Docs: correct executable catalog evidence anchors (#148)

[flyingrobots]

The v1 catalog ledger names absent ordering and filesystem publication test files. This correction points KEEP-CATALOG-003 to tests/catalog.rs and its tests/catalog/ordering_laws.rs module, and KEEP-CATALOG-008 to src/adapters/filesystem_catalog_publisher_tests.rs, which includes the existing filesystem fixture modules. Readers can now locate and execute the claimed evidence.

Closes #148. Branch starts at origin/main 8d90251.

Invariant and approach: preserve both catalog requirements and correct only their executable evidence anchors. Rejected alternatives: empty targets solely to make stale paths exist, or weaker requirements. Failure mode addressed: falsely named oracles cannot be located or executed.

Validation: RED Docker existence checks fail for both old paths on the exact parent. GREEN verifies actual owner files, module inclusion and absence of the stale ledger paths. Both ordering/duplicate-refusal laws and all16 filesystem publisher fixture laws pass in debug and release using the parent runtime and its dedicated source build directory. The initial filesystem test filter selected zero tests; that result was discarded and the corrected filter executed16 laws in each mode. Those unit fixtures use an unchecked test publisher and do not prove production platform admission. Markdownlint0.23.2 passes both changed pages; git diff --check passes. No new Rust tests or full-workspace run is claimed for these documentation-only commits. Hosted checks and independent review remain required before merge.

Benchmark impact: none. Format/API compatibility: unchanged. Recovery and security implications: runtime behavior and durability ordering are unchanged; evidence references are more precise. Original roadmap checkboxes and acceptance criteria are preserved. Commits423d517 and032cd27 address the two independently verified stale anchors within one coherent documentation outcome.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 50546a78-e88d-487c-b6c3-4fd7abadfd20

📥 Commits

Reviewing files that changed from the base of the PR and between b50dbd4 and 63b436c.

📒 Files selected for processing (2)

• CHANGELOG.md
• docs/formats/segment-store-v1/requirements.md

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

Additional verified documentation finding: KEEP-CATALOG-008 in docs/formats/segment-store-v1/requirements.md names absent tests/catalog_filesystem_publication.rs. Actual executable owner is src/adapters/filesystem_catalog_publisher_tests.rs, which includes the authority/directory/initialization/refusal modules under tests/catalog_filesystem_publication/. This belongs to the same coherent catalog-evidence anchor correction as #148; no runtime behavior or original acceptance requirement changes. RED: old owner path must exist (fails); GREEN: ledger names actual unit-test owner, included modules remain findable, relevant laws pass debug/release. Cc @codex.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[flyingrobots]

Independent Ultra-Strict Read-Only Code Review: Pull Request #149

Repository: flyingrobots/keep
Branch: fix/148-catalog-ordering-evidence
Exact Current Head: 63b436cdb778bf6138575bda90fd2e1854c81de4
Target Base: b50dbd4cb4cee286aea1aa0352152a232197dda1 (origin/main)
Current Merge Base: b50dbd4cb4cee286aea1aa0352152a232197dda1
Parent 1 (PR branch): 032cd278e8922d3bb59ed9c74b1704af8395e498
Parent 2 (origin/main): b50dbd4cb4cee286aea1aa0352152a232197dda1
Original Fork Point: 8d902516e682361882bc5c9902de296ce5c9de85
Total Changes: 2 files (+6 insertions, -2 deletions)
Author: James Ross <james@flyingrobots.dev>
Review Type: Ultra-strict read-only adversarial gate

---

Executive Summary

PR #149 executes a documentation-only correction of the version-one catalog requirement evidence ledger in docs/formats/segment-store-v1/requirements.md and records the resolution in CHANGELOG.md. It addresses issue #148 by replacing stale references to nonexistent test files with their actual executable test owners:

1. KEEP-CATALOG-003 Evidence Correction: The ledger previously named tests/catalog_ordering.rs, which is absent on disk and has never existed in git history. The ledger now names the executable root integration target tests/catalog.rs and its dedicated submodule tests/catalog/ordering_laws.rs, which contains 2 ordering and duplicate-refusal laws.
2. KEEP-CATALOG-008 Evidence Correction: The ledger previously named tests/catalog_filesystem_publication.rs, which is absent on disk and has never existed in git history. The ledger now names tests/catalog_publication.rs and the actual unit-test owner src/adapters/filesystem_catalog_publisher_tests.rs, which incorporates 16 filesystem publication laws across 4 submodules (authority_laws, directory_laws, initialization_laws, refusal_laws).
3. Merge Commit 63b436c Integration: Resolves origin/main (b50dbd4, incorporating PR fix(benchmark): admit complete canonical baseline reports #143 canonical benchmark admission) cleanly. The CHANGELOG.md conflict resolution retains both the PR Correct executable catalog evidence anchors in v1 ledger #148 catalog evidence correction entry and the PR Admit only complete canonical source-bound benchmark reports #142 canonical benchmark admission entry without loss of history or semantic regression.
4. Zero Runtime Modifications: No Rust code, configuration, or test logic was modified. All production, port, adapter, and benchmark invariants remain identical.

---

Findings

No P0–P5 defects, regressions, broken invariants, or formatting violations were found.

