes
these findable at all: before it, "advertised" had no definition to be
wrong about.
Both retractions QUOTE the false claim rather than deleting it, the same
way the U9 row does. The wrong sentence is the one a later reader would
otherwise reconstruct, so it is kept visible with its correction
attached.
Still true and left standing in that list: view workers is
undiscoverable --- no binding opens it --- and setting provenance is
unanswerable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
`COHERENCE.md` carried two journey tables disagreeing at five steps ---
4, 6, 7, 10 and 11 --- because §2b regrades by the minimum over declared
subclaims while the older table grades by a prose verdict string. That
is the reading §2a and §2b exist to replace, so the disagreement is
expected; two normative tables in one document are not.
Marked SUPERSEDED rather than re-synced, and the choice is the point.
Re-syncing its verdicts would restore a second source of truth for
grades and guarantee this drift recurs the next time one moves; marking
removes the second source instead. What the table is genuinely good for
--- per-step evidence, what exists, what was measured, which PR changed
it --- is exactly what §2b's cells cite and do not restate, so it is
kept.
The distinction that governs what may stay: A HISTORICAL GRADE MAY
STAND; A FALSE STATEMENT ABOUT THE TREE MAY NOT. "Kept for its
evidence" licenses the first only.
Step 8 was the second kind and is corrected in place. It claimed there
is "no close/kill command", which is false --- `M-x buffer.kill-this` is
global (builtin/commands/default.lua:1209) and killing a terminal buffer
prunes the session and reaps the owned process
(tests/vterm_stage1_acceptance.rs:336). That claim is also where this
lane's own earlier 8(c) grade came from: the table asserted a missing
command, the grade inherited it, and neither had checked. Both are now
fixed against the same two citations.
The audit quotation about the original three missing bindings stays
unchanged --- it is a dated observation whose answer is already recorded
in the paragraph beneath it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
"`*workers*` has no binding at all" was false. The view carries a
buffer-local `C-c C-k` for `workers.cancel-at-point`
(`builtin/runtime/async.lua`, documented at `docs/keybindings.md:282`).
Corrected at all four sites it had spread to: the table row, the
contract paragraph, the summary, and the framing's historical example.
The absent thing is narrower and is now said precisely: NO BINDING
OPENS `editor.list-workers`. A binding that only works once you are
already inside the view cannot satisfy a discoverability subclaim ---
which is the same shape as the route-versus-binding distinction the
previous commit drew, one level further in. A route reaches the view
but is not a binding; `C-c C-k` is a binding but does not reach it.
11(c) asks for the conjunction, and neither half alone supplies it.
The Missing grade is unchanged, and so is the two-step GPU deficit. What
changes is that the row now states a fact about the tree rather than an
overstatement that happened to point at the right grade --- which is the
distinction this table exists to hold, since a grade resting on a false
premise is not falsifiable, it is merely unfalsified.
Left alone deliberately: the audit quote at COHERENCE.md:562, where
"no bindings at all" refers to opening a file, opening a terminal and
running a build. That is a historical observation about OTHER commands,
and the paragraph immediately below it already records that all three
were answered.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Three findings, one of which is a retraction.
GPU 3(c) is inferred again, in BOTH halves. The previous commit called
its rendering half "verified" on gpu_invocation_acceptance.rs:706. That
test runs `--headless-managed-probe`, which connects, receives and
DECODES a `BufferSnapshot` into text; it never constructs GPU render
state and never calls `render_offscreen` (pmacs-gpu/src/main.rs:1065).
It witnesses delivery and decoding, which is real and is not rendering.
Retracted rather than softened: "verified" was the word doing the
damage, and this file is where a reader goes to find out what has
actually been measured.
The discoverability contract said the four welcome key entries decide
every discoverability grade --- while the table two paragraphs below it
graded steps 4 and 7 on welcome PROSE and on the help graph. A standard
cannot carry both. The contract now states what it actually applies:
advertisement includes the welcome's prose (`M-x`, `M-x help` at
welcome.lua:61) and is TRANSITIVE through the help graph, which is how
`help.list-keybindings` carries browse and symbol.
That transitivity forced the distinction 11(c) was already resting on
without saying so: a BINDING is a stronger claim than a ROUTE. Step 7
passes because its commands are bound and a listing names them; step 11
fails because `*workers*` has no binding for any listing to name. So the
summary's "no advertised route at all" was FALSE --- the route is
`M-x help` -> `help.list-commands` -> `editor.list-workers` --- and the
Missing grade survives on the binding, exactly as 11(c) is worded.
The framing's worked examples are marked HISTORICAL, with COHERENCE.md
§2b named authoritative. A framing and the standard it serves were
handing a reader two different grades for step 7. Both examples keep
their point: the head-grade rule would have graded BOTH `Works`, which
is what makes it unsound. Step 7 moving on better evidence is the system
working; step 11 not moving is the defect surviving contact with it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Every citation in the review was checked before the grade moved, and
three of them overturn a grade this table argued for.
4 -> Works. The welcome's FIRST LINE is "M-x runs any command; M-x help
lists the keys" (welcome.lua:61). The previous grade rested on an
"exact advertised set" of four entries --- read off the key table while
ignoring the prose directly above it. A discoverability subclaim graded
against a partial reading of the very file that answers it.
7 -> Works, under the wording as published. The advertised `M-x help`
route reaches `help.list-keybindings`, which lists every registered
binding --- asserted over every sequence at discovery_acceptance.rs:208
--- so browse and symbol are advertised transitively. The alternative
reading is recorded rather than silently discarded: if 7(d) means DIRECT
advertisement, it must say so, and the framing's own worked example then
forces Missing, never Partial.
