reading

Documentation

Overview

Package reading assembles the input a cold reading is handed.

Blindness is a property of the input, not a promise the reader makes. The include table below is the whole of what a reading may see: what it does not name is absent, including a record family invented after the table was written, and including this instrument's own output (itd-183, spc-61).

The package is cobra-free and stdout-free like every sibling under internal/core (adr-23): it takes a structured request and returns a structured result, and the front doors format it.

Index

• Constants
• Variables
• func AssemblerVersion() string
• func ReadOutput(path string) ([]byte, error)
• func RefuseReachableOutDir(repoRoot, outDir, label string, names ...string) error
• func WriteRunArtefact(repoRoot, runID, name string, v any) (string, error)
• type AmbiguousCandidateRun
  • func (e *AmbiguousCandidateRun) Error() string
• type AppliedPreset
  • func (s AppliedPreset) Hash() (string, error)
• type AssembleRequest
• type AssembleResult
  • func Assemble(req AssembleRequest) (AssembleResult, error)
• type Bundle
• type BundleItem
• type BundlePreset
• type Definition
  • func LoadDefinition(repoRoot string, p Position) (Definition, error)
• type Exclusion
• type IngestRequest
• type IngestResult
  • func Ingest(req IngestRequest) (IngestResult, error)
  • func (r IngestResult) HasDisclosure() bool
• type Instrument
• type ItemRefusal
  • func (r ItemRefusal) IsElision() bool
  • func (r ItemRefusal) Render() string
• type Kind
• type KindSize
• type Manifest
  • func DecodeManifest(data []byte) (Manifest, error)
• type ManifestItem
• type MechanismReport
• type NoCandidateRun
  • func (e *NoCandidateRun) Error() string
• type ObjectSet
• type Output
• type Parked
  • func ReadParked(repoRoot, runID string) (Parked, error)
  • func (p Parked) DispatchInput(def Definition, model string) (string, error)
• type Position
  • func ParsePosition(s string) (Position, error)
  • func Positions() []Position
• type PositionEntry
  • func (e PositionEntry) Applied() AppliedPreset
• type PositionNotExercised
  • func (e *PositionNotExercised) Error() string
• type PresetFile
  • func LoadPresets(repoRoot string) (PresetFile, error)
• type RefusalRecord
• type Row
  • func (r Row) AdmittedAt(p Position) bool
  • func (r Row) Reaches(rel string) bool
• type RunRecord
• type Scan
• type Selector
• type SizeReport
• type Status
  • func Describe(repoRoot string) (Status, error)
• type WideningRun
  • func (r WideningRun) Line() string
  • func (r WideningRun) Qualifies() bool
• type Window

Constants

const (
	BundleFileName   = "bundle.json"
	ManifestFileName = issueschema.RunManifestFileName
)

BundleFileName and ManifestFileName are the two artefacts an assembly writes: separate files, so the assembled input can go to a reader while the manifest stays with the auditor.

const (
	MarkerBegin = "<!-- BEGIN GENERATED: reading-include-table -->"
	MarkerEnd   = "<!-- END GENERATED: reading-include-table -->"
)

Marker delimiters for the rendered table in the readings charter.

const (
	// OutputType is the only _type the ingest accepts.
	OutputType = "abcd.reading.output/1"
	// RunType tags the run-metadata record, which is the commit marker.
	RunType = "abcd.reading.run/1"
	// RefusalType tags the record a list-level refusal leaves behind.
	RefusalType = "abcd.reading.refusal/1"
	// StageType tags the write-aside marker an in-flight ingest parks.
	StageType = "abcd.reading.ingest-stage/1"
)

The three artefact type tags this file reads and writes. They are carried in the documents themselves, exactly as the bundle's and the manifest's are, so a reader of a loose file can tell them apart without their filenames.

const (
	RunFileName     = issueschema.RunRecordFileName
	RefusalFileName = "refusal.json"
)

The three filenames under a run's durable directory, and the stage's lock.

const (
	RegimeGenerative   = "generative"
	RegimeExplicative  = "explicative"
	RegimeEvaluative   = "evaluative"
	RegimeRegistrative = "registrative"
)

The four supply regimes, named where the gate branches on them so a literal never drifts out of the table it came from.

const (
	BundleType   = "abcd.reading.bundle"
	ManifestType = "abcd.reading.manifest"
)

The two artefact type tags. They are carried in the documents themselves so a reader of a loose file can tell the two apart without its filename.

const AssemblerVersionCore = "1.11.0"

AssemblerVersionCore is the hand-set semver of the assembly contract: the include table, the projection, the bundle shape and the manifest shape together. It moves when the contract moves, which a digest cannot detect — a rewritten rule text moves the rendering without changing what the assembler promises, and a projection change alters the promise without touching the table (spc-61, ruling (12); spc-68). It goes 1.2.0 to 1.3.0 with the local ledger tier's entry in the exclusion floor: the floor is asserted into every manifest and enforced by assertExclusions, so an added entry is an added PROMISE — a refusal a reader can now check and previously could not — rather than a rewording of an existing one (iss-2608311238236490). It goes 1.3.0 to 1.4.0 with the withdrawal of the scope operand: the bundle's `scope` block becomes `preset` and the manifest's `scope`, `scope_hash` and `scope_overridden` become `preset` and `preset_hash`, so the shape a reader and an auditor are promised has moved and nothing about the previous shape remains true (adr-2609021016286571, spc-2609021004075744). It goes 1.4.0 to 1.5.0 with itd-194: Table gains a Scan declaration per row and four brief-chapter rows, the shipped row withdraws from widening, Exclusions gains the widening-scoped shipped entry, the rendering gains a Floor column and the manifest item gains its scan mark. Every one of those is a change to what a reader and an auditor are PROMISED about what was examined, and the digest moves with the rendering by construction (adr-56 as refined 2026-09-02, spc-2609021003136831). It goes 1.5.0 to 1.6.0 with the comparative channel: Table gains the candidate row, allKinds() gains `candidate`, Exclusions gains the comparative position's derived ledger rows and narrows the `.abcd/work/issues` row to the three other positions, and the bundle item gains `candidate` and `field`. Every one of those moves what a reader and an auditor are PROMISED — a source admitted at one position, a vocabulary member, refusals a reader can now check — which is MINOR by this constant's own rule (adr-2609021016272867, spc-2609020626039834). It goes 1.6.0 to 1.7.0 with the reading of "at the target" deriveCandidateRun states: a committed widening run at an ancestor of the target qualifies when only the readings store and the issue ledger changed between the two, the refusal listing gains the run whose object set moved and the path that moved it, and the manifest gains `candidate_run_target`. The selection rule and the manifest shape are both what a reader and an auditor are PROMISED, which is MINOR by this constant's own rule (adr-2609021016272867 as read there; iss-2609021833302981, iss-2609021857343626). It goes 1.7.0 to 1.8.0 with the transcript store's relocation: the exclusion floor's transcript-store row stops asserting an unreachability that is now conditional — a checkout declared in ~/.abcd.noindex/local-transcript-roots keeps its store inside the tree — and becomes a `directory` row naming `.abcd/.work.local/transcripts`. Signal `directory` is enforced by assertExclusions where `unreachable path` was enforced by nothing, so the floor gains a refusal a reader can check, which is MINOR by this constant's own rule (iss-95). It goes 1.8.0 to 1.9.0 with the reframe record: Exclusions gains the row naming the family at every position, and the comparative position's derived ledger rows gain `.abcd/work/issues/reframes` from the ledger's directory list. Both are refusals a reader can now check, which is MINOR by this constant's own rule (spc-2609020626048705). It goes 1.9.0 to 1.10.0 with the per-run context stamp: the bundle gains `context_stamp`, and the bundle shape is part of the contract a reader is PROMISED — it now carries a token naming its kind and its run — which is MINOR by this constant's own rule (adr-2609021016275803, spc-2609020626045177). It goes 1.10.0 to 1.11.0 with the knowledge record as a read object: Table gains the principles row at the three assembling positions, allKinds() gains `principle`, the projection gains its labelled-paragraph resolution, and Exclusions gains the four claim keys and the citation entry, which a new refusal enforces. A source admitted, a vocabulary member and refusals a reader can now check are each MINOR by this constant's own rule (adr-2609021016270132, spc-2609020626042471).

const CandidateSource = capture.LedgerRelPath + "/" + issueschema.ReadingsDir

CandidateSource is the ledger directory the candidate row reaches: the working tier's readings store, one directory per run. It is the leaf bucket the readings family keys on, which is what assembler rule 1 permits an include row to name (ruling (18)).

const CharterPath = ".abcd/development/readings/README.md"

CharterPath is the readings family's charter, which renders the table.

const CriteriaDiscipline = "itd-191"

CriteriaDiscipline is the record that declares the selection criteria. It is the one record the comparative position's disciplines row is narrowed to, and the one an entry cannot widen past.

const DefaultRunDir = ".abcd/.work.local/scratch/reading-runs"

DefaultRunDir is the local-tier parent an unnamed run is parked under.

const DefinitionsDir = "agents"

DefinitionsDir is where the four reading definitions live. The assembler never reads one — a definition is the reader's, and this package denies the whole directory to every assembly — but the status render reports which are present, because a missing definition is the difference between an instrument that can be dispatched and one that cannot.

const IngestStageDir = ".abcd/.work.local/scratch/reading-ingest"

IngestStageDir is the local-tier write-aside area one ingest stages into. It is deliberately in the ephemeral tier: a stage is evidence of an ingest in flight, never a record, and a crash must leave it somewhere no commit can pick it up.

const LintConfigPath = ".abcd/record-lint.json"

LintConfigPath is the record-lint configuration the record scan reads its stores from. Enumeration comes from that scan and nowhere else: there is one parser of the record's shape in this binary.

const MaxFileBytes = issueschema.RunArtefactReadLimit

MaxFileBytes bounds one admitted file. A file past the cap is a refusal, not a truncation: a silently shortened item would be an assembled input no re-run could reproduce from the manifest's hash.

const PatternField = "pattern"

PatternField is the envelope's provenance field: the pattern the reading read under. It is the reading RECORD's own field name (issueschema.ReadingRequired) and the key the four definitions instruct, so the payload, the record and the instruction all say one word. itd-185 and spc-63 call the same field the pattern named; there is one field, and this is its wire name.

const PresetConfigPath = ".abcd/config/reading-presets.json"

PresetConfigPath is the committed preset configuration. It is the ONE place a repository path may be named, and it joins the record-lint configuration in the dirty set by the same argument: an uncommitted edit to it reshapes an assembly as surely as an edit to a record does.

const PresetSchemaVersion = 2

PresetSchemaVersion is the preset file's own shape version, separate from the artefacts' SchemaVersion: the configuration and the output are different shapes with different reasons to move.