Coverage & Verification Notes

• Static & Git Inspection vs. Host Execution: In strict compliance with the independent gate mandate ("no edits, host tests, commits, pushes, comments, merges, config changes or agents"), no tests were run on the host system. Test existence, module linkage, and law assertions were verified statically from the repository tree and parent execution logs (main8d90251-integration.log).
• Test Publisher vs. Production Platform Admission: As caveated in the PR description, the unit test fixtures in src/adapters/filesystem_catalog_publisher_tests.rs use FilesystemCatalogPublisher::open_unchecked_for_tests, which bypasses FilesystemPlatformAdmission. They prove adapter-level state machine invariants and failure refusal, but do not demonstrate production platform admission.
• Durability Boundary: Unit and integration tests verify atomic rename and recovery state handling across process crashes. Directory synchronization and power-loss durability cannot be inferred from file synchronization or rename operations alone.

---

Seven-Part Review Protocol Audit

1. Every Code Path & Evidence Linkage

The changed documentation references two public requirement rows:

• KEEP-CATALOG-003 ("Catalog entries are sorted by logical identity and duplicate keys are refused independently of input order"):
  • Stale Path: tests/catalog_ordering.rs (absent on disk and across all git history).
  • Corrected Path: tests/catalog.rs, tests/catalog/ordering_laws.rs.
  • Module Linkage: tests/catalog.rs:13-14 declares #[path = "catalog/ordering_laws.rs"] mod ordering_laws;.
  • Executed Production Path: In src/lib.rs / src/catalog/, ChecksummedCatalog::decode calls decode_entries, enforcing identity sorting and rejecting duplicate logical identities with typed errors.
  • Executable Laws in Target:
    • tests/catalog/ordering_laws.rs:10-24 (catalog_refuses_duplicate_logical_identities) asserts CatalogDecodeError::DuplicateIdentity { first_index: 0, duplicate_index: 1 }.
    • tests/catalog/ordering_laws.rs:27-43 (catalog_refuses_out_of_order_logical_identities) asserts CatalogDecodeError::IdentityOrder { previous_index: 0, observed_index: 1 }.
• KEEP-CATALOG-008 ("Segment, catalog, and head publication follows the documented synchronization order..."):
  • Stale Path: tests/catalog_filesystem_publication.rs (absent on disk and across all git history).
  • Corrected Path: tests/catalog_publication.rs, src/adapters/filesystem_catalog_publisher_tests.rs.
  • Module Linkage: src/adapters/mod.rs:76-77 declares #[cfg(test)] mod filesystem_catalog_publisher_tests;.
  • Submodule Linkages: src/adapters/filesystem_catalog_publisher_tests.rs:3-10 includes:
    • Line 4: #[path = "../../tests/catalog_filesystem_publication/authority_laws.rs"] mod authority_laws; (2 laws)
    • Line 6: #[path = "../../tests/catalog_filesystem_publication/directory_laws.rs"] mod directory_laws; (3 laws)
    • Line 8: #[path = "../../tests/catalog_filesystem_publication/initialization_laws.rs"] mod initialization_laws; (2 laws)
    • Line 10: #[path = "../../tests/catalog_filesystem_publication/refusal_laws.rs"] mod refusal_laws; (6 laws)
    • Lines 38, 73, 182: 3 laws in root test file.
    • Total: 16 executable unit laws.

2. Merges are Changes (Audit of Merge 63b436c)

• Parent 1 (032cd278e8922d3bb59ed9c74b1704af8395e498): Docs commit adding src/adapters/filesystem_catalog_publisher_tests.rs for KEEP-CATALOG-008.
• Parent 2 (b50dbd4cb4cee286aea1aa0352152a232197dda1): origin/main containing PR fix(benchmark): admit complete canonical baseline reports #143 (commit 0aa063f, canonical benchmark admission).
• Merge Resolution: Clean integration.
  • In CHANGELOG.md:627-647, the PR Correct executable catalog evidence anchors in v1 ledger #148 entry was placed cleanly at the top of ### Fixed, immediately followed by the complete PR Admit only complete canonical source-bound benchmark reports #142 benchmark admission entry. No lines or historical changes from Admit only complete canonical source-bound benchmark reports #142, [BAD CODE™] Avoid double verification pass in reference read paths #71, or earlier PRs were lost or corrupted.
  • In docs/formats/segment-store-v1/requirements.md, changes applied cleanly without conflict (PR fix(benchmark): admit complete canonical baseline reports #143 did not touch requirements.md).
  • No code or runtime invariants introduced by PR fix(benchmark): admit complete canonical baseline reports #143 were disturbed.

3. No Trusted Claims

• Claim: Stale paths were absent. Verified: git log --all -- tests/catalog_ordering.rs tests/catalog_filesystem_publication.rs confirmed both files never existed in the repository.
• Claim: Modules include the actual laws. Verified: tests/catalog.rs:13-14 and src/adapters/mod.rs:76-77 explicitly wire the modules into test targets.
• Claim: Law counts. Verified: exactly 2 ordering laws in ordering_laws.rs; exactly 16 laws in filesystem_catalog_publisher_tests.rs and its 4 included modules.
• Claim: Unchecked publisher used in unit fixtures. Verified: src/adapters/filesystem_catalog_publisher_tests.rs:42,77 calls open_unchecked_for_tests.