8 -> Works. `M-x buffer.kill-this` is a global command
(default.lua:1209), and killing a terminal buffer prunes the session and
reaps the process (vterm_stage1_acceptance.rs:336). 8(c) never asked for
a terminal-specific command; the previous grade invented that
requirement and then failed the tree against it.
10 -> Works. "Gated on step 6 or 9" is a DEPENDENCY, not one of
10(a-c), and §2a's own membership rule forbids an annotation from
lowering a grade. The previous row let it do exactly that, two commits
after publishing the rule against it.
6 and 11 -> Missing, and this is the aggregation rule finally being
stated instead of assumed. A subclaim naming a conjunction is graded by
the same minimum as a step: an ABSENT member makes it Missing, not
degraded. 6(e)'s later-crash half is absent; 11(c) has no binding at
all. Both were Partial because a conjunction was treated as one
degradable atom --- which would make the ordinal mean one thing at the
subclaim level and another at the step level.
The headline is unchanged: GPU trails local TUI at exactly steps 5 and
12. It survived a round that moved half the rows, which is some evidence
it is a property of the tree rather than of the grader.
The table's other finding is now visible: the journey's two WORST steps
are frontend-independent. Steps 6 and 11 are Missing in all three
columns --- language intelligence dies silently after a crash, and
background work has no advertised route at all. Neither is GUI work,
and both were previously carried as Partial, which is how they stayed
off the critical path.
The GPU 3(c) inference flag is narrowed: rendering is VERIFIED at
gpu_invocation_acceptance.rs:706. Only browsing interaction is inferred.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
11(b) first: "what originated it" would have PASSED on #232, which
exposes handler origin through the dispatch-name ambient. That lane's
own framing refused to call origin ownership --- populated from static
constants it misattributes third-party work to a builtin --- so the
loose wording would have let §9's central gap vanish from the grade.
Now: purpose AND accountable owner, not kind or dispatcher, across
jobs, processes, servers and terminals. "Each job" had quietly excluded
three of the four disjoint planes.
Then the table. Every discoverability subclaim turned out to be decided
by one file: `welcome.lua` advertises exactly `C-x C-f`, `C-c t`,
`C-c c`, `C-x b`. So 8(d) and 9(d) PASS on advertisement rather than on
a bare binding, while 4(c), 7(d) and 11(c) fail --- help, browse,
symbol and `*workers*` are all reachable and none is advertised.
The result is narrower than the report that opened this arc, and
falsifiable. Closure condition 2 fails at EXACTLY TWO steps: GPU is
below local TUI at step 5 (Partial vs Works, no IME) and step 12
(Missing vs Partial, restore is a structural no-op). Every other cell
is equal --- including the six Partials the GPU merely shares.
The attached column earns its place at precisely those two rows, and
they point opposite ways. Step 12 fails on attached TUI AND GPU, so it
is a daemon-boundary gap no GPU work can close, which is why Stage 4b
is P2-gated. Step 5 fails on GPU alone, so it is frontend-local and
Stage 1d closes it. One merged TUI column would have shown two red
cells and no way to tell those apart --- the argument for three columns,
now demonstrated rather than asserted.
Two cells moved for reasons worth naming. Step 6 grades Partial and not
Missing because startup failure DOES surface; only a later crash is
silent, so 6(e) is degraded rather than absent. Step 11 grades Partial
because the view is reachable by `M-x` --- unadvertised, not missing.
Three GPU cells rest on inference rather than on the 4bc55e8 audit ---
3(c), 9 and 6(c) --- and are marked as needing verification before this
table is used as a release gate, rather than being quietly graded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
All six change what the table will be able to say, so they land before
any cell is graded rather than after.
5(d) loses its performance half. "Large files stay usable" was
performance wearing a correctness coat; the long-lines arc's defect is
UNREACHABLE TEXT, so the subclaim is now that an overlong line's full
contents are reachable by wrapping or horizontal navigation. Its 100 MB
timing witness stays a separate performance gate.
7(d) said "bound or advertised", which contradicts the framing's own
worked example: `M-.` IS bound and is nevertheless graded
undiscoverable. Advertised in-product, not merely bound.
9 gains discoverability, because §2's own criteria list already says
"Build or test command discoverable" thirty lines above this table ---
the subclaim was missing from the list while the requirement sat in the
section's prose, which is the same tested-vs-exercised split in
documentation form. `C-c c` is what was bound to satisfy it. 9(a) also
sharpens to "in the opened project's context", so a build that runs in
an unrelated cwd cannot pass.
6 gains (e): failure is visible and actionable, covering BOTH startup
failure and a later crash. Post-start server death is the defect
currently responsible for this step's Partial verdict, and the subclaim
list omitted it entirely --- `server_is_live` is consulted to SKIP work,
not to report it.
11 is retitled to the journey's own words, "Understand what background
work is running". "See background work" was my paraphrase and it was
weaker than the thing being graded. Its detailed-view subclaim now
requires each job's purpose AND what originated it, so §9's central
attribution gap cannot vanish from the grade --- #232 shipped purpose;
ownership is still missing, and that distinction is exactly what this
step must be able to express.
The membership rule narrows to "any defect cited as the reason a cell is
below Works must be a subclaim". The previous "anything named as a
defect" swept in limitations the section explicitly excludes --- no
package manager, no tutorial --- and so contradicted its own exclusions.
3(c) stands, with a note that it requires a browsable directory SURFACE
and that dired is its evidence rather than its definition: a subclaim
naming the implementation would grade the mechanism instead of the
journey. Step 8's addition and the 12(c) worked example stand unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
§3.3 of the arc framing requires the per-frontend table to grade each
cell as the MINIMUM over that step's required subclaims, and requires
the subclaim list to be published: a grade whose subclaims are unstated
is not falsifiable, which is the whole objection that section answers.
