WAL — checkpoint 2026-08-29: R4.1 fallible discovery T6a landed; identity positions T6b next

Current phase

01The active epic is campaigns/packages-2026-09/TZ-LIFECYCLE-EXTENSIONS-v0.1.md; its granular authority for execution state is campaigns/packages-2026-09/LIFECYCLE-EXTENSIONS-IMPLEMENTATION-LEDGER.md. R3.4 is integrated, green and mirrored. R7.4 is now complete on exact tree 6f074e66: lifecycle_tasks and strict hosted/no-spend lifecycle_run share bounded/pinned state, selected-node/run ownership, the outermost lifecycle lease, one lower application/trace command, real package-source composition and generated report semantics with the CLI. Agent rows park without constructing a provider; ordinary algorithmic rows remain complete without an LLM. The final panel executed all 54 dynamic gates and ended self-check: all green after the named wire-ratchet decision and a deterministic Windows mandatory-lock repair found by the boundary run. R7.5 P0 is landed at 41abb4db, cd9999cc, 653a3c32 / e8e67280: exact evidence means declared input manifests plus independent artifact and run witnesses, never an arbitrary tree hash or a relabelled execution fingerprint. Requirements exposes four independent observations through a future vibe-requirements library and one CLI/MCP query, with specmap only an optional provider above lifecycle. No unmet synthesis, duplicate evidence command, coding agent or automatic loop exists. P1 is now landed at 6d843467, d3a9d59b / 55937044: canonical evidence fragments, additive strict lifecycle state/report, the metadata-only requirements root, relational validators and corpora are generated and green. P2 now extracts the read-only facts/query libraries, relation adapter and the lifecycle measurement/reconciliation runtime without changing that wire. Its first atom is landed at 1dac7531 / 65b0cba6: vibe-facts now owns the canonical root scanner and four-state adoption join, while CLI facts reuses it. Architecture correction 1898382d / 7a5b6837 separates hosted inclusive-chain resume from uninterrupted stale→recompute and pins the failure-carried evidence/member identity laws before A4/A5 code. A2/A3 are now landed through one-read witnesses 5fb4246d, shared query 6a300cf8, lock authority a1095d8e and relation adapter ea031767, with maps/trust refinements through 8a05d344. P2/A4a is landed at c3e51139 / 172c854d: one prepared declared-input walk preserves the legacy fingerprint while independently producing the exact scoped input manifest. P2/A4b is landed at 5b01d71c: the exact declaration sibling, stable two-read input observation and current-run state carriage are green. A4c0 is landed at d24de1ff: multi-gigabyte artifact content streams through one held no-follow handle without a byte cap. A4c1 is landed at 2cabc7a7: produced/host-accepted artifact baselines, transient current re-observations, exact file/tree witnesses and hosted-output B3 are green. P2/A5 is landed at 594734a3 / 63c35c85: the lifecycle library now produces one validated verification member, the complete phase epoch gates verify before its suffix, and CLI/MCP carry the same value through success and failure. P3 is landed at 1ff0ad64, e9301051, fdb1c465 / 46f9321b: thin requirements surfaces, installed-skill discovery and the fake external PDSA reference are complete with no engine policy/back-edge or provider call. Boundary repairs 5eeb4283, 8b871fb1, b7515063 closed the stale decoder/shape/sync ratchets. The final exact tree ran all 54 dynamic gates through self-check: all green; R7.5 is complete. R4.0 is landed at 6af1b86f / 8531cf82: the pure registry kernel owns one collector below lifecycle; compatibility is type-identical; dependency, syntax-complete ambient and public-root identity fences are green. Root accepted kernel 22, lifecycle 287/3 ignored, orchestrator 126 + doctests, strict clippy/check/conform and the acyclic metadata DAG. R4.1 is current: one lock-ordered workspace snapshot produces owner-scoped plans; each manifest activates its own lane, uninstall regeneration uses the in-memory post-removal future lock, per-unit lanes fingerprint their owner plan and node lanes always recompute transactionally. R4.1 has now landed package control carriage/projection at 52a59dcc and crash-safe per-unit