[darko-mijic]

Consolidated into PR #40. PR #40 was opened on top of this branch, so every commit here is in it unchanged, and it now targets main with the whole-repository review (PR #38), this execution and a second review pass in one pull request. This description stays as the execution's record; it was corrected for accuracy before the pull request closed, and the corrections that needed code are fixed in PR #40.

Executing the whole-repository review

This pull request carries out the confirmed findings of the whole-repository review in PR #38, read at main b5e0a8be. It closes the review's two high-severity defects, repairs the drift between ready Specs and the agent surface, gives the deferred design questions a home in the graph, and corrects the docs a newcomer reads first. A second pass then carries out the owner's rulings that the first pass left: the intent panel's labels and memo preview (Q6a, Q6b), the slice-page rule, and the reservation of kind in Then slots (L1-03). It also narrows the symbolic-link warning, a delegated choice that awaits the owner's review.

The two high-severity fixes:

• A planted link no longer makes sdp build write outside the corpus (L4-01). Its staging files followed an existing link, so a planted symbolic or hard link under generated/ made a build overwrite the file it pointed to. Staging now unlinks a stale entry and creates the file exclusively. An output parent that resolves outside the root, or dangles, is refused before any write or cleanup, and is checked again before each staged write. These are path checks, not race-free confinement: a process writing inside the root during a build could still swap generated/ between a check and a later delete or rename. PR review: the whole repository, its fixes, and the durable-content inventory #40 rechecks before every mutation, refuses a linked generated/, checks that directory's identity after publication, and states this threat model in spec:extraction.build-pipeline#writeBoundary.
• A hand-authored delivery fact is refused in every carrier (L3-01). The honesty check missed the camelCase spelling hasVerifier, so a TypeScript carrier could author a fact the Markdown carrier refuses. One internal spelling list now feeds the authoring-shape check, extraction's reserved keys and the Gherkin tag pattern.

Delivery facts are derived, never authored, and a build writes only inside its root. These fixes put both principles back in force, the second against planted links. The rest of the arc fixes smaller defects, records the owner's rulings in the corpus, and brings the docs in line with the graph.

The rulings pass:

• The intent panel says what each gathered intent asks for (Q6a). A row named only its scope and the free-text request, though #ui.gatheredIntents asks for the change too. Each row now reads <scope> <action label>: <request>, and the panel and the compose dialog read one label map.
• The person can read the hand-off before it leaves (Q6b). The panel shows a closed, read-only Preview memo holding the exact memo Copy memo copies. The carrying Spec gains rule #memoPreview and UI entry memoPreview in the same change.
• A Pack export leaves the slice page out. The owner kept the provisional answer, so #exportCarriesSlice becomes rule #exportOmitsSlice, and a new test pins the behavior the export already had.
• Only a link that could hide a carrier or anchor warns. The first pass made every symbolic link below the root warn, including this repository's own CLAUDE.md. A link now warns only when it targets a directory or its name is a carrier or anchor-candidate name, and never when its own name is one discovery skips (a dot-name, node_modules, dist, generated or coverage); discovery still follows none. This narrows the owner's Q1 ruling and awaits the owner's review. PR review: the whole repository, its fixes, and the durable-content inventory #40 judges a link by the entry it stands for, so a candidate-named file link warns even when its name starts with a dot.
• A Then slot cannot be named kind (L1-03). A Then slot named kind collided with the generated Outcome's discriminant, so a legal carrier produced an invalid Outcome type. The owner ruled to reserve the word. Graph validation now reports conformance/reserved-then-slot as an error, and contract generation withholds the affected contract with a warning naming the word. The Outcome keeps its flat shape, and Given and When slots may still be named kind.

How the work ran. Same approach as the review:

• Nine lanes in two passes, each implemented by one model family (Claude or GPT through the relay plugin) and reviewed adversarially by the other.
• Every fix proves itself with a test that fails without it.
• The first pass merged into fix/review-findings in the order C, W, H1, H2, P, D; the rulings pass merged S, L, then K. The full gate ran over each merged result.

Working record. Branch fix/review-findings; base main b5e0a8be. Owner's working rules: execute PR #38's findings with workflows of Claude and GPT agents, while the coordinating session keeps its context for coordination and execution. Commits, push and this draft are authorized; the owner reviews and merges. There is no arc Pack: the arc executes findings and owner rulings, and its corpus changes are measured below with the design diff (recipe 35) from the base. The lanes' plan and results are in evidence/pr39/README.md; evidence/pr39/ is arc evidence and is removed before merge.

What each lane did

Outcomes: fixed (a code or doc defect, with a test), applied (a proposal change, capture or rule as written), adapted (carried out as a later owner ruling reshaped it), needs-ruling (parked for the owner). The verdict column is the reviewing family's last round.

