- The optimality gate's decode-failure message names ARG3 and the rebuild
command (node routing/scripts/build-road-graph.mjs); the frozen D-03
constants (OPTIMALITY_EPSILON_PCT = 0.1, REQUIRED_BASELINE_ARG_VERSION
= 1) and the immutable alt-baseline.json record are untouched.
- The oracle sweep's graph-missing (SKIP) and decode-failure wording names
the ARG3 binary; the seeded 200-pair symmetric-compare constants and the
three violation classes are unchanged.
- RO1/RO2 ban the ARG3 magic 0x41524733 in the upload script's and the
Worker's comment-stripped code: the one-path laws now cover the CURRENT
format, not just the retired ones. The Worker keeps exactly one
decodeGraph call, no GRAPH_VERSION, no magic, no === 2.
- measure-route-cpu.mjs is untouched here by design: its LADDER HISTORY
gains the CH rung only once the measured numbers exist (task 3).
MG1/MG2 fail against the current scripts: the optimality gate and the
oracle sweep still describe the binary-under-test in ARG2-era terms and
their decode-failure messages do not name ARG3 or the rebuild command.
MG3 pins the CPU gate's budget/sample constants exactly-once (already
true — stays green).
- The build no longer imports landmark.ts (deleted in 08.1-01) and has no
--landmarks knob: the compacted directed edges feed contractGraph (the
ONE CH construction authority) and the tables encode through the single
encodeGraph authority as the ch: block (never landmarks:).
- Any contraction/encode throw names the CH preprocessing stage and exits 1
BEFORE any write — collect-then-write keeps the previous binary intact
(T-08.1-10).
- The build prints the measured CH stats block (D-08/D-09): contracted
nodes, shortcuts + ratio per node, witness searches + settle-budget hits,
chRank bytes, shortcut bytes, wall-clock over contraction + encode, and
total binary bytes. No ARG3 payload ceiling exists (D-08) — the enforced
1-80 MB D-01 envelope is unchanged and still fails before any write.
- The stale ARG2-era 30 MB forecast advisory is retired with the layout it
forecasted; the measurement itself is the record.
- --check becomes a pure decode+facts tool for any valid ARG3 (the
committed mini fixture included): prints chShortcutCount, shortcut
ratio, chRank length; the envelope appears as an advisory line — the
enforced gates stay in the build path.
BS1-BS5 pin plan 02 task 1's behavior before it exists: the build script
must be landmark-free in stripped code, run ONE contractGraph stage into
the ch: encode input, print the full measured CH stats block (D-08/D-09),
keep the 1-80 MB D-01 envelope single and unchanged, and decode the
committed ARG3 fixture green via --check with CH facts. BS1/BS2/BS3/BS5
fail against the current landmark-era script (which cannot even load —
landmark.ts was deleted in 08.1-01).
- 08.1-01 task 2: re-pin graph.test.mjs in-memory G-cases (G1/G3/G8/G9/G10/G11)
and astar.test.mjs in-memory/ALT cases; suspend only committed-fixture G7 and
A1/A2/A4/A5/A6 (the runner auto-discovers all suites and parses no argv, so
task 2's verify could never exit 0 otherwise)
- 08.1-01 task 3: own un-suspension of G7 and A1/A2/A4/A5/A6 after the ARG3
fixture regeneration
- 08.1-01 task 1: drop the cosmetic --test-name-pattern flag (ignored by the
hand-rolled runner; full suite runs instead)
- 08.1-02 task 2: use grep -cF for the rollout decodeGraph call-site gate
(BRE form exited 2 with 'Unmatched ( or \\(')
- 08.1-02 task 1: replace the no-op '|| test $? -eq 1' landmark gate with a
'test "$(...)" -eq 0' count assertion that can actually fail
- new named constant LANDMARK_I32_WEIGHT_CEILING (0x7fffffff) in
landmark.ts: a seconds/quantumS quotient at or past 2^31 would wrap
NEGATIVE on the Int32Array store, silently bypassing the
LANDMARK_MAX_QUANTA throw in dijkstraPass (a negative contribution
never exceeds it) and — at a -1 wrap — becoming the 0xFFFF sentinel;
prepare() now fails loud at the table-build entry, naming the edge,
the ceiling and the fix (raise landmarkQuantumS)
- 'nothing is clamped, ever' now holds at the storage boundary;
validation is per-edge at build entry — the search hot path stays
allocation-free and validation-free
- L5b regression vector: 3e10 s edge (3e11 quanta) throws in both
landmarkTables and farthestPointAnchors; just-under-ceiling
(2147483646) still fails via the documented 65000 law; ordinary
weights untouched
- the graph binary is NOT committed: routing/data/.gitignore ignores
*.bin (git check-ignore verified) — forks rebuild their own
(docs/ROAD-GRAPH.md), so the old assertion message was factually false
- CPU3 now mirrors CPU4's law: absent binary -> honest SKIP (not a