This commit is the list ALONE. No cell is graded yet, deliberately ---
the subclaims are the part a reader can disagree with by pointing at
something, and every grade inherits their errors. Grading in the same
commit would bury the reviewable half under the arguable one.
Two rules decide membership. Discoverability is a SUBCLAIM wherever it
is the step's substance --- steps 4, 7, 8 and 11 --- because "present
but nobody can find it" is the failure those steps exist to catch, and
the head-grade rule this replaces would have let it become annotation
text with no effect on closure. And anything load-bearing enough to name
as a defect is load-bearing enough to be a subclaim; an annotation
cannot absorb a failing one.
Performance, aesthetics and cross-editor parity are named as NOT
subclaims. Each is real and each is graded elsewhere or nowhere; folding
them in would make every cell a judgement about taste and the ordinal
would stop meaning anything.
Frontend-specific limitations are also excluded, because they are what
the three columns MEASURE --- encoding them in the subclaims would beg
the question the table exists to answer.
Step 12(c) is recorded as the worked example: a required subclaim
everywhere, structurally impossible on any daemon-backed frontend under
Q#DS9, so the GPU cell will fail it by CONSTRUCTION rather than by
omission. The old single-verdict table could not say that --- "Partial"
was doing the work of both "some of this is missing" and "some of this
cannot exist yet".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Rule 4 retires a lane only once its durable facts have reached
`docs/agent-handoff.md`, so that was CHECKED per lane rather than
assumed. Four of the five were already covered --- the `commit_to`
capture-at-request-time lesson (#231), per-worktree gate target dirs
(#225), the `build-crdt` step and the `gpu_invocation` signature
(#228/#229), the v23 frozen-variant lesson (#228). One was NOT:
`texlab` appeared ZERO times in the handoff, so #230's lane could not
be retired yet and its facts are added first --- LaTeX is served by
texlab, its root comes from an upward `.texlabroot` walk verified in
texlab's own source, and `.git` is deliberately excluded because a
repository root is the wrong answer for a multi-file document.
The handoff's Fake LSP mode list was stale in the same breath: it named
four modes when the binary has twenty-eight. Enumerated from the binary
and grouped, because a stale mode list is precisely how a test ends up
covering the shape next to the defect --- which is the failure this
lane has now watched happen twice in the file-watcher work.
Retired: #224, #225, #228's PR-specific block, #230, #231. That is 737
lines of ledger describing work that has shipped.
#228 is the one that is NOT a deletion. Its PR block is retired INTO
the standing Discovery lane, which is rewritten to "Stages 1 and 2
merged; later work remains" --- deleting that lane on the strength of
one merged stage would have dropped four named pieces of open work.
While rewriting it, its first open item turned out to be what Stage 2
actually shipped (richer M-x rows over v23), so it is removed and the
rest renumbered: a completed item sitting in an open list is the same
staleness this commit exists to clear, one level down.
Left deliberately: #229's and #232's lanes, which are already labelled
MERGED accurately. They are Rule 4 candidates but not STALE, and
widening this commit to them would mix "the ledger lied" with "the
ledger is verbose".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Rebased onto e67ad07; the framing commit replayed with no conflict.
Three corrections, each verified against the tree rather than against
this lane's own notes:
COHERENCE.md said `v6..=v21` schema support. The ceiling moved TWICE
since: #221 to v22 for `LineWrapFacts`, #228 to v23 for
`MinibufferPromptRows`. Now v23. The same row's "production attach
remains v20" is correct --- `ADVERTISED_PROTOCOL_VERSION` is 20 --- and
is deliberately left alone.
Journey step 11 read "Works but undiscoverable --- no statusline
spinner/progress indicator anywhere". #232 shipped exactly that
indicator on 2026-08-09, so the row went stale the day it landed. Now
Partial, with what actually exists and what does not: the indicator is
there, the `*workers*` view still has no keybinding.
§9's "No progress indicator exists anywhere" carried the grep that was
the evidence for opening worker identity in the first place. Corrected,
with the part that did NOT change stated as plainly: a purpose says
what a job is doing, never who asked, and attribution is what §9
grades. THE SECTION'S GRADE IS LEFT UNTOUCHED pending a re-audit ---
moving a grade is an audit act, not a documentation correction, and
Stage 0 is docs-only.
U9's row claimed "whatever this is, it is not the tree" about a
same-tree green. This file's own rerun rule forbids that: a same-tree
green establishes intermittence only, and a tree can raise an
intermittent failure RATE without making it deterministic. Replaced
with "not deterministic on this tree; causation and rate effect
unresolved", and the wrong claim is quoted rather than deleted, because
it is the one a later reader would otherwise reach for.
Also corrects this lane's own earlier claim that `add0ba1` had done
half of Stage 0's absorption. It absorbed #227 and #234; five stale
lanes and both COHERENCE corrections remained.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Opens the GUI arc. The framing and the lane are this branch's FIRST
commit, which is both the arc's own rule for every PR in it and the
reason this branch exists today rather than after #227: the document
spent two review rounds as an untracked file in one worktree, and
uncommitted work does not travel between machines.
Revision 3 closed two blocking findings from the second round.
The closure comparison is falsifiable now. Revision 2 ordered its
grades but never said how a cell acquires one, and its "normalize to
the head grade" rule mis-graded exactly the rows it was written for:
journey steps 7 and 11 both read "works but undiscoverable" and would
both have graded `Works`, with the undiscoverability demoted to prose
that cannot block closure --- while discoverability IS the substance of
steps 4, 7 and 11. Grades now have observable criteria, a compound step
takes the minimum over declared subclaims, and the table carries three
columns (local TUI, attached TUI, GPU) compared against the local TUI.
