Version. 0.10
Date. 2026-08-02
Charter. standing-notes/dunin7-standing-authorization-charter-v0_1, ratified 2026-07-30.
Author. Claude Code (execution session). Operator: Marvin Percival.
Supersedes. v0.9 at record 931efe1. v0.8 at 1bfc9e5. v0.7 at 585742d, v0.6 at 38a7014, v0.5 at 32182bf, v0.4 at 1ec5c2a, v0.2 at 40571cf, v0.1 at 602bd9c stand as siblings. v0.3 remains deliberately absent.
Changes from v0.9. Change request C's Step 0 is done — a read-only inspection, no code touched. B-28 is a validation fix, not a data-loss fix, and the cause is located to two lines. B-7's download half turns out to be a wire, not a build. And rendering is not a forbidden term, so only one of change request C's two rooms faces the vocabulary wall.
No code, in either repository. This was a read-only R-5 inspection.
loomworks-record)
| Commit | Subject |
|---|---|
| 1cc3115 | change request C Step 0 inspection brief (engine target corrected to a6a3ed6) |
| 038a3ca | change request C Step 0 findings v0.1 |
| this filing | status brief v0.10 |
Operator Layer main 7e81e30, tag manifestation-room-v0_1. Engine main a6a3ed6, tag authorship-truth-v0_1, read-only this session. Both trees clean on entry and exit.
B-28 is a validation fix, not a data-loss fix, and the brief's own test decided it: a refusal before persistence is validation, after is data loss. The assertion is written — contributions.py:268 — and then rolled back, because the response is built afterwards and get_db_session rolls back on any exception.
The cause is a two-line type mismatch. text/markdown is registered to the discovery-to-seed skill, which emits source_mode="discovery"; the assertion schema declares Literal["text", "voice", "pdf", "image"] at schemas.py:2524 and again at :2806. discovery is emitted and not allowed; text is allowed and emitted by no skill. A fix reaching only one of the two declarations leaves the other to fail identically.
And the contribution is recoverable. The uploaded file row survives — the upload is a separate earlier request that commits normally — so the same file_id can be re-contributed the moment the mismatch is fixed. No bytes are lost. What is lost is the work, not the document.
> The design question behind it is named, not decided. Contributing a Markdown file currently routes it through seed extraction, whose own registration comment says the canonical path is elsewhere. Whether that binding is right at all must be answered before choosing between widening the Literal and re-binding the pattern.
B-7's download half is a wire, not a build. The engine has served GET /renders/{id}/download — plus /content and /files/ — all along, and it can convert format on the way out, which is more than B-7 asks for. The surface calls exactly one render path: the list. The room's "no dead Download button" comment records an only-show-what-is-available choice made when there was no route to call. There is one. (The same shape the Manifestation inspection found, and the brief was right to say check before assuming.)
B-7's currency half is a real gap, on both sides. Renders carry no supersession marker — unlike Manifestations, which do — so the engine states no current-marker either. The surface receives state, created_at and display_number and displays none of them, while filtering server-side to produced only. Side by side, two renders are both produced and distinguished only by an ascending number that says nothing about currency.
Shaping is open on the engine and larger than Manifestation was. All four capabilities exist across three routers, with version-pinning by query parameter exactly as Manifestations have it, and no surface adapter exists at all. But it carries a confirm/retire lifecycle, executors, and asynchronous jobs — a read plus a state machine plus a poll. The change request should not inherit "the engine needed no work" as though the two rooms were the same size.
rendering is not a forbidden term. The list is engagement_id · engagement_title · engagement_name · assertion_id · shape_event · render_event · manifestation · shaping · specialist · materializer · normative_force. rendering is absent, which is why renderingEmpty and renderingRunning already sit unexempted in src/ and pass.
So the two rooms are asymmetric: the Rendering room may be named for itself throughout — component, file, adapter, test ids — and needs no exemption. The Shaping room may not, and its machine-facing names must use the discriminator shape, as Manifestation uses compose.
The brief's expected React-vocabulary collision does not materialise, for the same reason.
And the trap CR-2026-160 hit is answered before the change request specifies a path: a Shaping adapter must be lib/api/shape.ts, never shaping.ts — the wall matches import specifiers, so a room-named adapter would trip it in every consumer and force a whole-file exemption on each. A Rendering adapter faces no such constraint; renders.ts already exists and is already a boundary file.
Site 10's kind-collapse is struck, and this is the finding of the arc.
The spoken door writes kind="companion"; the typed door writes kind="person". The sizing recorded the fix as "one of the two, consistently" — a consistency tidy-up, carried unexamined from the walk audit.