failure); the run-the-ladder assertions fire only when it is present
- reason text aligned with reality: 'gitignored fork-rebuildable artifact'
- sweepOracle: Math.abs(deltaS) > ORACLE_EPSILON_S replaces the one-sided
'seconds > optimal + eps' check — a result FASTER than the Dijkstra
oracle (the traversal-law-break signature, e.g. a oneway relaxed) is
now a violation, stamped ORACLE-MISMATCH, never a pass
- worstDeltaPct tracks MAGNITUDE not sign — a -40% law break moves it
- pass gate: suboptimal === 0 && oracleMismatch === 0 && classBreaks === 0
- header gate description + exit codes updated: the check is |Δ| in both
directions; GATE FAIL names both violation classes; GATE PASS reads
0/N |Δ| violations
- row-level signed Δ printout unchanged (sign/direction reporting kept)
measure-astar-oracle-sweep.mjs (maintainer-time, route-corpus law: exported
core sweepOracle + CLI guard, print-the-measurement, honest exit codes):
- FRESH seeded cross-metro pairs via measure-optimality-baseline.mjs's
exported generateCrossMetroPairs core — seed 0x08f1, deliberately NOT
the D-03 corpus seed 0x08a1, so this sweep never measures the corpus
- compared-pair law: one 3x-oversampled draw, consumed in order until 200
COMPARED pairs (reachable + null-vs-null unreachable both compare;
snap misses counted and printed; same binary + seed => same set) —
random bbox coordinates are ~20% off-road and an unsnappable pair
cannot exercise the search
- brute-force unidirectional Dijkstra oracle (label-setting, heap, the
shared oneway traversal law) on the SAME snapped node pair
- gate: 0 suboptimal (epsilon 1e-6 s — f64 summation-order noise floor,
A1's epsilon); class-breaks (one side routes, other doesn't) violate
- honest skip when the gitignored binary is absent (exit 0, SKIP printed)
First run on the fixed engine: 200 compared (182 routed, 18 unreachable),
0 SUBOPTIMAL, worst delta +0.000% — GATE PASS. The pre-F1 engine measured
1/194 suboptimal on this pair shape (bench7, debug session).
Debug session alt-potential-4x-slowdown, root cause RC-1 (LIVE correctness
bug): bound()'s per-node sentinel skip (tv === 0xffff -> drop landmark l)
varied the active landmark family set PER NODE, so the toTable max lost
cross-edge consistency across edges leaving the 6,285-node disconnected
island (2.02% of cells) — shipped routeAstar returned suboptimal seconds
on 1/194 fresh random real-graph pairs vs the Dijkstra oracle (worst
single-edge family variance 1,026 s). D-03's fixed corpus was green on
sampling luck.
The fix (reverseFor precedent, in-constraint):
- per-graph WeakMap memo cleanColumnsFor: clean[l] = 'to-column l has ZERO
sentinel cells' — O(L*n) sequential row scans once per graph/isolate
- per-search active list activeL = clean columns only; bound() loops the
active list with NO per-node sentinel branch; the constant-table
goal/origin NaN checks are retained (belt)
- on the current binary (0/24 clean columns) potentials degrade to EXACTLY
haversine — the designed sound fallback; the pre-ALT CPU band returns
- ALT stays live and tested on strongly connected fixtures (mini-graph
0/2 dirty columns, A12 ring all-clean, new A13 mixed subset case)
- LANDMARK_SENTINEL_U16 named constant; sentinel compares at setup scope
only; pure-module law untouched
BH stop rule, reductions, balanced alternation, meet probes, real-seconds
reconstruction: UNTOUCHED. F2 (transposed table) explicitly out of scope.
Battery: routing 81/81 (A11 RED pins now green, A13 new), bot 126/126,
routing+bot typecheck clean.
- A9: island fixture re-pinned as ALL-DIRTY (every to-column holds a
B-node sentinel -> every landmark drops search-scoped -> the whole
fixture runs the haversine fallback); the old 'real ALT bounds live in
A' claim is gone — it described the per-node sentinel skip RC-1 removed
- A10: mechanism comment updated to the containment law (active list
empty at search scope, never a per-node l-mask)
- A11: structural pin rewritten to the F1 bound() shape — cleanColumnsFor
memo + activeL list must exist in code; inline '=== 0xffff' sentinel
compares BANNED (RC-1's exact shape); named-constant law pinned —
FAILS ON SHIPPED CODE (the RED gate)
- A12: re-sealed as the ALT-ACTIVE counterpart — all to-columns clean
(strongly connected ring + spur), pinned by table scan
- A13 (new): mixed clean/dirty columns via a one-way-bottleneck twin-ring
fixture — the subset-active-list branch neither A9 nor A12 exercises;
64-pair Dijkstra equivalence + honest nulls
Fails today by design: A11 (4 pins) against the shipped per-node skip.
Task 4, re-scoped per the plan's honest-FAIL branch: the c3 class is NOT
retired — every record now states the measured post-ALT truth.