Half B's dependency graph was inverted. Viewport facts are ABOUT a
window, and whether a semantic window is a daemon projection or a
frontend-local object is what the model stage decides --- so the facts
cannot be designed first. Revision 2 also had a framing-only stage
handing the sidebar geometry no stage shipped. The order is now model
framing, then the viewport/identity substrate, then splits plus
IMPLEMENTED side geometry, then the sidebar.
Q#GA4 through Q#GA12 are ruled and closed.
Four claims this revision inherited were wrong and are corrected with
their sources rather than quietly dropped: the daemon has always
emitted `InstanceSignal::Bell` (daemon.rs:1373), so Bell is
consumer-only; the GPU NEVER consumes daemon `view_top`, which the
backlog states in as many words; Q#DS9 scopes save AND restore, so
Stage 4b owns both; and the protocol ceiling is v23, not v22 --- #228
raised it after #221, and revisions 2 and 3 both read the range at the
audit anchor without re-reading it afterwards.
The three-column claim is narrowed to what it can support. The attached
TUI handshakes `semantic_render: false` and never consumes the
SemanticFrame family, so a shared GPU/attached gap cannot implicate the
semantic wire. The columns separate local from daemon-attached, and
attached-grid from semantic; source tracing still assigns ownership.
Q#GA6's citation is corrected to the one site that matters: local and
attached document events converge on the document handler, whose only
wheel arms are Up/Down at editor.rs:3189. The sites revision 3 cited
were terminal-content paths.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The arc completed at 122b8e8, so per rule 4 the lane comes out of the
ledger: durable facts move to the handoff section-1 arc bullet (the
pool-thread cost of sleep jobs, the loops-that-never-run cancellation
lesson, the group state machine and its double-enforced retirement,
the server-owned scan root with its reachable deterministic fallback,
the core-count-assumption CI lesson and the taskset rehearsal, probe
and witness-bound discipline, the stray-marker re-rooting hazard, and
the deliberately unbuilt kernel-notification option). The handoff
anchor and the canonical-base line move to 122b8e8.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The four-blockers bullet kept its own copy of the round-one claim that
round two disproved; both copies now point at the manual-spawn
adoption path. The facts-list heading no longer counts itself.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review round three on PR #235, plus the diagnosis of its first CI run:
all five test legs failed on one test, deterministically, while
sixteen local cores stayed green.
The mid-walk cancellation bound could not bite the per-entry poll
alone. The cancel lands two files into a 41-file directory --- root
contributes three dir entries --- so with the per-entry poll deleted
the directory finishes and the per-DIRECTORY poll catches at seen ==
44, under the old bound of 60. The bound is now 40 against an expected
exactly-35 (3 + one 32-entry poll stride), and the entry-poll-only
bite goes red at 44. Verified both ways.
The retirement helper observed a REQUEST, not settlement: it returned
as soon as an active row showed cancel_requested, which a worker that
ignored the token and completed successfully would satisfy. It now
waits for a completed row with status == "cancelled", making the
lane's "settles cancelled" claim true at the witness, not just at the
Rust layer.
The CI red: d3_pump(1600) between the mid-walk join and the late.bbb
write assumed the held walk would complete within 1.6 s. On a 3-thread
CI pool, 8 sleeps of 1200 ms drain in ~3.6 s of waves, so the file
landed before the held walk even STARTED and folded into the joiner's
baseline --- exactly the fold the test exists to assert for mid.bbb,
applied to the wrong file. Deterministic on every 2-4-core runner,
invisible on 16 cores. The drain is now an observable condition ---
at least one post-join walk completed and none active --- with the
saturation sleeps at 800 ms, and the three saturation tests plus the
whole eighteen-test family re-run green under taskset -c 0-3, the CI
pool shape reproduced locally.
A fixed-duration pump against pool-dependent timing is a core-count
assumption in disguise; the lane records it as such.
Superseded round-one text in the lane (the fallback "unreachability"
claim round two disproved) is corrected in place.
One gate run also hit the live attach-retry BrokenPipe row --- fourth
occurrence, all three required fragments verified against the durable
sweep log, recorded in docs/ci-red-signatures.md. This lane touches no
pmacs-gpu code, no wire, and no protocol; the same sweep passed twice
earlier the same day on materially the same tree. The retirement bar
(mechanism, not rate) is unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implements docs/lsp-file-watch-d3-framing.md revision 4, approved
2026-08-11 with the four rulings adopted as proposed: the honest bar
(absent at idle, one attributable job per concurrently due group), no
exclusions by default, server root_uri -> cwd -> attachment fallback,
and constants rather than config keys.
pmacs.fs.walk_tree: the whole recursive tree as ONE cancellable job
(JobKind::FsWalkTree, reply reuses ReplyKind::ReadDir --- identical
payload shape, so the Lua boundary needs no second conversion). Names
are base-relative; symlinks recorded, never traversed; an unreadable
subdirectory skips its subtree (scan_tree's pcall behaviour); only the
root failing to open fails the walk; the cancel token is polled once
per directory. Eight Rust unit tests, including flat-directory entry
parity with read_dir_blocking and the two review-round cancellation
cases (empty-tree pre-cancel; mid-walk via the cfg(test) entry hook).
