docs: record the D5 C6 close-out - #117
Merged
Merged
Conversation
C6 in two PRs, per the owner's ruling that the conversion and the deletion be separated and each carry its own review: #115 retired the three regeneration tools to verify-only, #116 deleted the eleven legacy runners and wired verification into the three sites where the C5 harness had been reading frozen inputs unchecked. Decision (3) - kill the second factor data path - closes here. What is worth carrying forward is not the deletion. Three things were established by measurement rather than by assertion: The wiring is real. Reverting a read site to a bare path, replacing it with an inline path that never calls the gateway, and keeping the call but swallowing its exception are three distinct ways to bypass the check, and each has a test that goes red. The third one is the reason the record side uses a behaviour test rather than an AST assertion: AST can only show the line is present. A manifest's claim was narrowed to what it actually blocks, in two rounds. It was first written too wide - it promised to catch a case that can no longer occur on the pinned record, because the loss already happened and what is pinned is the state after it. Then it was written too narrow, missing a boolean verdict flag that is neither a count nor a key yet is compared. The narrow wording came from the lead relaying a reviewer phrasing; the implementer rejected it on measurement, on the grounds that copying it would build the same defect into the fix. The test that asserts the remaining limitation is deliberately built to go red if anyone strengthens the check, so the declaration cannot silently become wider than the code again. And the frozen directory turned out not to be immutable. Seven of its 113 files are covered by no hash at all, and the one that is genuinely unprotected is the one that was actually overwritten, in July. The rule now states what it can honestly state: "no bytes were written" is a claim about an operation, not about the directory. The same protocol hole recurred three times: the tree was modified while a reviewer was measuring it. Neither occurrence was caught by a test; both were caught by an observation that contradicted an expectation. Closing it took one rule on each side - the lead waits for every item including appended ones, the reviewer states whether it has finished, and the implementer does not resume after declaring it has stopped, not even for a defect it found itself. Neither contamination cost a round, because the scoping was done by which text a measurement read rather than by commit timestamps, and because "no executable change" was measured as AST equality after stripping docstrings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
进度文档 PR，对应 #115（C6 改造） 与 #116（C6 删除）。docs-only。
docs/progress/07_factor_layer_refactor.md追加 C6 条目docs/progress/pr_ledger.md补 refactor(factors): retire the three regeneration tools, verify the frozen bytes instead #115–docs: record the D5 C6 close-out #117CLAUDE.md只动三处（状态表 / 当前主线段 / 路线图），按 docs: split the progress log out of CLAUDE.md into docs/progress/ #110 立的规矩——长条目进docs/progress/cp CLAUDE.md AGENTS.md，cmp逐字节相同记录的重点
决策③「杀第二条因子取数路径」收尾：11 个旧 runner 归零，三个重生成工具退役为 verify-only，D1 基线 frozen-forever。
但值得带走的不是删除本身，是三件被测量而非被断言的事：
同一个协议洞复发三次
树在评审测量期间被改动，两次。都不是被测试抓住的，都是被"与预期矛盾的观察"抓住的。 闭合它需要三方各补一条：lead 等全部条目（含追加项）交付且明确收工才派返工；评审每份报告显式声明是否收工；实现方声明停手后非经指派不得恢复工作——哪怕是自己发现的真缺陷。
两次污染都没让任何一轮重来，因为定界是按**「哪次测量读了哪份文本」做的（不是 commit 时间戳——工作树先于 commit 改变），且"没动可执行代码"是用剥掉 docstring 后的 AST 相等**量出来的。