- KNOWN-LIMITATIONS: the cross-metro section is the /cari-shaped record —
WHAT CHANGED (ALT built, D-03 optimality green quoted) / what REMAINS
(the CPU verdict FAIL lines quoted with date; the one-directional-
Lipschitz wall named; the escalation open); the roadmap-pointer ALT row
flips to Built (Phase 8) with the measured verdict — never 'not built'
again
- ROAD-GRAPH: the ladder table gains the (c2) rung (EXECUTED, measured
FAIL, the L=32 probe quoted); the decision paragraph states c2
executed-verdict-fail and names the real remaining options; new 'The
ARG2 binary layout' section (72-byte header, landmarkCount/
landmarkQuantumS, u16 suffix + sentinels, the quantum knob's ≈6,553 s
ceiling, the storage-name-vs-format-truth law); key facts carry the
optimality gate and the ARG2 wording; the fork contract's build step
teaches the landmark stage (no new commands)
- docs/CONFIGURATION.md: verify-only — all path/script claims still true,
no edit needed
- staged as selective hunks; the tree's pre-existing doc-sync edits
(battery paragraph, 'six maintainer scripts' intro) remain uncommitted
greps: 'Next-milestone item, not built' = 0; the measured p95 strings
quoted; (c2)/landmarkQuantumS/ARG2 all present; ARG1 appears only in
layout/router-pending contexts.
Task 3, re-scoped per the plan's honest-FAIL branch: the CPU verdict FAILED
(the ladder ran to its documented stop), so the c3 class is NOT retired —
the record instead carries the executed-and-measured ALT truth.
- budget-gates.mjs: the verdict law documents the Phase-8 outcome (ALT
EXECUTED, optimality green, CPU verdict FAIL 152.788/185.692 ms quoted
with date; L=32 probe measured worse) — the stale 'next-milestone item'
wording is gone; ROUTE_CPU_DRIFT_GUARD_MS re-anchored 200 → 400 (the
post-ALT documented band outgrew the old guard; ≈2x the worst shipped-
config run 185.692 ms); the guard stays a regression trip-wire, the 8 ms
budget stays and its FAIL still prints every run
- budget-audit.test.mjs: CPU3 pins the new law (evidence must name the
EXECUTED-in-Phase-8 verdict and must NEVER say 'next-milestone');
19/19 vectors ok (the count holds — no vector dropped)
- docs/BUDGETS.md: route-cpu row carries the Phase-8 measured numbers +
date; the c3 section is the honest post-ALT record (what changed, the
quoted gate lines, the one-directional-Lipschitz wall, the open
escalation) — staged as selective hunks; the tree's pre-existing
doc-sync edits in other sections remain uncommitted, untouched
grep law: zero 'next-milestone' hits in budget-gates.mjs + BUDGETS.md;
ROUTE_CPU_DRIFT_GUARD_MS still exported and used.
Task 1: the D-03 gate script (measure-optimality-gate.mjs) reads the frozen
pre-ALT record, re-routes the same coordinate-pinned pairs on the current
ARG2 binary, and gates on seconds-equality (±0.1%) + verdict-class
preservation — never on node paths (equal-cost ties are documented behavior).
Rule-1 deviation the gate forced on its first run: routeAstar returned
SUBOPTIMAL real-graph routes (x038: 1234.6s vs the 1214.8s Dijkstra optimum;
x045: 1475.5s vs 1460.6s) — the fixture sweep could not see it. Root cause:
the fromTable bound d̂(ℓ,t) − d̂(ℓ,v) is one-directional Lipschitz (its u-side
term needs the REVERSE edge; a oneway does not provide one — the anchor
reached node 264611 126.8s faster than its own 1.49s upstream neighbour
264610), and the shared Ikeda average p = (h_f − h_b)/2 is consistent only
when every family inside h_f/h_b is two-sided. The toTable bound
d̂(v,ℓ) − d̂(t,ℓ) rides stored traversable edges in BOTH directions; it alone
joins the haversine now. Stop rule, reductions, meet probes, reconstruction:
untouched. landmarkTables/build verified EXACT (0 mismatches vs independent
integer Dijkstras, both rows, all 24 anchors).
- measure-optimality-gate.mjs: exported core + CLI guard (route-corpus
pattern); epsilon mirror + argVersion asserts precede any measurement;
per-pair rows, extract-drift WARNING (never a re-record), honest exit law
- astar.ts: potential() consults landmarkTo only; doc-comments carry the
one-directional-Lipschitz law and the x038/x045 evidence
- astar.test.mjs: A11 re-pinned (landmarkFrom must NOT appear in the
comment-stripped search — re-adding it trips the pin); A12 oneway-ring
sweep added (directed reach asymmetry stays Dijkstra-equal on every pair)
Battery: routing 80/80, bot 126/126, both typechecks green.
D-03 gate: GATE PASS — 53/53 routed pairs equal within ±0.1% (max |Δ| 0.005%),
verdict classes preserved (6 unreachable + 41 unsnappable, 0 re-snapped).