4. Constants Against Evidence

• ENTRY_LENGTH = 160: Verified in tests/catalog.rs:52 against format specification in docs/formats/segment-store-v1/specification.md.
• FIRST_ENTRY_OFFSET = 128: Verified in tests/catalog.rs:45, matching 128-byte v1 catalog header.
• RETAINED_SEGMENT_LIMIT = 1_048_576: Verified in src/adapters/filesystem_catalog_publisher_tests.rs:34.
• CATALOG_DIGEST = "04b82519b0399baefd0b9c0f32a871052e4c47e3a00226ab03b21661470f7320": Verified against frozen conformance fixture conformance/segment-store/v1/one-zero-catalog.hex.

5. Derived Numeric Counts & Exact Intersection Analysis

• Files Modified: Exactly 2 files (CHANGELOG.md, docs/formats/segment-store-v1/requirements.md).
• Diff Stat: 6 insertions, 2 deletions across the PR branch against target b50dbd4.
• Commits on Branch: 3 commits (423d517, 032cd27, 63b436c).
• Requirements Corrected: 2 rows (KEEP-CATALOG-003, KEEP-CATALOG-008).
• Executable Test Laws:
  • Ordering laws: exactly 2.
  • Filesystem publisher laws: exactly 16 (3 file-level + 2 authority + 3 directory + 2 initialization + 6 refusal).
• PR 149 Activity & Pagination:
  • pr149-comments.json: 4 comments (1 Codex bot, 1 CodeRabbit bot, 1 author scope note, 1 Codex bot environment note).
  • pr149-reviews.json: 0 reviews ([]).
  • pr149-threads.json: 0 review threads (nodes: [], pageInfo.hasNextPage: false).

6. Errors and State Machines

• CatalogDecodeError Assertions: tests/catalog/ordering_laws.rs tests precise enum variants DuplicateIdentity { first_index: 0, duplicate_index: 1 } and IdentityOrder { previous_index: 0, observed_index: 1 }.
• Publication Refusal Invariants: tests/catalog_filesystem_publication/refusal_laws.rs validates stale expected generation, unexpected segment publication, conflicting catalog digests, corrupted stages, missing predecessor heads, and non-monotonic generation leaps. Refusals abort prior to mutating storage.

7. Repository Standards & AGENTS.md Conformance

• Pure Rust edition 2024: Maintained (0 Python scripts).
• Zero Runtime Code Modification: Pure docs-only PR.
• File Lengths:
  • docs/formats/segment-store-v1/requirements.md: exactly 200 lines (meets target file size of 200 lines).
  • tests/catalog.rs: 94 lines.
  • tests/catalog/ordering_laws.rs: 53 lines.
  • src/adapters/filesystem_catalog_publisher_tests.rs: 199 lines (under 200-line target).
• Formatting: git diff --check passed cleanly with 0 whitespace errors. MD013 is properly disabled for requirements table rows.

---

Mandatory Verification Checklist

Check Category	Verification Evidence & Exact File Coordinates	Status
Path: KEEP-CATALOG-003 Entry	docs/formats/segment-store-v1/requirements.md:74 -> tests/catalog.rs:13-14 -> tests/catalog/ordering_laws.rs:1-53	VERIFIED
Path: KEEP-CATALOG-008 Entry	docs/formats/segment-store-v1/requirements.md:79 -> tests/catalog_publication.rs:1-120 & src/adapters/filesystem_catalog_publisher_tests.rs:1-199	VERIFIED
Path: Publisher Module Linkage	src/adapters/mod.rs:76-77 (#[cfg(test)] mod filesystem_catalog_publisher_tests;)	VERIFIED
Path: Publisher Submodule Inclusions	src/adapters/filesystem_catalog_publisher_tests.rs:3-10 (authority_laws, directory_laws, initialization_laws, refusal_laws)	VERIFIED
Merge: Parent SHAs & Base	Merge: 63b436c, Parent 1: 032cd27, Parent 2: b50dbd4, Merge base: 8d90251	VERIFIED
Merge: PR #143 Preservation	CHANGELOG.md:631-647 (Retains full #142 canonical admission text immediately following #148 entry)	VERIFIED
Merge: Zero Code Diffs	git diff b50dbd4...63b436c -- src xtask fuzz benchmark benches tests produces empty output	VERIFIED
Stale Anchor Nonexistence	tests/catalog_ordering.rs & tests/catalog_filesystem_publication.rs confirmed absent in working tree and git log	VERIFIED
Evidence: Ordering Laws	Exactly 2 laws in tests/catalog/ordering_laws.rs:10,27	VERIFIED
Evidence: Filesystem Laws	Exactly 16 laws (3 in root publisher tests + 2 authority + 3 directory + 2 initialization + 6 refusal)	VERIFIED
Test Fixture Posture	Publisher unit fixtures use open_unchecked_for_tests (filesystem_catalog_publisher_tests.rs:42,77); properly caveated as non-production platform admission	VERIFIED
PR Activity & Pagination	pr149-comments.json (4 comments), pr149-reviews.json (0), pr149-threads.json (0 threads, hasNextPage: false)	VERIFIED
Formatting & Whitespace	git diff --check passes cleanly; MD013 disabled on requirements table; paragraphs properly formatted	VERIFIED
Check Accounting	Statically executed: git topology, diff --check, grep, law counts, json pagination. Inspected only: parent Docker logs, conformance fixtures, markdownlint rules. Skipped: host cargo test. Unavailable: physical power loss.	VERIFIED

