vh
c5ac49356f
Nothing in flight. The in-flight section is rewritten to the post-release state and carries the five things a fresh session must not do: push (main is 8 ahead of origin/main), seed the registry, send the 17-handle note, run either dated prediction early, or start U7 without re-counting the booths first. Two new detail files: the release itself, and what each of the five review passes could only see alone -- the strongest evidence this repo has for running all of them rather than picking one. The earlier U6 entry is reconciled; it was written while the gates were still out and said NOT TAGGED. Restored in the rewrite: the warning that the 17 handles were never told `keep` stopped meaning "waiting on an answer", which is load-bearing for how the 2026-10-06 re-count reads, and the fact that a remote now exists.
3.3 KiB
Three cold panels on one unit, and what each lens could only see alone
2026-09-22 · booth
U6 ran all three /heid* gates plus two in-session passes. Every one of the
five found something the others structurally could not, which is the
strongest evidence this repo has for running them all rather than picking one.
The scoreboard
| gate | when | found |
|---|---|---|
| seam review (in-session, sibling-aware) | before code | 3 real contract defects — a claim about a sibling test that was false, resolve_booth named as a per-row predicate when it RAISES 404, and silence on percent-encoding |
| adversarial self-pass (in-session) | during | 4 defects — a FIFO hang, unquote leaking control characters, a fail-closed-by-accident guard, a stranded scratch file |
/heid-contract-review (4 arms) |
parallel | the import/apply selection gap, 4-of-4 — plus per-field cap semantics, and two passages of the document contradicting each other |
/heid-code-review (4 arms) |
parallel | 3 surface-drift findings 4-of-4, an IPv6 identity bug, and a falsifier that could not fail |
/heid-bug-hunt (4 arms) |
parallel | a <div> inside a <span>, a symlink disagreement, an append outside its lock |
The three findings worth remembering
1. The highest-value finding was a MISSING FEATURE, and the paraphrase lens
found it. bench import --apply registered every candidate while the same
contract said ~14 of 35 were bookmarks that must stay on the board. The dry-run
report existed because the decision is not mechanizable — and then --apply
ignored it. A code-vs-contract lens cannot see this: the code matched the
contract. Only reading the contract as prose, for what it promises a human,
surfaces "these two sentences cannot both be satisfied."
2. A falsifier that could not fail, again. INV-4's tie-break test went
through the registry, and _write_all serializes with sort_keys=True — so
both insertion orders came back off disk already id-sorted, and removing the
tie-break left the test green. Same class as the five vacuous U4 falsifiers.
We ran a vacuity pass and still shipped one; a cold reader caught it. See
2026-09-22-vacuous-falsifiers.
3. The single sharpest line came from a cross-module memory no new-module
review could have. Three bug-hunt arms independently noted that this repo
had already paid for the RecursionError class in marks.py, with a test
documenting it — and the new module re-introduced the unguarded parse. No
amount of reading benches.py in isolation surfaces that.
Complementarity, measured in both directions on one diff
The bug-hunt panel found three live defects the in-session pass missed — all three invisible to any test (a layout nesting, a symlink disagreement, a lock-ordering race). The in-session pass had already closed three of that panel's four convergent findings before the reply landed. Neither substitutes for the other, and this round is the cleanest specimen of it so far.
One finding was declined, with reasoning recorded in the contract: on a host
where booth.links cannot be imported, booth link now refuses every URL
rather than only booth ones. A guard that fails open is not a guard, and that
state is a broken install where most of the CLI is equally broken.