Development record
No session holds both a reading and the ledger, and a per-run context stamp is how the record shows it
Context
Brief invariant 15 states that no session holds both a reading and the ledger. The scribe definition (itd-188) states the same as the inverse of the read block: a reading receives a positively included slice of the shipped repository and no ledger; the scribe receives ledger content and no shipped tree. The invariant has a sentence and no mechanism.
Its fidelity verdict said so. Both of itd-188's criteria were found met by declaration: no assembler runs for the scribe, and session retention cannot show that no session held both. The read block, by contrast, is held by an assembler, a manifest and an eval. One half of the wall is built and the other is asserted.
A first attempt at a mechanism, a fixed stamp token per session kind, fails invariant 16: the tokens would be committed in the documentation and the code, so any session that read them would carry both and be reported in breach, while a session that reached the ledger by any route other than the scribe verb would carry one stamp and be reported clean. The attestation would say more than the examination establishes.
Decision
Every assembly carries a per-run context stamp: the kind of session it is for (reading or scribe), the run identifier, and a digest of the assembled context. The stamp is matched exactly. A session that reads the documentation carries none; a session that was handed a bundle or a scribe context carries the one for that run.
The scribe's context is assembled by a verb with an allow list derived from the ledger's own directory list, so a record family added later is inside the scribe's world and outside the reading's by the same declaration, and the scribe's manifest is parked in the local tier at assembly and promoted beside the run at ingest, inside the read block.
The session store gains a separation check that reports a retained transcript carrying both stamps of one run, by name; reports the runs it saw when none does; and reports the property as unobserved, never as clean, when no retained transcript carries any stamp. The check reads transcript metadata only, which keeps it inside the consumer list invariant 15 enumerates.
What the check does not claim is stated with it: a host that assembles a session's context before anything is retained is outside its reach, and there the scribe definition's protocol remains the gate.
Alternatives Considered
- Leave the property to the protocol. The reading and scribe sessions are run separately by instruction. Rejected: the design's whole argument is that a boundary is checkable rather than assertable, and this is the one boundary that stayed assertable.
- A fixed stamp per session kind. Rejected for the reason in the context: it produces false violations and false clean passes, and an attestation may not outrun its examination.
- Scan transcript bodies for ledger paths and bundle content. Reaches the bodies, which invariant 15 reserves to the custodian's own reads and to nothing else. Rejected.
Consequences
- Brief invariant 15 is amended to name the stamp and the check as the mechanism behind its sentence, and to state the unobserved case.
- The reading bundle's shape changes by one field, which moves the assembler version on itd-199's precedent.
- The scribe becomes a verb of its own (
scribe assemble,scribe ingest), never a sub-verb ofreading, because the two contexts must never share a front door; its ingest writes through the capture verbs' own validators and inherits the ordering gate adr-2609021016272867 states. - The scribe transcribes dispositions and reads the reading records from the store. The framework's scribe section has the scribe transcribe reading outputs as well, and its output-contract section has the ingest verb write the reading records; under the record the verb does that first, so the scribe is handed the run's committed reading records rather than a raw output a second time. That is the framework agreeing with itself through the verb, and it is stated here so nobody reads it as a departure.
- The transcript store's metadata gains one key for the stamps, written by the custodian at capture and read by the check; bodies are untouched.
Status note
Accepted by the maintainer on 2026-09-02, at the planning interview for the Iteration 2 intents, after each decision was checked against the design framework v4 and its readings companion v4 and found not to contradict them. Drafted as proposed and held there until that interview, because it amends a brief invariant and adds a consumer to the transcript store's enumerated list, neither an agent's act. The invariant amendment is adopted with it.