---

Verdict

APPROVE

Primary correction: checklist merge base is b50dbd4, actual byte grammar is catalog.md, and production trace belongs to catalog_decoder/catalog_entry_sequence adapters. Simulated fixtures are not process-death execution. Separate issue150 remains unresolved. Complete corrected review requested; prior approval is not yet the gate. Cc @codex.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[flyingrobots]

Independent Ultra-Strict Read-Only Code Review: Pull Request #149 (Revised)

Repository: flyingrobots/keep
Branch: fix/148-catalog-ordering-evidence
Exact Current Head: 63b436cdb778bf6138575bda90fd2e1854c81de4
Target Base: b50dbd4cb4cee286aea1aa0352152a232197dda1 (origin/main)
Current Merge Base (origin/main vs HEAD): b50dbd4cb4cee286aea1aa0352152a232197dda1
Historical Fork Point (prior to merge 63b436c): 8d902516e682361882bc5c9902de296ce5c9de85
Parent 1 (PR branch pre-merge): 032cd278e8922d3bb59ed9c74b1704af8395e498
Parent 2 (origin/main): b50dbd4cb4cee286aea1aa0352152a232197dda1
Total Changes: 2 files (+6 insertions, -2 deletions)
Author: James Ross <james@flyingrobots.dev>
Review Type: Ultra-strict read-only adversarial gate

---

Executive Summary

PR #149 executes an atomic, documentation-only correction of the version-one catalog requirement evidence ledger in docs/formats/segment-store-v1/requirements.md and records the fix in CHANGELOG.md. It resolves issue #148 by replacing stale references to nonexistent test files with their actual executable test targets and unit owners:

1. KEEP-CATALOG-003 Evidence Anchor: Stale reference tests/catalog_ordering.rs (which does not exist in the working tree or reachable git history) is corrected to name the public integration target tests/catalog.rs and its included module tests/catalog/ordering_laws.rs, containing 2 executable ordering and duplicate-refusal laws.
2. KEEP-CATALOG-008 Evidence Anchor: Stale reference tests/catalog_filesystem_publication.rs (which does not exist in the working tree or reachable git history) is corrected to name tests/catalog_publication.rs and the actual unit-test owner src/adapters/filesystem_catalog_publisher_tests.rs, which incorporates 16 filesystem publication laws across 4 submodules (authority_laws, directory_laws, initialization_laws, refusal_laws).
3. Merge Integration 63b436c: Merge commit 63b436c cleanly integrates target main b50dbd4 (PR fix(benchmark): admit complete canonical baseline reports #143 canonical benchmark report admission). The merge resolution in CHANGELOG.md:627-647 retains both the PR Correct executable catalog evidence anchors in v1 ledger #148 catalog evidence correction entry and the PR Admit only complete canonical source-bound benchmark reports #142 canonical benchmark admission entry verbatim.
4. Source Runtime Unchanged: Zero lines of Rust code, configuration, or tests are modified.
5. Issue Preserve platform admission across public catalog publisher routes (T-12.2) #150 Evaluation: Newly verified issue Preserve platform admission across public catalog publisher routes (T-12.2) #150 (where the public repository-tasks constructor FilesystemCatalogPublisher::open_unchecked_for_repository_tasks accepts a FilesystemWriterLock from production initialization that refused AdmitPlatform) is a pre-existing source defect from milestone T12.2 acceptance. It was not introduced by PR Docs: correct executable catalog evidence anchors (#148) #149. PR Docs: correct executable catalog evidence anchors (#148) #149 does not claim to resolve Preserve platform admission across public catalog publisher routes (T-12.2) #150 and is independently mergeable without waiving any acceptance criterion.

---

Findings

No P0–P5 code defects, regressions, or AGENTS.md policy violations were introduced by PR #149.

Coverage & Environmental Limitations

• Inspected vs. Executed: Per strict gate instructions ("no edits, host tests, Git mutations, comments, config or agents"), no tests were run on the host system. Test existence, module inclusion, and law assertions were verified statically from the repository tree and parent execution logs (main8d90251-integration.log).
• In-Process Unit Fixtures vs. Physical Power-Loss Testing: The 16 filesystem unit fixtures in src/adapters/filesystem_catalog_publisher_tests.rs and the fault-injection tests in tests/catalog_publication.rs are in-process Rust tests using ephemeral temp directories (TestDirectory) and simulated in-memory storage ports. They are NOT executed process-death or power-loss tests. Process-death survival is not physical power-loss proof, and directory synchronization cannot be inferred from file synchronization or atomic rename operations.
• Unchecked Test Publisher: Fixtures in src/adapters/filesystem_catalog_publisher_tests.rs:42,77 call FilesystemCatalogPublisher::open_unchecked_for_tests, which bypasses FilesystemPlatformAdmission. They prove adapter-level state machine invariants and failure refusal, but do not establish production platform admission.
• Historical Nonexistence Boundary: Nonexistence of tests/catalog_ordering.rs and tests/catalog_filesystem_publication.rs is verified strictly across the current repository tree and all commits reachable in git history at 63b436c and b50dbd4.
• Pre-Existing Defect (Issue Preserve platform admission across public catalog publisher routes (T-12.2) #150): src/adapters/filesystem_catalog_publisher.rs:88-96 exposes open_unchecked_for_repository_tasks, which admits an unchecked writer lock without enforcing platform admission checks. This pre-existing issue remains open and must be resolved in its own atomic PR; it does not block the documentation-only fix in PR Docs: correct executable catalog evidence anchors (#148) #149.

