Self-hosting phase 4: the oracle split, the floor and view waves, and the honest 05 stay

AGENTS.md

@@ -17,7 +17,7 @@ claims; **`src/` and tests** are authoritative evidence of current realization.
 > machinery landed (plan 13) · authoring **carrier ruled** as `.sdp.md` (the carrier ruling, MD-18;
 > plan 16) — product Markdown parser and self-hosting landed · **canonical-default carrier
 > rule:** Specs default to Markdown; Packs remain TS until a Pack syntax ruling; the TS DSL survives
-> as import source and a lawful per-ID option. · **what now:** ✅ EXECUTED — phase-3 implementation complete; the pre-close adversarial review is archived with every finding dispositioned. The prior `EXECUTED — phase-1 implementation complete; final audit passed` and phase-2 statuses remain historic context. The systematic tests-to-executable-specs rewrite ran across the cheap laws and the core model dissolved into Specs; the remaining work is the recorded corpus gaps (the lower readiness-floor clause tables, the derived-readiness banner, and the rest) and the concept docs still standing on their own audits. Build state lives in
+> as import source and a lawful per-ID option. · **what now:** ✅ EXECUTED — phase-4 implementation complete; the pre-close adversarial review is archived with every finding dispositioned. The earlier phase-1 to phase-3 statuses remain historic context. The corpus oracle is split into per-law assertions over one hoisted extraction; one shared module now states the contract-dependent suites for both the test wrapper and the lint config; the floor wave and the view wave carried the readiness-floor clause tables and the projection laws, adding **10 new bound points, each mutation-probed red**. Corpus at **`ready: 66 / defined: 37`** over 103 Specs, 0 errors / 0 warnings. `docs/concept/05` **stays, two clauses short** — a per-team severity override and a team-overridable floor config (gaps 13/14), which are the named next work, beside the `06`/`07` gaps still standing. Build state lives in
 > **`plans/`** — read the highest
 > **primary-numbered** plan's status header, plus any **active subplans it (or its parent family)
 > explicitly designates as current**; ignore unnumbered files and letter-suffixed plans only when
@@ -138,6 +138,9 @@ Every doc honours both — never mistake one half for the other:
 - **Lineage is evidence, not template.** Prior art **`@libar-dev/architect`** (local clone when
   present, e.g. a sibling `architect` checkout) taught us the problem in production; treat its
   *shape* as evidence about the problem, never as the answer.
+- **A "verified" row is re-measured, never inherited.** A docket or ledger row claiming *fixed* or *verified*
+  is re-checked against the tree at the moment of verification, never trusted from the row that closed it —
+  the phase-4 close caught a "verified — intact" row that had been false since the commit after the one it cited.
 - **Git hygiene** follows the global rules (no `git stash`; commit early on a WIP branch; commit/push only when
   asked).
 

contract-dependent-suites.mjs

@@ -0,0 +1,39 @@
+// One source of truth for the suites that import generated contracts.
+//
+// A bound suite couples two surfaces that never see each other: the test wrapper
+// (`vitest-test.mjs`), which must refuse to run before the tree it imports exists, and the lint
+// config (`eslint.config.js`), which must stay runnable in a clean room where that tree has not
+// been generated yet. Naming the same files twice drifted once; both consumers now read this
+// module, so a new bound suite enters the list here and both surfaces follow.
+//
+// One row per generated contract tree, listing every test file that imports from it. Rows stay
+// per-tree so the recovery command a missing tree names is stated once, never repeated per suite.
+//
+// The exclusion rule: a suite that derives its graph in memory never belongs here — the corpus
+// oracle (`test/self-hosting-graph.test.ts`) and the contracts self-check
+// (`test/self-hosting-contracts.test.ts`) import no contract, so listing them would weaken lint
+// and demand a generation neither needs.
+
+export const contractDependentSuites = [
+  {
+    contracts: "generated/contracts",
+    generation: "npm run generate:self-hosting",
+    testPaths: [
+      "test/self-hosting-carrier.test.ts",
+      "test/self-hosting-duplicate-ids.test.ts",
+      "test/self-hosting-extraction.test.ts",
+      "test/self-hosting-model.test.ts",
+      "test/self-hosting-projections.test.ts",
+      "test/self-hosting-sdp-import.test.ts",
+      "test/self-hosting-validators.test.ts",
+    ],
+  },
+  {
+    contracts: "examples/checkout-v1/generated/contracts",
+    generation: "npm run generate:example",
+    testPaths: ["examples/checkout-v1/test/orders/create-order.valid-cart.test.ts"],
+  },
+];
+
+/** The repository-root tree — the one whose suites fall inside the typed-lint globs. */
+export const rootContractDependentSuite = contractDependentSuites[0];

