Amend Constitution §3: scope the compile-time capability claim

[MatejGomboc]

What

Takes the reword the 2026-07-30 prior-art review recommended for Constitution §3 — exactly as flagged in docs/CHANGELOG.md, now on the maintainer's authorisation.

Before:

Rust's ownership and move semantics model capability transfer at compile time.

After:

Rust's ownership and move semantics model the kernel's own capability handling at compile time — no accidental duplication or use-after-move; cross-process transfer is a runtime table operation the generation scheme secures.

Why

The old sentence was true of one thing and false of another. True: inside the kernel, the no-Clone Capability makes duplication and use-after-move compiler-checked properties (PR #12 proves it with a compile_fail test). False: what a process observes when authority transfers is a runtime table operation — the borrow checker sees one compilation unit and cannot span protection domains (RedLeaf's group reached the same conclusion for ownership types generally). Our own generation counters exist precisely because runtime checks are what hold that boundary.

The constitution had become the last place in the repository making the unscoped claim — RFC-0003's amendment, the research note and the capability crate's docs all already state the scoped version. In a project whose law demands every line be explainable (§5.2), a slogan the maintainer would have to walk back when explaining it does not belong in the doctrine list.

Scope

• CONSTITUTION.md §3 — the one sentence, reworded as flagged
• docs/CHANGELOG.md — the amendment logged, as constitutional amendments always are, however small
• RFC-0003 §6 and the research note still quote the old sentence, deliberately unedited — they are the historical record of what was reviewed

Markdown and British-spelling gates clean.

🤖 Generated with Claude Code