publication at 91142777 with governing law ab68d145; map 3883f15e. T1 semantic config/compiler digest is landed at b65f9958; T3 typed dependency/host/path selector and subject-less enabled view are landed at 48d7dc75. Central review forced four-digit TOML dates, composable host+path subjects, one-collection plans and canonical OR-set equality. Exact T2 construction authority/refusals/byte frames are frozen at d5fcd92d; T2 implementation is landed at 49e944f0 over borrowed hash validation 87ef2df6. Root accepted exact frames/refusals after three mutation REDs; map b768bcb8 is 6831/2318/2091 with zero suspects, gated orphans or unresolved host edges. T4 carriage is landed at a252fcc8: legacy constructors pin empty, nonempty is schedule/byte/error-inert and opaque retargeting forwards the whole plan. T5 is landed at 0eb46c82: production catalog empty, one cfg-test identity catalog, exact bounded name/epoch/stage resolution and no schedule change. T6a is landed at 01f1522e: typed callback errors cross every discovery recursion and the three legacy callers eliminate Infallible exhaustively. Map ce3e62bf is 6831/2344/2117 at zero suspects/orphans/unresolved. T6b is current.

Landed evidence

• 02R1 diff materialisation, strict slot ownership, mutable hash gate, verify-heal and hook-on-nonempty-diff are complete.
• R2 nine-phase lifecycle, contribution collection/order, controls, envelope, handlers, freshness, presets/query and owner scenario §10.1 are complete.
• R3 explicit six-carrier compiler IR, named pass schedule, verifier and command-owned compile trace are complete. Current R4.1 checkpoint specmap: 6831 units, 2344 tagged items, 2117 edges, 0 suspects, 0 gated orphans, 0 unresolved host edges, 25 standing warnings.
• R7.1 provider, R7.2 CLI agent output contract, R7.3 hosted exact-run park/resume and R7.4 MCP lifecycle surfaces are complete under R7-MCP-LIFECYCLE-ARCHITECTURE-v0.1.md: one lower application service, selected-node/run ownership, bounded/pinned state, outermost lease, strict JTD tasks query and hosted/no-spend MCP run. Its first wave is landed through 17d94f8f; A4 is complete at 0225ce41 / 970520d4 with safefs prerequisite 31ca1e7d; the selected-node lower mapping is 7bd335e2 / b3ff308c; A5 outermost lease is complete at 7e330974 / 93177db6; A6 selected-node state ownership is complete at e1121d9b, b4d91749, 8debdf2e, c82012c3, exact-gated and independently reviewed. A7–A8 tasks query is complete at cf5ec17d, ee741f2e / d338e880, 30534ff9 / 7b9732f0, df678d7b / c62177fe: exact state bytes, final-name-safe tasks, four-attempt optimism and strict MCP projection are narrow-gated. The coherent A0–A8 full panel is green on a4253de7: 54 dynamic gates, both home tripwires, workspace/package/MCP tests+clippy, conform 0 new, codegen/specmap/wire and markup 508/0 all ended self-check: all green after boundary repairs 4ecd2cc5, 21567b6c, a4253de7. A9 execution ports, A10 lower projection and A11 neutral plan are landed; A12 is complete at 053b7e37 / ba874cdf. Its opaque provenance and sealed-plan gates, exact clean error chain, registry epoch, 74 unit + 50 doctest + compile-fail, 566 CLI unit and focused lifecycle family passed, and the final independent review returned PASS. A13 is complete at 3f01e2dc / afdd3adc: one lower trace owner and generic exact-error carrier, inherent RunPrelude trace-home join and a real measurement→registered-root double-hop RED. Central gates passed 101 orchestrator unit, 63 doctest + compile-fail, 546 CLI command units, the focused lifecycle/trace matrix, strict clippy, conform 0 new and specmap. A14 is complete at cd793ca9 / 2b08c818: one credential-free SelectedWorldPromptResolver, exact self/lock-selected embed resolution, eleven lower REDs, 213 unit + 14 doctest and 36 CLI integrations green. A15a/b/c are complete at 5df76260 / 23044cfd, 0ef2f8f5 / a4336ea2, 1027ca5e, 9c340df8 / a0276a0d; the named boundary repairs are 602ef5e8, 9fc6c2bb / 6f074e66. The final R7.4 panel on 6f074e66 ran workspace tests/clippy, host check, conform 0 new, codegen/specmap/wire, every package/MCP suite, both user-home tripwires and markup 508/0 through self-check: all green. Config, credentials, network transport and completion remain CLI-only; provider presence activates nothing by itself.