Frontmatter
| id | adr-2609021016275803 |
|---|---|
| type | adr |
| status | accepted |
| date | 2026-09-02 |
.abcd/development/decisions/adrs/2609021016275803-no-session-holds-both-a-reading-and-the.md
open on GitHub ↗ · commit history ↗
References5
- adr-55The construal stands in the record; its history does notrelated
- adr-56An exclusion control asserts only what it can proverelated
- itd-183The cold reading sees exactly what the assembler passes — positive inclusion, field projection, and a per-run manifestrelated
- itd-188Machine assistance in maintaining the ledger, without any context that holds both ledger content and a readingrelated
- itd-2609020625402599The scribe's context is assembled and its output is ingested by a verb, and the record can show that no session held both a reading and the ledgerrelated
mentions7
- adr-2609021016272867The comparative reading receives one widening run's candidates, a positional exception to the prior-run exhaust, with the run derived from the record and no operand added
- dcn-26090200000000032026-09-02 — adr-2609021016272867, adr-2609021016275803, adr-2609021016270132 and adr-2609021016288378 are adopted (maintainer, at the same interview, each checked against the framework and the companion first). adr-2609021016272867: the comparative reading receives two body fields of one named widening run's items as the single exception to the prior-run exhaust, through a fourth closed operand naming the run; the maintainer chose the named operand over a derived selection because two widening runs coexist after the closing run, on the condition that an absent operand lists the runs the operator may choose from. adr-2609021016275803: per-run context stamps and a session-separation check that reports held-for-what-was-seen or unobserved, never clean; `scribe assemble` and `scribe ingest` with a ledger-only allow list derived from the ledger's directory list. adr-2609021016270132: the principles family is a declared record store with four typed keys, forward-only, read cold by statement and never by citation, with the inheritance check. adr-2609021016288378: in its three-surface form, because the single-section draft contradicted the design's two landings and adr-55's definition of the construal.
- dcn-26090200000000112026-09-02 — adr-56's third rule is refined, not contradicted, by the source-and-tests ruling (maintainer): a control that admits an input it cannot examine may pass it only with a per-item unscanned mark in its attestation, so the second rule (an attestation never says more than the examination) carries what the third rule carried; refusal stays the rule for an input the control claims to have examined and could not. Invariant 16 amended to say so. Every ADR is now checked against the framework v4 and the companion v4: adr-58 is superseded by adr-2609021016286571, adr-2609021016272867 is corrected to the derived run, and none of adr-55, adr-57, adr-2609021016275803, adr-2609021016270132, adr-2609021016288378 or adr-2609021016286571 contradicts either document. The two-hundred-thousand-token target is a clarification the documents do not speak to, kept as such.
- dcn-26092900000000122026-09-29 — Ruling J13 (the product thinker, 2026-09-29, verbatim: "iss-2608230752354928 source_kind: BOTH, two separate labels (tool + route).") is applied to the transcript store (lane sourceLabels, autonomous run A). `source_kind` carries the ROUTE, a closed set of `native` (abcd's own capture of the host's transcript) and `import` (another tool's export); a new `source_tool` carries the TOOL, an open lowercase slug with `host` reserved for the harness abcd is installed in. The tool vocabulary is open rather than closed, so a second harness needs no code change, and because it is caller-named it passes the redaction scan with the body and a label the scan would change refuses the capture. Neither label can stand in for the other: the route refuses a tool name, the tool refuses a route word and any `-import` composite, and an import never names `host`. A record stored before the split carries `source_kind` alone and reads under both labels, derived on read without rewriting it: `native` as native from `host`, `specstory-import` as import from `specstory`; the same derivation accepts the fused spelling on write. Nothing migrates on write, and only `history migrate`, rewriting a record for its own reasons, stamps the new form. The record schema version does not move: parsing is by field presence (adr-2609021016275803).
- dcn-26092900000000212026-09-29 — Ruling J13 (the product thinker, 2026-09-29, verbatim: "iss-2608230752354928 source_kind: BOTH, two separate labels (tool + route).") is applied to the transcript store (lane sourceLabels, autonomous run A). `source_kind` carries the ROUTE, a closed set of `native` (abcd's own capture of the host's transcript) and `import` (another tool's export); a new `source_tool` carries the TOOL, an open lowercase slug with `host` reserved for the harness abcd is installed in. The tool vocabulary is open rather than closed, so a second harness needs no code change, and because it is caller-named it passes the redaction scan with the body and a label the scan would change refuses the capture. Neither label can stand in for the other: the route refuses a tool name, the tool refuses a route word and any `-import` composite, and an import never names `host`. A record stored before the split carries `source_kind` alone and reads under both labels, derived on read without rewriting it: `native` as native from `host`, `specstory-import` as import from `specstory`; the same derivation accepts the fused spelling on write. Nothing migrates on write, and only `history migrate`, rewriting a record for its own reasons, stamps the new form. The record schema version does not move: parsing is by field presence (adr-2609021016275803).
- itd-199A reading is about something narrower than everything, and its scope is a committed, adjustable choice
- spc-2609020626045177The scribe verb: an allow-list assembler, an authoring-refusing ingest, and a per-run context stamp the transcript store can check