C, corpus (Claude implements, GPT reviews: changes, then approve in round 2)

Item	Outcome	Proof	What changed
P1	applied	self-hosting oracle (consumers.ts pin)	#wrapIdiom calls a recipe through the recipes binding instead of inlining its body
P2	applied	oracle pin	the reader's method inventory names resolveEntryAddress
P3	applied	oracle pin	the reader gains rule #entryAddressResolution; its rule keys shift
P4	applied	oracle pin	the delivery-record cleanup gains rule #inventoryFirst
P5	applied	oracle pin	#durableContent keeps blocking, with the accepted provisional
P6	applied	oracle pin	cited-line-text records #lineText's answer as rule #lineRecorded
P7	applied	oracle pin	cited-line-text records #lineBound's answer as a design entry; readiness stays scoped
Q1	adapted	lane C leaves the excludes Spec unchanged; lanes W and L change it, and the code is in lane W	no symbolicLinks question: the owner ruled the policy
Q2	adapted	no test reads jtbd-stories/	the job changes, not the Spec: JS-F1 hands scoped intent to an agent that picks its own budget (recipe 36)
Q3	adapted	self-hosting-graph.test.ts totals and consumers family (3 tests fail with the old pins)	the AI-reading capture keeps the four ruled links, each a declared relation with a reason
Q4	adapted	observation family descriptors fail with the old trigger	the freshness trigger is the owner's wording; the owner decides
Q5	applied	oracle pin	#perSlotOnly drops its deferral clause; the combination capture carries it
Q6	adapted	lane C leaves the intent-panel Spec unchanged; lane S changes it	no handOffPreview question; the code half is carried in lane S
K1–K3	applied	oracle pins, recipe 20	three idea captures, each with a blocking deferral (below)

W, writes inside the root (GPT implements, Claude reviews: changes, then approve in round 2)

Item	Outcome	Proof	What changed
L4-01 (high)	fixed	test/cli-write-boundaries.test.ts: 14 build-boundary cases, including dangling generated links; sentinel bytes are overwritten without the fix	exclusive staging after unlinking stale entries; unsafe or dangling output parents refused before any write
L4-04	adapted	the same suite: validate, Studio and vault watch run through a linked root; "keeps the named root" guards ordinary output	only the watch root's directory check resolves its physical path; root parsing stays lexical
L4-02	fixed	the same suite: view, mermaid and gherkin exit 0 on a case collision without the fix	publication refused when two page paths collide by case, naming both paths and ids
Q1	applied	test/exclude-diagnostics.test.ts "names skipped candidate links while resolving an explicitly linked root" (lane L renamed lane W's version, which named every skipped link): without the fix it fails first on the explicitly linked root, whose carrier path runs through the link instead of the real corpus directory	discovery never follows a link below the root, warns once per link outside an excluded or skipped path, and resolves an explicitly named root first; lane L narrows which links warn

H1, honesty and carriers (GPT implements, Claude reviews: changes, then approve in round 2)

Item	Outcome	Proof	What changed
L3-01 (high)	fixed	six honesty cases in test/validators.test.ts and test/extract.test.ts report no finding without the fix; package-smoke export pins unchanged	one delivery-fact spelling list, outside the public barrel
L1-03	needs-ruling, then carried by lane K	graph queries confirm the slot grammar, the Outcome shape and the closed generation-finding list	none in this lane: a legal kind slot generates an invalid Outcome type, and the two options were reserving kind in Then slots or changing the Outcome payload's representation; the owner ruled for the reservation (lane K)
L1-04	fixed	17 block-shape cases in test/markdown-reifier.test.ts	list text refuses the block shapes the carrier rules list; code-span forms stay accepted
L1-05	fixed	test/readiness.test.ts, test/validators.test.ts: invalid-altitude floor findings without the fix	floor evaluation and derived readiness skip a Spec with an unratified altitude

H2, verification runtime (GPT implements, Claude reviews: changes, then approve in round 2)

Item	Outcome	Proof	What changed
L1-01	fixed	test/codegen.test.ts: 5 dispatch cases fail without the fix	a key shared across phases gets one handler that branches on the occurrence's phase
L1-02	fixed	test/codegen.test.ts: 2 cases resolve instead of rejecting; "preserves the noMatchingThen" guards the message	an unspecified oracle never matches a Then, so the existing noMatchingThen diagnostic fires
L5-01	fixed	test/self-hosting-graph.test.ts: 608 anchors against the pinned 609 without the binding	test/markdown-reifier.test.ts verifies spec:carrier.markdown-body-grammar
L5-02	fixed	the same, 811 binding edges against 812	test/structural-anchors.test.ts verifies spec:model.anchors