- The stage between edge compaction and encode feeds the graph's edges to
landmark.ts (farthestPointAnchors + landmarkTables + landmarkCoverage) —
the script quantizes and implements nothing itself (single-authority law)
- D-02 scaling rule L = clamp(round(N/13000), 16, 32) (~24 at KL's 311k
nodes) with a --landmarks <n> measured knob (positive int, hard cap 128,
parsed before --check)
- Honest gates before any write: quantum-ceiling throw -> fail with the
raise-quantum hint (Pitfall 5); per-anchor coverage >= 0.9 (the SAME
fraction for any L — the override cannot lower it, T-08-11); anchor
shortfall fails loud instead of encoding a weaker ALT
- encodeGraph receives landmarks: { quantumS, nodes, to, from } — the one
ARG2 authority; no local fallback encode
- Stats gate prints L/quantum/coverage min-mean/table bytes/sentinel totals
BEFORE the size gates; --check mirrors the facts from the decoded binary
(landmarkCount/quantum/anchors/coverage/sentinels, no network)
- A1 ladder history gains rung (c2): EXECUTED in this preprocessing stage
- RO1 upload-format-agnostic: upload-road-graph.mjs keeps KEY
'kl-roadgraph.v1.bin' + BUCKET 'araharah-graphs'; comment-stripped code
contains ZERO format tokens (landmark/encodeGraph/decodeGraph/ARG1/ARG2
magics/GRAPH_VERSION) — the migration is byte-shipping of the same key,
forever (A8 grep-shape)
- RO2 one decode path: worker-router.ts keeps GRAPH_KEY unchanged, exactly
ONE decodeGraph call in the loadGraph flow, no version-conditional branch
(GRAPH_VERSION / magics / '=== 2' absent) — an undecodable binary flows
to the existing null -> router-pending path (D-01 at the consumer)
- full battery at this commit — the FIRST where routeAstar consults real
landmark tables on the bot suite's ARG2 corridor graphs: routing 79/79
(A1 seal + A9/A10/A11 + RO1/RO2), bot 126/126 (RT trunks + cron),
routing+bot typechecks clean; worker-router.ts and upload-road-graph.mjs
untouched (git diff --stat empty)
- routeAstar's ONLY change: the h_f/h_b bodies become max(ALT triangle
bounds, haversine) — per-search Float64Array(L) constant tables in quanta
(0xFFFF written as NaN = search-scoped landmark drop), lazy per-node
max over the four triangle families with RAW u16 sentinel compares
BEFORE any float conversion, haversine max-fallback on sentinel-flooded
nodes (Pattern 3 containment)
- the (h_f - h_b)/2 combination, reductions, balanced alternation, meet
probes, BH stop rule, and real-seconds reconstruction are byte-identical
(research Pattern 1 — the survey's (pf-pr)/2 is what p_f already is)
- no Map/Object allocations (A8 green), no new imports, one search path
(L >= 1 is the decodeGraph guarantee, D-01)
- A1's 625-pair Dijkstra-equivalence sweep re-pinned under ALT: the
standing optimality proof; A9 island + A10 skip laws sealed; A11
structural pin green
- module header + routeAstar doc gain the ALT paragraph (c-metric
exactness, sentinel laws, Ikeda history intact)
- A9: two-component synthetic (3x3 grid + 4-node path), anchors HAND-PINNED
inside component A only via landmarkTables; full 169-pair sweep asserts
seconds-only Dijkstra equivalence (A-internal with ALT live, B-internal
on the haversine fallback, 72 cross pairs -> null)
- A10: origin AND goal inside the anchorless component — all families drop
at SEARCH scope, the 16 B-internal pairs still route Dijkstra-equal
- A11: comment-stripped astar.ts must reference landmarkTo/landmarkFrom/
landmarkQuantumS in CODE; one sentinel spelling (0xffff, never 65535);
A8's no-Map law unchanged — FAILS now (RED: the potential is still
pure haversine)
- case-index doc-comment extended A1-A8 -> A1-A11; buildIslandFixture
helper routes fixture tables through the ONE landmark module
webhook corridor/sparse builders + guidance-cron unnamed way compute
tiny tables through the ONE preprocessing core (@araharah/routing
farthestPointAnchors + landmarkTables) and pass the landmarks block
into the same single encodeGraph call — call-site updates, not a
second encode function. Graphs with no degree>=2 candidate (sparse,
2-node) pin their anchor explicitly; tables still come from the
integer-Dijkstra core.
FULL BATTERY at this commit: routing:test 74/74, bot 126/126, both
typechecks clean; the regenerated fixture is deterministic (byte-
identical re-run); mini-graph-arg1.bin is byte-stable vs its committed
08-01 bytes.
graph.ts versioned IN PLACE (no second codec): GRAPH_MAGIC 0x41524732,
GRAPH_VERSION 2, HEADER_SIZE 72 (72%8==0 keeps f64 views aligned);
header gains landmarkCount u32 @60 (the old pad), landmarkQuantumS f32
@64, reserved u32 @68; the landmark suffix (u16 toTable, u16 fromTable,
u32 landmarkNodes) extends layoutFor's total arithmetic — exact-size
law covers the variable suffix BEFORE any view allocation (T-08-01).
D-01 fail-honest: ARG1 bytes / version!=2 / landmarkCount=0 / hostile
quantum / size mismatch all decode null (committed mini-graph-arg1.bin
is the standing rejection vector). GraphInput.landmarks REQUIRED and
loud-validated (T-08-04). RoadGraph gains the five landmark fields
(Plan 08-03's ALT potentials consume them).
