Add an Appendix E incident retrodiction harness

loopx/semantics/incident_v0.json

@@ -0,0 +1,166 @@
+{
+  "schema_version": "loopx_semantic_incident_ledger_v0",
+  "meaning": "The incident and review lessons recorded in the semantic vocabulary RFC's Appendix E, each paired with the probe that retrodicts it against today's guard. A retrodiction asks whether the guard as it exists now rejects the defect form the lesson describes; it does not ask whether a historical revision passed, because the guard did not exist then and that answer is always no. `expectation` is authored from the lesson text, never from probe output; the harness reports where the measurement disagrees with it.",
+  "source": "docs/architecture/rfcs/semantic-vocabulary-convergence-v0.md#appendix-e",
+  "measured_at": "3937f6b99",
+  "incidents": [
+    {
+      "id": "E01",
+      "class": "cross_runtime_hand_sync",
+      "defect": "Parallel constant lists across runtimes pass review until the day one side changes; a parity check must exist before the second copy is accepted.",
+      "expected_rule": "A registered cross-runtime vocabulary compares both owner modules against the registry value set.",
+      "probe": "cross_runtime_value_drift",
+      "expectation": "caught"
+    },
+    {
+      "id": "E02",
+      "class": "fixture_private_copy",
+      "defect": "A private extraction of a shared constant looks harmless in a large module and is the most common way a schema version forks; test fixtures are second, and HANDOFF_MODES was copied into an e2e fixture.",
+      "expected_rule": "A copy outside the scanned roots is either visible to the scan or named as a declared boundary.",
+      "probe": "fixture_copy_visible",
+      "expectation": "uncovered"
+    },
+    {
+      "id": "E03",
+      "class": "malformed_literal_ignored",
+      "defect": "A literal scan that only accepts [a-z_] silently skipped a _v2 spelling; malformed values must be reported, not ignored.",
+      "expected_rule": "Quoted literals are captured whatever their shape and the shape is validated separately.",
+      "probe": "malformed_value_reported",
+      "expectation": "caught"
+    },
+    {
+      "id": "E04",
+      "class": "blind_guard_green_baseline",
+      "defect": "A scan pattern written from Python examples matched no TypeScript at all, and a guard that is green on a baseline containing violations proves only that it is blind.",
+      "expected_rule": "Both runtimes the registry claims to cover are anchored, so dropping one is a failure.",
+      "probe": "typescript_blind_guard",
+      "expectation": "caught"
+    },
+    {
+      "id": "E05",
+      "class": "registry_weakens_validator",
+      "defect": "When the registry is both the specification and the validator's input, a data edit can weaken the validator.",
+      "expected_rule": "Recognised forms live in code, coverage counts are floored, and owners must be module::Symbol.",
+      "probe": "registry_weakness_rejected",
+      "expectation": "caught"
+    },
+    {
+      "id": "E06",
+      "class": "name_only_ratchet",
+      "defect": "A ratchet on names alone lets an already-conflicting name gain a third spelling.",
+      "expected_rule": "Definition counts and name counts are both budgeted.",
+      "probe": "definitions_ratcheted",
+      "expectation": "caught"
+    },
+    {
+      "id": "E07",
+      "class": "fleet_discovered_not_commit_time",
+      "defect": "A smoke the fleet discovers is not a commit-time check; if the answer is 'after merge', the invariant is a report, not a gate.",
+      "expected_rule": "The guard is selected by the pre-merge planning path for a diff that only touches the guarded code.",
+      "probe": "commit_time_selection",
+      "expectation": "caught"
+    },
+    {
+      "id": "E08",
+      "class": "anchor_less_or_equal",
+      "defect": "An anchor compared with <= pins only the value it held when written, so every tightening below it is unprotected.",
+      "expected_rule": "Budget and floor anchors compare with equality, so neither raising nor lowering the registry value passes.",
+      "probe": "anchor_equality",
+      "expectation": "caught"
+    },
+    {
+      "id": "E09",
+      "class": "field_carries_multiple_vocabularies",