The watcher itself is rewritten as the framed group scheduler. No
sleeps anywhere: one process.after-tick subscription (installed once
and guarded --- pmacs.hook.remove does not exist) drives every
(server, base) group's deadline off monotonic_ms, autosave's Q#AS2
idiom. The old design held one pool thread per sleeping watcher and
allocated 1 sleep + D read_dir jobs per watcher per tick --- 1,326
per tick for rust-analyzer's six watchers on this 220-directory
checkout. At idle there is now NO running job, which is also the
strongest witness in the suite: activity_summary settles to None, and
that assertion is unwritable under the old design.
The scheduler is the framing's state machine, all three review rounds
included: single-flight per group with generation-checked completions;
deadlines advanced from completion; the round-3 three-arm completion
partition (success / stale-or-retired / live non-success, with the
failure latch and quiet cancellation); joins wake the group, queue
exactly one follow-up mid-walk, and never reset the backoff curve;
per-watcher baselines --- the first snapshot whose WALK STARTED after
the join; membership captured at scan start; per-member cancellation
recheck at emit through the preserved _after_scan_for_tests seam;
backoff 250ms x2 to a 4s cap, reset by any emitted change; retirement
cancels the in-flight walk cooperatively.
Verification: eighteen acceptance tests. The six #234 tests are
byte-unchanged and green. Ten witnesses cover the framing's plan (the
review rounds added the fallback-determinism and root-boundary pair,
making twelve):
idle absence (and never a sleep purpose), one walk job per scan on a
twelve-directory fixture, join-wakes plus the registration epoch,
queued baseline for a mid-walk join (driven by saturating the worker
pool so the walk genuinely queues), single-flight under a withheld
completion pump, retirement and rebaseline through the fake's
unregister/re-register triggers, live cancel via pmacs._async._cancel
on the queued job, live failure with the once-per-error latch and the
preserved-snapshot recovery (DELETED for the pre-failure file is only
derivable from the retained snapshot), backoff shape from seam
timestamps, and the configured-root base.
Every witness was mutation-tested. Two findings from the bites:
- Retirement is DOUBLE-ENFORCED (unregister path and post-scan sweep)
and biting either copy alone is masked by the other; only biting
both goes red. Kept deliberately: the sweep covers seam-cancelled
members, the unregister path covers idle groups whose next deadline
is seconds away.
- The first idle probe was VACUOUS: it read pmacs.async instead of
pmacs._async, errored, and the unwrap_or_default made every sample
read as "absent". The probe now expects rather than defaults, so a
broken probe is a red test, not a green lie.
One environmental fact, recorded in the lane: an empty stray /tmp/.git
(since removed) made project detection root every markerless tempdir
fixture at /tmp, which under Q#D3-3 the watcher then faithfully
watched. A markerless-fixture red that looks like a watcher bug may be
an ancestor marker.
A pre-commit review round found four blockers, all fixed here:
- walk_tree checked cancellation only inside its entry loops, which an
EMPTY tree never enters --- a pre-cancelled queued walk returned an
empty SUCCESS, which the success arm would commit and diff into a
deletion storm. Cancellation is now checked before opening and
before returning, cancellation outranks a missing-root error, and a
unit test pins both.
- The neither-root-nor-cwd attachment fallback was still pairs-order
nondeterministic --- the exact accident D3 set out to remove, behind
a comment claiming otherwise. It now takes the lexicographically
smallest attachment directory. Verified at the spawn sites: every
server spawned with an attached file gets cwd = root, so the arm is
defensive and unreachable through production spawning --- which is
also why it carries no through-the-server witness.
- A base at the filesystem root joined as //path (and file:////path in
URIs). Both join sites now go through join_under, the root-aware
idiom dired's handler already uses, and the dir-of capture for a
root-level file ("" from the match) normalizes to "/".
- The walk-count and scan-times probes defaulted on error, so two
broken probes could compare equal and pass the retirement witness.
Every probe now expects --- a broken probe is a red test, the same
correction the vacuous idle probe forced.
A second pre-commit round found three more, all fixed here:
- Mid-walk cancellation was UNWITNESSED: both Rust cancel tests
pre-cancelled and the acceptance test cancelled a queued walk, so
deleting the internal polls left every test green. A cfg(test)
entry hook now flips the token at an exact entry boundary and the
witness asserts the walk stopped NEAR it (bound on entries
processed), which is what discriminates the polls from the
entry/exit checks. The retirement witness now holds a walk in
flight across the unregister and asserts the job settles cancelled.
- The "unreachable fallback" claim was WRONG: pmacs.lsp.spawn may
omit both cwd and root_uri, and ensure_server adopts such a live
server for markerless files (root_uri and key_uri both nil). The
lexicographic-minimum fallback now has a through-the-server
witness: five sibling directories, the minimum opened last ---
five, because with two the build's hash order coincided with the
lexicographic answer and the first-pairs bite survived.
- The root-boundary joins gained a witness through exported
production functions (the _deliver_status pattern): the matcher and
URI builder driven at base "/", where reverting either join_under
call makes the anchored glob refuse //hit and the URI grow a fourth
slash. No fixture can walk / for real.
Verification totals after both rounds: eight walk_tree unit tests,
eighteen acceptance tests (six byte-unchanged, twelve witnesses), all
mutation-verified.
No wire change, no PROTOCOL_VERSION bump; walk_tree is an fs binding.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Revision 4 absorbs review round 3. A live walk cancellation or failure
now has an explicit group-state transition: no snapshot, epoch, or emit;
the prior state and backoff survive; in-flight clears; queued joins run
immediately; otherwise the group reschedules. Distinct failures report
once until a successful scan clears the latch.
Correct the queued-baseline latency bound and add live-cancel and
live-failure witnesses. Record the round in the active-work lane; the
four user rulings still block implementation.
Review round 2: two P1 design gaps and one P2 overclaim, all in the
cadence revision 2 introduced.