Fixture regenerated as ARG2 through the SAME encode authority: the
builder gains the tiny real landmark stage (L=2, anchors [0,18],
quantum 0.1s, coverage 1.0 — identical bytes every re-run).
Rule-3 call-site updates forced by the required-landmarks law (missed
by the plan's files list): astar.test A3 + snap.test S3 synthetics
carry inert hand landmark blocks. Fixture regen pulled forward from
task 3 so this commit's own battery is green (74 passed, 0 failed).
farthestPointAnchors + landmarkTables + landmarkCoverage over the
ĉ metric: edge weights floor-quantized once (Math.floor(seconds/q)),
exact integer Dijkstras (Int32 labels, binary heap, lazy deletion),
0xFFFF sentinel, 65000-quantum loud overflow. Traversal law mirrors
astar.ts verbatim: bit0 edges never relaxed in EITHER direction.
Test-vector corrections caught at GREEN (expectations were wrong,
implementation was right):
- L4: rows index by anchor POSITION (row-major [l*N+v]), not node id
- L6: the c-metric farthest node from corner 0 is interior node 18
(297q: interior hops cost 2x perimeter), not corner 24 (264q) —
verified against an independent brute-force Dijkstra
A 2-node graph has no degree>=2 candidates, so farthestPointAnchors
returns empty before any Dijkstra runs and never reaches the overflow
throw. Node 1 on a 3-node path is a candidate, so the selection pass
actually exercises the law.
Hand-computed vectors for the pure landmark compute core: deterministic
degree-filtered farthest-point anchors, exact integer quanta
(floor(2.55/0.1)=25, two edges=50), 0xFFFF sentinel + self-cell laws,
oneway asymmetry, the 65000-quantum overflow throw, and the 5x5-grid
corner-to-corner 264-quanta vector with coverage 1.0.
- Part A: the ONE consolidated walk (D-05) — four clients × seven
interactions, ⬜ cells, PASS/FAIL/NOT RUN vocabulary defined in-file
- Part B: the Android battery record (D-04) — 11 required fields, the
no-extrapolation rule in the file's own voice
- Part C: the 12 automated-half commands with ⬜ result cells + the
--live NOT-RUN-is-not-a-pass note
- Part D: the six D-09 checklist items, each naming its evidence
- Executor notes: the /cari defect ROOT-CAUSED+FIXED (script param
name), the c3 posture, the R2 graph state, the KV-list over-ceiling
options (user decision), the kv-expiry credential caveat, never-fake
- FINAL VERDICT: ⬜ NOT YET SIGNED — the human fills the verdicts
- the Bot API parameter is 'scope' (verified against
core.telegram.org/bots/api/methods/setmycommands); the script's
'bot_command_scope' was an unknown field Telegram silently ignores,
so every call hit the default scope and the two clear calls wiped the
default set entirely — the ok:true lines proved nothing about scope
- registration re-run: default (agnostic/en/ms) + all_private_chats
(agnostic/ms) read back help, privacy, cari via getMyCommands with
the correct 'scope' param; group scopes verified cleared
- docs/KNOWN-LIMITATIONS.md: the 'Telegram-side defect' attribution
corrected to the actual script bug; residual client menu-caching
caveat + type-the-command workaround kept
- bot/README.md command row updated to the real scope set
- banner takes one step down the SAME type-token scale in landscape
(headline-md distance / label-lg street) + xs vertical padding so the
measures fit the 72px min-height instead of overflowing it
- guide-list chrome offset corrected to its own margin stack
(sm + 72 + 1 + 24 + sm = 113px, was 104px)
- bottom register: the portrait 64px control-clearance composite already
seats the guidance/confirm card inside the landscape height — the
landscape override is removed (measured card top 159 vs banner bottom
103 at 844x390); attribution chip + recenter control clear
- device-walk feedback on 07-02's committed geometry; tokens binding
- captures re-run: CAPTURE OK — 22/22 non-blank
- /start sendPhoto now points at MASTER_FILE-arah2_logo.png (deployed
from web/public/ — the untracked asset lands here so the reference
resolves on deploy)
- README + AGENTS.md + the 4 mockup screens swapped the Stitch
googleusercontent logo placeholder for the local master logo
- pre-existing on the tree through 07-03..07-05 execution; verified by
this session's baselines (bot 126/126, web 165/165, captures 22/22)
- source-side runtime-hosts gate gains DOC_POINTER_STATIC_TEXT_HOSTS (the
MapLibre-attribution precedent): the published repo origin may appear
ONLY as a bare URL literal in bot copy (D-08/D-09), never fetched
- class is NARROW and pinned by SA6: a fetch( target naming the same
host is still a violation
- Rule 1 (found by SA6's RED): the fetch( handler's declaration
heuristic misclassified any quoted absolute URL as a TS declaration —
quoted strings are targets; they now reach the host check
- docs/PRIVACY-AUDIT.md: adjudication documented + dated re-run addendum
- deferred-items.md #1 closed: npm run privacy-audit exits 0 again
(PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations; suite 13/13)
- asset-header probe reads HTTP status BEFORE interpreting headers — a
non-2xx is deployment drift (the notRun exit-2 class), never a cache
violation; the violations.length count bug fixed
- XHTML namespace URI joins the SVG spec-identifier adjudication
- probeUnavailable carries the reason only (the CLI prints NOT RUN)
- CP2/AU1 suite vectors updated to the corrected contracts
Residue note: these edits were on the tree during 07-03/07-04 execution
but escaped those plans' commits (07-04-SUMMARY residue caution).