docs/concept/07-mvp-roadmap-and-open-questions.md

@@ -121,7 +121,7 @@ the standing invariant plus where its protection lives.
 - **④ `implemented` is a UI hazard — view-label only.** Model semantics are settled (binding, never
   liveness — MD-7): the internal fact name stays `implemented` (it powers the `implemented ∧ ¬ready` drift
   query), and views render binding language instead: *"Implementation binding: present / Verifier binding:
-  present / Runtime observation: not tracked."*
+  present / Expected-outcome oracle: none / Runtime observation: not tracked."*
 - **⑤ `coverage-unknown` is acceptance, never a design note.** File-level blast-radius (the reader, `06` §2)
   reports a changed-but-unanchored file as an explicit `coverage-unknown` item, never silently
   under-reporting — test-pinned, so a too-small reach set is a caught regression, not a rendering choice.

eslint.config.js

@@ -3,6 +3,8 @@ import globals from "globals";
 import tseslint from "typescript-eslint";
 import { fileURLToPath } from "node:url";
 
+import { rootContractDependentSuite } from "./contract-dependent-suites.mjs";
+
 const tsconfigRootDir = fileURLToPath(new URL(".", import.meta.url));
 const typedTsFiles = ["src/**/*.ts", "test/**/*.ts", "tsup.config.ts", "vitest.config.ts"];
 const exampleTsFiles = ["examples/**/*.ts"];
@@ -50,18 +52,14 @@ export default tseslint.config(
     // The root generated contracts are intentionally absent until the later generate:self-hosting
     // gate leg. Typecheck runs after that generation and checks these tests' contract types; lint
     // keeps all other rules enabled without making the required lint-before-generation order depend
-    // on ignored derived output. This list is the bound-suite half of `vitest-test.mjs`'s root
-    // contract-dependency row — every suite that imports `generated/contracts/` belongs here, and
-    // a suite that derives its graph in memory (the corpus oracle, the contracts self-check) must
-    // not, so lint keeps full strength where nothing is missing in a clean room.
-    files: [
-      "test/self-hosting-carrier.test.ts",
-      "test/self-hosting-duplicate-ids.test.ts",
-      "test/self-hosting-extraction.test.ts",
-      "test/self-hosting-model.test.ts",
-      "test/self-hosting-sdp-import.test.ts",
-      "test/self-hosting-validators.test.ts",
-    ],
+    // on ignored derived output. The file list is derived from the shared
+    // `contract-dependent-suites.mjs` root row — the same rows `vitest-test.mjs` reads, so the two
+    // surfaces can no longer drift apart. Every suite that imports `generated/contracts/` belongs
+    // in that row, and a suite that derives its graph in memory (the corpus oracle, the contracts
+    // self-check) must not, so lint keeps full strength where nothing is missing in a clean room.
+    // Only the root tree's suites appear here: the example tree lints under `exampleTsFiles`,
+    // outside the typed-lint globs these exemptions relax.
+    files: [...rootContractDependentSuite.testPaths],
     rules: {
       "@typescript-eslint/no-unsafe-argument": "off",
       "@typescript-eslint/no-unsafe-assignment": "off",