---

Seven-Part Review Protocol Audit

1. Every Code Path & Exact Runtime Dispatch

The PR changes documentation referencing two public requirement rows. The actual runtime dispatch paths and executable evidence are:

A. KEEP-CATALOG-003 (Catalog Entry Sorting & Duplicate Refusal)

• Stale Ledger Anchor: tests/catalog_ordering.rs (absent on disk and in inspected git history).
• Corrected Ledger Anchor: tests/catalog.rs, tests/catalog/ordering_laws.rs.
• Test Target Module Linkage:
  • Root integration test: tests/catalog.rs.
  • Module declaration: tests/catalog.rs:13-14 (#[path = "catalog/ordering_laws.rs"] mod ordering_laws;).
• Production Dispatch Trace:
  1. Entry point: src/adapters/checksummed_catalog.rs:63-65:
     ChecksummedCatalog::decode(encoded) delegates directly to catalog_decoder::decode(encoded).
  2. Admission pipeline: src/adapters/catalog_decoder.rs:15-26:
     catalog_decoder::decode calls catalog_header_decoder::decode, validate_header, validate_observed_length, catalog_integrity::validate, and catalog_entry_sequence::validate(encoded, metadata.entry_count()).
  3. Entry stream validation: src/adapters/catalog_entry_sequence.rs:9-36:
     catalog_entry_sequence::validate slices entry bytes, iterates chunks_exact(160), decodes each entry with catalog_entry_decoder::decode, and calls validate_order(previous, index, decoded.identity()).
  4. Ordering & duplicate enforcement: src/adapters/catalog_entry_sequence.rs:38-57:
     Evaluates previous_identity.cmp(&observed):
     • Ordering::Equal: returns Err(CatalogDecodeError::DuplicateIdentity { first_index: previous_index, duplicate_index: observed_index }).
     • Ordering::Greater: returns Err(CatalogDecodeError::IdentityOrder { previous_index, observed_index }).
     • Ordering::Less: returns Ok(()).
• Executable Laws in Target:
  • tests/catalog/ordering_laws.rs:10-24: catalog_refuses_duplicate_logical_identities asserts exact typed failure CatalogDecodeError::DuplicateIdentity { first_index: 0, duplicate_index: 1 }.
  • tests/catalog/ordering_laws.rs:27-43: catalog_refuses_out_of_order_logical_identities asserts exact typed failure CatalogDecodeError::IdentityOrder { previous_index: 0, observed_index: 1 }.

B. KEEP-CATALOG-008 (Publication Synchronization, State Recovery & Refusal)

• Stale Ledger Anchor: tests/catalog_publication.rs, tests/catalog_filesystem_publication.rs (tests/catalog_filesystem_publication.rs absent on disk and in inspected git history).
• Corrected Ledger Anchor: tests/catalog_publication.rs, src/adapters/filesystem_catalog_publisher_tests.rs.
• Module Linkage:
  • Unit test owner: src/adapters/mod.rs:76-77 (#[cfg(test)] mod filesystem_catalog_publisher_tests;).
  • Included submodules in src/adapters/filesystem_catalog_publisher_tests.rs:3-10:
    • Line 4: #[path = "../../tests/catalog_filesystem_publication/authority_laws.rs"] mod authority_laws;
    • Line 6: #[path = "../../tests/catalog_filesystem_publication/directory_laws.rs"] mod directory_laws;
    • Line 8: #[path = "../../tests/catalog_filesystem_publication/initialization_laws.rs"] mod initialization_laws;
    • Line 10: #[path = "../../tests/catalog_filesystem_publication/refusal_laws.rs"] mod refusal_laws;
• 16 Concrete Refusal & Publication Scenarios Derived from Code:
  • src/adapters/filesystem_catalog_publisher_tests.rs (3 laws):
    1. Line 38: successful_publication_materializes_only_the_exact_durable_view (happy path: writes HEAD, catalog, segment; cleans staging; verifies loaded snapshot matches receipt).
    2. Line 73: durable_publication_retry_returns_the_same_synchronized_receipt (retry path: idempotent re-publication of current generation returns AlreadyPublished without mutating storage).
    3. Line 182: publisher_drop_closes_writable_stages_before_releasing_writer_authority (drop order: verifies catalog stage and head stage struct fields precede _lock, guaranteeing stages close before lock release).
  • tests/catalog_filesystem_publication/authority_laws.rs (2 laws):
    4. Line 17: metadata_equivalent_external_stage_cannot_authorize_publication (unauthorized stage: external memory stage rejected with FilesystemCatalogPublicationError::SegmentAuthorityRequired during VerifyCurrent).
    5. Line 59: one_publisher_cannot_select_another_publishers_stage (publisher authority: selecting another publisher's sealed stage rejected with SegmentPublicationError::PublisherAuthority).
  • tests/catalog_filesystem_publication/directory_laws.rs (3 laws):
    6. Line 10: publisher_has_no_unadmitted_production_constructor (architectural law: verifies open requires FilesystemPlatformAdmission, and FilesystemPlatformAdmission exposes no unverified public constructor).
    7. Line 28: publisher_refuses_a_non_directory_protocol_namespace (namespace corruption: non-directory staging returns io::ErrorKind::NotADirectory).
    8. Line 45: publisher_never_follows_a_symbolic_protocol_namespace (security law: symlinked staging directory returns ELOOP).
  • tests/catalog_filesystem_publication/initialization_laws.rs (2 laws):
    9. Line 16: absent_head_refuses_a_retained_segment (orphan recovery: uninitialized store with orphan in segments/ rejected with FilesystemCatalogPublicationError::SegmentPoolRecoveryRequired).
    10. Line 21: absent_head_refuses_a_retained_catalog (orphan recovery: uninitialized store with orphan in catalogs/ rejected with FilesystemCatalogPublicationError::CatalogPoolRecoveryRequired).
  • tests/catalog_filesystem_publication/refusal_laws.rs (6 laws):
    11. Line 20: conflicting_immutable_pool_bytes_refuse_before_visibility (immutable pool conflict: pre-existing conflicting segment rejected with CatalogRestartError::SegmentCoordinate during VerifySegmentPool; HEAD untouched).
    12. Line 77: stale_current_head_refuses_before_creating_catalog_state (staleness refusal: uninitialized expectation against published store rejected with FilesystemCatalogPublicationError::CurrentState during VerifyCurrent; no current.cat created).
    13. Line 131: leftover_next_head_requires_recovery_before_any_mutation (crash recovery: abandoned head.next in store root rejected with FilesystemCatalogPublicationError::HeadRecoveryRequired during VerifyCurrent; zero mutation).
    14. Line 171: leftover_catalog_stage_refuses_before_segment_pool_mutation (crash recovery: leftover current.cat in staging rejected with FilesystemCatalogPublicationError::CatalogRecoveryRequired during VerifyCurrent; segment pool not mutated).
    15. Line 214: catalog_only_publication_refuses_a_leftover_segment_stage (crash recovery: catalog-only publication with leftover current.seg in staging rejected with FilesystemCatalogPublicationError::SegmentRecoveryRequired during VerifyCurrent).
    16. Line 250: already_published_retry_refuses_a_recreated_segment_stage (retry recovery: already-published retry with recreated current.seg rejected with FilesystemCatalogPublicationError::SegmentRecoveryRequired during VerifyCurrent).