It goes 1 to 2 with the three-part entry: the object set the run is about, the kinds admitted within it, and the window the entry was calibrated for (spc-2609020626048722). The named `presets` map goes with the operand that chose between its keys; a version 2 file names one entry per position at the top level.

const PrincipleField = lint.PrincipleStatementLabel

PrincipleField is the one field a principle travels as: its statement, the labelled paragraph `**The rule.**` with the H1 title above it (projectPrincipleStatement, over the derivation principle_claims shares, so the label is the lint's own constant). Everything after it — the reasons, the bounds, the promotion rung — and every frontmatter key stays behind, and a `## The rule` heading is never read as the statement.

const PrincipleSource = ".abcd/development/principles"

PrincipleSource is the knowledge record: one principle per file, each a statement and the genealogy it was distilled from.

const ReadingsRecordDir = issueschema.ReadingsRecordDir

ReadingsRecordDir is the durable home of a run's own artefacts: the promoted manifest, the run metadata, and a refusal.

It is an ALIAS of the constant in core/issueschema, which is where it moved when core/capture gained a reader of it: capture answers "which comparative run characterised this widening run" for the disposition gate, and two packages naming one directory with two string literals is a divergence waiting for a rename (spc-2609020626039834).

const RunIDFamily = "rdg"

RunIDFamily is the readings family's id prefix. It satisfies the mint's ^[a-z]+$ bound, and the mint reads no maximum, so two checkouts assembling in the same window cannot converge on one run id (adr-45).

const SchemaVersion = 11

SchemaVersion is the shape version of both artefacts an assembly writes.

It is ONE constant for two shapes, so a change to either restamps both. At version 2 the manifest item gained a kind and the bundle's shape did not move; the bundle was restamped anyway. At version 3 BOTH shapes moved, the bundle gaining the scope a reading was given and the manifest gaining the effective scope, its hash and the override stamp — so at that version the shared constant cost nothing. At version 4 the manifest item gained its byte length, so the shared constant restamps the bundle again. That is a known consequence of the shared constant, accepted rather than fixed inside a change that needed only one half of it — splitting the two is a larger change, and making the split silently is how a shape version stops meaning anything (spc-68). At version 5 BOTH shapes move again: the scope operand and its override stamp are withdrawn, so the manifest's `scope`, `scope_hash` and `scope_overridden` become `preset` and `preset_hash`, and the bundle's `scope` becomes `preset` (adr-2609021016286571). At version 6 the manifest item gains its `scan` mark, the fact of whether the exclusion floor examined that item, so the shared constant restamps the bundle once more (itd-194, adr-56 as refined 2026-09-02). At version 7 the RUN RECORD gains its `bounds` list, the departures a run made from the reading the design documents state; the bundle and the manifest are untouched and are restamped by the shared constant once more, which is why `AssemblerVersionCore` does not move with it (spc-2609020626048722). At version 8 BOTH shapes move for the comparative channel: the closed `Kind` vocabulary gains `candidate`, which `DecodeManifest` refuses when it does not know it, the bundle item gains `candidate` and `field`, and the manifest gains `candidate_run`, `candidates`, `exercised`, `candidate_fields` and `criteria` with its item gaining `candidate` (adr-2609021016272867, spc-2609020626039834). At version 9 the MANIFEST gains `candidate_run_target`, the commit the derived widening run itself read: the derivation now admits a run whose own records were committed since it read, so the run's target and the assembly's can differ and a reader needs both to check the selection (iss-2609021833302981). The bundle is untouched and is restamped by the shared constant once more. At version 10 the BUNDLE gains `context_stamp`, the per-run token naming the reading kind, the run and a digest of the item set, which a transcript retains and the separation check reads (adr-2609021016275803, spc-2609020626045177); the manifest is untouched and is restamped by the shared constant. At version 11 the closed `Kind` vocabulary gains `principle`, which `DecodeManifest` refuses when it does not know it, so a manifest carrying a principle item is a shape the previous version cannot read; the bundle is restamped by the shared constant (adr-2609021016270132, spc-2609020626042471).

const TargetTokens = 200_000

TargetTokens is the size a committed entry AIMS at, stated and never enforced. The maintainer ruled on 2026-09-02 that any figure inside the reader's window is acceptable and that a figure over the target is stated to the operator, so nothing here refuses: the size report carries one line, and the entry's declaration and comment say what reader it was measured for (divergence register 24).

Variables

var CandidateFields = []string{"configuration", "what_admits_it"}

CandidateFields are the two widening body fields a candidate travels as: the configuration the widening reading returned, and what admits it. The item's pattern, its manifest reference, its regime and every other field of the record have no row here and therefore no item — provenance is the ENVELOPE's and not the candidate's, and widening the projection by one field would be a manifest change and a recorded one (the intent's third scope condition; divergence register 23).

var ClosedVocabularies = map[string][]string{
	"claim_type": {"criterion", "causal", "context"},
}

ClosedVocabularies are the body fields whose value set is closed. The definitions instruct them and spc-63 tables them; without a check here the instruction is the only thing enforcing them, which makes it a suggestion.

var Exclusions = []Exclusion{
	{Rule: "field projection", Signal: "frontmatter key", Detail: "origin"},
	{Rule: "field projection", Signal: "frontmatter key", Detail: "production_mode"},

	{Rule: "field projection", Signal: "frontmatter key", Detail: "claim_type"},
	{Rule: "field projection", Signal: "frontmatter key", Detail: "reference"},
	{Rule: "field projection", Signal: "frontmatter key", Detail: "comparison"},
	{Rule: "field projection", Signal: "frontmatter key", Detail: "evidence"},
	{Rule: "field projection", Signal: "heading", Detail: "Audit Notes"},
	{Rule: "field projection", Signal: "heading", Detail: "Open Questions"},
	{Rule: "field projection", Signal: "heading", Detail: "Why This Matters"},
	{Rule: "a reading's object excludes what it exists to change", Signal: "heading", Detail: "Scope Condition Dispositions"},

	{Rule: "verdict material: a prior verdict is revision history, the ground the Audit Notes exclusion rests on",
		Signal: "directory", Detail: ".abcd/development/brief/03-evidence"},
	{Rule: "absent from the positive walk", Signal: "directory", Detail: ".abcd/development/decisions"},
	{Rule: "absent from the positive walk", Signal: "directory", Detail: ".abcd/development/roadmap/rfcs"},
	{Rule: "absent from the positive walk", Signal: "directory", Detail: ".abcd/development/intents/superseded"},
	{Rule: "absent from the positive walk", Signal: "directory", Detail: ".abcd/development/plans"},
	{Rule: "absent from the positive walk", Signal: "directory", Detail: ".abcd/development/research/notes"},

	{
		Rule:      "no include names a directory containing a record family",
		Signal:    "directory",
		Detail:    capture.LedgerRelPath,
		Positions: coldPositions,
	},
	{Rule: "absent from the positive walk", Signal: "file", Detail: ".abcd/work/DECISIONS.md"},

	{Rule: "the statement is knowledge and the citations are genealogy", Signal: "citation",
		Detail: "record handles and links in a principle"},

	{Rule: "no reading consumes the local ledger side, unconditionally and under no flag (brief invariant 14)",
		Signal: "directory", Detail: ".abcd/.work.local"},
	{Rule: "absent from the positive walk", Signal: "record type in a denied path", Detail: "the lapse log"},

	{Rule: "absent from the positive walk", Signal: "record type in a denied path", Detail: "the reframe record"},
	{Rule: "absent from the positive walk", Signal: "record type in a denied path", Detail: "admission and selection grounds"},
	{Rule: "the instrument's own output is never its input", Signal: "directory", Detail: ".abcd/development/readings"},
	{Rule: "the instrument's own output is never its input", Signal: "directory", Detail: "agents"},
	{Rule: "the instrument's own output is never its input", Signal: "directory", Detail: "evals"},
	{Rule: "the instrument's own output is never its input", Signal: "directory", Detail: "internal/core/reading"},

	{Rule: "the store is out of tree by default, and inside it only under .abcd/.work.local, which is excluded above",
		Signal: "directory", Detail: ".abcd/.work.local/transcripts"},
	{
		Rule:      "a reading's object excludes what it exists to change",
		Signal:    "directory",
		Detail:    ".abcd/development/intents/drafts",
		Positions: []Position{PositionWidening, PositionComparative, PositionDetection},
	},
	{
		Rule:      "a reading's object excludes what it exists to change",
		Signal:    "directory",
		Detail:    ".abcd/development/intents/planned",
		Positions: []Position{PositionWidening, PositionComparative, PositionDetection},
	},
	{
		Rule:      "the widening object as the design documents state it",
		Signal:    "directory",
		Detail:    ".abcd/development/intents/shipped",
		Positions: []Position{PositionWidening},
	},

	{
		Rule:      "the comparative reading receives the candidates and the criteria alone",
		Signal:    "directory",
		Detail:    PrincipleSource,
		Positions: []Position{PositionComparative},
	},
}

Exclusions is the exclusion floor: every field, heading and directory the assembler refuses, each with the signal by which a reader detects it. It is asserted into every manifest so a reader can check the exclusions rather than trust a disclosure.

