Opened against main at 0ec13b3, 13 files, on the gate-green head. The
lane block is IN REVIEW rather than IMPLEMENTING, and carries the PR's
URL so a recovering session finds it without searching.
The standing rule is restated in place rather than assumed: not to be
merged unprompted.
Narrow U21 to same-run intermittence without excluding an intermittent
tree effect, and preserve the empty-stdout mechanism boundary from U2.
Correct the shell-status explanation, record the exit-143 sweep
termination, and mark the full pre-PR gate complete.
All sixteen steps of scripts/gate, run 20260902T125049Z-4162684: fmt,
clippy, lib 2009, lib-crdt 2202, the eight touched acceptance suites, m4
168, gpu 322, the workspace sweep at 121 targets and 4138 passed, and
diff-check.
It took three attempts and neither failure was the tree. The first
refused under nohup with no stage run; the second was SIGTERM'd
mid-sweep by a background limit while still compiling, having run no
test; the one real red before them was U21's PTY signature at 03-lib, a
selector that passed twice more in that same run.
The latest verified CODE head stays 9ec4ff1 --- the commits since are
documentation --- and the gate ran at 04ebd2f, which is what the line
now says. The lane is ready for its PR, and the honest statement of
residual risk is U21, not this work.
The pre-PR gate redded at step 03-lib on
m6_1_pty_canonical_mode_keeps_kernel_echo, alone, with U2's familiar
`stty -a output was: ""`. Recorded as U21 rather than folded into U2 or
U9: U2's selector is the RAW test, and U9's requires the canonical test
and composition_overhead together in 11-sweep. Here canonical redded
with no companion at all, in the narrowest step, which no existing row
has shown.
The evidence is unusually good for this family. The same selector passed
in steps 04-lib-crdt and 15-sweep of the SAME run, on the same tree,
minutes apart --- an in-run control that excludes the tree without
relying on a rerun at different conditions. Three later full --lib runs
and one isolated run are also green. The load confound is once again
unmeasured at the moment of failure; the readings that exist were taken
afterwards and are recorded as such.
Two invocation mistakes are recorded in the lane notes because both made
a failed gate look like a running one. nohup leaves SIGINT ignored and
the gate refuses to start in that state --- correctly --- printing two
lines and exiting in under a second. My monitor filtered for step
banners and test results, so it matched none of that, and fifteen
minutes of silence read as progress. And a trailing `; echo "exit=$?"`
reported the echo's status, so the harness logged exit 0 for a gate
whose own summary said FAILED.
Advance the verified code checkpoint to 9ec4ff1, correct the cross-crate
test-support method count from three to four, and record why the earlier
greater-than-zero assertions did not establish exactly one viewport step.
Capture the exact transcript, exact-origin, and geometry-acceptance
assertions together with the three mutation results that discriminate them.
The full pre-PR gate remains the next action.
The completion note said step 3 was closed. It was closed with an
emission-only row, against a framing that rejects emission-only rows in
as many words. The entry now says what the first version measured, what
replaced it, and the structural cost --- a dev-dependency from pmacs-gpu
on pmacs, three doc(hidden) test-support methods, and one shared panel
fixture where daemon.rs previously had its own.
It also names the mutation that distinguishes the two versions: dropping
the daemon's panel horizontal arm. No count of emitted events can see
that, which is the whole reason the framing asked for an effect.
Three residuals from review, all of the same family --- a claim that
looked covered and was not.
B1's disposal was implemented for panels only. Terminal(BufferId) is a
residual owner too, and exit_terminal_mode dropped four terminal-only
caches without dropping the bank, so leaving a terminal and re-entering
the SAME one inherited it: the key is the buffer id and it has not
changed. clear_terminals() now runs at that teardown, with a row that
enters, banks 0.6, leaves, re-enters the same buffer, and finds nothing
waiting. The type's own doc still said disposal was unimplemented and
owed; it now says where both halves live.
R5 and the panel-disposal row stopped after the successor's first 0.6
produced nothing. Unlike R4, neither completed the successor's own
0.6 + 0.6 --- so both passed just as well against an accumulator that
banks nothing at all, which is exactly the state they exist to rule
out. Both now carry the completion leg and assert the exact expected
effect. Demonstrated rather than asserted: with accumulation broken
outright (bank = delta instead of bank += delta) those two rows now
fail, and before this change they did not.
The Absent arm resets EIGHT fields before the new clear, not nine. Both
places that said nine are corrected.
Gates: fmt; clippy --workspace --all-targets -D warnings; pmacs-gpu 322;
--lib 2009; git diff --check.
Both owed lists are now empty. Nothing is landed-but-unwitnessed, and
nothing is owed outright; the next step is the full pre-PR gate.
The three that closed are recorded with what each actually required,
because two of them were not simply "write the row":
Step 3's witness needed the ORDER to be the argument --- 0.6 vertical
then 0.6 horizontal, both reaching nothing --- since a shared
accumulator would have the second complete the first.
B1's disposal half needed mechanism. BufferId keying distinguishes
panel A from panel B for free but cannot see a panel closed and
reopened on the same persistent buffer, and the Absent arm reset nine
pieces of panel state one line at a time with the wheel residual
missing from the list. That is the third time this lane has found the
same omission shape: a hand-maintained reset list with one field left
off it.
Rewrite the live witness and mutation tables around the decision that
GPU horizontal authority is structural, while the TUI owns the literal
latch. Correct L2's driver, give L3 and L7 their frontend-specific
instances, scope L6 and L8 to the TUI state they can observe, and record
the GPU clamp paths and their real mutation dependencies.