---

2. Merges are Changes (Audit of Merge 63b436c)

• Parent 1 (032cd27): PR branch commit adding src/adapters/filesystem_catalog_publisher_tests.rs for KEEP-CATALOG-008.
• Parent 2 (b50dbd4): Target base origin/main containing PR fix(benchmark): admit complete canonical baseline reports #143 (commit 0aa063f, canonical benchmark admission).
• Current Merge Base: Resolves to b50dbd4cb4cee286aea1aa0352152a232197dda1.
• Historical Fork Point: 8d902516e682361882bc5c9902de296ce5c9de85 (where 423d517 originally branched from main).
• Semantic Conflict Resolution:
  • CHANGELOG.md conflict resolved by placing the PR Correct executable catalog evidence anchors in v1 ledger #148 entry at lines 627–630, followed immediately by the full PR Admit only complete canonical source-bound benchmark reports #142 entry at lines 631–647, preserving both changelog records without dropping or modifying any historical lines.
  • docs/formats/segment-store-v1/requirements.md merged without conflicts because PR fix(benchmark): admit complete canonical baseline reports #143 did not touch requirements.md.
  • All invariants from PR fix(benchmark): admit complete canonical baseline reports #143 (bounded 1 MiB report admission, metadata uniqueness via BTreeSet, 16 metadata coordinates, 13 scenario rows, 5 profile rows, checked arithmetic) remain fully intact.

---

3. No Trusted Claims

• Claim: Stale paths do not exist. Verified: git log --all -- tests/catalog_ordering.rs tests/catalog_filesystem_publication.rs confirmed neither file has ever existed in the inspected repository tree or history.
• Claim: Named files exist and link modules. Verified: tests/catalog.rs:13-14 includes ordering_laws.rs; src/adapters/mod.rs:76-77 includes filesystem_catalog_publisher_tests.rs.
• Claim: 2 ordering laws & 16 publisher laws. Verified: exactly 2 tests in tests/catalog/ordering_laws.rs; exactly 16 tests across filesystem_catalog_publisher_tests.rs and its 4 included submodules.
• Claim: Docker execution on parent. Inspected in main8d90251-integration.log. Zero tests run on macOS host per read-only gate instructions.

---

4. Constants Against Evidence

• ENTRY_LENGTH = 160: Verified in tests/catalog.rs:52 against the byte grammar specification in docs/formats/segment-store-v1/catalog.md:27,44-60 (entry length 160 bytes, lines 44–60).
• FIRST_ENTRY_OFFSET = 128: Verified in tests/catalog.rs:45 against docs/formats/segment-store-v1/catalog.md:17-35 (header length exactly 128 bytes).
• RETAINED_SEGMENT_LIMIT = 1_048_576: Verified in src/adapters/filesystem_catalog_publisher_tests.rs:34.
• CATALOG_DIGEST = "04b82519b0399baefd0b9c0f32a871052e4c47e3a00226ab03b21661470f7320": Verified against frozen conformance fixture conformance/segment-store/v1/one-zero-catalog.hex.
• SEGMENT_DIGEST = "b7542dced2ab770894a14d1d04b066e3a899942602c5986d35ba6df6c1a35cfc": Verified against conformance/segment-store/v1/one-zero-segment.hex.