A join now wakes the group: next_scan_at pulls to now, an in-flight
walk queues exactly one immediate follow-up, and a baseline is only a
snapshot whose WALK STARTED after the join --- an in-flight walk may
have passed a directory before a pre-join file appeared there, so its
snapshot as a baseline would turn that file into a false CREATED.
Without the wake, a backed-off group folds post-registration files
into the baseline and never reports them; today registration scans
immediately and the coalesced design must not regress that.
The group is now a defined state machine: single-flight per group
(overlap unrepresentable, not avoided), deadlines advanced from
completion (a walk outliving its interval degrades to back-to-back
scans, never overlap), stale completions rejected by generation
(#234 P2 at group scope), and retirement --- last member gone or
server death --- that cooperatively cancels the walk. Cancellation
therefore enters walk_tree contract and tests; polling the cancel
token between directory reads is the established job shape. The
after-tick subscription installs once and guards, because
pmacs.hook.remove does not exist (the P3 gap).
Q#D3-1 restated honestly: groups key on (server, base), so several
can be due on one frame and per-group single-flight still permits N
jobs. The bar offered is absence at idle plus one attributable job
per concurrently due group, with a global scan queue as the
alternative if one-at-a-time must be guaranteed.
Six round-2 witnesses join the plan: join-wakes, no-overlap,
retirement, queued-baseline, plus the round-1 epoch and idle pair.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review round 1 (five findings, four P1) and revision 1 did not survive
it. The findings are recorded in the document; three are cases where
the framing reasoned from the wrong mechanism.
The promised idle state was impossible: pmacs.workers.sleep is a
RUNNING job for its whole duration --- dispatched onto the worker
pool, sleeping in 1ms slices on one of available_parallelism - 1
threads --- and activity_summary counts every running job. A 4s
backoff sleep renders as a constant "sleep 4000ms", and filtering it
would touch the instrument. Revision 2 removes the sleep from the
design: one process.after-tick subscription owns every group's
schedule via monotonic_ms --- autosave's Q#AS2 idiom, whose own
comment names the pool-thread hazard. Waiting now allocates no job
and no thread; the indicator is absent at idle by its None-at-zero
contract, which also becomes the strongest witness in the plan.
The scan root is the server's, not a guess: root_uri then cwd then
the attached-file fallback. project.detect was wrong by the tree's
own testimony --- server rooting honors configured strings and
resolvers first, and texlab's Q#LX2 documents a root that detect can
never produce.
Coalescing gained delivery semantics: shared snapshots, per-watcher
baselines (the first snapshot completed after join), membership
captured at scan start, cancellation rechecked per watcher at emit
(#234's P2 rule, per member). Two epoch witnesses join the plan; the
six existing tests do not cover this and were never claimed to.
Exclusions default to NONE. Any unconditional skip deviates from the
registered glob contract (**/-leading globs can match under .git/,
and a server may register .git/HEAD outright), and walk_tree removes
the job-count economics that made skipping look necessary: 80% of
jobs becomes readdir syscalls inside one job.
Arithmetic corrected to this checkout: D = 220, so 221 jobs per
watcher per tick and 1,326 for rust-analyzer's six --- six of them
pool-thread-holding sleeps. Revised steady state: zero jobs at idle,
one walk_tree job while a scan runs.
Q#D3-1..4 rewritten accordingly; all four still block implementation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Framing and lane update at the branch's first commit, portable during
review. Revision 1 is a DRAFT and no implementation may start from it.
The remainder of issue #233 after #234: the watcher is correct and
still walks everything. The framing re-verifies the cost model at
add0ba1 and adds two facts the issue does not carry:
- On this checkout .git alone is 177 of 220 directories --- over 80%
of every walk --- and the machine does not even have an in-tree
target/ (external CARGO_TARGET_DIR). The issue's 187/46 numbers were
measured with one.
- The string-form base is NONDETERMINISTIC: resolve_watcher takes the
directory of whichever attachment pairs() yields first, so which
tree a bare-string watcher can see depends on table hash order. #234
made matching correct per base; which base is still accidental.
Design space A-E with the trade-offs stated: coalesce per (server,
base); a Rust walk_tree primitive (one job per scan instead of one per
directory --- no new crate, no wire change); an ignore list, with the
target/ staleness hazard named (rust-analyzer's **/*.rs covers
OUT_DIR outputs, so an aggressive default trades churn for staleness
in exactly the server the issue is about); idle backoff; and kernel
notification, deliberately staged separately because A-D are pure wins
it does not obsolete and a new-crate decision deserves its own
framing.
Proposed Stage 1: walk_tree + coalescing + backoff, VCS-only skip
default, project-root base preference. At rest on this repo: from
~1,100 jobs per scan-bound tick to one job every four seconds, named
for its root.
Four rulings block implementation (Q#D3-1..4): the acceptance bar
(one attributable blip at idle, not silence --- silence is Stage 2),
the skip-list default and where it lives (a list-valued setting is
not expressible in today's ConfigValue), the string-form base change,
and knobs vs constants.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The absorption pass after the two merges of 2026-08-11: the LSP
file-watcher fix#234 (ae84d58) and git integration Stage 1 #227
(b867f64), landed in that order so the 2026-08-10 hold on #227 was
discharged rather than overridden.
The handoff anchor moves 9a26ac8 -> b867f64 and lists the ten-merge
first-parent chain between them. Only #227 and #234 are absorbed into
section 1 at this anchor; the eight between keep their facts in their
ledger lanes, several of whose headers still say OPEN --- the anchor
paragraph says so explicitly and repeats the ledger's own rule: trust
the canonical-base line over any lane header.