The floor is a DECLARATION a reader checks, and the assembler additionally refuses to emit an item under any path-shaped entry, so the two cannot part company (see assertExclusions).

What each entry asserts, and over WHICH items, is fixed here rather than left to a reader: an entry whose Signal is `frontmatter key` or `heading` is asserted for the items the manifest marks `parsed` and for no other, because those two signals are read by a scan and a scan that did not run establishes nothing; an entry whose Signal is `directory`, `file` or `unreachable path` is asserted for EVERY item, because assertExclusions enforces those by path and a path needs no parse. That is brief invariant 16 made a property of the artefact rather than of the run: a scan that ran and a scan that never ran no longer produce the same attestation (adr-56 as refined 2026-09-02).

var ReservedNames = map[string][]string{
	RegimeEvaluative:   {"order", "rank", "recommended", "score"},
	RegimeRegistrative: {"fix", "remedy", "resolution"},
	RegimeExplicative:  {"disposition", "status"},
}

ReservedNames is the per-regime reserved-name table. A payload naming one of these is refused with the field named and the licence stated.

`generative` has no row and needs none: its body schema is two fields, so any other key is refused as an unknown field anyway, and the generative licence is the widest — the constraint on it falls at admission, not here.

var Table = []Row{
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/01-product",
		Match:     []string{".md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "adr-55: the construal as it presently stands is committed record, " +
			"admissible to every reader including a cold reading",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/02-constraints",
		Match:     []string{".md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "The constraints chapter states the platform, the dependency stance, " +
			"the invariants and the naming a reading reads against",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/04-surfaces",
		Match:     []string{".md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "The surfaces chapter is brief current text, which both design documents " +
			"name as a reading's object",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/05-internals",
		Match:     []string{".md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "The internals chapter is brief current text, which both design documents " +
			"name as a reading's object",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/06-delivery",
		Match:     []string{".md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "The delivery chapter is brief current text, which both design documents " +
			"name as a reading's object",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/brief/glossary",
		Match:     []string{".md"},
		Kind:      KindGlossaryTerm,
		Scan:      ScanParsed,
		Rule: "adr-55: the glossary's committed terms are committed record; " +
			"superseded terms and the reasoning that settled them are not",
	},
	{

		Positions: coldPositions,
		Source:    ".abcd/development/brief",
		Match:     []string{"00-meta.md"},
		Kind:      KindBriefSection,
		Scan:      ScanParsed,
		Rule: "The meta chapter is brief current text, which both design documents " +
			"name as a reading's object; it is one file at the brief's root",
	},
	{

		Positions: allPositions,
		Source:    ".abcd/development/intents/disciplines",
		Match:     []string{".md"},
		Store:     "itd",
		Bucket:    "disciplines",
		Kind:      KindDiscipline,
		Scan:      ScanParsed,
		Rule: "A discipline is a standing commitment the record already holds, " +
			"named individually inside the intent family",
	},
	{

		Positions: []Position{PositionEntailment, PositionDetection},
		Source:    ".abcd/development/intents/shipped",
		Match:     []string{".md"},
		Store:     "itd",
		Bucket:    "shipped",
		Fields:    intentProjection,
		Kind:      KindIntentProjection,
		Scan:      ScanParsed,
		Rule: "Assembler rule 2: a shipped intent travels as its claim record, " +
			"so the Audit Notes and dispositions it also carries stay behind; not at " +
			"widening, whose object neither design document states with them in it " +
			"(ruled 2026-09-02, iss-2609012259587904)",
	},
	{
		Positions: coldPositions,
		Source:    ".abcd/development/specs",
		Match:     []string{".md"},
		Store:     "spc",
		Kind:      KindSpec,
		Scan:      ScanParsed,
		Rule:      "The design record a capability was built against",
	},
	{
		Positions: []Position{PositionEntailment},
		Source:    ".abcd/development/intents/drafts",
		Match:     []string{".md"},
		Store:     "itd",
		Bucket:    "drafts",
		Fields:    intentProjection,
		Kind:      KindIntentProjection,
		Scan:      ScanParsed,
		Rule: "Assembler rule 2: articulation precedes selection, so entailment sees " +
			"the candidate set and the reading asked to widen it does not",
	},
	{
		Positions: []Position{PositionEntailment},
		Source:    ".abcd/development/intents/planned",
		Match:     []string{".md"},
		Store:     "itd",
		Bucket:    "planned",
		Fields:    intentProjection,
		Kind:      KindIntentProjection,
		Scan:      ScanParsed,
		Rule: "Assembler rule 2: articulation precedes selection, so entailment sees " +
			"the candidate set and the reading asked to widen it does not",
	},
	{

		Positions: coldPositions,
		Source:    PrincipleSource,
		Match:     []string{".md"},
		Store:     "prn",
		Fields:    []string{PrincipleField},
		Kind:      KindPrinciple,
		Scan:      ScanParsed,
		Rule: "The knowledge record is a read object: a principle travels as its statement, " +
			"and its keys and citations are genealogy (adr-2609021016270132)",
	},
	{

		Positions:   coldPositions,
		Source:      ".",
		MatchSuffix: []string{"_test.go"},
		Kind:        KindTest,
		Scan:        ScanUnscanned,
		Rule: "Admitted where a committed preset entry names this kind, and never examined: " +
			"an item admitted here travels whole and marked `unscanned` in the manifest, " +
			"because the exclusion floor's key and heading signals are record shapes only a " +
			"markdown file carries",
	},
	{
		Positions: coldPositions,
		Source:    ".",
		Match:     []string{".go"},
		Kind:      KindSource,
		Scan:      ScanUnscanned,
		Rule: "Admitted where a committed preset entry names this kind, and never examined: " +
			"an item admitted here travels whole and marked `unscanned` in the manifest, " +
			"because the exclusion floor's key and heading signals are record shapes only a " +
			"markdown file carries",
	},
	{
		Positions: coldPositions,
		Source:    ".",
		Match:     []string{".md"},
		Kind:      KindDoc,
		Scan:      ScanParsed,
		Rule: "Assembler rule 1: the shipped tree is the delivered documentation and the " +
			"root prose, with the record denied structurally",
	},
	{
		Positions: coldPositions,
		Source:    ".",
		Match:     []string{".json", ".yml", ".yaml", ".toml", ".mod", ".sum", "Makefile"},
		Kind:      KindConfig,
		Scan:      ScanUnscanned,
		Rule: "Admitted where a committed preset entry names this kind, and never examined: " +
			"an item admitted here travels whole and marked `unscanned` in the manifest, " +
			"because the exclusion floor's key and heading signals are record shapes only a " +
			"markdown file carries",
	},
	{

		Positions: []Position{PositionComparative},
		Source:    CandidateSource,
		Match:     []string{".md"},
		Store:     issueschema.ReadingItemFamily,
		Fields:    CandidateFields,
		Kind:      KindCandidate,
		Scan:      ScanParsed,
		Rule: "adr-2609021016272867: at the comparative position, and at no other, two body " +
			"fields of one DERIVED widening run's items are admitted as that reading's " +
			"candidate set — the candidate text is cold, and its fate is warm. Everything " +
			"else in the readings store stays excluded: the run's manifest, the items' " +
			"envelopes and patterns, every disposition, admission and surprise, and every " +
			"other run",
	},
}

Table is the include table: the single source of truth for what a cold reading may see. It is rendered into the readings charter under a test asserting the two agree, on the idiom internal/core/lifeboat/mapping.go carries for the brief.

Order is significant only for rendering and for tie-breaking a path two rows admit: the first row that reaches a path owns the projection applied to it.

Functions

func AssemblerVersion

func AssemblerVersion() string

AssemblerVersion is the core semver with the rendered include table's digest as semver build metadata. The digest is computed, not declared, so a table change moves the stamped version whether or not anyone notices: a manifest cannot name a version that does not describe the table it was built from.

This is structural where the previous gate was advisory. That gate compared the rendering's digest to a standalone literal and never read the version at all, so changing the table and restating the literal was green with the version unmoved (iss-2608311949385350) — an attestation asserting more than its examination establishes, which brief invariant 16 forbids.

The digest is carried WHOLE, not truncated. A short digest would have been easier to read and would not have supported the sentence above: Row.Rule is free prose of unbounded length inside the digested input, so a truncation is a collision an author can grind rather than one they would have to be unlucky to hit. The claim this function makes is absolute, so the evidence behind it is too — brief invariant 16 is the rule that an attestation states no more than its examination establishes, and this function IS an attestation.

func ReadOutput

func ReadOutput(path string) ([]byte, error)

ReadOutput reads a reading's output the way the ingest does, for a front door that hands the bytes on through IngestRequest.Output.

func RefuseReachableOutDir

func RefuseReachableOutDir(repoRoot, outDir, label string, names ...string) error

RefuseReachableOutDir refuses an output directory where any of the named files would be admitted by the include table at some position. It is the check refuseSelfAdmittingOutDir makes for this assembler's own two artefacts, exported for the one other assembler whose output must never become a reading's input: the scribe's context carries ledger content, and a context parked where the table reaches it is the next reading handed the ledger (spc-2609020626045177, brief invariant 15).

func WriteRunArtefact

func WriteRunArtefact(repoRoot, runID, name string, v any) (string, error)

WriteRunArtefact writes one JSON document beside a COMMITTED run, and it is the one way a package outside this one does so.