---

5. Derived Numeric Counts & Exact Quantities

• Files Modified: Exactly 2 files (CHANGELOG.md, docs/formats/segment-store-v1/requirements.md).
• Diff Stat against Target b50dbd4: 6 insertions, 2 deletions (+4 in CHANGELOG.md, +2/-2 in requirements.md).
• Commits on Branch: 3 commits (423d517, 032cd27, 63b436c).
• Requirement Ledger Rows Corrected: Exactly 2 rows (KEEP-CATALOG-003, KEEP-CATALOG-008).
• Test Law Totals:
  • Ordering laws: exactly 2 (catalog_refuses_duplicate_logical_identities, catalog_refuses_out_of_order_logical_identities).
  • Filesystem unit laws: exactly 16 (3 root file + 2 authority + 3 directory + 2 initialization + 6 refusal).
• PR Docs: correct executable catalog evidence anchors (#148) #149 Activity & Pagination:
  • pr149-comments.json: 4 comments (1 Codex usage limit, 1 CodeRabbit rate limit, 1 author scope note #5945987059, 1 Codex environment note). Array length 4, no pagination.
  • pr149-reviews.json: 0 reviews ([]).
  • pr149-threads.json: 0 review threads (nodes: [], pageInfo: { hasNextPage: false, endCursor: null }). Fully paginated.

---

6. Errors and State Machines

• CatalogDecodeError Assertions: ordering_laws.rs tests precise typed errors DuplicateIdentity and IdentityOrder.
• Publication Refusal & Recovery Invariants: refusal_laws.rs, authority_laws.rs, and initialization_laws.rs enforce the publication state machine: verifying current state, checking segment and catalog pools, and verifying writer authority before any stage files are written or published. Stale or corrupt states refuse with typed errors without leaving orphaned protocol mutations.

---

7. Repository Standards & AGENTS.md Conformance

• Pure Rust edition 2024: Maintained; zero Python scripts.
• Documentation Only: 0 lines of Rust production or test code modified.
• File Lengths:
  • docs/formats/segment-store-v1/requirements.md: exactly 200 lines (meets AGENTS.md 200-line target file size).
  • tests/catalog/ordering_laws.rs: 53 lines.
  • src/adapters/filesystem_catalog_publisher_tests.rs: 199 lines (under 200-line target).
  • CHANGELOG.md: 815 lines (historical changelog).
• Formatting: git diff --check passed cleanly with 0 whitespace errors. MD013 is disabled for the requirements table, and prose paragraphs are properly formatted.

---

Evaluation of Pre-Existing Issue #150

Issue Description: In src/adapters/filesystem_catalog_publisher.rs:88-96, the constructor open_unchecked_for_repository_tasks accepts a FilesystemWriterLock from callers without verifying platform admission. If a production initialization attempt failed during StoreInitializationPhase::AdmitPlatform due to an unsupported platform, but acquired or retained a writer lock, this constructor would admit the lock without platform validation.

Impact on PR #149 Mergeability:

1. Origin: Issue Preserve platform admission across public catalog publisher routes (T-12.2) #150 belongs to the original milestone T12.2 acceptance (issues Implement catalog generations and one-writer/many-reader publication #16 and Build the durable crash-injection and recovery matrix #17). It was not introduced, modified, or exacerbated by PR Docs: correct executable catalog evidence anchors (#148) #149.
2. Independence: PR Docs: correct executable catalog evidence anchors (#148) #149 is strictly a documentation-only evidence anchor correction. It touches only CHANGELOG.md and requirements.md.
3. Invariants: PR Docs: correct executable catalog evidence anchors (#148) #149 does not claim that issue Preserve platform admission across public catalog publisher routes (T-12.2) #150 is resolved, nor does it weaken any verification or admission criteria.
4. Mergeability: Under repository planning policy ("One executable issue → one coherent PR → one independently verifiable change. Every merged result leaves the target branch in a working state"), PR Docs: correct executable catalog evidence anchors (#148) #149 resolves issue Correct executable catalog evidence anchors in v1 ledger #148 completely and independently. Issue Preserve platform admission across public catalog publisher routes (T-12.2) #150 is independently tracked and should be resolved in its own targeted PR. PR Docs: correct executable catalog evidence anchors (#148) #149 is therefore independently mergeable.

