Lifts Soul's p8 (closed tick at the current ordinal refused before any cell)
and p9 (a 45-minute external advance moves the ordinal) into tests, and a
racing-open test for the create-only open. Fixes s2 ordinal-edges-unpinned.
Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
open_tick, close_tick and close_ticks_before lose `pub`: run_tick through
open_or_find is the only caller, and a compile_fail doctest pins that an
exported-type holder cannot call them. open_tick uses
OwnedRedbMessagePackBackingStore::insert_entry_if_absent in one write
transaction instead of read-then-push, so two opens of one ordinal cannot both
succeed. Fixes s2 tick-rows-have-a-public-writer and open-tick-is-check-then-put.
Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run-level order-reversed case now commits both cells through another
driver, each one's act having moved the other's scope, in either order; the
resuming run answers both with their receipts. Not built before this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The cell that acted is second in the frozen order; the first is in flight when
the run ends. Closes the order dependence budget_exhausted_stops_before_the_clock_and_resumes
only passed around.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A row that carries its submission body is resumed whatever the caller's scope
digest (the world answers it by command id); a row still in flight keeps the
digest gate. World and scope must always match. GroupedRun.refused names each
constituent that did not commit (LeftBeforeSelection, ScopeChanged,
WorldRefused); needs keeps decode problems only. A group submits declines
first, then exercises in the world's attention order read once.
Not verified at this commit (written before the first build).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The tick index is the world's TimeAdvanced count, read through a driver-only
mailbox door, and derive_cover takes it instead of now and the span. A tick
document ghostlight.verse_tick.v1 is written before the first cell and read by
any later run, so a resume under another span or cover budget finishes the open
tick as it was opened. The clock id is clock_command_id(world, ordinal) and is
pinned by a test. TickIndex::of and run_tick's per-call derive_cover are gone.
Fixes findings resume-rederives-tick-identity, tick-identity-collides-across-spans,
clock-id-unpinned. Not yet built or run at this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the operator-log cut at the tick's start revision against the act the
interrupted run left at that very revision. Builds; the mutation pass named it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the exit status of a Failed run against a provider that refuses every call,
and the positive-integer guard for ticks and token cap. Builds; the earlier
mutation pass named these as survivors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run that ends inside a tick (budget, pending cell, failed clock) now keeps
that tick's checkpoint with closed false, so what its cells committed is not
lost. A cell that committed before an interruption meets a moved scope
digest when the tick resumes and is refused as ScopeMoved; nothing commits
twice. Removes the temporary diagnostic. Builds; not yet re-verified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The faction that acted holds no opportunity until the clock moves, so the open
tick re-derives with one cell. Builds and passes except this assertion, which
this commit corrects.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
run_manual advances the verse world tick by tick under the recording port's
token cap: snapshot, opportunities and agency graph from the mailbox,
derive_cover, each cell on its members' current opportunities, one clock
advance, a checkpoint in ghostlight.verse_run.v1. A tick that cannot finish
leaves the clock where it was, so a later run re-derives the same cells and
command ids and the kernel answers from its ledger.
WorldMailbox::opportunities is the tick driver's own door beside agency_graph.
OperatorEvent now names the verb, its render path and the bound roles.
Not yet built or tested: this commit is the first write of the pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pins the trim of a faction Name into its institution label, genesis twice
(same intent: same receipt, nothing changes; another command id:
CreationTargetOccupied), and, as evidence for the open question
ship-acts-are-not-speech, that a phase A ship verb commits only as an
utterance. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CreateVerseWorldIntent lowers to one CreateWorld bound to the catalog's
grammar: a commons, one affordance per non-speak grammar verb (the kernel
supplies speak), and per faction an import-keyed institution granted every
verb plus a canonical fact citing aetheria:<commit>:aetheria.faction/<key>.
WorldMailbox::create_verse sends it through create_authenticated. The role
lowering moves into GrammarVerb::role_specs, which admits_roles now uses.
Also pins the reader's non-string allegiance key and invalid-UTF-8 refusals.
All commits build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The store re-sorts rows it writes, so the reversed-rows test never reached the
reader unsorted. Both file-shape tests now splice raw snapshot rows. Builds;
test-only change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The store's writer keeps one row per record key, so the previous test never
held two rows. Builds; the test crate is the only change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reader mints every faction and allegiance ImportKey and refuses a
non-canonical one as a typed NonCanonicalKey naming record and field (0 or 12);
two faction rows under one record key are DuplicateFaction. Payloads decode
through rmpv so a MessagePack bin or ext cell at a higher key (C# byte[],
DateTime) no longer fails the record. Tests pin the record-key sort and a
non-map Allegiance. Schema-version check (item 2) not done: CultLib gap.