The containment root and the write belong to this package — it opens the repository root as Ingest does, resolves every component in the kernel, and writes through the canonical encoder — so a second package reaching into a run directory with its own filepath.Join would be a second answer to where a run's artefacts live and how they are written. spc-2609020626045177's `scribe ingest` promotes its own manifest through this; nothing in this delivery calls it, and that is said plainly rather than dressed up as a caller.

Four refusals, each closing a way the durable tier could stop being durable: a run with no commit marker never happened and nothing may be filed beside it; a name that is one of the run's own three files would rewrite the run's evidence; a name that is not a plain `.json` basename is a path rather than an artefact; and an existing file is refused outright, because the durable tier is WRITE-ONCE at emission and an amended run record is one nothing can date.

Types

type AmbiguousCandidateRun

type AmbiguousCandidateRun struct {
	Target string
	Runs   []WideningRun
}

AmbiguousCandidateRun is the refusal when more than one qualifies. The remedy is stated because the design already sequences it: dispositioning one run's items is the act that follows a comparative reading, and performing it makes the selection unambiguous.

func (*AmbiguousCandidateRun) Error

func (e *AmbiguousCandidateRun) Error() string

type AppliedPreset

type AppliedPreset struct {
	// Selectors are the resolved clauses, in a canonical order so one entry
	// hashes to one value.
	Selectors []Selector `json:"selectors"`
}

AppliedPreset is what one run was about: the committed entry for the invoked position, resolved to selectors.

It carries no source token and no override stamp, and that absence is the point. Both were provenance about a CHOICE the operator made at the invocation, and there is no such choice: the entry is settled by the position and by what is committed (adr-2609021016286571). A run is reproducible from the commit the manifest names and the entry it records.

func (AppliedPreset) Hash

func (s AppliedPreset) Hash() (string, error)

Hash is the applied entry's content hash, so a manifest can name the entry a run actually had and a reader can tell two runs apart by it. It also means a preset edited later can never make a past run unreadable: the run names the entry it applied, not the file as it stands now.

type AssembleRequest

type AssembleRequest struct {
	// RepoRoot is the repository the assembly reads.
	RepoRoot string
	// Position is the reading position. The set is closed.
	Position Position
	// Target is "HEAD" or a hexadecimal commit sha of 7 to 40 digits. Branch
	// names and tags are refused as mutable: the manifest's re-runnability rests
	// on a reference that cannot move.
	Target string
	// OutDir is the operator-named directory the two artefacts are written to.
	// Empty means the default local-tier run directory.
	OutDir string
	// OutDirLabel is how the OPERATOR spelled OutDir, used in refusal messages so
	// a path they did not type is never quoted back at them. The front door
	// resolves a relative --out against the working directory before calling in,
	// and scrubPaths cannot redact the result when the working directory is not a
	// prefix of it. Empty means OutDir is the operator's own spelling.
	OutDirLabel string
	// DryRun writes nothing into the repository's own tiers. With OutDir set the
	// artefacts still land there; with OutDir empty nothing is written at all
	// and the result is rendered only.
	DryRun bool
}

AssembleRequest is one assembly: a position, a target commit, and where the two artefacts go. It carries no free-text operand of any kind, because there is no channel through which ledger content may travel in the framing of a request (ruling (5)).

type AssembleResult

type AssembleResult struct {
	RunID            string        `json:"run_id"`
	Position         Position      `json:"position"`
	TargetCommit     string        `json:"target_commit"`
	AssemblerVersion string        `json:"assembler_version"`
	ItemCount        int           `json:"item_count"`
	ManifestHash     string        `json:"manifest_hash"`
	Preset           AppliedPreset `json:"preset"`
	Size             SizeReport    `json:"size"`
	// CandidateRun is the widening run this assembly derived, and Candidates the
	// count of items it holds. Both are empty at every position but comparative,
	// where the operator has to be told which run the reading is about — no
	// operand named it, so the result is where they learn it
	// (adr-2609021016272867).
	CandidateRun string `json:"candidate_run,omitempty"`
	Candidates   int    `json:"candidates,omitempty"`
	// NotExercised reports the fixed interpretation: the derived run held fewer
	// than two candidates, so the comparative reading has nothing to compare and
	// the position was not exercised. The assembly still stages a run, and
	// ingesting it commits a comparative run with an empty item set naming that
	// widening run (the 2026-09-02 interpretations ruling; companion 7.6).
	NotExercised bool     `json:"not_exercised,omitempty"`
	OutDir       string   `json:"out_dir,omitempty"`
	Artefacts    []string `json:"artefacts"`
	Written      bool     `json:"written"`
	// Ingestable says whether `reading ingest` can find this run. The ingest
	// resolves a run's manifest only under DefaultRunDir by its run id, so an
	// assembly written anywhere else (an operator-named --out) is an inspection
	// copy that no ingest will ever prove, and a dry run wrote nothing to find.
	// It is reported at assembly time because the cost otherwise lands after
	// the reading has been commissioned and returned (iss-2609091648476051).
	Ingestable bool `json:"ingestable"`

	Bundle   Bundle   `json:"-"`
	Manifest Manifest `json:"-"`
}

AssembleResult is what one assembly produced. The bundle and the manifest are carried for a caller that wants them in memory, and the artefacts are named by their basenames rather than by a full path.

OutDir is whatever the CALLER passed in, echoed back so it can find what it asked for. The core takes a relative one against the repository root, which suits the default it computes itself; the CLI resolves an operator's relative --out against the working directory before calling in, and then puts the operator's own string back on the result, so no absolute path nobody typed reaches the success surface. Neither ARTEFACT carries an output path at all.

func Assemble

func Assemble(req AssembleRequest) (AssembleResult, error)

Assemble walks the repository under the include table at the given position and produces the assembled input and its manifest.

type Bundle

type Bundle struct {
	Type          string `json:"_type"`
	SchemaVersion int    `json:"schema_version"`
	// ContextStamp is the per-run context stamp: the reading kind, the run this
	// bundle was assembled for, and the first twelve hex digits of the sha256
	// over its own item set (adr-2609021016275803). A session that was handed
	// this bundle through a tool the host retains carries the stamp in its
	// transcript, and that is what the transcript store's separation check reads.
	//
	// It is a TOKEN and not a path, so brief invariant 15 holds: core/sessionkind
	// parses it exactly, and it names no location and selects nothing.
	ContextStamp string   `json:"context_stamp"`
	Position     Position `json:"position"`
	// Preset is what THIS run was given, and it is the reading's own fact
	// rather than the auditor's. A reader told its object is the shipped tree
	// and handed a tenth of it will report the missing nine tenths as a
	// tension against the claim record, with every gate green.
	//
	// It carries NO repository path under any entry, and no provenance. See
	// BundlePreset: it is a projection rather than the applied entry precisely
	// because the obvious implementation carried a path, and which entry was
	// applied and what it hashes to is the auditor's business and lives on the
	// manifest.
	Preset BundlePreset `json:"preset"`
	Items  []BundleItem `json:"items"`
}

Bundle is the assembled input: the reading's entire working set.

It carries no timestamp and exactly one run-dependent value, the context stamp, so two assemblies of one repository state at one commit are byte-identical but for the run segment of that stamp — the property itd-187's eval falsifies independently, with the stamp set aside and held to agree in kind and digest.

type BundleItem

type BundleItem struct {
	ItemKey string `json:"item_key"`
	Kind    Kind   `json:"kind"`
	// Candidate and Field are set on a CANDIDATE item and on nothing else: which
	// rdi-N of the derived widening run this text belongs to, and whether it is
	// the configuration or what admits it.
	//
	// A comparative reading returns one item per candidate-criterion pair and its
	// body cites a `candidate_id`, so it has to be able to name the candidate it
	// is characterising in the terms it was handed. Neither value is a repository
	// path — an item id is an ordinal minted by the ingest verb, and a field name
	// is a record's own key — so brief invariant 15 holds, and
	// TestNoBundleFieldIsAScopeSelector pins both against becoming selectors
	// (spc-2609020626039834).
	Candidate string `json:"candidate,omitempty"`
	Field     string `json:"field,omitempty"`
	Text      string `json:"text"`
}

BundleItem is one passed item as the reading receives it: a key, a material class, and the text. It carries NO repository path, by construction — the key is an ordinal and the kind names a class, never a location (invariant 15).

type BundlePreset

type BundlePreset struct {
	Kinds   []Kind   `json:"kinds,omitempty"`
	Records []string `json:"records,omitempty"`
	// LocationNarrowings counts the location-based narrowings applied. It is a
	// count and never a list, because the list would be the paths.
	LocationNarrowings int `json:"location_narrowings,omitempty"`
}

BundlePreset is the applied entry as a READING sees it, and it is deliberately NOT the AppliedPreset the manifest carries.

The manifest may name repository paths; the bundle may not, by brief invariant 15 — the assembled input is the reading's entire working set and no repository path enters its context. An entry's Path selectors ARE repository paths, so writing one type into both artefacts put a path into the reading's own working set. That is what this split exists to prevent, and it was a live breach before it was caught (iss-2608312058244357).

A reading still has to know it was handed a subset: told its object is the shipped tree and given a tenth of it, it reports the missing nine tenths as a finding. So it is told the kinds and the records it was handed, and that a narrowing by LOCATION applied — never where. That is enough to know the bundle is not the whole object, and it carries no location.

type Definition

type Definition struct {
	// Position is the position the definition holds.
	Position Position `json:"position"`
	// Regime is the supply regime the definition states, verbatim.
	Regime string `json:"regime"`
	// Path is the definition file, repo-relative and slash-separated.
	Path string `json:"path"`
	// SHA256 is the hex digest of the whole file, frontmatter included.
	SHA256 string `json:"sha256"`
}

Definition is one cold-reading definition as this binary resolves it: where it is, which position it holds, the regime it states, and the hash of the bytes that were read. The hash is the instrument's identity for a run — two runs at one position under one definition hash read under the same instructions.

func LoadDefinition

func LoadDefinition(repoRoot string, p Position) (Definition, error)

LoadDefinition resolves p to its definition under repoRoot and reports what the file states. The root is a parameter rather than a discovered value so a caller — the ingest verb, or a test over a temporary tree — decides which repository is being read.

