RED-first fixes for the three bugs the source-blind field test caught. Two
are the same failure the whole cycle keeps circling: prose that tells a
caller something the code does not do.
- The chart not-found refusal prescribed `aura exec --tap <NODE.FIELD>=<FOLD>`.
The selector takes a declared tap NAME, so following the refusal verbatim
earns a second refusal ("the tap plan names 'sub.value', but the blueprint
declares no such tap"), and the flag is not needed at all — a plain run
records every declared tap. This sentence predates the cycle and was carried
over verbatim while the rest of the refusal was corrected; the field test
ran it as written, which is exactly why it ran it.
- `aura measure ic <family-handle>` answered "no recorded run '…' under
runs/traces" for a handle that IS recorded — the value the campaign run
printed, that `chart` renders, whose directory exists. A family holds
members rather than one series, so IC is measured over a member. The
refusal now says that and lists the member keys, which also closes the
friction that nothing on any text surface prints them: reaching a member
previously meant the very `ls runs/traces/` this cycle set out to retire.
- C28's #297 note still gave the entry points' signature as the retired
`(_, Vec<String>)` pair in the present tense, contradicting C27 one contract
over. The close commit claimed lockstep; this makes it true.
Both code fixes have tests that fail without them. The field test also found
four friction items and two spec gaps, filed rather than fixed here.
refs #309
Architect review over 024e865..HEAD (issues #296/#348/#297/#299). Holds
confirmed: zero process::exit in the assembly crate with the milestone
promise pinned in-process; C1/C18 record shapes untouched with guard and
stamp sharing one label constructor; the C30/#348 re-arm transition-safe
with no stale references. Drift resolved in this commit: the C14 contract
now records the context-borne reproduce guard classes (#299), C30 carries
the source-level-identity limit in the contract itself (not only in
build.rs), the guide's exit-class prose no longer names the retired run
verb, C28 durably enumerates the deliberate print residuum, and the
pip_or_refuse doc names reproduce (not 'the CLI shell') as the from_choice
home.
Bench: all 5 fingerprints OK (engine/ingest/campaign_sweep/campaign_heavy/
cli_fixed_cost); metric deltas within load noise on a busy box (loadavg
12 warning), report-only, no baseline moved.
All 14 process::exit sites in aura-runner (member x8, measure x5,
translate x1) convert to RunnerError { exit_code, message } propagation;
run_signal_r / run_measurement return Result tuples carrying the
skipped-tap names beside the C18 reports (record shapes untouched), and
the CLI owns printing via the shared exit_on_runner_error arm (the
dispatch_reproduce pattern — reproduce now uses the same helper).
cost_knob becomes fallible: the sweep worker maps it into the cell's
MemberFault (closing the one hole in 'a worker never process-exits'),
the persist path keeps its string channel. The skipped-tap note is
CLI-printed from returned data, byte-identical.
The one deliberate behaviour change is the minuted C14 adjudication:
refusals in the content of what argv named (binding, synthetic mismatch,
compile, tap-bind content, exposes-neither) move exit 1 -> 2; the
boundary is FORM vs VALUE — an out-of-domain override value keeps the
runtime class via the panic containment, matching the campaign leg.
Environment/data/IO refusals stay 1 (TapPlanError::exit_class is the
single source). Named re-pins in exec.rs, run_refuses_unrunnable_
blueprint.rs, tap_recording.rs, graph_construct.rs; new library-level
test pins the milestone promise (a refusal returns in-process, the
embedding host survives). Prose is byte-identical everywhere.
Docs in lockstep: C28 deferred block closed (14 sites, hole closed),
C14 partition + form-vs-value boundary, C27 note emission, guide exit
classes. Fork minutes: issues/297#issuecomment-4868 and -4873.
closes#297
Cycle-close audit for the #283/#77 tap-subscribers cycle
(09994b8..6e3f394). Architect review: code contract-clean; what
holds — C1/C7/C8 (empty-output caller-built consumers, (Timestamp,
Cell) zero-heap payload, lifecycle hooks inside the sequential loop,
byte-identical twin-run and streamed-vs-legacy byte-equality pins),
C28 (assembly-crate placement of the writer-holding consumer,
c28_layering guard green), C25 (registry growth = new Rust entry,
data-expressible Named form, roster-enumerating refusals). All drift
items were doc lifts, resolved in this commit:
- C8: the lifecycle is now a symmetric pair — initialize() as
finalize's start-of-stream mirror (infallible by signature;
acquire-in-initialize, degrade-to-inert, surface-once-at-finalize);
history sidecar records the refinement and the #77 resolution the
old Deferred paragraph still carried as open.