P, CLI and package polish (Claude implements, GPT reviews: changes twice, then approve in round 3)

Item	Outcome	Proof	What changed
L2-3	fixed	test/cli-q.test.ts "names a body that stops inside a template literal"	sdp q reports an unterminated template at its real line and column, not 1:1
L2-5	fixed	test/studio-s3.test.ts "states in its help the refusal the command applies"	studio --help states the build-owned-path refusal the CLI enforces
L3-03	fixed	test/markdown-ascii-trim.test.ts	the Markdown carrier's ASCII trim helpers scan linearly, so a long whitespace run no longer makes prose and title trimming quadratic. Two other extraction paths still slow down on a long space run: the thematic-break check, which this PR also applies to list text, and the anchor comment-line pattern. PR #40 makes both linear
L4-03	fixed	test/self-hosting-duplicate-ids.test.ts: option values, listings, and watch/dev keep the dedicated CLI pass	the vitest wrapper reads its arguments with Vitest's own parser, so an option's value is no longer taken for a file filter and the CLI suite keeps its dedicated pass; listings are forwarded once. The caller's options reach the pooled pass only: the CLI pass runs without the caller's name pattern, and a report file leaves its tests out. PR #40 gives the dedicated pass the caller's options, drops a package manager's leading --, and stops a report file or coverage from silently leaving the CLI pass out
L9-F2	fixed	test/package-smoke.test.ts types a .cts consumer under Node16; test/bootstrap.test.ts pins the export map; check:git-install passes at the head	the root export's existing require condition gains .d.cts declarations. The CommonJS root requires two ES-module-only dependencies, so it loads only on a Node that runs require(esm), while engines.node still says >=20; PR #40 narrows it to ^20.19.0 || >=22.12.0
C1	fixed	test/check-temporal.test.ts "sweeps the decision registry"	the temporal sweep no longer exempts DECISIONS.md

D, docs and vocabulary (Claude implements, GPT reviews: approve in round 1)

Item	Outcome	Proof	What changed
L6-1	fixed	test/self-hosting-graph.test.ts "names in the handbook exactly the warning kinds the oracle retains"	AGENTS.md names honesty/gaps as the retained warning (prose-mention warnings no longer exist)
L6-4	fixed	"names every narrowing decision on the narrowed decision's registry row" (14 refines edges)	DECISIONS.md rows MD-33, MD-25, MD-27 and MD-18 name their narrowers
L2-6	fixed	test/recipes.test.ts runs every recipe with an absent subject	the catalog intro lists both answer shapes completely
L6-6	fixed	test/skills.test.ts resolves #entryAdapters	the skill separates the three entry adapters from the reader joins
L9-F1	fixed	test/checkout-v1.test.ts builds the expected summary line	the example README shows the build summary its extraction produces
L9-F4	fixed	checked against sdp new spec and a scratch corpus; no test reads it	the capture job asks for kind and altitude, as its AC1 does
L9-F5	fixed	checked against the lenses Spec's title; no test reads it	the README explains carriers after the quick start and names the Studio's five lenses

S, Studio rulings (Claude implements, GPT reviews: approve in round 1)

Item	Outcome	Proof	What changed
Q6a	fixed	test/studio-s5.test.ts "names each gathered intent's scope and the change it asks for": rows lose their action label with the row hunk reverted	each gathered row reads <scope> <action label>: <request>; the label map moves into intent-panel.ts, and change-pack reads "Change Pack membership or framing"
Q6b	fixed	test/studio-s5.test.ts "previews the memo it hands off, closed and read-only, before the copy actions": no details element without the fix	a closed Preview memo holds the memo Copy memo copies; rule #memoPreview and UI entry memoPreview on the intent-panel Spec, with oracle pins moved
SP1	applied	test/studio-slice.test.ts "leaves the slice page out of the Pack export": fails when the export is made to copy the slice page	#exportCarriesSlice removed; rule #exportOmitsSlice added; no export code changed

L, link-warning scope (GPT implements, Claude reviews: approve in round 1)

Item	Outcome	Proof	What changed
Q1n	fixed	test/exclude-diagnostics.test.ts and three more suites: 225 failures with lane L's discover.ts change reverted at the head (the mixed-link fixture, the CLAUDE.md, types.d.ts, other.txt and other.feature cases, two self-hosting runs, and 218 cases in test/recipes.test.ts, whose recipe runs now expect an empty stderr)	a link warns only if it targets a directory or carries a carrier or anchor-candidate name; #canonicalDiscovery says so; the CLAUDE.md warning pins and the handbook sentence are gone

K, reserve-kind (GPT implements, Claude reviews: changes, then approve in round 2)