Mark the framing amendment revision 21, discharge the ledger's stale
owed wording, and record that L7b now proves the incremental path with
a full-reshape sentinel rather than inferring it from unchanged line
count. Keep historical checkpoints distinct from the one current
verified code head.
The framing claimed L2's height-only resize "invokes the real follow
path (resize -> ensure_caret_painted -> horizontal_follow)". It does
not, in the setup L2 itself mandates: the caret is deliberately outside
the manual viewport, and the painted-before policy skips the follow
precisely there. The paragraph now carries the correction and its
consequence --- that the GPU needs no authority flag, because there is
no follow to outrank --- along with the decision to delete rather than
complete it, and the four rows that replace the single one.
The ledger's stale claims go with it. "Landed but not yet witnessed"
still listed wrap and buffer-replacement clearing, which L8 and L8b-L8e
now cover and whose GPU half described a latch that no longer exists;
"owed outright" still listed L7b and the GPU read side. Both are
corrected rather than quietly dropped, since the entry's purpose is to
tell a recovering session what is actually left.
Also records the shared-target false red's FOURTH occurrence, at the
same four module uses with drifted line numbers --- which is the entry's
own point about which parts of that signature are stable.
L7b and the GPU work, and one finding the next session should not have
to rediscover: the framing's L2 is offered as the GPU's manual-authority
witness and cannot be one. The origin survives a height-only resize with
manual_left_authority never read anywhere in that frontend, because
Q#F6's painted-before policy skips the follow whenever the caret is off
screen --- and when the caret is on screen it is inside the viewport,
where follow_left is a no-op. Both branches leave the latch unreachable.
The real gap was clause 3's clamp, and it is recorded with the number
that shows it: 960px past the maximum after a widen, most of the
viewport blank.
The entry marks L2's wording as owed to the FRAMING rather than the
code, and says explicitly that deleting the GPU's four inert writes
versus giving them a reader is a framing decision. Recording it as owed
rather than settling it in passing is the point --- an approved contract
does not get amended by whoever notices it is wrong.
The implementation and census name four live-window buffer replacement
paths, but two test/helper comments still called the set three and the
ledger still said only two paths already reset cursor, selection and
view_top. Correct all three counts: four replacement paths, three of
which already carried the other TUI replacement resets.
The ledger repeated a2d5b26's "three replacement paths", which was a
count taken by recall. It is four, and the entry now says how the
correct one was obtained --- grep every write of a window's buffer_id ---
along with the one site deliberately excluded and why, so the next
census does not re-decide it.
This is the second count in this lane stated from memory and found
short by review; the first was reshape call sites that no geometry path
reached. The pattern is worth the sentence it costs: both times the
list was of things that had been thought of, and both times review
found the member nobody had.
U20's margin comparison named the wrong baseline. 0.879 and 0.592 are
overheads above 1.0, not excesses over the 1.10 budget --- those are
0.779 and 0.492, which make the ratio 1.58x rather than 1.48x. All
three numbers are now given with what each measures.
Also records that L4's caret probe was closed at its right edge, and
why is_some() alone could not see that end.
Two corrections to U20 and the lane record for a2d5b26.
U20 said six green control runs establish that the observing diff is
not the cause. They do not. They establish non-reproduction in six
runs, which is all a rerun ever establishes in this registry --- a tree
that fails intermittently can carry a changed failure rate that six
runs are far too few to see. Treating non-reproduction as exoneration
is exactly the reasoning this file refuses when a rerun turns a red
green. What the controls actually do is remove the easy story and leave
the question open, and the row now says so.
The margin comparison was also arithmetic dressed as a phrase. "A third
again worse" than U6's 1.592 is not what 1.879 is: as a ratio it is
1.18x, as budget excess (0.879 over versus 0.592 over) it is 1.48x.
Both numbers are now given, with the note that they answer different
questions --- which is why neither gets compressed into an adjective.
The ledger records clause 5's replacement half and the two witness
repairs that came with it, both being assertions that looked strict and
were not: an origin that merely came down rather than landing on the
exact bound, and a rationale about the caret's position that the
fixture made false.
Three records, all from the same session.
**U20.** U6's composition-overhead test redded ALONE, its paired
keystroke test passing in the same run. U6's own closing rule says that
is a different incident, so it is filed as one rather than as a sixth
U6 occurrence: U6's selector requires the pair, and its whole argument
is that two unrelated subsystems failing at once is less likely than
one loaded machine. One test alone does not carry that argument.
The observing diff touches the paint path, so it was a live suspect and
was tested instead of argued about --- three full-lib runs with it and
three with the two files restored to HEAD, all six green. The margin is
recorded per U11: 1.879 against a 1.10 budget, a third worse than U6's
worst. The row says plainly that the size of the margin does not
resolve whether this is load or regression, and that a contemporaneous
load reading is the missing evidence.
**The shared-target false red fired a third time**, giving the complete
set of four error sites that the second occurrence's captured tail had
cut to three. An earlier draft of that entry guessed the missing fourth
was widest_display_columns; the third occurrence shows the guess was
right, and the entry now says it was still right not to record it --- a
signature that is usually right is one nobody can match against.
**And the latch entry was wrong.** It listed the manual horizontal
authority latch as "landed but not yet witnessed". It was written in
four places and read in none on the GPU, and absent entirely on the
TUI. An unread bool preserves nothing. The entry now carries the
measurement that showed it --- origin 30, next paint 0 --- and the three
things the framing's L-table did not anticipate, since those are what a
recovering session would otherwise rediscover from scratch.