A missing file is returned wrapped around os.ErrNotExist, so a caller that treats absence as a state can say so with errors.Is. Every other fault is a fault: a definition present but silent about its position or its regime is worse than an absent one, because it reports an instrument that is not there.

type Exclusion

type Exclusion struct {
	// Rule is the assembler rule the exclusion instances.
	Rule string `json:"rule"`
	// Signal is how a reader detects it: a frontmatter key, a heading, a
	// directory absent from the positive walk, or a store outside the tree.
	Signal string `json:"signal"`
	// Detail names the excluded thing.
	Detail string `json:"detail"`
	// Positions are the positions the exclusion binds at. An empty Positions
	// binds at every position.
	Positions []Position `json:"-"`
}

Exclusion is one refused source and the signal that detects it.

type IngestRequest

type IngestRequest struct {
	RepoRoot string
	// OutputPath is the reading's returned JSON. The front door resolves a
	// relative path against the working directory before it arrives here.
	OutputPath string
	// Output is the output's bytes when the front door has already read them
	// through ReadOutput (to route on the position it names and to report the
	// model its instrument names). The ingest then validates these bytes and
	// does not read OutputPath again, so what was routed and reported is what
	// is ingested. Nil means the ingest reads OutputPath itself.
	Output []byte
	// Match, when non-nil, runs the filing-time match on every item stored
	// (ruling DQ2b, adr-2609300821558671); capture.IngestReadingRequest.Match
	// says what it compares and writes. nil stores the items unmatched.
	Match *match.Config
}

IngestRequest is one ingest: a repository and one payload file.

There is no position operand and no regime operand. The position is the payload's claim, checked against the manifest of the run it names; the regime is the definition's, and nothing an operator types can reach it.

type IngestResult

type IngestResult struct {
	RunID    string                     `json:"run_id"`
	Position Position                   `json:"position"`
	Regime   string                     `json:"regime"`
	Records  []capture.ReadingRecordRef `json:"records"`
	// Matches is the filing-time match's outcome per stored record, when the
	// request asked for one: the likely repeats the ingest linked and listed.
	Matches      []capture.ReadingMatch `json:"matches,omitempty"`
	RefusedItems []ItemRefusal          `json:"refused_items,omitempty"`
	// RefusedCount is how many items were refused in total. RefusedItems is
	// capped — the item count is payload-chosen — so the two differ when a run
	// refused more than the cap, and the count is what nothing truncates.
	RefusedCount  int      `json:"refused_count,omitempty"`
	RunRecordPath string   `json:"run_record,omitempty"`
	RefusalPath   string   `json:"refusal_record,omitempty"`
	ClearedStages []string `json:"cleared_stages,omitempty"`
	// RolledBack names the reading records the sweep REMOVED from the committed
	// ledger, because their run never reached its commit marker. A delete in the
	// committed tier is reported by id: "cleared an orphaned stage" does not tell
	// an operator that records left the ledger with it.
	RolledBack []string `json:"rolled_back_records,omitempty"`
	// PendingStages names the orphaned stages this invocation found and LEFT
	// IN PLACE. The sweep is a delete in the committed tier, and every such
	// delete is fenced behind the whole payload validating, so an invocation
	// that is refused — or that fails before the sweep — reports the orphans
	// it saw and leaves them for the next one that validates. A sweep that
	// skipped something says so.
	//
	// LEFT IN PLACE is the whole of it: a stage this invocation cleared is not
	// on this list, whichever path cleared it — the sweep's, or the single
	// rollback a refusal makes on its own run id.
	PendingStages []string `json:"pending_stages,omitempty"`
	Redacted      int      `json:"redacted,omitempty"`
	Degraded      string   `json:"redaction_degraded,omitempty"`
}

IngestResult is what an ingest did.

func Ingest

func Ingest(req IngestRequest) (IngestResult, error)

Ingest validates one reading's output and writes its records.

The order is the protocol, and it is the order for a reason: no OTHER run's durable state is mutated by a run that is refused — nothing is written and nothing is deleted until the whole payload validates, save the refusal record that a refusal after step 3 exists to leave and the rollback of this run's own earlier crashed attempt that ac-10 obliges it to make — the ledger records land as one batch, and the run metadata lands last as the commit marker.

1. Find any orphaned stage a previous invocation left, read-only, so a refusal below can name what it saw. Nothing is cleared yet.
2. Read and decode the payload strictly.
3. Check the envelope, and resolve the parked run's manifest by content hash. Until this passes, the run has no proven identity, so nothing — not even a refusal — can be recorded against it.
4. Resolve the definition and check the regime and the instrument against it. A refusal from here on writes a refusal record.
5. Validate every item; an item-level violation refuses that item and lands the rest.
6. Sweep the orphans found at step 1, naming and clearing each and rolling its never-committed run back. This is the first delete in the committed tier, and the payload it runs under has validated in full.
7. Stage, write the ledger records, promote the manifest, and write the run metadata last.

The sweep sat at step 1 once, and with an orphan present an ingest refused at the type check deleted that orphan's ledger records and reported the type error alone (iss-2608311517509690). A refused run now leaves the orphans it found in place and reports them as pending — and because it leaves them, the bare `reading` verb names them as `orphaned_ingests`, which is the only surface an operator has for the state.

func (IngestResult) HasDisclosure

func (r IngestResult) HasDisclosure() bool

HasDisclosure reports whether the result carries something the operator has to be told even when the verb returned an error: a refusal record written, a stage cleared, a record removed from the ledger, an orphan seen and left in place, or a degraded outcome. The front doors render the result on the error path exactly when this is true — one predicate, so a field added here cannot be one the surface silently drops.

type Instrument

type Instrument struct {
	Model            string `json:"model"`
	DefinitionSHA256 string `json:"definition_sha256"`
	AssemblerVersion string `json:"assembler_version"`
}

Instrument is the identity of the thing that read: the model, the content hash of the definition it read under, and the version of the assembler that built its input. All three are required, and all three are carried into the run metadata, so two runs claiming the same instrument are provably the same — which is what the closing-run comparison rests on (ruling (12)).

type ItemRefusal

type ItemRefusal struct {
	Ordinal int    `json:"ordinal,omitempty"`
	Rule    string `json:"rule"`
	Field   string `json:"field,omitempty"`
	Detail  string `json:"detail"`
}

ItemRefusal is one item the run refused, and why: the ordinal, the rule, the offending field, and enough of what the item said for the reader to see which rule it broke.

That last part is payload text — a criterion the discipline does not declare is quoted back precisely BECAUSE nothing constrains it — and the refusal is committed, so every such quotation is redacted and then neutralised by the ingest's payloadField before it lands here. It carries no whole item BODY at any point: a body belongs in the ledger record, and this names a field.

Ordinal is omitted when it is zero, because zero is not an ordinal: items are numbered from one, and the one entry carrying none is the elision entry a bounded list ends with (boundedRefusals). A durable record that wrote `"ordinal": 0` named an item that does not exist as surely as a terminal printing "item 0" would (iss-2608311518250688).

func (ItemRefusal) IsElision

func (r ItemRefusal) IsElision() bool

IsElision reports whether r is the list's elision entry rather than an item. An item has an ordinal from one; the elision entry has none, and nothing else is ever built without one. This is the ONE rule both surfaces render by.

func (ItemRefusal) Render

func (r ItemRefusal) Render() string

Render is the one-line form of a refusal, shared by every surface that prints the list — the refusal record's reason and the terminal render. There is no item 0: the elision entry renders under its rule alone, and a reader is never sent looking for an item that does not exist. The terminal once carried this branch and the record writer did not, and the durable record was the one that named item 0 (iss-2608311518250688).

type Kind

type Kind string

Kind is a bundle item's material class. It names WHAT a passed item is and never WHERE it came from: the vocabulary is closed, and no member of it carries a location. The path mapping lives in the manifest alone, so an auditor can resolve an item to its source and the reading cannot (brief invariant 15).

const (
	KindBriefSection     Kind = "brief-section"
	KindGlossaryTerm     Kind = "glossary-term"
	KindIntentProjection Kind = "intent-projection"
	KindDiscipline       Kind = "discipline"
	KindSpec             Kind = "spec"
	KindSource           Kind = "source"
	KindTest             Kind = "test"
	KindDoc              Kind = "doc"
	KindConfig           Kind = "config"
	// KindCandidate is one projected field of one item of the derived widening
	// run: the configuration, or what admits it. It is the comparative
	// position's whole object beside the criteria discipline, and it is the ONE
	// member of this vocabulary a committed preset entry may not name — an entry
	// selects repository material, and a candidate is selected by the derived
	// run (adr-2609021016272867; validatePresets refuses it by name).
	KindCandidate Kind = "candidate"
	// KindPrinciple is one principle of the knowledge record, projected to its
	// statement: the H1 title and the `**The rule.**` paragraph, links unwrapped
	// to their labels. Its four claim keys and every citation stay behind as
	// genealogy (adr-2609021016270132, spc-2609020626042471).
	KindPrinciple Kind = "principle"
)

type KindSize

type KindSize struct {
	Kind      Kind `json:"kind"`
	Items     int  `json:"items"`
	Bytes     int  `json:"bytes"`
	TokensEst int  `json:"tokens_est"`
}