Item	Outcome	Proof	What changed
L1-03	fixed	test/codegen.test.ts "reserved Then slot kind": 20 of its 26 cases fail with the source change reverted (the other 6 guard lawful slot names and kind in Given and When); the validator audit (test/validator-audit.test.ts) fails 6 tests too, because its probe table gains a conformance/reserved-then-slot pair	rule #reservedThenSlot on the slot-notation and executable-contracts Specs; an error-level conformance check naming the reserved word; generation withholds the space or step contract with contracts/reserved-then-slot

Integration

The merge had one conflict: lane H2's oracle totals against lane C's. It was resolved by adding both lanes' deltas, then confirmed with sdp validate and the oracle tests. The full gate then passed on the first run. One defect showed only in the merged result. Lane D's handbook paragraph says check:self-hosting emits only honesty/gaps warnings. Since lane W's discovery change, the same step's build line also counts a pinned extract/symbolic-link-skipped warning for the CLAUDE.md link. fix: integrate the review lanes adds that sentence, and the handbook test now requires every pinned extraction finding to be named (it fails without the sentence).

The rulings pass merged lanes S and L, then lane K, each without a conflict, and the full gate passed on the first run each time, so it needed no integration fix. Lane L removes the CLAUDE.md warning itself, so it also takes back the first pass's handbook sentence and its test loop; the self-hosting test now pins that discovery reports no extraction finding at all.

New in the corpus

The design diff (recipe 35) from the base graph, measured at the head: 3 Specs added, 11 changed, 1 Pack changed, 2 bindings gained a verifier.

• spec:consumers.ai-assisted-reading, an idea capture (K1, Q3). The articles describe an AI assistant that presents the graph to a person, and no Spec owned the question. Blocking question #aiPresentationBoundary asks what contract keeps generated output apart from graph claims. Its provisional: select existing deterministic readings only, and keep any generated text outside the Studio and the frozen projections. Its four links are declared relations with reasons, so no new prose-mention warning appears.
• spec:observation.run-evidence.bound-file-freshness, an idea capture (K2, Q4). It takes #freshness off the ready run-evidence Spec, where a blocking question would have dropped the parent below its floor. The trigger is the owner's wording.
• spec:consumers.agent-surface.combination-coverage, an idea capture (K3, Q5). It holds the deferred question of which slot-value combinations recipe 44 should report. #perSlotOnly keeps its key and drops the deferral clause.
• spec:consumers.reader#entryAddressResolution gives the public resolveEntryAddress method a contract. #wrapIdiom now prescribes the recipes binding.
• spec:protocol.delivery-record-cleanup#inventoryFirst and spec:consumers.spec-studio.cited-line-text#lineRecorded record in the graph the answers the owner accepted in PR Plan 47: roadmaps, capability maps and design slices #36, which lived only in that PR's description.
• spec:extraction.excludes#canonicalDiscovery gains the discovery sentence: a symbolic link below the root is never followed, and it warns only when it targets a directory or its name is a carrier or anchor-candidate name, never inside an excluded path or when its own name is one discovery skips (a dot-name, node_modules, dist, generated, coverage). PR review: the whole repository, its fixes, and the durable-content inventory #40 rewords the rule so a dot-named candidate file link warns.
• spec:consumers.spec-studio.intent-panel#memoPreview and its UI entry memoPreview add the ruled memo preview.
• spec:consumers.spec-studio.slice-page#exportOmitsSlice turns the answered #exportCarriesSlice question into a rule.
• spec:carrier.slot-notation#reservedThenSlot and spec:extraction.executable-contracts#reservedThenSlot reserve kind in Then slots, and the executable-contracts finding list gains contracts/reserved-then-slot.
• JS-F1 changes its job instead of a Spec gaining a question: the panel hands off scope ids, and the receiving agent picks its own budget.

Rulings

Owner rulings

None are new in this pull request. It carries out the rulings the owner made on PR #38's questions and in two follow-ups:

Ruling	One line	Carried by
Accept the seven-change proposal	P1–P7 as proposed, base b5e0a8be; 1–3 repair drift, 4–7 record answers accepted in PR #36	lane C, reader and the Specs above
Discovery never follows a symbolic link below the root (Q1)	a found link warns; an explicitly named root is resolved first; no open question	lanes W and L, excludes, discover.ts
Change the job, not the Spec (Q2)	JS-F1 drops the token-budgeted preview; the agent picks its own budget	lane C, 06-edit-through-the-lens.md
Author the trimmed AI-reading capture (Q3)	four links, each a declared relation; one-line provisional	lane C, ai-assisted-reading
Author the freshness capture, owner decides (Q4)	the trigger reworded	lane C, bound-file-freshness
Author the combination capture, owner decides (Q5)	#perSlotOnly keeps its key	lane C, combination-coverage, example-space-coverage
The missing action label is a code defect (Q6a)	fix it with a test; no open question	lane S, intent-panel-element.ts
The memo preview is yes (Q6b)	collapsed, read-only, with a rule and a UI entry in the same change	lane S, spec-studio.intent-panel
A Pack export does not carry the slice page	the provisional stands; the question becomes a rule	lane S, spec-studio.slice-page
PR #32's delegated rulings (U1)	ratified as the graph carries them; a later narrowing wins	no edit
The Studio's refusal is worded by the Spec (U2)	refused: a page that recomputes a join, claim, fact or floor, or a second graph	no edit; spec-studio #noSecondGraph, #recipeAnswers
PR #38's delegated choices	seven ratified; "design findings stay open questions" is superseded by Q1, Q2 and Q6	PR #38
The eight article corrections	accepted	PR #34 (2dc6a1a2)
The inventory answers #durableContent	accepted with its row rulings; the cleanup lands it in its first commit	the cleanup arc, delivery-record-cleanup
Homes for R1, R5, R7, R9, R11, L8-01, L8-02	use the proposed homes	the cleanup arc
R4, the TypeScript carrier's static grammar	a new spec:carrier.typescript-authoring, its rung stated honestly	the cleanup arc
R2, field evidence from the earlier system	the cleanup pull request's record, not a Spec; at most a number-free rationale sentence	the cleanup arc, point-per-example
Live dependencies	DECISIONS.md stays; the plan-reading gate checks retire with the folders; measure.mjs moves beside its test	the cleanup arc, roadmap-replaces-plans #gateRecord
Reserve kind in Then slots (L1-03)	a conformance finding and a generation refusal naming the reserved word; the flat Outcome shape stays	lane K, slot-notation, executable-contracts

Delegated choices awaiting the owner's review

Choice	One line	Where
L4-04 narrowed to the watch root	only watch setup resolves the root's physical path; output keeps the named path, so macOS /var → /private/var does not leak into ordinary output	validate-watch.ts
A case collision is refused, not renamed (L4-02)	the frozen projection names stay unchanged	artifacts.ts
Q1's warning narrowed to candidate links (lane L)	departs from the ruling's "each link it finds gets one warning": a file link whose name is no carrier or anchor candidate could never hide one, so it is silent; a directory link warns unless its name is one discovery skips (a dot-name, node_modules, dist, generated, coverage). At this head a dot-named candidate file link is silent as well; PR #40 makes it warn. A dangling or looping non-candidate link is silent too	discover.ts, excludes
Q6a's labels (lane S)	one label map shared by the panel and the compose dialog; change-pack reads "Change Pack membership or framing"; an unknown action shows its raw string	intent-panel.ts
The delivery-fact spelling list stays internal (L3-01)	not exported from the package barrel, so the public exports are unchanged	delivery-fact-spellings.ts
An invalid altitude skips floor evaluation (L1-05)	the altitude finding stands alone, with no floor findings piled on it	readiness-floor.ts
StepFn gains a required third parameter (L1-01)	the step occurrence, so one handler can branch on phase. StepFn and StepBindings are public on ./runner: a handler may still declare two parameters, but code that calls, wraps or retypes a StepFn or a StepBindings entry must now pass the step. Bindings handed to ./testing are unaffected	runner/index.ts
list and init are forwarded in one spawn (L4-03)	a bare related or bench now splits, though the base ran each as one spawn, so once benchmarks exist a bare bench runs the CLI unit suite after them. As at the base, related <source> stays one pooled spawn that also selects test/cli.test.ts, and a file:line filter goes unrecognized, so a CLI location runs pooled and a contract-dependent one skips the contract preflight. PR #40 forwards bench once, splits every related, and reads a file:line filter as its file	vitest-test.mjs
The root export's existing require condition gains .d.cts declarations (L9-F2)	the base already published require; the conditions now nest so import and require each carry their own types, which changes the published export map. The CommonJS root loads only on Node 20.19+ or 22.12+, and PR #40 sets engines.node to ^20.19.0 || >=22.12.0	package.json
C1 fixes the exemption only	the finding's second half, that the temporal guard's law has no Spec, is not authored	check-temporal.mjs
MD-18 also names its narrowers (L6-4)	beyond the three reported rows, so the test holds for every refines edge; drop it and skip MD-18 if unwanted	DECISIONS.md
JS-F1 criterion 7 capitalized	the ruled sentence with a capital first letter, matching the list	06-edit-through-the-lens.md
Q3's relation types	refines projections-model; dependsOn claim-taxonomy, spec-studio and shipped-projections-frozen	ai-assisted-reading
L1-03's finding is an error; generation withholds (lane K)	the ruling named no severity: the conformance finding is an error, so validation fails; generation's refusal is a withheld space or step contract with a warning, because every generation finding is a warning and gating belongs to graph validation	validators.ts, contracts.ts