Name f441d3d as the latest verified code head, not the lane's current
head. The documentation commit carrying that old wording made it false
on arrival.
Keep the authoritative remote ref as the recovery source so later
documentation-only commits need no self-referential SHA update.
The ledger still pointed at 175cc7b as the code head and still listed
B6's routing row as owed, two commits after it landed. A recovery
checkpoint that lags is worse than none: it reads as current and sends
the next session to a tree missing the work it is about to redo.
Head is now f441d3d at 312 GPU rows. B6 moves out of "owed outright"
into a block of its own, because the part worth recovering is not that
it landed but what its fixture had to defeat: TWO independent conditions
each make a horizontal-inertness claim vacuous --- four-column lines pin
B7's saturated right bound to zero, and line wrap, on by default, makes
scroll_by_columns return early and pin the left edge whatever the
target. The default harness document has both. A row asserting "the
minimap did not scroll sideways" passes under either while testing
nothing, and the setup assertion caught it twice.
Also records the review that followed: the same row pinned neither
probe's target and discarded both Steps, so an unchanged
code_scroll_left was the whole of "inert". And it notes the asymmetry a
reader would otherwise get wrong --- the contrast leg cannot use the
transcript, because a horizontal document scroll is local and silent, so
both legs' transcripts are empty.
The B5 paragraph keeps 175cc7b as its own historical anchor, now said
plainly to be B5's checkpoint rather than the lane's, with the current
head named beside it.
The local false compile red remains a machine-local artifact-state
hazard with no CI occurrence. If the same fragments ever appear in CI,
that run is a new incident and must be recorded under its actual job
and flavor, not the local bare-cargo flavor.
Withdraw the rust-cache explanation: workspace crates are not cached by
default and GitHub cache visibility is scoped. Neither replace it with
the equally unmeasured claim that CI builds fresh.
3bd9ad1 justified keeping the shared-target false red out of
docs/ci-red-signatures.md by asserting the registry is for CI reds and
that a row would have to invent a job and flavor. Both halves are false.
The registry carries many `local (Linux)` rows with precise invocation
flavors --- one of them flavored "with sibling worktrees building
concurrently", which is adjacent to this very mechanism --- and this
incident's truthful flavor is plainly statable: local, bare
`cargo test -p pmacs-gpu`, globally shared target.
I asserted a property of a file I had not read. The conclusion happened
to survive; the reason did not, and a reason that cannot be checked is
the part that goes on to be reused.
The entry now keeps it here for the reason that actually holds --- a
machine-local artifact-state hazard with no CI occurrence, every one of
them from bypassing scripts/gate --- and records that a CI appearance
would belong in the registry with that flavor. It also declines the
easy immunity claim: CI restores artifacts through rust-cache from a
cache shared across branches, so the same mixing has a plausible CI
analogue that has simply never been observed. The superseded reasoning
is named in place rather than quietly replaced.
Records, in this lane's infrastructure notes rather than
docs/ci-red-signatures.md, a red that has now fired twice locally. The
registry is for CI reds; a row there would have to name a job and
flavor this has never had.
The signature is E0433, "cannot find `columns` in `pmacs_protocol`",
four errors from a bare `cargo test -p pmacs-gpu`. Both times the module
was entirely present --- columns.rs matching HEAD, `pub mod columns;` at
lib.rs:40 in worktree and HEAD alike. Nothing was missing to find.
CARGO_TARGET_DIR is exported globally here, one directory for every
checkout, and `main` has no columns module at all --- the sharing
refactor is unmerged 1b work. So a pmacs-protocol artifact built without
the module shares a target directory with the branch that needs it. The
entry states what was confirmed (the shared directory, the module's
absence on main, the red clearing) and says plainly that which build
deposited the stale artifact was not determined.
Three of the four error sites are recorded. The fourth scrolled past the
captured tail, so the entry says so instead of naming a likely
candidate.
The control is `scripts/gate` and its per-worktree CARGO_TARGET_DIR, not
the touch that cleared it --- with the warning that the touch papers
over a genuine deletion exactly as readily, and that the two reds look
alike. agent-handoff.md:2609 already carries the general bare-cargo
hazard; it did not carry this signature, count, or control.
Advance the GUI Stage 1b ledger to the immutable code head and correct
the central-hook claim. Counting reshape callers missed two panel-band
transitions: accepted frame changes and geometry epoch invalidation.
Record the shared inset-change seam, the content-only repaint exception,
the 309-row GPU pass, workspace clippy/fmt/diff verification, and all four
executed mutations.
Moves B5 from "owed outright" to landed at `a4627cd`, and records where
its icon re-derivation ended up: `reshape`'s tail, rather than the two
call sites that had been noticed.
The recovery-relevant part is the failure mode, not the fix. Twice the
patch went to a path someone had pointed at, and twice a second applier
in the same arm restored the icon anyway --- so the row passed with its
documented mutation applied. That is not a weak witness. It is a row
that measures nothing while reading, in the diff, exactly like a row
that measures something.
The block said the platform decision "replaces a `cfg!` read". It does
not: production still reads `cfg!(target_os = "linux")` at
pmacs-gpu/src/main.rs:3450. What became injectable is the SELECTION
decision taken after that target fact --- `is_linux` comes from `cfg!`
in a non-test build and from an override otherwise, and
`paste_source_for(is_linux)` is the part a row can drive both ways.
And "L1-L8 still owed" hid implemented state that recovery needs. The
manual authority latch, its wrap/replacement clearing, and R4/R5's two
separate residual resets have all LANDED; what is owed is their
witnesses. The block now splits "landed but not yet witnessed" from
"owed outright" rather than letting one phrase imply neither exists.
