diff --git a/crates/aura-runner/src/member.rs b/crates/aura-runner/src/member.rs index 738af90..f3bd674 100644 --- a/crates/aura-runner/src/member.rs +++ b/crates/aura-runner/src/member.rs @@ -159,8 +159,8 @@ fn no_data_in_window(symbol: &str, from_ms: Option, to_ms: Option, env /// Resolve the per-instrument pip from the recorded geometry sidecar, or refuse /// (#297: returned, not printed) when the symbol has no recorded geometry — the -/// single home of the guessed-pip refusal, shared by `open_real_source` and the -/// CLI shell's `DataSource::from_choice`. Reads the symbol's geometry metadata +/// single home of the guessed-pip refusal, shared by `open_real_source` and +/// reproduce's `DataSource::from_choice` chain (`family.rs`). Reads the symbol's geometry metadata /// (not bar data) before the run source opens, so an instrument with no /// recorded geometry refuses without a guessed pip; the pip is the provider's /// recorded value, honest by construction. diff --git a/docs/authoring-guide.md b/docs/authoring-guide.md index e6dc174..893195d 100644 --- a/docs/authoring-guide.md +++ b/docs/authoring-guide.md @@ -855,9 +855,9 @@ mismatch, a compile error, a tap-bind content fault (unknown fold/tap, duplicate) — are the content of the argv-named file and exit 2 like a usage error; only its environment refusals (a tap-trace store write failure) exit 1. The no-data family (no local data, no data in the requested window, -no recorded geometry) belongs to the real-data verbs — `aura run`, -`reproduce`, the campaign legs — where it likewise exits 1 (#297; the full -partition lives in [C14](design/contracts/c14-headless-two-faces.md)). `aura +no recorded geometry) belongs to the real-data paths — `reproduce` and the +campaign legs — where it likewise exits 1 (#297; the full partition lives +in [C14](design/contracts/c14-headless-two-faces.md)). `aura reproduce`'s identity/pip guard (a stored member's recorded instrument or broker/pip label contradicting the source it re-derives against) is likewise class 1 on the plain verb — its source is derived from the diff --git a/docs/design/contracts/c14-headless-two-faces.md b/docs/design/contracts/c14-headless-two-faces.md index eb1c8aa..92c568d 100644 --- a/docs/design/contracts/c14-headless-two-faces.md +++ b/docs/design/contracts/c14-headless-two-faces.md @@ -95,6 +95,17 @@ mismatch, unknown param, compile error) is class 2 argv-content; a well-formed value the node itself refuses in its own domain is class 1, regardless of which leg hit it. +**The reproduce guard's classes are context-borne (#299, 2026-07-26).** +Reproducing a stored family refuses up front when the effective data +source's identity or pip/broker geometry contradicts the member manifests +(divergence would be mechanical — refusing beats reporting a false +`DIVERGED`). The refusal prose is one; the class is carried by who named +the source: the explicit-source library seam (`reproduce_family_in`) +refuses class 2 (the caller named it), while the plain verb's derived +path — the source is reconstructed from the manifest — refuses the same +drift as class 1 (environment/data: a re-ingested sidecar, a stored label +outside the known shapes; nobody named the faulting input). + **Single document grammar (#319, 2026-07-25).** The five dual-grammar subcommands (run/sweep/walkforward/mc/generalize) that used to keep two grammars under one token are retired; one verb, `exec `, dispatches diff --git a/docs/design/contracts/c28-stratification.md b/docs/design/contracts/c28-stratification.md index 8d9b282..b0b0347 100644 --- a/docs/design/contracts/c28-stratification.md +++ b/docs/design/contracts/c28-stratification.md @@ -185,6 +185,11 @@ reports it through its existing string-error channel into the campaign summary's exit. Refusal prose is byte-identical everywhere; only who prints it changed, plus — per the adjudicated C14 partition — the exit class of refusals whose fault is in the content of what argv named. +What remains printing in the assembly crate is the deliberate note/info +residuum — the fold/trace notes and the traces-persisted line +(`runner.rs`) and the stale-dylib warning (`project.rs`) — benign +diagnostics that print and never exit; migrating them needs a note-channel +design of its own. ## See also - [C1](c01-determinism.md) — determinism / bit-identity, the correctness invariant the layer cuts preserve diff --git a/docs/design/contracts/c30-stability-discipline.md b/docs/design/contracts/c30-stability-discipline.md index 3802011..158da32 100644 --- a/docs/design/contracts/c30-stability-discipline.md +++ b/docs/design/contracts/c30-stability-discipline.md @@ -34,7 +34,10 @@ hand-maintained version. by build.rs). The aura-core stamp must be equally honest: a build-identity fingerprint derived mechanically from aura-core's sources, so a node dylib loads only against the aura-core it was - built from. A hand-maintained version that never moves disarms the + built from — *source-level* identity, an accepted limit: the + consuming build's lockfile and feature selection stay outside the + stamp, so the seam refuses staleness of aura-core itself, never the + full link graph. A hand-maintained version that never moves disarms the refusal (the pre-C30 state: `CORE_VERSION` frozen at 0.1.0 matched every stale dylib); a hand-bumped one re-arms it only between bumps — an implicit ABI promise this contract refuses to make. *(Re-armed by