- C27: Guarantee and Current state now describe the shipped model —
tap plan (Named{label, params} | Live) over the layered fold
registry, BOTH entry points (run_signal_r AND run_measurement) on
the one shared wiring pair, record streaming at constant memory.
- C28: aura-runner now defines one graph node of its own (the
in-graph record consumer — exactly the graph-meets-persistence
assembly position); the #297 refusal-site count grows ~20 → ~24
(the four tap-plan refusals, already typed before the exit).
- glossary §tap: the subscription/fold-registry sense added; Avoid
line steers probe/monitor/scope away from the observation slot.
Bench (report-only, loadavg 5.8 > 2 on the box — read with care),
all fingerprints OK, no regression:
engine_throughput bars_per_s 14005262 wall_s 0.714s Δ bars_per_s +3.0% wall_s -3.0%
ingest_throughput bars_per_s 12970670 wall_s 0.387s Δ bars_per_s +0.5% wall_s -0.5%
campaign_sweep cpu_percent 2202.0 peak_rss_mb 92.2 wall_s 1.396s Δ cpu_percent +1.5% peak_rss_mb -6.1% wall_s -1.5%
campaign_heavy cpu_percent 2155.0 peak_rss_mb 94.8 wall_s 5.585s Δ cpu_percent +1.8% peak_rss_mb -3.5% wall_s -0.4%
cli_fixed_cost help_ms 1.5ms run_ms 3.6ms Δ help_ms -1.8% run_ms -2.6%
No baseline update (report-only surface; no ratify due).
Correction on 6e3f394's body: "no Probe symbol is introduced
anywhere" — introduced is the operative word; the pre-existing
aura-core test fixture `struct Probe` stays, as the cycle's design
record specified.
Follow-ups on the tracker: #308 (legacy Recorder surface migration),
#307 (binary trace format). Cycle spec/plan working files discarded.
refs #283 refs #77
The single-file ledger had grown to 2968 lines / ~42k tokens, mixing
current design law with accreted history: 59 cycle-stamped realization
blocks, 18 [HISTORY] passages, 22 supersession markers, and the C10 /
C22 / C24 reframe sagas layered several supersessions deep. A
code-grounding audit (31 agents, adversarially verified) confirmed 11
defects stated as current truth: stale crate homes from the C28 #288
roster split (cost nodes, PositionManagement, PositionEvent, Session),
the renamed InputSpec->PortSpec, the pre-#241 project model in C16 and
the open-threads section, a stale HarnessKind retirement deferral in
C24, and three C28-internal inconsistencies.
New shape, per the ailang precedent:
- INDEX.md stays the sole addressable entry point: foundation, external
components, a C-id-keyed contract map (one line per contract), and
only the genuinely open architectural threads.
- contracts/cNN-<slug>.md carries each contract's current truth only:
Guarantee / Forbids / Why with ratified refinements integrated, plus
a code-anchored Current state. All confirmed defects are fixed here;
crate anchors were re-verified against the tree.
- contracts/cNN-<slug>.history.md (18 sidecars) and INDEX.history.md
preserve every superseded block verbatim, stamps and issue refs
intact, under a frozen-record banner. Nothing was deleted: superseded
design intent remains an addressable working-tree artifact, off the
per-cycle audit walk.
- Ledger discipline is now stated in INDEX.md: live files are edited in
place at cycle close, superseded text moves verbatim to the sidecar,
and a supersession marker in a live file is itself an audit finding.
Every contract file was verified against its old text by an independent
zero-loss pass (statement-by-statement) plus a code-accuracy spot check;
C-ids and contract titles are unchanged, so existing C-id citations in
code, tests, and issues resolve as before.
claude