It also names the authoritative ref and the exact recovery command,
which is what this file is for and what the block did not have.
The lane has been implementing without a ledger entry, which is the
recovery state this file exists to carry. It records the base, the
framing revision, what has landed, and what is still owed --- including
B1's disposal half, which the code documents as absent rather than
stubbing.
Three findings are recorded because each cost review time and none is
this lane's to fix:
- `scripts/gate`'s clippy step runs default features only, so crdt-gated
code is never linted locally;
- NOTHING runs `cargo doc` anywhere, so broken intra-doc links are
ungated repository-wide --- including one pre-existing, in a file this
lane never touched;
- no non-Linux CI leg runs `pmacs-gpu` tests, which is why B4's platform
decision is an injected parameter rather than a `cfg!` read.
Each names the lane that would own the fix rather than proposing it
here.
The post-merge gate of the docs-only absorption commit redded at
`07-sweep` with U16's exact signature. Same selector, same panic site,
both required fragments.
It is the first occurrence on `main`, which removes the last attribution
question this row could have had --- the first two were on a branch
whose diff touched nothing under `src/packages/`, and this one has no
observing branch at all.
Three occurrences in about eleven hours, against eight consecutive green
`--lib` runs earlier the same morning. That is the closest this row has
to a rate and it is still not a measurement, because nobody has counted
runs and failures over a fixed window. Isolated reruns green three
times, which per the rerun rule establishes intermittence only.
The structural fix belongs to `file_io`: a version-suffixed child
inherits a cwd that a `TempDir` then deletes, and no care inside the
mutating test can close a process-wide window.
Merged at the approved head `093d677` via `--match-head-commit`, 14/14
CI green and the eight-stage local gate green on that exact commit.
The lane block keeps its full review history rather than collapsing to
a one-line "merged": ten rounds, four on the framing and six on the
implementation, and almost every finding in the later six was against a
RECORD rather than against code.
The heading said "a terminal bell never arrives within a 5s poll" while
the body two paragraphs down withdraws exactly that: the evidence shows
the bell was not OBSERVED within five seconds, not that it never came. A
title is the part most readers keep, so it was the worse place to leave
it. Retitled to match.
U16 said its reds and greens were "across two days". Every run the row
cites --- both reds and every green --- is 2026-08-31, which the
sentences immediately above it already said twice ("again the same day",
"returned within the day"). Corrected in both files.
U19 said "no rerun was performed on this selector". The very next gate
run was one: it passed in `03-lib`, `04-lib-crdt` and the exact
`07-sweep` context it failed in, at ea786a2. So did U16's selector,
after its second occurrence. Both rows now record those passes and
classify as intermittent. Writing "no rerun was performed" in the same
commit whose gate reran it is the kind of claim this file exists to
catch.
U19 also overstated three things. The evidence shows no bell was
OBSERVED within five seconds --- not that one "never comes", and not
that scheduling cannot explain it. "Three orders of magnitude of slack"
does not hold against the 200ms budget it cited: 5s is 5000x of 1ms but
only 25x of 200ms, so the distinction from the budget family is one of
degree. And adding an elapsed value later cannot make a future margin
comparable with THIS unmeasured one --- that margin is gone for good; it
only makes future failures comparable with each other.
R7 kept a sentence reconstructed before the renumbering: its "prior five
spread across lanes and months" were eight, and not evenly spread ---
three of them fall on one branch on 2026-08-15. The line census skipped
occurrence five, whose block never captured a line; it is now marked
unrecorded rather than guessed or omitted.
U16's introduction still said it was "worth more than its one
occurrence" while its status said second.
The gate verifying the R7 renumbering redded twice in `07-sweep`.
`cache_survives_across_fetcher_instances` is **U16's second
occurrence** --- same selector, same panic site, both required
fragments. It is the first time that row has reproduced, and it settles
an earlier withdrawal in the right direction: claiming "the window is
narrow" from eight green runs was wrong, and the failure came back
within the day. The child-inheritance chain stays a candidate; this
occurrence demonstrates it no more than the first did.
`terminal_bell_baseline_suppresses_history_and_delivers_each_new_bell_once`
is new, recorded as U19. It is a deadline but not the budget family's
kind: those assert work finishes in 1ms or 200ms, while this asserts an
event arrives at all inside FIVE SECONDS. Folding it into that family
would blur the one distinction those rows have.
Like R1, its assertion has `Instant::now()` in hand at the panic and
reports none of it, so the margin is unrecoverable and a future
occurrence will not be comparable to this one. That is the second place
in this codebase where the same omission costs the same thing.
`docs/active-work.md` recorded two full-fragment R7 occurrences from
2026-08-15 (logs 20260815T095532Z and T100719Z, `attach.rs:1728`) under
a heading saying they were "owed to the registry by whichever branch
merges second". Both branches merged. Nothing carried them across, and
they sat there for sixteen days, so R7's count read two low even after
yesterday's renumbering.
With those absorbed and the duplicate "fourth" fixed, the sequence is:
August 29 = ninth and tenth, August 30 = eleventh, August 31 = twelfth.
The parse-budget lane block, which still said sixth and seventh, is
updated too.
The deferral itself was reasonable --- this file has been bitten by two
branches inventing the same row id --- but not discharging it was not.
The lesson recorded is narrower than "absorb faster": an entry parked
under "owed to the registry" needs an owner named in the same sentence,
or it belongs to nobody.