+      "defect": "One field name can carry several vocabularies inside one envelope; a scan that sees the field cannot see the slot.",
+      "expected_rule": "Slots are recorded as a registered relation with an anchored composed domain.",
+      "probe": "slot_relation",
+      "expectation": "caught"
+    },
+    {
+      "id": "E10",
+      "class": "committed_snapshot_coupling",
+      "defect": "A committed snapshot of the whole tree makes the guard's input depend on other people's merges.",
+      "expected_rule": "The inventory is computed at check time and no snapshot is tracked.",
+      "probe": "no_committed_snapshot",
+      "expectation": "caught"
+    },
+    {
+      "id": "E11",
+      "class": "no_way_to_say_different_things",
+      "defect": "A name-keyed collision rule needs a way to say 'these are different things that share a name', or the honest fix and a rename lower the same number.",
+      "expected_rule": "A declaration names every defining module, so a rename cannot remove the debt.",
+      "probe": "scope_declaration",
+      "expectation": "caught"
+    },
+    {
+      "id": "E12",
+      "class": "document_scope_exceeds_scanner",
+      "defect": "When a document widens its scope faster than the code, the two must be reconciled; a scope claim the scanner does not implement is a false invariant.",
+      "expected_rule": "The scan's implemented reach is measured at check time and compared with the declared claim.",
+      "probe": "scan_reach_disclosed",
+      "expectation": "uncovered"
+    },
+    {
+      "id": "E13",
+      "class": "budgets_only_go_down",
+      "defect": "Budgets that only go down describe a direction; write the target table before the second milestone, or nobody can say when the work is done.",
+      "expected_rule": "The RFC carries a target table whose rows name the surface, the target, and the milestone that reaches it.",
+      "probe": "target_table",
+      "expectation": "caught"
+    },
+    {
+      "id": "E14",
+      "class": "dangling_decision_reference",
+      "defect": "A decision that waits on 'a check' the RFC never defines is a dangling reference dressed as prudence.",
+      "expected_rule": "Every open decision names the invariant and the milestone that delivers its input.",
+      "probe": "dangling_decision",
+      "expectation": "uncovered"
+    },
+    {
+      "id": "E15",
+      "class": "role_word_not_defined",
+      "defect": "Using a role word nineteen times is not defining it; until the roles are a table with a check per role, 'who writes this value' has no single answer.",
+      "expected_rule": "Roles are a declared table with a hierarchy and a producer check that fails closed.",
+      "probe": "roles_table",
+      "expectation": "caught"
+    }
+  ],
+  "negative_controls": [
+    {
+      "id": "NC01",
+      "class": "single_value_not_a_vocabulary",
+      "meaning": "A closed set with one value is not a twin or a fork, so the collision rule must stay silent.",
+      "probe": "single_value_ignored"
+    },
+    {
+      "id": "NC02",
+      "class": "unrelated_names_not_auto_merged",
+      "meaning": "Two names sharing a generic value set are a review candidate, never an automatic same_concept registration.",
+      "probe": "unrelated_not_autoregistered"
+    },
+    {
+      "id": "NC03",
+      "class": "equality_anchor_accepts_current",
+      "meaning": "The equality anchors accept the registry as committed, so the comparison is not fail-always.",
+      "probe": "equality_anchor_accepts_current"
+    },
+    {
+      "id": "NC04",
+      "class": "owner_shape_accepts_current",
+      "meaning": "The registry's own owner declarations pass the shape and value checks, so those checks are not fail-always.",
+      "probe": "owner_shape_accepts_current"
+    },
+    {
+      "id": "NC05",
+      "class": "substring_not_counted",
+      "meaning": "The identifier-counting ratchet must not count a longer identifier that merely contains the field name.",
+      "probe": "substring_not_counted"
+    }
+  ],
+  "caught_baseline": {
+    "meaning": "Frozen at authoring time so the retrodiction cannot silently regress; it records what the guard caught then, not a target.",
+    "would_have_caught": 12,
+    "total": 15,
+    "negative_control_false_positives": 0
+  }
+}