Version. 0.17
Date. 2026-08-03
Charter. standing-notes/dunin7-standing-authorization-charter-v0_1.
Author. Claude Code (execution session). Operator: Marvin Percival.
Supersedes. v0.16 at record 8097f5d. All earlier versions stand as siblings; v0.3 remains deliberately absent.
Changes from v0.16. B-9 is built, merged and tagged. The arc that began with fixing what the record said about itself now ends with a surface that shows it. The walk B-9's wording actually promised is still not buildable, and Q-15 is still the Operator's.
Operator Layer main cb8b940, tag provenance-walk-v0_1, push-verified. Previous main f477c87. Engine ffc29af, untouched throughout — no file outside the Operator Layer was edited, and the acceptance gate's item 8 holds.
Seven commits, one per step, merged --no-ff so the sequence survives in the history.
Three record filings, each push-verified: 8097f5d (B-9 Step 0 findings + brief v0.16), 798e70e (CR-2026-164 v0.3 + standing note v0.7), 34d0b1c (build list v0.15).
Open a finished document and see, for every note that went into it, who said it and who committed it — back through the Shape it was built from, the picture that Shape drew on, and the notes that picture organized. Every hop reads the version actually selected, never the record as it stands today.
The live check made that load-bearing rather than decorative. Seeded so the selected versions were superseded, the pinned reads returned a confirmed Shape and its v1 grouping while the unpinned reads returned a retired Shape and a different grouping. A walk without the version would have answered confidently and wrongly.
Three refusals, which are the product rather than the caveats:
compose.ts was not alone. The findings counted hops; adapters do not divide by hop. Four adapters discarded walk data, and the two the findings missed are the two the actor decisions depend on — memory.ts serves hops four and five and discarded on both: the version that pins the note, and the actor identifier the comparison runs on.
And one thing that was not a discard. The surface declared three actor kinds where the engine has four. companion was absent from a type asserting the engine could not send a value it sends routinely. It arrived unchecked and nothing caught it, because nothing consumed the kind at all — the surface read only a name. That is the flattening the CR forbids, and the walk is now the first consumer of the kind in the codebase.
Recorded as a scope call rather than absorbed silently, and the Operator was asked before it was built.
The vocabulary wall caught a comment — the third time in this arc, the same way both earlier times. Naming a walled term in order to say a file does not carry it is still naming it. Reworded; no exemption was requested, and no WIRE_BOUNDARY_FILES entry was added at any step.
A verification of mine was wrong and was caught here rather than by a reviewer. The first lint comparison used plain git stash, which leaves untracked files in place — both new files stayed on disk during the "baseline" run and it reported a false all-clear. Redone with -u. The corrected figure: lint baseline 32 errors, now 33. The added one is a rule fourteen files already break, including the room the CR names as the model this code follows. Consistency with the blessed pattern was chosen over a one-file exception; the rule wants a codebase-wide item, which is now B-42.
Two fixture edits changed values no assertion reads. One room asserts the number of groups and never their sizes; the Memory room never asserted a contributor at all. Both restored to their original values. That second gap is why a three-kind union survived against a four-kind engine, and it now has tests — recording the room's actual behaviour, not the walk's, because asserting an aspiration there would fail for the wrong reason.
The guards were mutation-tested rather than assumed. Disabling the sentinel check fails two tests; collapsing the actor comparison to the identifier alone fails two; making the sentinel match case-sensitive fails one.
Throwaway database, engine on a spare port, inline environment only, torn down after. playground_dev never connected to; .env untouched; the protected engagements never touched.
A complete walk ran through the real adapters, walk module and actor presentation — not curl — and produced all four cases the decisions turn on, including **the sentinel rendered as *someone the record does not identify***. A deliberately failed hop rejected while the other hops still landed; a deliberately failed note came back unreadable while the other four kept their text.
Suite: 111 files, 693 passed, 0 failed, exit 1 on the twelve baseline fetchPlatformLevel rejections — the baseline set exactly, with 41 tests added. Wall passes. Type-check holds at its pre-existing four errors.
Four new build-list items, all surfaced by building rather than planned — B-41 to B-44 in list v0.15.
Also still open from before: B-8, B-10, B-11 and the rest of the main line, unchanged.
Q-1, Q-3, Q-10, Q-13 carry forward unchanged. Q-15 and Q-16 both survive the build and now block nothing — B-9 shipped without either being answered, which was the point of shaping it that way.
| # | Question | Default | Blocks | Proceeds regardless | |---|---|---|---|---| | Q-15 | Per-statement provenance — clicking a sentence rather than a note. Not buildable as B-9's wording promised, and not buildable the obvious way either: asking the model to cite its sources makes the citations model output, and a fabricated citation leads confidently to the wrong person — worse than no walk, in the feature built to show the record can be trusted. It wants a mechanism that does not depend on the model being honest, which is an investigation. | None taken. Charter F-7 — a pipeline and substrate change is an architecture-level fork. | Nothing now. The render-level walk shipped. | Everything. | | Q-16 | Should a walk use the event identifier? It opens a hop the reference-walk cannot make — which event produced this version, by which actor, with what presence proof — and nothing reads it today on either side. Exposing it is a response field and a route that resolves an event id. | None taken. Deciding by default is not permitted (F-8). | Nothing. Out of scope for the CR by its own §4. | Everything. |
F-1: seven merges now await one restart — CR-2026-159, -160, -161, both halves of -162, -163 and -164. Six change requests, seven merges, one spanning both repositories. Everything marked DONE is done in the repositories and absent from the running system, including the walk that just closed.
B-16. Seed v0.13 still awaits your reading (F-3).
R-2 end-to-end, one repository. Branch checked before the first commit; per-step commits; the suite compared against the Step 0 baseline sets at every step.
C-1 observed at the merge. Fetch and HEAD re-verified immediately before, clean index confirmed, no divergence, tag free, --no-ff. The merge command failed once on an unrelated argument error — the tree and the absence of a partial merge were re-verified before retrying, because a failed merge invocation is exactly where a contaminated index would appear.
C-2 used once, to fix a typo in my own unpushed commit message, after re-confirming HEAD and that nothing was pushed.
R-4 held. Spare ports, inline environment only, throwaway database, torn down after. playground_dev never connected to and the protected engagements untouched (A-7 respected).
R-1 for three filings, each pushed on a clean pre-flight and verified at origin.
F-1 respected: merged is not deployed. Two forks stayed on the queue rather than being decided by default.
One anomaly, reported not papered over (A-6). The documented database-creation path does not produce a working database. It did not stop the verification — the boundary was named, worked around in the throwaway only, and filed as B-41.
DUNIN7 — Done In Seven LLC — Miami, Florida DUNIN7 — status brief — v0.17 — 2026-08-03 The walk between records is built. The walk inside a document is still a decision, and it is still yours.