- 3 tasks (TDD RED→GREEN), 7 commits, 19/19 budget-audit suite vectors
- BUDGET AUDIT CLEAN (exit 0); --live exits 2 on deployment drift (honest class)
- 2 deviations documented: the c3-aware route-cpu verdict (plan contradiction),
the golden-corpus environment-drift class
- open items for 07-06 flagged: the KV-list cadence finding + the privacy-audit
RED (07-05's gitmirah strings) — both in deferred-items.md
- a missing package.json in the audit root is T-07-22's environment-drift class,
not a corpus failure — the corpora cannot even be spawned there
- AU1's flag-skip assertion matches the printed 'NOT RUN — (pass --live)' shape
- the full ceilings table (Cloudflare Workers limits / KV limits / pricing, sourced)
- current measurements: A* p95 83.989 ms vs 8 ms ladder budget (the accepted c3 class,
negative headroom printed), BA9 79,815/204,800 gz, app bundle 479,178/500,000 gz,
KV write classes (cron = 0, source-proven), golden corpora exit 0
- the per-request-class subrequest inventory (source-derived, not a live Workers Logs metric)
- the DISCOVERED finding: KV list rate 1,440/day (60 s cron x 1 list/tick) OVER the
1,000/day ceiling — documented with options, decision deferred to the 07-06 launch gate
- the c3 cross-metro escalation restated; honest Statement; unsigned signature block
- npm run budget-audit: 5 required gates + the --live cache-header probe; one evidence line per gate
- the FREE-TIER COMPARISON table: every documented Cloudflare free-plan ceiling beside the
current value where measured, `not measured` where not — the console form of docs/BUDGETS.md
- exit 0 CLEAN / 1 FAILED / 2 NOT RUN — a skip is never a pass (T-07-22)
- no secret, no coordinate in the output (D-14's category-only law, applied to budgets)
- route-cpu: RE-RUNS routing/scripts/measure-route-cpu.mjs as a child process; p95 printed
against the 8 ms product budget + 10 ms free ceiling; the child's GATE FAIL line carried
verbatim; the accepted c3 band has a 200 ms drift guard — uncharted regression fails
- bundle-budget: BA9 route-payload gz sum + whole-app bundle ceiling (500000 gz bytes);
Worker bundle honest NOT MEASURED when bot/dist is absent (never zero)
- kv-writes: 4 write sites inventoried by family, every write TTL-named (PG1); the cron
zero-write law is source-proven — runGuidanceCronTick's body must contain no .put(/.delete(
- subrequests: per-request-class external-subrequest inventory derived from the route table;
uninventoried classes FAIL; source-derived honesty sentence verbatim; never a fabricated zero
- cache-headers: reuses cloudflare-probes' runAssetHeaderProbe (imported, never forked)
- golden-corpus: RE-RUNS routing:corpus + search:corpus as child processes (SC4.a/SC4.b)
- every gate must print its measurement and carry its contract id
- every gate must be able to FAIL on a synthetic violation (fixture injection)
- a skip is never a pass (notRun class; T-07-22)
- web/public/_headers: /assets/* → public, max-age=31556952, immutable (Vite content-hashed output)
- / → public, max-age=0, must-revalidate (the HTML entry points at the current hashed assets)
- no CORS/Set-Cookie/other rules — same-origin policy stays the app's design
- verified: web/dist/_headers exists after the theme+web build
- /cari re-arm RAN 2026-10-25: all six scopes ok:true — 'all command scopes
armed'; residual Telegram client-menu caching risk stated, workaround
pointers at docs/KNOWN-LIMITATIONS.md (T-07-24/T-07-26)
- A1: NOT RETIRED as a mechanism hypothesis — mitigated-by-design via the
chain.ts polling degradation; A3: RETIRED as a decision constraint
(remote workers.dev origin, no LAN-IP dev deployment)
- the Phase-3 FINAL VERDICT table untouched (1 occurrence; the dated
section is the closure)
- docs/KNOWN-LIMITATIONS.md — new, for drivers AND forks: OSM data gaps,
the c3 cross-metro CPU degradation (2-8 ms short / p95 38-93 ms cross-metro,
measure-route-cpu.mjs LADDER HISTORY as evidence, ALT as the committed lever,
Workers Paid rejected on the $0 mandate), the /cari menu defect + the
type-the-command workaround, the beta-quality statement, the roadmap
pointers (WASM-router / ALT / engine B — none in this release), the
privacy paragraph, and the fork-facing audit commands
- strings.ts helpMenu (en+ms): ONE pointer line each, not /-prefixed so the
CS5 menu parse ignores it; URL is the repo's actual remote deep link
(http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md),
identical in both locales — single-copy law (D-05)
- suite 126/126, CS5 green
- IN-01: delete the never-constructed ParsedInitData export (sole repo hit was
its own declaration); the three read-helper catches now carry Intent:
comments stating malformed-vs-tampered precedence and the chat-degrade law
- IN-02: wrangler.jsonc line 2 states the post-fact truth — the chat_sessions