Out of scope, on purpose

• The record findings and the inventory go to the delivery-record cleanup, which lands the accepted inventory in its first commit and closes #durableContent there. The same applies to the second set of rulings: the homes for R1, R2, R5, R7, R9, R11, L8-01 and L8-02, the new spec:carrier.typescript-authoring (R4), and the live dependencies. R6 and R8 are still open (below). Nothing in plans/ or reviews/ is deleted.
• The concept-document drift (L6-2, D1, L6-5) belongs to the cleanup, which dissolves those documents.
• The article corrections (L9-F6, L9-F7 and six more) are in PR docs(articles): publish the product and projection narrative #34.

Left open

• For the cleanup arc: R6's re-entry conditions (or dropping R6), R8's home, and the plan-46 prototypes' new location.
• Still open by design: register-input's three questions (its design pass, roadmap place 3) and designColumnsSufficiency (waits for the first adopter's design passes).

Try it

Run at the head:

npm ci && npm run build

# The corpus: 0 errors and the three pinned honesty/gaps warnings; no warning for the CLAUDE.md link
pnpm --silent sdp validate . --exclude explorations --exclude examples --exclude test/fixtures/import/parity

# The open-question register, with the three new captures
pnpm --silent sdp:q "$(cat dist/recipes/20-open-question-register.js)"

# The anchor model's verifiers now include the structural refusal suite
pnpm --silent sdp:q "$(cat dist/recipes/03-what-does-this-spec-guarantee-and-who-verifies-it.js)" --params '{"spec":"spec:model.anchors"}'

# A broken body is reported where it breaks: "line 1, column 12"
pnpm --silent sdp:q 'return `abc'

# A build refuses a generated/ link that escapes the root ("unsafe output parent ... escapes the extraction root")
mkdir -p /tmp/sdp-try/corpus /tmp/sdp-try/outside && ln -s ../outside /tmp/sdp-try/corpus/generated
cp specs/consumers/ai-assisted-reading.sdp.md /tmp/sdp-try/corpus/
node dist/cli/sdp.js build /tmp/sdp-try/corpus

# Only a link that could hide a carrier or anchor warns: "linked" does, NOTES.md is silent
rm /tmp/sdp-try/corpus/generated && echo hi > /tmp/sdp-try/outside/notes.md
ln -s ../outside/notes.md /tmp/sdp-try/corpus/NOTES.md && ln -s ../outside /tmp/sdp-try/corpus/linked
node dist/cli/sdp.js build /tmp/sdp-try/corpus

# A Then slot named kind is refused: one conformance/reserved-then-slot error, and the space contract is withheld
mkdir -p /tmp/sdp-try/kind && printf '%s\n' '---' 'id: spec:try.kind' 'kind: behavior' 'altitude: story' 'readiness: idea' 'relations: {}' '---' '# A Then slot named kind' '## Intent' '- outcome: Show the reserved Then slot.' '## Example space' '```gwt-vocabulary' 'Given an order' 'When the order is placed' 'Then the result is {kind:string}' '```' > /tmp/sdp-try/kind/kind.sdp.md
node dist/cli/sdp.js validate /tmp/sdp-try/kind

# The Studio's intent panel, on a Spec page (the top-level pages offer no composing action)
node dist/cli/sdp.js studio . --exclude explorations --exclude examples --exclude test/fixtures/import/parity
# Open generated/spec-studio/specs/consumers.spec-studio.intent-panel.html#rule.memoPreview in a browser.
# Under rule.memoPreview press "Propose new text", enter a request and press "Gather".
# Open "Composing (1)", give a base commit and a reason, then open "Preview memo".

Feedback wanted:

• The narrowed link warning (lane L). It departs from Q1's literal text so that a link which cannot hide a carrier or anchor stays silent. Is that the ruling's intent, or should every link warn and this repository exclude its own CLAUDE.md?
• The memo preview (Q6b). Is a closed disclosure before the copy actions the right weight, or should it open once a base and a reason are given?
• CommonJS as a typed surface (L9-F2). The base already published a require condition, and this PR gives it its own types. Should CommonJS stay a typed surface, on Node ^20.19.0 || >=22.12.0 as PR review: the whole repository, its fixes, and the durable-content inventory #40 sets, or should the package drop the condition, which breaks every CommonJS consumer?

Measured at the head

Measured at the head, with the corpus exclusions. Re-run the recipes rather than inheriting these numbers.