The summary cell's line-specific claim was also incomplete: occurrences
one through FOUR report `attach.rs:1680`, not the first three.
And U18 over-corrected. `GONOSUMDB` is a real Go variable ---
`go help environment` documents `GOPRIVATE, GONOPROXY, GONOSUMDB` as
module prefixes "that should not be compared against the checksum
database", which is exactly the step that failed. It is technically
applicable; whether the authentication tradeoff is acceptable is a
different question. Discarding a real knob while correcting an invented
one is its own error and is recorded as one.
R7 carried TWO blocks numbered "fourth" --- D3 on 2026-08-11 and TMPDIR
isolation on 2026-08-13 --- so every later ordinal was one low. The new
red is R7's TENTH, not its ninth. Renumbered by date, with the duplicate
recorded in the status cell rather than silently fixed. The summary cell
said "three occurrences" and now states the total, keeping the
`attach.rs:1680` fact as the line-specific claim it always was.
U9's selector was named wrong in yesterday's correction. The row names
the CANONICAL pty test (`src/process.rs:3967`), not
`raw_mode_disables_kernel_echo` (`:3945`) --- and U9's own "relation to
U2" cell turns on exactly that distinction, so getting it backwards
would have undercut the row the paragraph was correcting.
The arithmetic was still wrong in two places. There are 121 result lines
and the doc-test groups are numbers 120 and 121, not 121 and 122; and
U9's table cell still asserted the strict 119-to-121 alternation that
the paragraph below it retracts.
U18 listed three outage options and all three were wrong. `GONOSUMCHECK`
is not a Go environment variable --- that sentence invented it.
`GOFLAGS=-mod=mod` selects module update mode and does not bypass
checksum-database authentication. And a version-suffixed `go install`
ignores vendor directories, so "a vendored gopls" needs a different
installation path. No replacement knob is named, because none was
verified.
The ledger called uncontrolled foreign load "the same evidence U9's
synthetic-load control was meant to produce" and said "U9 stays owed",
both of which contradict the correction below them. And its lane heading
said four registry rows moved while listing eight.
Three corrections to yesterday's correction, and one new row.
The serial-binary measurement was stated as "119 Running and 121 result
lines alternate strictly", which cannot be strict --- the count itself
gave it away. Precisely: 119 ordinary targets each report before the
next starts, and the two extra result lines belong to `Doc-tests pmacs`
and `Doc-tests pmacs_protocol`, which cargo labels differently and runs
last.
The replacement premise did not describe U9 either. Both U9 selectors
live in the ROOT LIB TARGET --- `m6_1_pty_raw_mode_disables_kernel_echo`
(src/process.rs:3945) and `composition_overhead_under_ten_percent`
(src/editor.rs:9717) --- and the sweep runs that target first, finishing
it in about 12 seconds. The sweep's later minutes cannot reach them.
What survives: the sweep re-runs the lib target late in the overall gate
invocation, under unmeasured machine state.
Two stale references to U9's void control are corrected, including the
ledger's claim that a synthetic-load run would "either implicate load or
clear it". It would not: with concurrency fixed at 1 there is no second
arm, so a red shows load is sufficient and a green shows nothing.
Non-reproduction never clears anything under this file's own rerun rule.
U18 is new and a new class. `Test (ubuntu-latest / luajit)` died in
toolchain setup before any cargo command ran: `go install gopls@v0.16.2`
hit an HTTP/2 INTERNAL_ERROR from sum.golang.org while verifying
x/telemetry. Every other row here is a test that failed; this is
infrastructure the workflow depends on failing to answer, and it
presents as a red check indistinguishable from a real one.
U9's "structural difference worth testing next" claimed that
`cargo test --workspace` runs many test binaries concurrently while
`--lib` runs one, and derived its discriminating control from that:
"pin test-binary concurrency to 1". The premise is false. Cargo runs
test TARGETS serially, one executable at a time, so that concurrency is
already 1 and the control pins nothing.
Measured in this project's own gate logs rather than asserted from the
cargo book: `20260831T093655Z-857818/07-sweep.log` alternates `Running`
and `test result:` strictly --- 119 to 121 markers, ZERO cases of one
binary starting before the previous reported. The pattern is `RTRTRT`.
That falsifies a premise two rows rested on, so U12's family paragraph
is corrected too. What survives is smaller and still true: a sweep is a
long sequence of binaries, so a budget inside it runs at an arbitrary
point in a multi-minute step. The family still should not consume review
rounds --- but it now needs a control someone has to design.
U17 no longer claims `--test-threads=1` exercises U9's control. It is a
different knob: it serializes test FUNCTIONS within one executable. Its
candidate mechanism is narrowed to match --- removing sibling test
functions removes ONE source of contention, which supports neither
"fastest" nor "narrowest".
R6's block drops two overclaims: a PR run CAN show the identical red
(only the main dispatch establishes it on the merge base), and this was
not the dispatch key's first use --- #245's D2/D3 dispatched three runs
right after it merged. It is the first use for a live merge-base
control.
Five corrections, all mine.
U16 stopped at "the window exists", which misses why restoring the cwd
does not close it. `run_git` calls `run_git_inner(None, ...)`, and that
sets `current_dir` only when `cwd` is `Some` (fetcher.rs:329-330), so
the spawned git INHERITS the parent's temporary cwd. The parent then
restores its own --- which does nothing for a child that already has its
working directory --- and the TempDir drops underneath it. The restore
is not merely too early; it is irrelevant to the child.