Both lanes are rewritten to their remainders per rule 4's arc test:
- LSP file watcher: the arc is issue #233 and it stays open until D3
closes it. The lane now carries the D3 start-state --- the walk
still recurses into everything every 250ms, no notify dependency in
the tree, no ignore-list infrastructure to reuse --- and the user's
ruling that D3 is next.
- Git integration: Stage 2 (gutter markers) is the remainder, and the
lane preserves the one scheduling constraint that matters: it needs
new DecorationKind variants, a PROTOCOL_VERSION bump, so it must run
alone. The five-round review history stays in the PR and framing;
what the handoff absorbs is what the next lane needs: the
capture-at-invocation census and its single-mechanism fix, the macOS
EILSEQ portability fact and its latent crdt-module sibling, the
root-parsing byte lessons, and the copy/rename presentation ruling.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Review of the #233 implementation found two correctness defects. Both
are cases where the FIRST fix for #233 was itself wrong, which is worth
naming: this lane repaired absolute globs and, in the same change, broke
a case that had worked since May.
P1 --- `resolve_watcher` returned "absolute" for EVERY string, so the
form was carried but derived from the union arm rather than from the
pattern. A bare `*.txt` is a valid relative pattern (LSP 3.17 defines
`Pattern` relative to a base path; VS Code treats string watchers as
applying across workspace folders), and classifying it absolute matched
it against `<base>/foo.txt`, which `^[^/]*%.txt$` can never match. A
leading `/` is what makes a pattern absolute. The `filewatchflat` test
could not catch this: it sends the RelativePattern OBJECT form, so it
constrains the object arm, never the string arm the regression lived in
--- the framing's own F1 finding, repeating inside the lane that named
it.
P2 --- `scan_tree` awaits `read_dir` once per directory, so the watcher
coroutine sits suspended for most of a tick with `_sleep` already
cleared. A cancel arriving there sets `cancelled` and has no sleep to
interrupt, and the resumed scan ran on to `did_change_watched_files`:
one stale batch under the superseded pattern, which is a wrong-pattern
notification the server acts on. Cancellation and liveness are rechecked
after the scan.
Both tests are mutation-checked and each bite fails only its own defect.
Reverting P1 fails the bare-string test alone --- the absolute test
still passes, so the two readings are independent. Deleting P2's recheck
reproduces the defect verbatim: `.received = "1 file:///…/foo.txt"`,
a batch from a watcher that was already cancelled.
P2's witness needs a seam. The race is a cancel landing during one of
the scan's suspensions, which no arrangement of real timing produces on
demand --- the same situation, and the same device, as `git.lua`'s
`_deliver_status`. `pmacs.lsp._after_scan_for_tests` is nil in
production and is handed the SCAN RESULT deliberately: a test that
cancels on any other scan passes with the recheck deleted, because the
loop would break at the post-sleep check and emit nothing anyway.
Gates: 9/9 green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The lane header carries the PR number and the ref it was opened at, so
the next machine can find the review without searching GitHub.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implements D1 and D2 from docs/lsp-file-watcher-framing.md (revision 1,
approved 2026-08-10). The user ruled that the walking survives this
lane; D3 gets its own framing.
D1. resolve_watcher now returns (base, pattern, form) and the watch
record carries the form. Per LSP, a plain-string glob matches the
file's ABSOLUTE path while a RelativePattern's pattern is relative to
its base --- and resolve_watcher discarded the distinction, so every
downstream consumer matched relatively. Real servers send absolute
globs: rust-analyzer was never told about any file change (all six of
its globs absolute), and gopls saw go.mod but never a .go edit. The
match subject is chosen in start_file_watcher --- form "absolute"
matches base .. "/" .. rel, form "relative" matches rel unchanged.
scan_tree still walks in relative terms; only the string handed to the
matcher changes.
D2. register_file_watchers now cancels the outgoing record list before
file_watchers[skey][reg.id] = recs drops the only reference to it. The
cancel loop is factored into cancel_watch_records, shared with
unregister_file_watchers, so the two paths cannot diverge.
rust-analyzer registers the same id twice with no unregister between
--- previously 12 concurrent pollers, 6 permanently uncancellable.
Verification, per the framing's plan. Three new fake-LSP modes and
tests beside m4_24, each mutation-tested against the defect it names:
- filewatchabs registers a plain-string absolute glob whose relative
reading matches nothing. Red before D1 (reverting the match subject
fails exactly this test), green after.
- filewatchflat registers a RelativePattern without a leading **/
(*.txt at the base) --- F2's guard. Matching every form absolutely
fails exactly this test, so the obvious wrong fix cannot land green.
It also pins that a base-level pattern does not match into
subdirectories.
- filewatchrereg registers the same id twice (rust-analyzer's shape).
The witness is observable polling, not table shape: f.old exists on
disk before either .new event lands, so a leaked watcher at the same
250ms cadence reports it before the second positive. Reverting D2
fails exactly this test, the leaked .old event visible in .received.
m4_24 stayed green under all three mutations --- the framing's F1
finding (the existing test is insensitive to D1 in both directions),
confirmed rather than assumed. It is kept unchanged.
The framing doc records the approval and the answered ruling; the
active-work lane moves to IMPLEMENTED with the verification results.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Framing and lane at the branch's first commit, so the document is
portable while it is reviewed. The GUI arc framing spent two review
rounds as an untracked file in one worktree; that is the lesson being
applied, not a preference.
Revision 1 is a DRAFT and no implementation may start from it.
Scope is D1 and D2, the two bug-shaped defects. Every claim in the
framing was read or executed against `0e4c58d` rather than carried from
the issue --- including re-running the tree's own `expand_braces` /
`glob_one_to_pattern` / `glob_matcher` under LuaJIT, which reproduces
the issue's glob table exactly, compiled patterns included.