All commits build (not yet run; the suite runs next).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Aetheria-written fixture binds only Faction, Cargo and Place, so mutants
deleting the Person and Population arms survived. The new test authors each
code at the role's key and reads it back as its own kind. Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
read_aetheria_catalog opens the catalog read-only, mirrors
aetheria.verse_grammar, aetheria.verse_verb and aetheria.faction by integer
key, and refuses unknown enums, bad verb or role names and a missing grammar
by record key. Fixture written by Aetheria's own fixture writer at master
92b82e9a (provenance beside it). Also the NFD/NFC position sweep for import
keys. Not yet built or run when committed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The replay-key test now covers schema_id, reasoning_summary,
output_format_name, tool_choice and prompt_cache_key beside the ten it
had, over a Vec so a future keyed field is one more row. Tests only;
every commit builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tests only, no production change. Both build. A late NFD sequence and a
late format character in a long lore-shaped path kill an is_nfc-on-prefix
mutant; a resolved effect carrying two subjects with one key kills a
fresh declared set in admit_resolved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run ledger is the one owner of what a run began as: its cap and the
world id and state digest it started from. Replay takes the store, the run
and a restored world and refuses a different world up front with a typed
error naming the field. Restores the decode checks the ledger rules do not
imply, makes the replay key an exhaustive destructure, and pins the
over-bound edge. Not yet built or tested at this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Soul's forgeries shaped as real keys (NFC vs NFD, ZWSP, NUL, BOM, RLO, BEL,
double space, tab, NBSP), a lore path with spaces admitted, and a loaded
state with a shared or malformed key refused. Test-only commit; builds if
the prior commit does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The record key is canonical free text per ruling import-key-canonical-text
(NFC, no Cc/Cf, only U+0020 whitespace, no edge or doubled space). The
resolver, admit_resolved and verify_state_shape all call the same predicate
and import_key_fault; admit_resolved's second held-set iteration is deleted.
Adds unicode-normalization and unicode-properties. Not yet verified on
Yggdrasil; build status of this commit unproven.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ImportKey (schema, record) rides SubjectDeclaration and SubjectState as an
optional field (serde default, skipped when None, so keyless worlds keep their
digests) and is exposed on SubjectSnapshot. resolve_patch, the one resolution
owner for genesis and the owner, consumer, Play and elaborator doors, refuses a
malformed key, a key declared twice in one patch, and a key any existing subject
holds, retired included. admit_resolved, the subjects map's only writer, holds
the same injectivity as an invariant. Typed mismatches name the handle only.
Compile-checked (cargo check --tests) on Starfire; tests not yet run, so no
claim that this commit's tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A record with a run id that is no key segment has no readable ledger, and a
record at sequence zero fails the density rule at open; the two decode_row
conditions were equivalent mutants (cargo-mutants missed both). Builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner declares unanswered only in Draft, and the forged-effect twin refuses
a kind the world already holds. Test-only; builds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GrammarBinding::refusal is the single grammar predicate. The resolver maps it
to Mismatch, and admit_resolved (the catalog's only writer, reached by
apply_effect) maps it to an Invariant error, so an effect resolved elsewhere
cannot install an out-of-grammar entry. The speak entry must also be bound as
a Conversation verb (Mismatch::SpeakRenderPathDisagreesWithGrammar).
Tests: owner, play, consumer and elaborator doors refuse kind and role
signature after the revision has moved past genesis; speak bound as ShipAction
is refused at bind; apply_effect refuses a forged effect.
Builds (cargo check --tests, Starfire compile only). Merge of origin/main
8d263bb was mechanical (no conflicts).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two reserve mutants timed out because the test spun waiting for a call a
mutant had refused. The wait is now bounded and fails. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The in-memory run tally no longer counts rows (only open used it); the store
test pins a record whose run id is not a key segment; the lend_tool_results
forwarding has a test; the in-flight test fails by timeout instead of hanging
when a held call is let through. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ProviderCallRecord (ghostlight.verse_provider_call.v1) keyed (run id, sequence),
CallRecordStore over an owned redb CultCache file, RecordingInferencePort
(bound check before the call, real usage charged after, record written before
the output returns) and ReplayInferencePort. InferenceFaultClass gains
BudgetExhausted. Not yet compiled or run: this commit may not build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up hosted-key-del-pin: a mutant allowing DEL survived the key-shape
test. The case list gains an interior DEL. Builds: yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