namespace id below is live, no re-creation
- IN-03: new T4 vector 'age 900 s → ok:true (the boundary is INCLUSIVE)' pins
the strictly-greater comparator's inclusive edge (T-07-08); suite 126/126
- Findings table carries the ACTUAL printed evidence from the audited run
(commit 9c55e9a): 5 static gates PASS, 0 violations; live legs recorded
honestly as NOT RUN with the launch-gate re-run protocol
- Storage inventory: the four TTL-only KV families; Log vocabulary: the
category-only surfaces; Runtime network: the printed host inventory
(allowlist + documented static-text class) and D-02's zero-telemetry posture
- human signature block left blank for the launch gate (D-09)
- runs the five static gates in Pattern-4 order; --live adds the KV-expiry
and asset-header probes; the no-flag skip prints '(pass --live)' and is
never silently green
- exit 0 CLEAN / 1 FAILED (violations counted across gates) / 2 NOT RUN
(credentials or build or deployment drift — never mistaken for a pass)
- header states the maintainer-time-tool law, the GPL fork-reuse contract,
and D-02's zero-telemetry prove-the-absence posture
- AU1-3 CLI vectors green: CLEAN exit 0 on this tree, FAILED exit 1 via the
PRIVACY_AUDIT_ROOT fixture, NOT RUN exit 2 for --live without credentials
- runBundleTelemetryGate: PRODUCTION web/dist ONLY (dist-harness forbidden,
BA5); analytics/beacon token set (sendBeacon explicit form); positive
host allowlist with the host inventory printed, never assumed (A4);
deep-link crypto (D-11) and storage tokens JS-assets-only; a missing
build is notRun, never a silent pass
- runKvExpiryProbe: npx wrangler kv key list (current syntax, deprecated
colon form forbidden), namespace id read from bot/wrangler.jsonc at
runtime; parses name/expiration/metadata + list_complete/cursor and
follows the cursor; unexpected families REPORTED (A5); oldest/newest
expiry reported; raw key names never printed (category-only evidence)
- runAssetHeaderProbe: curl -sSI cache-control/cf-cache-status reported
VERBATIM (probabilistic — printed, never interpreted)
- documented adjudications: MapLibre static-text hosts, W3C namespace
identifiers, bare-array = CLI's internally-paginated complete set
- SA1-5: each source gate returns {id, pass, evidence}, passes the current
tree, and FAILS a synthetic violation via injected fixture roots
- BG1-2: production web/dist only; missing build is notRun (never a pass)
- CP1-2: probeUnavailable exact shape + credentials-absent degradation
- AU1-3: CLI exit 0/1/2 — CLEAN on this tree, FAILED on a fixture root
(PRIVACY_AUDIT_ROOT), NOT RUN for --live without credentials
- captureLeg accepts a per-leg viewport (default 390x844 unchanged)
- shell-guidance-landscape.png: corridor drive leg verbatim at 844x390 — the
@media (orientation: landscape) block exercised in a real browser
- shell-route-pending-landscape.png: the designed pending card in landscape
- both legs under the existing MIN_BYTES blank bar; capture 22/22 non-blank
- consult filters degenerate options (geometry.points < 2) into the pending-card class
- reroute ladder: no drawable option = the honest reroute-failed degradation, never a half-drawn snap-in
- GREEN for FM4; web suite 165/165, typecheck clean
- FAILURE_VECTORS as data: 7 classes (empty/error/no-geometry/off-road/
location-timeout/old-client/route-timeout), each with trigger + expected surface
- FM2 drives the REAL buildRoutePendingCard (text, no undefined, CTA wired)
- FM3 rejecting + never-settling sources both stay off the draw path (200ms guard)
- FM4 RED: a <2-point geometry currently reaches the draw path — the pending
card must replace the half-drawn line (T-07-12)
- FM5 pure-reducer excursion: one reroute-requested, storm guard holds, CALM slot
- FM6 old-client chrome builds with zero capability calls (07-01 owns fullscreen)
- FM7 location chain lands designed denied/awaiting-pin states
- route.ts: requestGuidanceFullscreen at BOTH guidance-start edges (activateGuidance + resume) directly after engageCloseProtection — synchronous, best-effort, return ignored
- route.ts: exitGuidanceFullscreen at BOTH teardown edges (teardownGuidance + stopGuidanceArtifacts) directly after releaseCloseProtection
- route.ts: watchFullscreenEvents registered exactly ONCE at the guidance-start edge; the callback is a deliberate no-op (observability only, D-14)
- main.ts: watchSafeAreaChanges(getWebApp()) called at the boot site directly after applySafeArea(resolveSafeInsets(getWebApp())) — insets re-resolve at runtime, not only once at boot (T-07-06b)
- no new logging; the route module's state-token console law unchanged
- telegram-mock gains requestFullscreen/exitFullscreen/lockOrientation/unlockOrientation + __fullscreen* state fields in the SAME change as the contract (contract + fake + test together)