plans/17-self-hosting-v1.md

@@ -453,7 +453,7 @@ the compact grouping below retains every listed concern and its durable disposit
 | Windows absolute excludes and `--exclude --foo` diagnostics | pre-existing/phase-2 | Exclude UX refinements are outside phase-1 acceptance. |
 | Path-prefix matcher coverage | deferred | Add a focused regression when exclusion handling is next changed. |
 | Library-seam exclusion wording | deferred | Public library diagnostics can be separated from CLI wording later. |
-| Indirect assembly of the `then` graph key | fixed-by-remediation | `cd735ae` names the key directly. |
+| Indirect assembly of the `then` graph key | fixed-by-remediation | `cd735ae` names the key directly. [Erratum, recorded at the phase-4 close: this row was false shortly after it was written — `fcd5cef`, a same-cluster grammar-hardening commit nine hours later, silently reintroduced the indirection, and it stood for three phases. Normalized for real at the phase-4 close; see plan 21 §6 and reviews/10 T-1.] |
 | Design Review dynamic-key ordering | deferred | Re-parsed graph rendering determinism is a projection follow-up. |
 | Design Review escaping outside prose slots | pre-existing/phase-2 | TS-carrier authored HTML policy needs a scoped rendering decision. |
 | GWT, examples, flows, and example-space permutation coverage | fixed-by-remediation | `f8b26f5` adds byte-equality permutation coverage. |

plans/18-self-hosting-phase-2.md

@@ -302,7 +302,7 @@ round-trip catalog is declared before implementation and may change only by an e
 - **Executed delivery:** `sdp import` landed as the durable, fs-free import seam with the CLI write-beside and `--dry-run` boundary; all eleven checkout Specs migrated atomically to Markdown; the canonical-default carrier rule replaced the interim rule; the bounded parser refusal-parity claim, decision-spec fold, and four honest corpus waves landed. The resulting self-hosting graph holds 58 Specs, 1 Pack, and 36 anchors, with 7 `ready` and 51 `defined` Specs.
 - **Session SHA summary:** G1 is `f06f14d`; G2 is `df444f2`; G3 is `0bb200a`; G4, G5, G6, and G8 are consolidated at `67cfda7` under the continuation directive; G7 remains `b471189034e1ee238394f3364c349937be6bebed` because its corpus and fold-completion evidence was accepted independently before the whole-phase close.
 - **Watch items:** all five terminal states are unfired. Table sugar was not forced because waves used existing sibling Specs and ruled body forms. The single-literal vocabulary form was unnecessary beyond the ruled literal syntax. No wave required a multi-entry constraint. New prose stayed under existing typed section owners, leaving the array-section sub-owner unfired. The Pack remains a TypeScript manifest, with no caller requiring Markdown Pack authoring.
-- **Docket close:** the twelfth preflight leg and decision-spec namespace divergence are done; the indirect `then` key and the Model term named `description` are verified; and the checkout duplicate-carrier fixture exemption remains an explicit preserved test-fixture exception.
+- **Docket close:** the twelfth preflight leg and decision-spec namespace divergence are done; the indirect `then` key and the Model term named `description` are verified [Erratum, recorded at the phase-4 close: the indirect `then` key was **not** verified — the phase-1 fix had silently regressed before this row was written. See plan 21 §6 and reviews/10 T-1.]; and the checkout duplicate-carrier fixture exemption remains an explicit preserved test-fixture exception.
 - **Deferred tail:** no-reparse spy coverage remains deferred because named-import interception is weaker than an injected read seam. Temporal token assembly remains deferred because the sanctioned temporal-guard pattern still applies; its comment can be narrowed later.
 - **Lean registry rulings:** the phase admitted `spec:decisions.*` records for the executable meta-model, naming and one-primitive laws, binding and section ownership, the typing and readiness-floor laws, one validation path, the `.sdp.ts` extension and carrier ruling, prose ownership, point-per-example, and the exclusion and envelope-grammar contracts. The Pack, agent-surface, and deferred-MCP decisions joined them; D1, D2, and D4 remain carried by their ordinary Specs. Each admission passed the three-part durability test and is linked from the lean registry.
 - **Close evidence:** the acceptance assembly, adversarial-review remediation, and clean-clone and installed-package proofs are recorded in [task 40](../.omo/evidence/self-hosting-phase-2/task-40-self-hosting-phase-2.acceptance.md), [task 41](../.omo/evidence/self-hosting-phase-2/task-41-self-hosting-phase-2.review.md), and [task 42](../.omo/evidence/self-hosting-phase-2/task-42-self-hosting-phase-2.final-proofs.log).
@@ -335,7 +335,7 @@ Planned disposition is not execution evidence. Every row starts pending and clos
 | Carrier-truth comment and temporal token assembly (review-06) | Records cluster adopts comment; token assembly deferred | done — comment now states only blockquote stripping and whitespace collapse; temporal token assembly remains deferred under the sanctioned temporal-guard pattern |
 | Stale provenance wording and plan-16 evidence dispositions (review-06) | Adopt with records cluster | REPAIRED — approval artifact wording aligns with CONTEXT; plan-16 repair items dispositioned below |
 | Twelfth preflight leg and decision-spec namespace divergence (review-06) | Verify preflight; resolve namespace in fold | done — the recorded preflight chain delta is benign, and the `spec:decisions.*` namespace fold landed |
-| Indirect assembly of the `then` graph key (review-06) | Verify remediation remains intact | verified — phase-1 remediation names the `then` key directly |
+| Indirect assembly of the `then` graph key (review-06) | Verify remediation remains intact | verified — phase-1 remediation names the `then` key directly. [Erratum, recorded at the phase-4 close: this verification was false when written — the fix it re-verified had already been reverted by a same-cluster commit, and the row was trusted rather than re-measured against the file. See plan 21 §6 and reviews/10 T-1.] |
 | Model term named `description` (review-06) | Verify remediation remains intact | verified — phase-1 remediation preserves the Model term named `description` |
 | Checkout duplicate-carrier fixture exemption (review-06) | Preserve as explicit fixture exception | preserved as explicit fixture exception — the deliberate dual-carrier fixture remains outside the one-canonical-surface product rule |
 | Exclude/CLI cluster (brief §6) | Land in tranche 1 | done s1 — loud Windows absolute rejection, flag-operand usage diagnostics, segment-boundary coverage, and library/CLI wording separation landed |