---

Mandatory Verification Checklist

Check Category	Verification Evidence & Exact File Coordinates	Status
Path: KEEP-CATALOG-003 Entry	docs/formats/segment-store-v1/requirements.md:74 -> tests/catalog.rs:13-14 -> tests/catalog/ordering_laws.rs:1-53	VERIFIED
Path: KEEP-CATALOG-008 Entry	docs/formats/segment-store-v1/requirements.md:79 -> tests/catalog_publication.rs:1-120 & src/adapters/filesystem_catalog_publisher_tests.rs:1-199	VERIFIED
Path: Production Decode Dispatch	src/adapters/checksummed_catalog.rs:63-65 -> src/adapters/catalog_decoder.rs:15-26 -> src/adapters/catalog_entry_sequence.rs:9-57	VERIFIED
Path: Publisher Module Linkage	src/adapters/mod.rs:76-77 (#[cfg(test)] mod filesystem_catalog_publisher_tests;)	VERIFIED
Path: Publisher Submodule Inclusions	src/adapters/filesystem_catalog_publisher_tests.rs:3-10 (authority_laws, directory_laws, initialization_laws, refusal_laws)	VERIFIED
Merge: Current Merge Base	Current merge base (origin/main vs HEAD): b50dbd4cb4cee286aea1aa0352152a232197dda1	VERIFIED
Merge: Historical Fork Point	Divergence point of branch before merge 63b436c: 8d902516e682361882bc5c9902de296ce5c9de85	VERIFIED
Merge: Parent SHAs	Merge commit 63b436c, Parent 1: 032cd27, Parent 2: b50dbd4	VERIFIED
Merge: PR #143 Preservation	CHANGELOG.md:631-647 (Retains full #142 canonical admission text immediately following #148 entry)	VERIFIED
Merge: Zero Code Diffs	git diff b50dbd4...63b436c -- src xtask fuzz benchmark benches tests produces empty output	VERIFIED
Stale Anchor Nonexistence	tests/catalog_ordering.rs & tests/catalog_filesystem_publication.rs confirmed absent in working tree and inspected git history	VERIFIED
Evidence: Byte Grammar Path	docs/formats/segment-store-v1/catalog.md:17-35,44-60 (Header 128 bytes, entry 160 bytes)	VERIFIED
Evidence: Ordering Laws	Exactly 2 laws in tests/catalog/ordering_laws.rs:10,27	VERIFIED
Evidence: Filesystem Laws	Exactly 16 concrete laws (3 root publisher + 2 authority + 3 directory + 2 initialization + 6 refusal)	VERIFIED
Execution Limitations	Unit fixtures & port tests are in-process tests, not executed physical power-loss or process-death tests	VERIFIED
Test Fixture Posture	Publisher unit fixtures use open_unchecked_for_tests (src/adapters/filesystem_catalog_publisher_tests.rs:42,77); properly caveated as non-production platform admission	VERIFIED
PR Activity & Pagination	pr149-comments.json (4 comments), pr149-reviews.json (0), pr149-threads.json (0 threads, hasNextPage: false)	VERIFIED
Issue #150 Evaluation	Pre-existing repository-tasks defect evaluated; PR #149 is independently mergeable without waiving any criteria	VERIFIED
Formatting & Whitespace	git diff --check passes cleanly; MD013 disabled on requirements table; paragraphs properly formatted	VERIFIED
Check Accounting	Statically executed: git topology, diff --check, grep, law counts, json pagination. Inspected only: parent Docker logs, conformance fixtures, markdownlint rules. Skipped: host cargo test. Unavailable: physical power loss.	VERIFIED

---

Verdict

APPROVE

[flyingrobots]

Code Lawyer Activity Summary and current-head merge gate: OPEN.

Item	Severity/source	Commit	Evidence	Outcome
Absent catalog ordering target	P4 / #148 audit	423d517	Old path absent on parent; replacement integration target includes both exact typed refusal laws	Fixed
Absent filesystem publication owner	P4 / self	032cd27	Old path absent; corrected owner includes all 16 fixture laws	Fixed
Main integration	Merge review	63b436c	Both changelog entries retained; entire delta against b50dbd4 is two documentation files, +6/-2	Verified
Independent gate	agy ULTRA STRICT	63b436c	Complete corrected review and checklist: APPROVE; no introduced findings	Passed
Platform-admission bypass	P2 / separate #150	Pre-existing	Public repository-task constructor remains a distinct unresolved runtime issue	Not resolved or waived by this documentation change

Current head is 63b436c; target and merge base are b50dbd4. All four required checks passed in run 36968023377: Rust quality gates, documentation/workflow integrity, runtime fuzz smoke, dependency policy. CodeRabbit is rate-limited, not an approving reviewer; the user's authorized agy fallback applies without bypassing repository protection.

Fresh Docker execution on exact target b50dbd4 confirms both ordering laws and all 16 publisher fixture laws in debug and release. This target has byte-identical runtime/tests to the reviewed head. Commands: cargo test --test catalog ordering_laws; cargo test --release --test catalog ordering_laws; cargo test --lib filesystem_catalog_publisher_tests; cargo test --release --lib filesystem_catalog_publisher_tests. Each selected respectively 2, 2, 16 and 16 tests, all passing. The initial login-shell invocation could not find cargo and was a setup failure; the corrected invocation passed. No current-head local full-workspace run is claimed. Required full validation is the current-head hosted CI; earlier Markdownlint and parent RED/GREEN checks remain documented in the PR. git diff --check passes.

Primary review reconciliation: the review's named main8d90251-integration.log is not accepted as raw proof of the 16 fixture executions; those were previously observed directly and now freshly captured on exact target b50dbd4. The #150 reproduction acquires its writer lock separately after initialization refuses; the refused initializer does not return publisher authority. Neither correction changes the demonstrated unchecked public constructor or this PR's independence. Reviewer activity counts refer to its earlier snapshot; refreshed complete REST pagination now yields seven global comments, zero reviews, and GraphQL zero threads with hasNextPage=false. No actionable unresolved finding remains in this PR.

Original acceptance criteria and checkboxes remain unchanged. Unit fixtures are not production platform-admission or physical power-loss proof. Merge is explicitly authorized by the user's clean agy plus green validation instruction. Cc @codex.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.