KindSize is one material kind's contribution to an assembly's weight.

type Manifest

type Manifest struct {
	Type             string   `json:"_type"`
	SchemaVersion    int      `json:"schema_version"`
	RunID            string   `json:"run_id"`
	Position         Position `json:"position"`
	TargetCommit     string   `json:"target_commit"`
	AssemblerVersion string   `json:"assembler_version"`
	// Preset and PresetHash are the auditor's account of what this run was
	// about: the committed entry for the invoked position, as selectors, and
	// its content hash. The hash lets a reader tell two runs apart by the entry
	// they applied rather than by re-deriving it, and it means a preset edited
	// later can never make a past run unreadable.
	//
	// There is no override stamp. It counted departures from the committed
	// presets, which was worth counting while an operand could depart from
	// them; nothing can now, so a stamp would assert a distinction that does
	// not exist (adr-2609021016286571).
	Preset     AppliedPreset `json:"preset"`
	PresetHash string        `json:"preset_hash"`
	// CandidateRun is the widening run this assembly DERIVED, at the comparative
	// position and nowhere else. It is on the manifest so a reader can check the
	// selection against the record rather than take it on trust: the run named is
	// the one committed widening run at this manifest's target whose items
	// carried no disposition and no admission when the assembly ran
	// (adr-2609021016272867).
	CandidateRun string `json:"candidate_run,omitempty"`
	// CandidateRunTarget is the commit THE DERIVED RUN ITSELF read, which is this
	// manifest's own TargetCommit or an ancestor of it. The two are recorded
	// separately, and both are recorded even when they are equal, because the
	// derivation admits a run whose records were committed since it read: a
	// reader with both commits can diff them and see for themselves that nothing
	// but the readings store and the issue ledger moved between the two
	// (adr-2609021016272867, as read in deriveCandidateRun; divergence register
	// 27; iss-2609021857343626).
	CandidateRunTarget string `json:"candidate_run_target,omitempty"`
	// Candidates is the count of items THE DERIVED RUN HOLDS — the count of
	// candidates the bundle carries when the position is exercised, and still the
	// run's own count when it is not. It is never written as zero for a run that
	// holds an item: Exercised is the field that says the position was not
	// exercised, and conflating the two would lose which of the two facts a
	// reader is looking at.
	Candidates int `json:"candidates,omitempty"`
	// Exercised is false on the staged empty run and true when the bundle carries
	// the candidates. It is a POINTER so that it is written whenever
	// CandidateRun is and absent everywhere else: a false value is then a
	// statement rather than an absence, and no widening manifest asserts an
	// `exercised` it has no business having an opinion about.
	Exercised *bool `json:"exercised,omitempty"`
	// CandidateFields are the two widening body fields projected, and Criteria
	// the criterion names parsed out of the committed discipline. Together they
	// are what the assembler SELECTED and what it WEIGHED, so a reader of the
	// manifest alone can say what the comparative reading was handed.
	CandidateFields []string       `json:"candidate_fields,omitempty"`
	Criteria        []string       `json:"criteria,omitempty"`
	Items           []ManifestItem `json:"items"`
	Exclusions      []Exclusion    `json:"exclusions"`
}

Manifest enumerates what an assembly passed, by path, by field and by hash, and asserts what it refused. It carries no item content, so committing it needs no redaction.

It carries no timestamp FIELD, but it is not timestamp-free and must not be described as such: RunID embeds a mint stamp by construction (adr-45). So two assemblies of one repository state at one commit produce manifests that differ in RunID and in nothing else — Items and Exclusions are identical, and the bundle beside them is byte-identical. That, not manifest byte-identity, is the determinism a re-run can be checked against, and it is why the manifest sits outside the amnesia eval's comparison rather than inside it.

func DecodeManifest

func DecodeManifest(data []byte) (Manifest, error)

DecodeManifest reads a manifest strictly: unknown fields, trailing content and a schema-version mismatch are all refused. All three are fail-closed on purpose, because a manifest is the evidence a reader judges contamination by.

It has NO front door yet, and that is deliberate rather than an oversight: the verb that reads a manifest back is the ingest, which spc-63 owns and which is not in this delivery. It is exported and tested here because the writer and the reader of one format belong together — a decoder written later, against the file rather than against the encoder, is how the two drift.

type ManifestItem

type ManifestItem struct {
	ItemKey string `json:"item_key"`
	Path    string `json:"path"`
	Field   string `json:"field,omitempty"`
	// Candidate is the reading item this text came from, on a candidate item and
	// on nothing else. It sits beside the Field this item already carried, so an
	// auditor can resolve a comparative output's `candidate_id` back to the
	// record it names without re-deriving it from the path — which is what the
	// ingest's unknown-candidate check compares against
	// (spc-2609020626039834, "Ingest at the comparative position").
	Candidate string `json:"candidate,omitempty"`
	// Kind is the item's material class, carried so a size report is checkable
	// against the manifest rather than asserted beside it. It is deliberately
	// NOT omitempty: an item without a kind is a defect, and a shape that can
	// omit the field cannot tell that defect from a well-formed item (spc-68).
	Kind Kind `json:"kind"`
	// Scan is whether the exclusion floor EXAMINED this item: `parsed` when its
	// key and heading signals were read over the bytes that travelled,
	// `unscanned` when the row that admitted it is one the floor does not parse
	// and the item travelled whole.
	//
	// It is what makes the manifest's exclusion assertion a fact about each item
	// rather than a claim about the run. Without it a scan that ran and found
	// nothing and a scan that never ran produced byte-identical attestations,
	// which is an attestation that does not attest (adr-56; brief invariant 16).
	//
	// Deliberately NOT omitempty, on the same argument Kind carries: an item
	// without a mark is a defect, and a shape that can omit the field cannot
	// tell that defect from a well-formed item.
	Scan Scan `json:"scan"`
	// Bytes is the length of the passed text. Without it the size report was
	// only HALF checkable against the manifest: an auditor could recompute the
	// per-kind item COUNTS and not the per-kind BYTES, which is the figure
	// itd-198 exists to add. The bundle carries the text and goes to the
	// reader; the manifest stays with the auditor, so an auditor holding only
	// the manifest could not corroborate the number the intent promised was
	// corroborable.
	Bytes  int    `json:"bytes"`
	SHA256 string `json:"sha256"`
}

ManifestItem maps one bundle item back to the file and field it came from, with the hash of the passed text. This mapping is the auditor's, and only the auditor's: it is the reason the bundle can be pathless and still checkable.

type MechanismReport

type MechanismReport struct {
	Intents    int `json:"intents"`
	Stated     int `json:"stated"`
	NoneStated int `json:"none_stated"`
	Absent     int `json:"absent"`
}

MechanismReport is the proportion the readings companion's section 6.6 asks be reported beside the entailment reading's findings (divergence register 16; iss-2609012259585189).

The count is per FILE, derived from the candidates by path and field, so it is checkable against the manifest, which already records which fields each file contributed. Nothing is added to the manifest's shape for it.

The three lower counts are exhaustive over Intents: a projected intent file either contributed a Mechanism item whose text is the nullity, one whose text is anything else, or no Mechanism item at all. The workstream's own shipped intents keep their absent claims as the Iteration 1 baseline and are reported, never backfilled (maintainer's ruling of 2026-09-02).

type NoCandidateRun

type NoCandidateRun struct {
	Target string
	Runs   []WideningRun
}

NoCandidateRun is the refusal when no widening run at the target qualifies. It carries the whole listing, because the remedy depends on which of the reasons applies: no run at all, a run that never committed, a run holding nothing, or a run whose items already carry a fate.

func (*NoCandidateRun) Error

func (e *NoCandidateRun) Error() string

type ObjectSet

type ObjectSet struct {
	Records []string `json:"records"`
	Paths   []string `json:"paths"`
}

ObjectSet is what a run is ABOUT: which records and which delivered paths. The term is the design framework's own (section 13), and the two lists are one fact shared by every kind the entry admits.

type Output

type Output struct {
	Type           string                       `json:"_type"`
	RunID          string                       `json:"run_id"`
	Position       Position                     `json:"position"`
	Regime         string                       `json:"regime"`
	ManifestSHA256 string                       `json:"manifest_sha256"`
	Instrument     Instrument                   `json:"instrument"`
	Items          []map[string]json.RawMessage `json:"items"`
}

Output is one reading's whole return, as it arrives.