Measure	Base b5e0a8be	Head
Specs · Packs · anchors	456 · 9 · 607	459 · 9 · 609
Graph nodes · edges	1072 · 2978	1077 · 2989
sdp validate	not re-measured	0 errors · 3 warnings (the pinned honesty/gaps); no extraction warning
Build backlog (recipe 1)	2	2: spec:consumers.edit-model, spec:consumers.intent-composition
Drift alarm (recipe 2)	0	0
Open questions (recipe 20): total · blocking · non-blocking	16 · 10 · 6	15 · 12 · 3
Deferrals · holds · Specs with questions · malformed	6 · 4 · 12 · 0	9 · 3 · 12 · 0
Mention audit (recipe 22): unbacked · unresolved	not re-measured	0 · 0
npm run check	not re-measured	pass: 129 files and 3307 tests, plus 100 in the dedicated CLI pass. A known flake, present at the base too: the vault watch example's snapshot helper can race the vault sync's staging rename and fail with ENOENT on a .sdp-tmp file, so a rerun at this head may fail once. PR #40 fixes the helper in a51bf5c6
check:git-install	not re-measured	pass (npm and pnpm clones, npm archive)

The base column comes from the base graph (sdp build at b5e0a8be): node counts read from it, and recipes 1, 2 and 20 run over it with the head's built recipes. The head column is the live graph at c7368f48754528b4303fae12a601d88da84e65c1. The diff stat from the base is 93 files, +2270 / −274.

Second review pass

A second review read this pull request at c7368f48. This pass changes no commit on this branch: the head stays c7368f48, and only this description changes. It corrects, in place:

• the StepFn row: the third parameter is required and public on ./runner (L1-01);
• the L9-F2 rows: the require condition already existed, and the CommonJS root needs Node ^20.19.0 || >=22.12.0;
• the L4-01 headline, which now states the threat model the path checks meet;
• the L3-03 row, narrowed to the trim helpers it fixed;
• the two test-wrapper rows (L4-03), and the link-warning text in the rulings pass, the corpus list and the delegated choices, which now name the links that stay silent;
• stale proof cells, with lane L's failure count re-measured at c7368f48 by reverting its discover.ts change and running the four suites;
• the gate row, which now names the vault snapshot flake;
• the Try-it Studio step, which now opens a page that composes;
• the forward section, which gains the owner's reasons, the re-entry condition and the refused list;
• a pinned link to the evidence README.

The engine and corpus fixes this review found are carried by PR #40, the one pull request for them. It targets this branch, fix/review-findings, so they land here when it merges. Its changes as pushed at 3a22c914: c7368f48...3a22c914. A row above that names PR #40 describes c7368f48 first, then what PR #40 changes.

Next

The next work, from the roadmap (recipe 55, re-rendered at the head)

Roadmap: The Protocol's roadmap pack:roadmap

To state means the floor allows ready and a person still judges the statement. Built means every Spec of the entry's work states ready and has an implementation binding; it reports no passing test and no deployment.

The Protocol's next work, first entry first. The order is a preference: it dates, gates and sequences nothing, and what each entry still needs is read from the graph each time.

First the cleanup that removes the frozen plans, review reports and superseded concept material, as the roadmap and the pull request record make possible. Then the two steps a reader of the Studio's pages could not take, the words of a test line that checks a declaration and an outside register's entries, and then the composed-intent model the build backlog holds. What the first adopter's mass update asks for joins when the owner selects it; a capture landing adds nothing here. An entry leaves by an edit to this manifest once its selected work is complete or no longer belongs among the next work.

To design

Place	Entry	Next	Purpose and reach
1	The Protocol removes its frozen plans, review reports and superseded concept material spec:protocol.delivery-record-cleanup	itself idea → scoped, nothing holds it; blocked by spec:protocol.delivery-record-cleanup#question.durableContent	Remove plans/, reviews/ and the superseded concept material from the tree, after moving into the graph the durable content they still hold, so the repository keeps one delivery record: the graph, git and the pull requests.
3	An outside register is a named Studio input, so a cited token links to its entry spec:consumers.spec-studio.register-input	itself scoped → defined, held by no-blocking-open-questions; blocked by spec:consumers.spec-studio.register-input#question.registerEntry, spec:consumers.spec-studio.register-input#question.inputForm	A cited token reads as bare text on every page, and the register that defines it is neither linked nor shown.

To state

Place	Entry	Earlier waiting statements	Purpose and reach
2	A pinned declaration shows the words of each test line that cites it spec:consumers.spec-studio.cited-line-text	No preceding waiting statement in the statement queue.	The declarations page names each citing line by file and line only, so the reader leaves the page to read it, and has no route at all when the page set carries no source link.