U16 also offered a serial guard around `set_current_dir` tests as a
structural control. That does not protect an unguarded test that spawns
a child, because the child outlives the guard. The options that work are
removing the cwd mutation, running that test in a subprocess, or
serializing the whole lib-test binary.
And U16 said 8 green runs showed the window was narrow. They do not.
Non-reproduction establishes intermittence and nothing else; nothing
here has sized this candidate's window.
U17 claimed no PR run can show its failure. A PR run exercises the same
test and could fail identically; what only a main-side run establishes
is that it fails ON MAIN, with no observing branch to suspect. And its
`got ok` does not prove the supersede arrived late --- it proves the
predecessor completed successfully before cancellation took effect,
which a timely supersede whose cancellation lost the race produces
identically.
The macOS lua54 leg redded on PR #246 with
`acc28_child_input_and_the_c_c_escape_work_unchanged_in_a_panel`. It is
a full three-condition match for R6 --- selector, flavor, and BOTH
required fragments (`timed out waiting for` + `/ready`) --- 26 days
after the first occurrence.
The log was read BEFORE anything was rerun. U3 named that lesson and U8
recorded its fourth violation; this is the first time it was followed on
a macOS job at the moment it mattered, and the fragments exist because
of it.
Rather than argue from an unrelated diff, a merge-base control was
dispatched at `aae5b35` --- the first real use of the
`workflow_dispatch` key #245 landed, and exactly the case U11 motivated
it for. The macOS legs came back GREEN, so the inference the control
could have supplied is unavailable. Recorded as a null result, the way
R1's row had to record its own. What each outcome would mean was written
down before the result was seen.
The control was not otherwise clean: `Test (crdt)` failed on `main`,
which is U17. It fails the opposite way to R1 and R5 --- not a missed
deadline but a predecessor that had already completed --- and the job
runs `--test-threads=1`, the condition U9's still-unrun control names. A
red on the merge base is invisible to any PR run.
The sweep step redded on `cache_survives_across_fetcher_instances` with
`fatal: Unable to read current working directory`. Not a budget test,
and not a load story.
It is the only row in this file that arrives with a named candidate
mechanism inside the test suite. `src/file_io.rs:434` calls
`std::env::set_current_dir` --- process-global state --- inside a test
running in one of libtest's parallel threads, points it at a `TempDir`,
and lets that `TempDir` drop. Every other test in the binary shares that
cwd for the window, and after the drop it is a deleted directory, which
is exactly what git reported.
Recorded as a candidate with a citation, not a demonstrated chain: 8
full parallel `--lib` runs did not reproduce it, which says the window is
narrow rather than absent. The row names the two controls that would
settle it and runs neither --- the structural fix is `file_io`'s, not a
CRDT invariant lane's.
Two precision errors, both mine.
U14 said "four selectors in three unrelated subsystems". They are four:
the async runtime, the optimistic-echo orchestrator, editor composition,
and the LSP dispatch seam. U6's own row treats its two selectors as
unrelated subsystems, so the `04-lib-crdt` pair is two of the four here,
not one. The `what is NOT` row said three as well.
U15 claimed to be the load number "U6 and U7 have each wanted since
2026-08-09". Half of that was wrong: U7 has carried a load average
(12.9 / 23.9) in its job/flavor field since that date. What U7 records
as unmeasured is narrower --- whether the shared `CARGO_TARGET_DIR` and
its sibling builds PRODUCED that load. So 34.04 is the first
contemporaneous reading for a U6 occurrence and a second data point
beside U7's, not the registry's first. The row title oversold it too.
U15's disposition list also omitted U15.
The gate line named `2c24303` while the branch head was `6ddce0f` ---
the same staleness review caught one round earlier, when it named
`db24ae3`. Naming one commit reproduces the defect on the next commit.
It is a table now: one row per gated head, so the next update adds a row
instead of rewriting a sentence, and the staleness is stated rather than
waiting to be found again.
Three corrections, all mine, all caught in review.
U14 claimed a second occurrence for a run whose selector set had
ROTATED --- `full_buffer_summary_flatten` and `dired_renders_10k_entries`
in place of `grep_supersede` and `acc34_purge`. This file's own matching
rule requires the exact selectors to match, so that is a new incident.
It is now U15. The `04-lib-crdt` pair the two runs share is recorded
where it belongs, as U6's own occurrence; U6 goes from one occurrence to
five, four of them on 2026-08-30.
U14 also said "three unrelated tests". There are four selectors.
And the load claim went too far. `/proc/loadavg` was read once, after
the second run, so there is no series to correlate against; the margins
are not monotonic (`composition_overhead` ran 1.182x, 1.592x, 1.527x,
and reports two different values within the second run); and an earlier
version said a load average of 34 "explains it without any help". What
34.04 establishes is severe unrelated load present CONTEMPORANEOUSLY
with one multi-red run --- a measured confound, not a measured cause.
That is still worth more than U6 and U7 have had since August, and it is
worth exactly that much.
The lane block also still carried the withdrawn "opposite way to R7"
claim and named `db24ae3` as the gate head. It now names `2c24303` and
log 20260830T193305Z-4167110.
The enumeration is the contract. Clippy's `match_same_arms` would
collapse the three `Ok(())` rows into one alternation, which is exactly
the conflation this lane exists to remove --- it would stop the table
from showing that `(forward, empty, None)` and `(history, empty, Some)`
are valid for OPPOSITE reasons.
The lint reached CI rather than the gate because the gate's clippy step
runs default features, so `#[cfg(feature = "crdt")]` code is never
linted locally. Five consecutive green gate runs could not see it. The
gap is recorded in the ledger; fixing it means adding a second clippy
flavor to shared gate infrastructure, which is its own lane.