Items are decoded as raw key/value maps rather than as a typed struct on purpose. A Go struct would need four shapes for the four position bodies, and json's DisallowUnknownFields would then report a licence breach as a bare unknown field. The key set is closed HERE instead, against the position's own body fields, which is strictly stronger: an unknown key is still refused, and a key on the position's reserved-name table is refused with the licence named.

type Parked

type Parked struct {
	RunID            string
	Position         Position
	AssemblerVersion string
	ManifestSHA256   string
	Bundle           []byte
	// Items is how many items the manifest lists, and Unscanned how many of
	// them it marks `unscanned`: the items the exclusion floor never examined,
	// which travel whole. A front door that sends the run to a provider names
	// the count before the send, so a paid send never carries it silently.
	Items     int
	Unscanned int
}

Parked is one staged run as a dispatch reads it: the run, its position, the manifest's content hash an output must cite, and the bundle bytes as the assembly wrote them.

func ReadParked

func ReadParked(repoRoot, runID string) (Parked, error)

ReadParked reads the run runID parked under DefaultRunDir in repoRoot, through the repository root, so a symlinked ancestor cannot serve another tree's run. The run id must match the run-id grammar before any path is built from it.

func (Parked) DispatchInput

func (p Parked) DispatchInput(def Definition, model string) (string, error)

DispatchInput is the input a provider is sent for p under def: the facts the output's envelope must cite, then the bundle. The reader is handed the bundle's items and nothing else from the repository; the envelope facts are the run's own identifiers, which the output must echo for the ingest to prove the run.

type Position

type Position string

Position is the reading position an assembly is invoked at. The set is closed: an unknown token is refused by name, never defaulted.

const (
	// PositionWidening reads for configurations the record has not considered.
	// It is the one position that must not see the candidate set it is asked to
	// widen, which is why its rows exclude the draft and planned intents.
	PositionWidening Position = "widening"
	// PositionEntailment reads for what the record already commits to. It sees
	// the draft and planned intents because articulation precedes selection.
	PositionEntailment Position = "entailment"
	// PositionComparative reads two or more configurations against the
	// selection-criteria discipline.
	PositionComparative Position = "comparative"
	// PositionDetection registers detections against the object.
	PositionDetection Position = "detection"
)

func ParsePosition

func ParsePosition(s string) (Position, error)

ParsePosition resolves a token to a position, refusing anything else by name.

func Positions

func Positions() []Position

Positions lists every position, in the order the charter renders them.

type PositionEntry

type PositionEntry struct {
	Comment string    `json:"comment,omitempty"`
	Object  ObjectSet `json:"object"`
	Kinds   []Kind    `json:"kinds"`
	Window  *Window   `json:"window,omitempty"`
	// AdmitDraftsAndPlanned hands the entailment position EVERY draft and
	// planned intent the include table admits there, rather than the object
	// set's alone. It is a pointer so that declaring it is distinguishable from
	// omitting it, which is what lets the loader refuse it at a position where
	// it means nothing rather than accept a key nobody reads.
	//
	// The maintainer ruled on 2026-09-02, at the Phase A review, that the
	// entailment reading is handed the object set only. The framework's section
	// 13 fixes the object set and the companion's section 6.2 makes drafts and
	// planned intents ADMISSIBLE there: admissible is a permission, the object
	// set is the scope, and handing every draft and planned intent in the
	// repository (147 projected intents on the tree the ruling was given over)
	// exceeds it. So the companion's admissibility becomes this switch — yes or
	// no for drafts and planned intents beyond the object set, default no — and
	// the drafts and planned rows otherwise narrow by the entry's record list
	// exactly as the shipped row does (divergence register 1 as corrected).
	AdmitDraftsAndPlanned *bool `json:"admit_drafts_and_planned,omitempty"`
}

PositionEntry is one position's committed entry, in the three parts the design names (spc-2609020626048722; divergence register 25).

Comment is free text nothing reads except a reviewer; it is declared so the strict decoder admits it, and it is where the entry says why it names the kinds it does and what reader a figure over the target was measured for.

func (PositionEntry) Applied

func (e PositionEntry) Applied() AppliedPreset

Applied renders the entry as the canonical clause list the manifest and the bundle carry. It is provenance, not the filter: what the run applied, in one order, so a reader can tell two runs apart by the entry they had.

type PositionNotExercised

type PositionNotExercised struct {
	CandidateRun string
	Candidates   int
}

PositionNotExercised is the fixed interpretation as a refusal: the derived widening run holds fewer than two candidates, so the comparative reading has nothing to compare.

It is returned BESIDE a populated result, because both halves are true — the assembly refused, and it staged the run whose ingest records the outcome. The front doors render the result and then exit on the error, which is the shape `reading ingest` already carries for a refusal that produced a durable record.

func (*PositionNotExercised) Error

func (e *PositionNotExercised) Error() string

type PresetFile

type PresetFile struct {
	SchemaVersion int                      `json:"schema_version"`
	Positions     map[string]PositionEntry `json:"positions"`
}

PresetFile is the committed configuration, one entry per position.

A preset carries an entry PER POSITION rather than one every position shares, because the finding this exists to fix is that three of the four positions received a byte-identical item set, and one entry over four near-identical admissions reproduces it exactly (iss-2608311501240566).

func LoadPresets

func LoadPresets(repoRoot string) (PresetFile, error)

LoadPresets reads and validates the committed preset configuration.

It is strict on unknown fields, like every other artefact this package reads: a key nobody reads is a scope nobody applies, and a preset that silently does less than it says is the failure this whole intent exists to close.

type RefusalRecord

type RefusalRecord struct {
	Type           string     `json:"_type"`
	SchemaVersion  int        `json:"schema_version"`
	RunID          string     `json:"run_id"`
	Position       Position   `json:"position"`
	Regime         string     `json:"regime,omitempty"`
	TargetCommit   string     `json:"target_commit"`
	ManifestSHA256 string     `json:"manifest_sha256"`
	Instrument     Instrument `json:"instrument"`
	Reason         string     `json:"reason"`
}

RefusalRecord is what a list-level refusal leaves behind: the run metadata and the named reason, and no items. The event is durable, and a rerun is a new run with a new run id, never an amendment.

Regime is omitted when the run has none: a run refused because its position's definition did not resolve — absent, malformed, or stating another position's licence — read under no regime the verb could name, and the record says nothing rather than something the verb never read. The reason names the definition instead.

type Row

type Row struct {
	// Positions are the reading positions this row is admitted at.
	Positions []Position
	// Source is the repo-relative directory the row reaches, "." for the
	// repository root.
	Source string
	// Match selects files inside Source: an entry beginning with "." is a file
	// extension, any other entry is an exact basename. An empty Match admits
	// every file, which no row uses — inclusion is positive at every grain.
	//
	// THE CASE RULE, for these two forms, MatchSuffix and any form added after
	// them: a form that names a KIND of file folds case, and a form that names
	// a FILE, or follows a tool's own rule, matches the spelling exactly.
	//   - An extension names a kind: `.MD` is markdown to every reader of it,
	//     so the extension form folds (strings.EqualFold).
	//   - A basename names one file by the spelling the repository commits:
	//     `Makefile` admits that file and not `makefile`, and a row that wants
	//     another spelling lists it. Folding here would admit, on a
	//     case-sensitive checkout, a second file the row never named.
	//   - A suffix follows the Go toolchain's rule, which is case-sensitive; see
	//     MatchSuffix.
	// A new form states which of the three it is, beside its field, and takes
	// that form's compare (iss-2608311949421873).
	Match []string
	// MatchSuffix selects files inside Source by basename suffix, matched
	// case-sensitively. It is a separate field rather than a third convention
	// inside Match so the form is named by where it sits rather than inferred
	// from a string's first character: no disambiguation rule against the two
	// Match forms is needed, and none exists to get wrong. The case rule is
	// deliberate and differs from Match's extension form, which folds case:
	// the Go toolchain builds a test only from a lowercase _test.go, so folding
	// here would label material a test that Go does not build as one. The
	// suffix is not the WHOLE of Go's rule — a file named exactly _test.go is
	// ignored by the toolchain for its leading underscore, and files under
	// testdata/ are never built either, yet both are labelled test here. Those
	// are labelling differences on material no build compiles, never admission
	// differences. A file matched by either field is admitted; the two are
	// ORed (spc-68).
	MatchSuffix []string
	// Fields are the named fields projected out of each matched file, in the
	// order they are emitted. A field is resolved as a heading section where the
	// file carries that heading, otherwise as a frontmatter key. An empty Fields
	// passes the whole file as one item.
	Fields []string
	// Store and Bucket, when set, route the row's enumeration through the
	// record graph (internal/core/lint's LoadRecordGraph, the one parser of the
	// record's shape in this binary) rather than through a file walk. Bucket is
	// the lifecycle directory, empty for every bucket of the store.
	Store  string
	Bucket string
	// Kind is the material class every item from this row carries.
	Kind Kind
	// Scan declares whether the exclusion floor parses what this row admits. It
	// is the table's own statement of the narrowing it performs, so admission
	// and examination are ONE declaration rather than a row on one side and an
	// extension test inside the floor on the other — the undeclared scope
	// decision underneath the whole container-shape class
	// (iss-2608301450065320, adr-56 rule 3). collect reads it: a ScanParsed row
	// goes through redactExcluded, a ScanUnscanned row's document travels
	// untouched and every item it yields is marked unscanned in the manifest.
	Scan Scan
	// Rule is the rule that admits the row, quoted in the charter.
	Rule string
}

Row is one include-table row: which positions admit this source, what is matched inside it, which fields are projected out of each matched file, the material class the items carry, and the rule that admits the row.