- FS1-FS7: both-halves guard vectors, the throwing-platform path (FS4), the exit mirror (FS5), the event categories (FS6), the old-client fallback (FS7, SC2.e)
- FS8: safeAreaChanged re-resolution through the union authority, with a minimal document stub restored in finally
- FS9: comment-stripped source-scan ban on the DOM-fullscreen/orientation-lock escape hatches (T-07-10) + the guard-is-not-optional assertion
- suite 157 passed, 0 failed (148 baseline + 9); mutation check: neutering the 8.0 guard fails FS2/FS5
- new watchSafeAreaChanges(wa): registers handlers for both Telegram inset events, each re-applying through the SAME union authority (resolveSafeInsets -> applySafeArea) — never a duplicated computation
- each handler wrapped in try/catch so a throwing client event cannot break the boot (T-07-06b)
- resolveSafeInsets/applySafeArea behaviour unchanged; nothing written to storage
- TelegramWebAppLike gains requestFullscreen/exitFullscreen/isFullscreen/lockOrientation/unlockOrientation as OPTIONAL members only (no existing member reshaped)
- new web/src/telegram/fullscreen.ts: requestGuidanceFullscreen/exitGuidanceFullscreen/watchFullscreenEvents behind the BOTH-halves guard (method presence AND isVersionAtLeast("8.0"))
- every platform call in try/catch — a refused request is a supported degradation, never an error surface (T-07-06)
- no DOM Fullscreen API, no generic orientation lock, zero logging (T-07-10, T-07-09)
Checker-issue round 1 on the Phase 7 plan set:
BLOCKER (07-01) — watchSafeAreaChanges and watchFullscreenEvents were created
and unit-tested but never called in production: main.ts:74 was the only
safe-area site and was not in files_modified, and the fullscreen events were
never registered. Insets never re-resolved at runtime on a real device while
every gate stayed green.
- web/src/main.ts joins 07-01's files_modified; task 4 step 8 wires
watchSafeAreaChanges(getWebApp()) directly after the boot site's
applySafeArea(resolveSafeInsets(getWebApp())) line.
- task 4 step 6 registers watchFullscreenEvents once at the guidance-start
edge in route.ts, with a deliberately no-op callback (events are
observability, never correctness).
- New grep acceptance criteria pin BOTH production call sites; two new
must_haves key_links name them; T-07-06b now names the boot-site call.
WARNING (07-04 / VALIDATION.md) — the golden corpora were attributed to 07-04
t3, which never ran them. Folded into the budget audit: runGoldenCorpusGate()
re-runs `npm run routing:corpus` and `npm run search:corpus` as child
processes (the same shape runCpuLadderGate already uses), so the ONE
budget-audit command enforces SC4.a/SC4.b. VALIDATION.md rows now name 07-04
t2 and the budget-audit command.
WARNING (07-02 t3) — the landscape-leg snippet omitted the required setup.
The action now says to copy the existing corridor guidance leg VERBATIM
(setup stubGuidanceRoute(page, corridorModel) + guideQuery carrying dest +
fixpair + waitMode/expectGuide) and change ONLY the name, the scheme, and the
viewport; two grep criteria pin the setup and the query.
WARNING (07-04) — D-06/SC4 name subrequests but nothing measured beside the
50/request ceiling. Added runSubrequestClassGate(): a per-request-class
inventory derived from the Worker's route table (engine-A /api/route = 0
external subrequests; the cron tick's Telegram send is the only recurring
class; KV ops tracked separately against their own ceiling). Unmeasurable
counts read "not measured", never 0. docs/BUDGETS.md gains a
"## Subrequests per request class" section and the record states that the
inventory is source-derived, not a live Workers Logs metric.
WARNING (07-RESEARCH.md) — "## Open Questions" is now
"## Open Questions (RESOLVED)" and each of the five items carries its adopted
disposition; Q2/Q3 resolve to "answered by measurement at the launch gate per
D-04/D-06".
INFO (07-VALIDATION.md) — nyquist_compliant flipped to true and the sign-off
is approved 2026-10-25 after the map-row correction.
Waves, dependencies, autonomous flags, and the other three plans are unchanged.
- task 1 done: the ?drive= replay knob, the seven guidance legs, the
DSGN-02 guidance gallery — all committed and green (web 148/148,
bot 125/125, routing 65/65, captures 20/20)
- two device-gate bugs fixed before the road (G7b confirm survival,
G7c puck+freshness)
- task 2 = checkpoint:human-verify gate=blocking: the executor STOPPED
per protocol — 06-DEVICE-GATE.md carries the real-drive checklist
(Parts A/B/C); device results are never faked
- STATE.md and ROADMAP.md intentionally untouched (orchestrator-owned,
per the dispatch)
- the same 7 files regenerated after b83a88e (updatePuck): the active/
dark legs now show the puck ON the route line instead of frozen at
the origin; 20/20 non-blank captures
araharah-executor