R7's eighth-occurrence write-up said the gate's ambient root, TMPDIR and
cross-stage process state were "now the only place the difference can
be". That is wrong. The paired runs exclude the SOURCE TREE and nothing
else: scheduler load, kernel and socket timing, page cache pressure and
whatever else the machine was doing also varied between them, and a
BrokenPipe on a socket handshake is exactly what those can drive. The
three remain the candidates worth varying one at a time --- because they
are the ones this project can vary --- not an exhaustive causal set.
U6 gained a second occurrence, and for the first time it REPRODUCED:
both selectors, both fragments, two consecutive runs. Margins recorded
per U11's lesson --- 1.343883ms against 1ms, and 1.182x against 1.10x.
Its asymmetry runs the opposite way to R7's: both failures were out of
gate, while the same command as `04-lib-crdt` was green in all four of
this lane's gate runs. Whatever the two rows share, it is not a
direction.
Framing revision 5 and the lane block are updated to match, including
the stale "AWAITING APPROVAL. Nothing implemented." header and the gate
line that named a commit the branch had already moved past.
The block claimed the fixture had verified that "replicas stay converged
--- the op IS broadcast". That was inspection of the call sites, not
execution: nothing had ever replayed the op on a replica, and text
equality alone cannot see a lost version advance. It also called the
buffer-end range location "genuinely arbitrary either way"; the census
rules it, and finds it weakly preferable.
Both corrections are recorded in place rather than quietly dropped,
along with what each review round caught and the two mutation
asymmetries the framing asserts.
I recorded the dispatched run's proptest red as "a DETERMINISTIC red",
"not like anything else in this registry --- a property violation with a
concrete witness, not a load artefact", and proposed committing the
proptest seed as the first step. All of that was wrong, and it was wrong
for a plain reason: I recorded a finding without checking whether main
already documented it.
src/buffer.rs:3005 carries an #[ignore]d deterministic fixture,
crdt_undo_of_an_identity_replace_reports_a_no_op_edit_carrying_an_op,
that reduces this exact case. The shrunken input is a randomly sampled
recurrence of it: Replace(5, 1, " ") replaces the trailing space with
itself, a textual no-op but a real CRDT delete-plus-insert, so Undo
emits a version-advancing operation with no visible text change.
Committing the seed was a second error. It duplicates a deterministic
fixture that already exists and would only make a disputed assertion
fail permanently instead of occasionally.
The fixture already verified what I would have re-derived: content stays
correct, replicas stay converged because the op IS broadcast and neither
crdt_op consumer short-circuits on an empty range, and the cursor does
not jump.
The entry now frames the actual decision --- whether a visible text delta
and a CRDT-version delta are independent dimensions of Edit --- and the
evidence a lane owes: that forward textual no-ops still produce no
operation, that any permitted empty-text undo operation carries valid
bytes and preserves remote replay convergence, and an explicit
disposition of derive_replacement_edit reporting the empty range at the
buffer end rather than the edit site.
The interruption is bounded and does not reorder the roadmap. GUI arc 1b
remains the next product lane.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
D3 PASS. Dispatched run 33307137965 on main: all 14 jobs started and
concluded success or failure, none skipped, cancelled or timed_out. The
run's own conclusion was failure, which D3 permits by design --- its
contract is that the matrix RAN, not that it passed.
D2 PASS, with every guard exercised rather than assumed. A reached
in_progress; B was dispatched while A ran; the REQUIRED OVERLAP WAS
OBSERVED, A in_progress and B pending, so this is not the vacuous
version that passes when A finishes first; headSha(A) == headSha(B) ==
7b82e14, so the two really shared ci-<sha>; and A concluded success, not
cancelled. B was cancelled afterwards by hand to save macOS minutes, and
its fate is not part of D2.
An unplanned observation is worth more than either witness: a main PUSH
run was already in_progress at 7b82e14 when the first dispatch was
issued, and the dispatch QUEUED BEHIND IT rather than cancelling it,
starting only once the push finished. That is the same-SHA
push/dispatch interaction the framing described and no witness covered.
The first dispatch also immediately found a red on main, which is what
the lane was built for --- and it is not like anything else in this
registry. rope_matches_crdt_projection_after_arbitrary_edits failed a
proptest assertion at src/buffer.rs:3120, "no-op edit must have crdt_op
= None (Undo)", and SHRANK to a four-operation minimal input. That is a
property violation with a concrete witness, not a load artefact. It is
recorded as its own lane with the selector, the assertion, the shrunken
ops, the regression seed, and the reason a local pass is not evidence:
no .proptest-regressions file is committed, so the failing case is not
replayed and one green local run means nothing.
Not investigated here. This lane's scope was one workflow key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Recorded together, because the control is what the occurrence owed.
The occurrence: Test (macos-latest / lua54) on head d9cc0fa, 1984 passed
and 1 failed, panicking at src/async_runtime.rs:2444 with R1's required
fragment. THIS IS R1 despite the new Lua flavor --- the row records
luajit and this is lua54, and flavor is not part of signature matching.
The selector and the fragment are, and both match.
The control: the same job at the branch's EXACT merge base 2e9f62b,
rerun the same hour, green at 1985 passed and 0 failed. Both logs were
preserved before the rerun, so neither result is reconstructed from a
conclusion --- the selector is read as "... ok" in the control's own log.
What that green control establishes is carefully bounded. It does NOT
establish environmental cause and does NOT retire R1; it shows only that
the merge base can pass the same job in the same hour. A RED control
would have established that the branch did not introduce the occurrence,
and that inference is simply unavailable here. R1 remains live either
way under its measurement-design disposition.