plans/18a-self-hosting-phase-2-execution.md

@@ -149,7 +149,7 @@ because its carried-forward rationale remains sanctioned. No row was silently dr
 | YAML scalar, line-number, document-end, non-mapping-root, cap-flood, GWT, heading, and duplicate-`When` grammar rows | plan-17 and review-06 grammar cluster | done s3 | [Task 18](../evidence/self-hosting-phase-2/task-18-self-hosting-phase-2.vitest.log) |
 | Windows-exclude, malformed-flag, matcher, and library-wording rows | plan-17 and review-06 exclude cluster | done s1 | [Task 10](../evidence/self-hosting-phase-2/task-10-self-hosting-phase-2.red.log), [task-40 green gate](../evidence/self-hosting-phase-2/task-40-self-hosting-phase-2.acceptance.md#current-green-gate) |
 | Dynamic-key ordering and non-prose escaping | plan-17 and review-06 Design Review cluster | done s2 | [Task 15](../evidence/self-hosting-phase-2/task-15-self-hosting-phase-2.vitest.log) |
-| Indirect `then`, GWT permutation, `description`, bound-example, and fixture-byte rows | plan-17 phase-1 remediations | dropped already fixed by phase-1 remediation | [plan-17 record](../../plans/17-self-hosting-v1.md) |
+| Indirect `then`, GWT permutation, `description`, bound-example, and fixture-byte rows | plan-17 phase-1 remediations | dropped already fixed by phase-1 remediation. [Erratum, recorded at the phase-4 close: the indirect `then` row was not in fact fixed by the phase-1 remediation — the fix was reverted inside the same cluster, so dropping the row left the defect live until the phase-4 close. See plan 21 §6 and reviews/10 T-1.] | [plan-17 record](../../plans/17-self-hosting-v1.md) |
 | Row-3 enrichment delta | plan-17 | dropped it remains the sanctioned `scoped` to `defined` maturity record | [plan-17 record](../../plans/17-self-hosting-v1.md) |
 | No-reparse spy coverage | plan-17 | deferred Named-import interception remains weaker than an injected read seam. | [plan-17 record](../../plans/17-self-hosting-v1.md) |
 | Carrier-truth comment, stale provenance, and plan-16 evidence dispositions | plan-17 and review-06 records cluster | done s6 | [fold ledger](#fold-ledger), [Task 39](../evidence/self-hosting-phase-2/task-39-self-hosting-phase-2.g7.md) |