They record different acts. The spoken door's actor is attached to a held draft; the code switches to actor_from_person for the human act, under a comment stating "the Companion proposed, the Operator's 'yes' performs it" and "attributed to the human, not the Companion that drafted it."
And the difference is load-bearing. Two consumers use != "companion" as their test for whether an actor is human, and NON_HUMAN_ACTOR_KINDS = {"agent", "companion"} is what the commit gates reject. Collapsing the doors to person would have made the Companion's own draft committable as a human act — destroying the R-A3/R-B20 split while presenting as cosmetic.
The boundary had no test protecting it. It has three now.
The generalisable lesson: a kind change is an authority change. NON_HUMAN_ACTOR_KINDS turns any edit to an actor's kind into an edit to who may commit, and nothing at the construction site says so.
None in the inspection itself — it wrote nothing and every claim carries a file and a line.
One correction made to the brief before filing it, and reported rather than applied silently. Its engine-read target was e106917 with a caveat that CR-2026-161 was building on a branch. Both were stale. The Operator named one line; the stale reference recurred in five, and correcting only the named one would have left §1's fences saying a6a3ed6 while the kickoff block still said e106917 — and the executing session reads the kickoff. All five updated; the read-only fences beside the branch prohibition preserved verbatim.
Two unread items are named rather than closed with a plausible reading: the status code the Operator actually sees on a failed Markdown contribution (needs a perimeter call the fences forbid — the defect's location and mechanism do not depend on it), and whether the shape-type → render-type mapping is enforced or merely exposed.
Nothing. All repositories pushed and origin-verified. No session in flight. The temporary live-verification file was removed after the checkpoint.
| # | Question | Default | Blocks | Proceeds regardless |
|---|---|---|---|---|
| Q-1 | B-16 — seed v0.13. Committing a seed version is an Operator act (F-3). | Commit as drafted once read. | Seed v0.13 only. | Everything. |
| Q-3 | The engine baseline is not zero. test_stele_router_mount 401. | Stays red and stays recorded. | Only a zero-failure gate. | Everything. |
| Q-10 | Do ephemeral agent identities belong in the record? Site 4 mints a fresh UUID naming no registered agent and stamps it on the summary and the event. Declared in the schema, so not a B-25 defect — but recognisably the B-25 class. Changing it changes a published API contract. | Open as its own build-list item; do not fold into another CR. | Nothing. | Everything. |
Q-5, Q-6, Q-7, Q-8 and Q-9 are all answered and removed — the escalation recipient is validated; seed_conversation.py:116 struck; site 10 struck with a guard; site 4 struck; the sentinel is contributor.
| Q-11 | Should contributed Markdown route through seed extraction at all? text/markdown is bound to the discovery-to-seed skill, whose own registration comment says the canonical path is seed_extraction, while a separate detection rule maps .md to text extraction at another layer. The B-28 fix differs depending on the answer: widen the Literal, or re-bind the pattern. | Widen the Literal — the smaller, reversible change — and file the re-binding separately. | B-28's remedy only. | Everything. |
| Q-12 | Do renders need an explicit current-marker? They carry no supersession reference, unlike Manifestations. Currency is inferable from display_number and timestamps but is never stated, and the surface displays neither. | Surface what already exists first; add an engine marker only if inference proves insufficient. | B-7's currency half only. | Everything. |
Batched Operator acts pending: one, now covering three merges. F-1 deployment — CR-2026-159 (engine), CR-2026-160 (Operator Layer) and CR-2026-161 (engine) are all merged and tagged but not deployed. The launchd restart is yours and batches to cadence.
None. The inspection ran wholly inside its fences: no dev server, no build, no test run, no database, no perimeter call, and the engine was read but never written. Both trees were clean on entry and exit.
R-5 observed throughout. A read-only sweep across two repositories that wrote nothing and authenticated nothing.
The brief's own §2.5 discipline earned its keep twice. Confirm a target exists before treating its silence as a pass — the brief was requested for filing before it had been saved, and the three sweeps requested with it would all have returned zero hits against the absent file and read as passes. Confirming existence first is what caught it. The same rule then governed this run's opening check.
Nothing inherited. The CR-A findings were read pre-B-5; every claim carried from them is marked re-verified or unverified in the findings, and one — that RenderingRoom derives its own states — turned out still true, while the room count on the contract had moved.
R-1 for the filings, pre-flight passing, findings mirrored to ~/Downloads.
F-1 unchanged: three merges remain merged and not deployed.
DUNIN7 — Done In Seven LLC — Miami, Florida DUNIN7 — status brief — v0.10 — 2026-08-02 The document was never lost, only its extraction. The download button was there all along.