Records that R1's assertion omits its measurement --- the same class #244
fixed, and a line my discarded sweep had surfaced --- and that it is
deliberately NOT fixed here. Adding the elapsed value would sharpen the
next failure's evidence and repair nothing about the measurement design
this row is about: that a thread::sleep(15ms) is asserted by comment to
mean the worker picked the job up. That belongs to the async-runtime
lane with the rest of Q#MCI3.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Adds workflow_dispatch: to ci.yml. One key, no inputs, and no job,
matrix, step, permission or timeout changes --- a dispatched run does
exactly what a push run does.
THE SCOPE IS ONE REGISTRY ROW, and the framing took three revisions to
get that right. CI never invokes scripts/gate --- zero occurrences ---
so every local-gate red already has a merge-base control that needs no
CI at all: the exact failing command, with its flags, at the recorded
merge base, in a separate worktree. U11 alone needs this trigger,
because it is macOS-specific and this project has no Mac. When it
recurred on #243 the only contemporaneous main-side control available
was a re-run of a run eight days old.
What this is NOT: it does not run scripts/gate, does not vary R7's gate
conditions, and does not select U9's alternate test commands. Those need
their own changes. This is infrastructure they would build on.
The concurrency interaction is stated at its real strength: once a
dispatched run is in_progress, a second same-SHA dispatch will not
cancel it. cancel-in-progress: false protects a RUNNING run and not a
pending one, and a main push and a dispatch at the same SHA do share
ci-<sha>. A PR run never shares a dispatch's group at all, so no
PR-involving test exercises the predicate.
D1 passes and bites pre-merge: the working-tree file parses and
workflow_dispatch is a key under `on`; dropping it fails the assertion.
The witness looks up both 'on' and the boolean True, because YAML 1.1
parses `on:` as a boolean and a naive d['on'] raises before checking
anything.
D2 and D3 are OWED POST-MERGE and recorded as such --- GitHub offers
workflow_dispatch only for a workflow already on the default branch, so
neither can run before this lands. D2 carries a void-and-retry rule so
it cannot pass when the two runs never actually overlap, and D3 requires
each job to conclude success or failure rather than merely not-skipped.
Framing docs/ci-manual-dispatch-framing.md revision 3, approved.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Merged 2026-08-29 at approved head 7b50682, merge commit a85205a, via
--match-head-commit. 14/14 CI green on that head, 8-stage local gate
green on it too.
Records what the lane exposed beyond its own change. THREE rows in one
session were written to assert a condition without keeping what would
explain its violation: the two parse budgets this fixes, and U13's
`let (out, _, _)`, which throws away a child's success status and stderr
so its failure cannot distinguish wrong-but-successful output from a
refused invocation. U13 is not this lane's to fix, but three instances
make it a pattern rather than an oversight, and each one costs a review
round to establish nothing.
Also records R7's sixth and seventh occurrences, the bounded observation
window that stops its ratio drifting with review activity, and the
correction that seventeen green out-of-gate runs are not exclusions ---
nothing outside the gate has ever reproduced R7, so matching one gate
condition at a time outside it cannot isolate an in-gate cause.
Per the standing rule, this absorption does not advance any canonical
base to its own commit.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
The head-exact review gate reached sweep with six green stages, then
`skipped_directories_are_reported_with_a_reason` observed empty child
stdout. The durable failure cannot say why because the row discards the
child status and stderr.
Record the exact signature, the structurally unrelated branch diff,
and the isolated-selector and full-binary green reruns at their actual
strength: intermittence only. Diagnostic hardening remains a separate
lane.
The previous commit recorded "in-gate 2 failures in 4 runs" and named
the final verification gate. Re-running the gate on that very commit
made both wrong: a fifth in-gate run, green, and a new log id. Every
docs fix forces a re-gate, and the re-gate invalidates the docs fix.
R7's window is now explicitly the four in-gate runs of 2026-08-29 up to
and including the first green, plus the 17 out-of-gate runs taken
between them. Later verification gates are excluded by definition. A
ratio that grows with review activity measures review activity, not the
phenomenon.
The ledger stops naming the head and log id at all. It records that
every review round ends with a green head-exact gate and points at the
PR body for the current values --- which is the same reason SS5b stopped
recording an ahead-count: a line naming a moving value is stale the
moment it is written, and that lane learned it twice.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Four stale claims, all in durable documentation that would have shipped
as written.
The framing still said "AWAITING APPROVAL. Nothing implemented" while
the ledger and the PR both said otherwise.
R7's status line said SIXTH OCCURRENCE while the body below it recorded
the seventh. Its tree-exclusion bullet said the observing lane's diff is
two docs; the lane carries three. And its cumulative figure said in-gate
is 2 failures in 3 runs, which omitted this lane's final head-exact
verification gate --- a fourth in-gate run, green. The figure is 2 in 4,
and the fourth is named so a reader can tell which run it was.
Active-work carried the same stale docs count and the same 2-in-3, and
recorded neither PR #244, nor the final head 2d76984, nor the gate log
20260829T152824Z-673477. It now carries all three, with the gate's
result read from its eight stage logs rather than inferred from stage
exits.
The sweep that found the last 2-in-3 also printed "(none = consistent)"
unconditionally, which is the read-success-from-absence shape this
project keeps catching. It now prints the hit count and only claims
CLEAN when that count is zero.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bqGA6s9tTUFzYpbeW3tai
Levi Neuwirth