To build

Place	Entry	Purpose and reach	Rests on
4	Views compose scoped intent instead of patching canonical source spec:consumers.edit-model	Let a view frame a requested change without giving derived surfaces a direct write path to canonical source.	nothing unbuilt

Waiting on the owner

• spec:protocol.delivery-record-cleanup#question.durableContent (blocking), place 1: Which content in plans/, reviews/ and the concept documents does no Spec, test, decision or recipe carry yet, and where does each piece belong?
• State spec:consumers.spec-studio.cited-line-text: it states scoped and its floor allows ready; place 2
• State spec:protocol.delivery-record-cleanup: it states idea and its floor allows scoped; place 1

Deferred, with their triggers

• spec:carrier.sdp-import.feature-adapter#question.featureAdapter: Which bare .feature constructs can an import adapter preserve honestly? Trigger: an adopter migrates a gen-1 .feature corpus into the Protocol
• spec:consumers.agent-surface.combination-coverage#question.combinationCoverage: Which combinations of slot values should coverage enumerate and report? Trigger: a design pass asks which combinations no example exercises
• spec:consumers.ai-assisted-reading#question.aiPresentationBoundary: If an assistant generates explanations or arrangements beyond selecting deterministic readings, what contract keeps its output distinct from graph claims and makes the exact reading reviewable, including how the exact output is retained with its model, prompt and inputs? Trigger: the UX design pass measures that assistant selection or a generated explanation helps a named review task
• spec:consumers.impact-graph.symbol-reach#question.symbolIdentity: Which language-neutral identity and extraction boundary can support exhaustive symbol reach without freezing a single compiler's representation into the Protocol? Trigger: a reader needs symbol-level reach that file-level imports and curated anchors cannot give
• spec:consumers.projections-model.roadmap-views#question.releaseReader: Does a reader need release or baseline views that the roadmap, the recipes and git tags do not serve? Trigger: the first published release
• spec:consumers.reference-projection#question.namedOutsideReader: Does a human reader outside the repository need a reference projection the four shipped roots do not serve? The taxonomy row is not that reader. Trigger: a named consumer outside the repository, with a way to measure that demand inside the arc that builds the projection
• spec:consumers.structural-mermaid#question.namedStructuralReader: Does a reader need diagrams rooted at code units, which census tables and Spec-rooted one-hop Mermaid do not serve? Trigger: a named reader with that need, plus a decision that refines spec:decisions.shipped-projections-frozen for the affected Mermaid rendering or supersedes that ruling whole
• spec:observation.run-evidence.bound-file-freshness#question.freshness: When should changes to bound files make recorded run evidence stale? Trigger: a reader cannot tell whether a run at another commit still applies, because nothing says whether its bound files changed since
• spec:observation.runtime-overlay#question.observationIdentity: Which external observation identity and freshness boundary is small enough for the graph while still supporting an honest observed delivery fact? Trigger: An adopter needs runtime measurements linked to measurable Spec targets and can supply an observation identity and freshness policy for review.

Why this order (the owner's reasons, unchanged from PR #36, not the memo's):

Place	Entry	The owner's reason
1	spec:protocol.delivery-record-cleanup	A dedicated pull request removes plans/ and reviews/ once PR #36's precedent landed
2	spec:consumers.spec-studio.cited-line-text	Closes a step a reader could not take in PR #35's reader tasks
3	spec:consumers.spec-studio.register-input	Closes the other such step
4	spec:consumers.edit-model	The composed-intent model is the whole build backlog

Re-entry: the cleanup at place 1 starts after this pull request merges, once R6's re-entry conditions are written or R6 is dropped (see Left open). It opens with the accepted inventory in its first commit.

Refused, durably (PR #36's list, plus the Studio item as U2 worded it): a rung stated by tooling; priority as a date, a schedule, a gate or a new relation; a roadmap that lists every feature; a slice or a capability as a new grouping primitive; an "over-designed" check; a diagram derived from prose; an anchor added for coverage; a tool that edits a carrier itself; a count, date or plan number inside a Spec; a Studio page that recomputes a join, claim, fact or floor, or a second graph.

The owner's decisions this pull request asks for:

1. Review the delegated choices above, especially the narrowed link warning (lane L), the export map change (L9-F2), StepFn's new required parameter (L1-01) and the error severity of the reserved-slot finding (L1-03).

The roadmap's order is unchanged: this arc completes no roadmap entry, so the manifest is not edited. The cleanup at place 1 is next, and it can now start from the accepted inventory.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[darko-mijic]

Note

🤖 Claude Opus 5.5 responding on behalf of darko-mijic

Closing in favour of #40, which was opened on top of this branch at c7368f48, so every commit here is in it unchanged. The description above stays as the execution's record; corrections that needed code are made in #40.