A row's Source is the ONLY directory it reaches. The structural deny is measured from the Source downward, which is exactly why naming a record family's leaf bucket individually is legal while naming a directory that CONTAINS a family is not (assembler rule 1, ruling (18)).

func (Row) AdmittedAt

func (r Row) AdmittedAt(p Position) bool

AdmittedAt reports whether the row is admitted at p.

func (Row) Reaches

func (r Row) Reaches(rel string) bool

Reaches reports whether the row admits the repo-relative file at rel. It is the predicate the walk applies and the predicate the table's own rule tests assert against, so the charter cannot claim a bound the walk does not keep.

type RunRecord

type RunRecord struct {
	Type           string                     `json:"_type"`
	SchemaVersion  int                        `json:"schema_version"`
	RunID          string                     `json:"run_id"`
	Position       Position                   `json:"position"`
	Regime         string                     `json:"regime"`
	TargetCommit   string                     `json:"target_commit"`
	ManifestSHA256 string                     `json:"manifest_sha256"`
	Instrument     Instrument                 `json:"instrument"`
	Records        []capture.ReadingRecordRef `json:"records"`
	RefusedItems   []ItemRefusal              `json:"refused_items"`
	RefusedCount   int                        `json:"refused_count"`
	// CandidateRun, Candidates and Exercised are the comparative position's three
	// facts, carried forward FROM THE MANIFEST so a committed comparative run
	// says which widening run it characterised, how many candidates that run
	// held, and whether the position was exercised at all.
	//
	// The join is what makes the outcome of a widening run ONE shape: a
	// committed comparative run naming it, never a mutable file. It is the
	// probe capture.ComparativeRunFor reads, and through it the gate
	// spc-2609020626040342 puts in the shared disposition writer
	// (adr-2609021016272867; the 2026-09-02 interpretations ruling).
	CandidateRun string `json:"candidate_run,omitempty"`
	Candidates   int    `json:"candidates,omitempty"`
	Exercised    *bool  `json:"exercised,omitempty"`
	// Bounds are the departures this run made from the reading the design
	// documents state, written by the verb FROM THE MANIFEST and never from the
	// operator. Ruling M5 is that a reading which departs from the one the
	// documents state is stated as a bound rather than passed off, and nothing
	// wrote either statement before this field existed
	// (cond-2609021140329660, cond-2609021140328523; divergence register 17
	// and 18).
	//
	// A run with neither carries an EMPTY list and never an absent key, so a
	// reader can tell a run that stated no bound from one written before the
	// field existed.
	Bounds []string `json:"bounds"`
}

RunRecord is the run metadata, written LAST as the commit marker: a run without one never happened.

type Scan

type Scan string

Scan says whether the exclusion floor examined an item, and it is ONE word used in two places: on a Row it is the table's promise that the floor parses what the row admits, and on a ManifestItem it is the fact of whether the floor did. Spelling the promise and the fact differently is how the two came to disagree in the first place — the include table admitted by container shape and the floor examined by file extension, and nothing downstream was told which items the examination had reached (adr-56; brief invariant 16).

const (
	// ScanParsed: the floor read this item's frontmatter keys and headings, so
	// the manifest's key and heading exclusions are asserted for it.
	ScanParsed Scan = "parsed"
	// ScanUnscanned: the floor did not examine this item. It travels whole, and
	// the manifest says so per item rather than leaving a reader to infer from a
	// clean run that a scan ran (the 2026-09-02 refinement of adr-56).
	ScanUnscanned Scan = "unscanned"
)

type Selector

type Selector struct {
	// Kind selects every item of one material class.
	Kind Kind `json:"kind,omitempty"`
	// Record selects the items whose path names one record.
	Record string `json:"record,omitempty"`
	// Path selects the items at or beneath one repo-relative directory. It is
	// reachable ONLY from a committed preset, never from the invocation.
	Path string `json:"path,omitempty"`
}

Selector is one clause of a scope. A candidate is selected if ANY clause matches it, so a scope is a union of its clauses and an empty scope selects nothing.

type SizeReport

type SizeReport struct {
	ByKind []KindSize `json:"by_kind"`
	Items  int        `json:"items"`
	// Unscanned is how many of those items the exclusion floor never examined,
	// which is the operator's own figure for how much of the assembly travels
	// on disclosure rather than on a scan. It rides on the result like the rest
	// of this report and on neither artefact, so it moves no version: the
	// per-item truth is the manifest's `scan` mark, and this is its total
	// (itd-194).
	Unscanned int    `json:"unscanned"`
	Bytes     int    `json:"bytes"`
	TokensEst int    `json:"tokens_est"`
	Basis     string `json:"basis"`
	// Window is the declaration the committed entry for this position carries,
	// nil where none is declared — a version 1 preset file. It rides on the
	// report rather than on either artefact, so a declaration is a fact about
	// the run's cost and never a field a reading or an auditor reads
	// (spc-2609020626048722).
	Window *Window `json:"window,omitempty"`
	// ExceedsWindow is whether this assembly measured past that declaration.
	// Nothing is refused for it: the eval is what fails, and the operator is
	// told here.
	ExceedsWindow bool `json:"exceeds_window"`
	// OverTarget is whether the total estimate exceeds TargetTokens. The target
	// is a statement to the operator and never a refusal (maintainer's ruling of
	// 2026-09-02; divergence register 24).
	OverTarget bool `json:"over_target"`
	// Mechanism is the entailment position's yield bound: how many projected
	// intents carry a mechanism claim. It is nil at every other position,
	// because the readings companion's section 6.6 asks for it beside the
	// entailment reading's findings and nowhere else.
	Mechanism *MechanismReport `json:"mechanism,omitempty"`
}

SizeReport is what an assembly would cost a reader, per material kind and in total. It rides on the result and never on the bundle: a reading has no use for its own weight, and itd-198 ac-8 holds the bundle's shape unchanged.

Bytes count the item text that actually travels, not the file on disk, so a projected record is counted at what the reading receives rather than at what the record weighs. No budget is enforced and none is invented: the assembler cannot know what a given reader accepts.

type Status

type Status struct {
	AssemblerVersion string     `json:"assembler_version"`
	SchemaVersion    int        `json:"schema_version"`
	CharterPath      string     `json:"charter_path"`
	Positions        []Position `json:"positions"`
	IncludeRows      int        `json:"include_rows"`
	ExclusionRows    int        `json:"exclusion_rows"`
	Definitions      []string   `json:"definitions"`
	// StagedRuns is what an ASSEMBLY parked and no ingest has yet given an
	// outcome: the runs still awaiting a reading. Nothing removes an assembly's
	// directory after its run is ingested, so the parking area alone lists every
	// run ever assembled, committed and refused alike; a parked run whose id
	// already has a commit marker or a refusal record is therefore left out, by
	// the probe the rerun refusal makes (runOutcome, iss-2608311621412224).
	StagedRuns []string `json:"staged_runs"`
	// OrphanedIngests names the runs whose ingest reached the ledger and never
	// reached its commit marker.
	//
	// It is reported because the ingest verb's sweep rides with the COMMIT: an
	// orphan therefore survives until the next invocation that validates, and
	// until then its reading records sit in the committed ledger for a run that
	// never happened. That is a state an operator has to be able to see, and no
	// other surface shows it — StagedRuns reads the assembly parking area, which
	// is a different directory.
	OrphanedIngests []string `json:"orphaned_ingests"`
	// LeftoverStages names the runs whose stage is still present although their
	// commit marker landed: the commit path's RemoveAll failed after run.json
	// was written. Those runs are complete. The next ingest that validates
	// clears the stage and leaves the records alone — the sweep probes the same
	// marker (rollbackRun) — so reporting one as an orphan would promise a
	// rollback that never happens (iss-2609012043437282).
	LeftoverStages []string `json:"leftover_stages"`
}

Status is the read-only render behind the bare verb: what this assembler is, what it would admit, which definitions are present, which runs an assembly has parked in the local tier, and which ingests were interrupted.

func Describe

func Describe(repoRoot string) (Status, error)

Describe reports the assembler's state over a repository. It writes nothing.

type WideningRun

type WideningRun struct {
	// ID is the run identifier (rdg-N).
	ID string `json:"id"`
	// Target is the commit the run's own record names: the commit its reading
	// actually read. It is the assembly's target or an ancestor of it, and the
	// manifest carries both so a reader can diff them.
	Target string `json:"target"`
	// Items is how many reading records the run holds in the ledger.
	Items int `json:"items"`
	// Dispositioned reports that at least one item carries a standing
	// disposition; Admitted, that at least one carries an admission. Either is a
	// fate, and a candidate set is defined as pre-admission.
	Dispositioned bool `json:"dispositioned"`
	Admitted      bool `json:"admitted"`
	// Committed reports that the run reached its commit marker
	// (`run.json`). A run without one never happened and its records are the
	// next ingest sweep's to roll back, so it is listed and never selected.
	Committed bool `json:"committed"`
	// Fated names what stands over the items that carry a fate, one rendered
	// phrase per item, so a refusal names THE ITEM AND THE DISPOSITION rather
	// than only the run. The two booleans above answer "did this run qualify";
	// this answers "which item stopped it", which is what the ordering guard
	// owes an operator (spc-2609020626039834, "The ordering guard").
	Fated []string `json:"fated,omitempty"`
	// Moved names the FIRST path that changed between this run's own target and
	// the assembly's, outside the readings store and the issue ledger's record
	// families. It is empty when the two targets are the same commit, and empty
	// when everything that changed between them was the instrument's own record.
	//
	// A run carrying it is LISTED and never selected: its items characterise an
	// object set this target no longer holds, and the operator needs the path to
	// see that (the reading of "at the target" this file's head comment states).
	Moved string `json:"object_set_moved,omitempty"`
}

WideningRun is one widening run at a target, as the derivation sees it: what it is, how much it holds, and whether anything has happened to what it holds.

Every field is on the LISTING a refusal renders, because the operator's next move depends on all of them: a run that did not qualify is shown rather than hidden, with the reason it did not.

func (WideningRun) Line

func (r WideningRun) Line() string

Line renders one run for the refusal listing: one run per line, saying what it holds and why it did or did not qualify.

func (WideningRun) Qualifies

func (r WideningRun) Qualifies() bool

Qualifies reports whether this run is the candidate set the ADR describes: a committed widening run holding items, none of which carries a fate, read over the object set this assembly's target still holds.

type Window

type Window struct {
	TokensEst         int    `json:"tokens_est"`
	MeasuredTokensEst int    `json:"measured_tokens_est"`
	MeasuredBytes     int    `json:"measured_bytes"`
	MeasuredAt        string `json:"measured_at"`
}

Window is the estimated-token figure an entry was calibrated to, beside the measurement it was taken from.

TokensEst is the DECLARATION, on the size report's own byte-derived basis (bytes divided by 3.85, spc-68), and the eval holds every entry to it. The three measured_* values are DISCLOSURE and nothing gates on them beyond shape: MeasuredAt must match the assembler's target grammar, and its reachability is deliberately not checked, because a squash or rebase merge rewrites a branch sha out of existence and a disclosure that fails the build after one would teach people to omit it.