#232 is NOT at fault and nothing about it should be reverted. The
activity indicator renders real in-flight jobs; what changed is
visibility, not behaviour, and the watcher has polled since 1c25730 in
May. Quieting the indicator would delete the instrument that found this.
Two findings the issue does not carry, both of which change the fix:
The existing test cannot discriminate this fix IN EITHER DIRECTION. The
fake LSP registers `**/*.txt`, which compiles to `^.-[^/]*%.txt$`, and
`.-` spans `/` --- so it matches relative and absolute subjects alike
and `m4_24` passes whether D1 is fixed or broken. The issue calls the
tested and exercised paths disjoint; the sharper statement is that the
one existing test is INSENSITIVE.
And "match the absolute path" alone would break `RelativePattern`:
measured, `*.txt` matches `a.txt` but not `/base/a.txt`.
`resolve_watcher` returns `(base, pattern)` and discards which form it
came from, so its CONTRACT has to change, not just the match subject. A
fix that misses this trades six broken rust-analyzer globs for every
RelativePattern that does not begin `**/`. The verification plan
includes a test that fails against exactly that wrong fix.
The framing also records what this lane does NOT fix, so the report is
not mistaken for closed: neither D1 nor D2 stops the walking, because
`walk` recurses unconditionally and `matches` gates only recording. The
modeline will keep flipping at roughly half the rate. Whether that meets
the acceptance bar is an open ruling for the user, stated as one rather
than assumed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The async completions rendered through whichever frontend was ambient
when git exited. Run `M-x git.status` in frontend A, let B become
active while `git status` runs, and A's panel opened in B. The
generation and the root were already captured at the keypress; the
frontend was the one input still read late.
Captured at invocation in all four entrances --- `git.status()`,
`_on_refresh`, `_deliver_root`'s hand-off, and the `git.diff-file`
command --- and threaded on the request table exactly as this module
already threads the generation and root. Committed under the profile
each surface actually takes: `"panel"` for `*git-status*`, `"document"`
for `*git-diff*`.
`set_status` moved INSIDE the status commit. Rows and message are now
computed first and emitted together, because a failure message
announcing a panel that the commit then refuses is the same misrouting
in its most confusing form.
A refused commit DROPS the render, which is the answer the
`expect_buffer` rule already gives when the panel a refresh belongs to
was killed. `commit_to` refuses before the body runs, so there is no
partial render to undo.
THE FIRST VERSION OF `g6_25` WAS WORTHLESS AND PASSED ITS OWN MUTATION.
`panel_text` finds `*git-status*` by NAME, which is global --- it
answers "does this buffer exist", not "which frontend is showing it"
--- so a render into the competitor satisfied it. Rewritten against
`side_window_for` and each view's active window, it now fails both
bites: removing the status commit grows a `*git-status*` panel in the
competing frontend; removing the diff commit hands it the document
window.
The merge also surfaced a cross-lane break invisible until the suites
ran: #232 made `purpose` required on `pmacs.process.spawn`, and this
module's spawn is on this branch, so it was never among the 11 sites
#232 updated. Each spawn now carries its own purpose and NOT the label
--- all three are labelled `git`, and only the purpose separates
resolving a repository from reading its status from diffing one file.
Existing tests that drive `_deliver_status` / `_deliver_diff` through
the internal seam now supply a captured destination. That includes the
one place it is load-bearing rather than uniform: `g6_23` reuses its
"stale" request table at the CURRENT ticket as its positive control,
which is the only one of those three deliveries that reaches a render.
Gates: 12/12 green --- git_status_stage1, destination_capture, journey
and worker_identity acceptance, plus the full sweep.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Merged rather than rebased, for the reason #231 was: nineteen commits
replayed against a ledger four lanes had rewritten is nineteen chances
to lose a lane entry, and the reviewed commits keep their SHAs. One
file conflicted.
The conflict was diff3-style with an EMPTY base --- both sides added
lanes at the same offset --- so it resolved by keeping both, this
branch's #227 lane ahead of main's. Worth noting because an empty base
section is exactly what produced the stray `|||||||` markers found
committed in this file earlier today: the base half of a diff3 conflict
reads as content if it is resolved by hand in a hurry.
This unblocks the lane. `pmacs.window.capture_destination` now exists
on the branch (`src/lua_bindings/window_panel.rs:638`), which is what
#227's review found missing and what #231 was split out to provide.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The merge gate for this lane failed at `11-sweep` on two selectors, and
both had already passed in `03-lib` and `04-lib-crdt` of the SAME gate
invocation, minutes earlier, on the same tree and machine. U6 and U7
could only ever compare a red run against a different run; this is the
first occurrence in the family where the control is inside the run, and
that is what the row is for.
Both are near misses against existing rows, and neither is folded in:
- The PTY failure carries U2's exact fragment, but U2's selector field
names only the *raw* selector. U2's occurrence 2 had raw and canonical
failing together; here canonical redded ALONE and raw passed, which
U2's evidence has never shown.
- `composition_overhead_under_ten_percent` is one of U6's two selectors,
and U6 instructs in its own text that one-without-the-other is a
different incident. It redded without its pair, in a different step,
at 1.613x against U6's 1.297x. Judged as instructed.
The row also records the first checkable candidate this family has had.
`cargo test --workspace` runs many test binaries concurrently while
`--lib` runs one, so the passing and failing steps differ in kind and
not merely in load average --- with a stated control that separates
load from concurrency. U6 and U7 both left the confound atmospheric
and unmeasured; this does not measure it either, but it names something
that can be.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Levi Neuwirth