• R7.5 P0 and P1 are complete: PROP-054 owns the five evidence outcomes, exact scoped witness identity, read-only fact/query contract, independent authoring/adoption/relation/ verification axes, external-only PDSA and LLM enhancement modes. The foundational vocabulary now admits lifecycle/phase/plugin precisely without widening package kinds. Architecture R7-EXTERNAL-ORCHESTRATION-ARCHITECTURE-v0.1.md fixes the cycle-safe crate graph, shared JTD fragments, one requirements root/query, fake external stale→recompute scenario and mutation matrix. P1 lands canonical-decimal witness counts, exact measured-run attribution, portable artifact paths, additive strict state/report, one neutral requirements root, base/enrichment source matrices and prose/verdict fences without widening ExecutionRecordStatus. Root passed 245/245 vibe-wire tests, strict clippy, conform 27 known / 0 new, check-codegen/wire-diff, host check 0 errors, markup 508/0 and specmap 6814/2218/1987 with no suspects, gated orphans or unresolved host edges. P2/A1 is also complete: dependency-clean fact scanning/adoption joins are shared by the CLI, MD/XML split brains refuse, and all 16 unit + 8 doctest + 6 CLI oracles are green. P2/A2–A5 and P3 are complete through the evidence/query/runtime/surface facts below and the all-green boundary panel.
• R7.5 requirements library and relation enrichment are complete: one read-only query, one-read source/registry witnesses, three exact digest domains, explicit partial source states, one provider call and current/carried adapter. Carried maps are record/hash/capability proven and current namespace is exact; root gates passed query 37+3, trace 57+8 and workspace 449 with strict clippy/conform/workspace check and specmap 6814/2230/1999 at zero suspects/orphans/unresolved.
• R7.5 A4a/A4b input measurement is complete: one enumeration and one logical union row feed exact legacy replay plus a separate declared-scope witness; accepted evidence uses two equal capability reads and zero raw fallback, while an evidence refusal preserves old fingerprint bytes and stores no partial measurement. Declaration identity and current-run carriage are durable. Root passed 10 declaration + 11 observation + 7 carriage REDs, all 10 A4a inputs, lifecycle 255+15, strict clippy, workspace check and conform 0 new.
• R7.5 A4c0/A4c1 streaming substrate is complete: safefs produces a stable raw content digest using two passes over one held handle, final-name identity and bounded directory enumeration, without a byte cap or content-sized allocation; lifecycle adds exact file/tree outer witnesses, per-artifact baselines, invocation-local current observations and identity-only hosted probing. Safefs 97+10 and lifecycle 292+15, strict clippy/workspace/ conform are green. A4 is complete.
• R7.5 A5 verification reconciliation is complete at 594734a3 / 63c35c85, with runtime laws 38a5c8f1 and specmap 97919def: current declarations/inputs and every accumulated artifact produce one generated, validated member; an empty verify phase cannot bypass it; partial install epochs cannot fire it; stale/missing/unstable stop before the suffix while matched/unavailable continue. The exact member survives later handler/generic failure into CLI and MCP. Root gates passed lifecycle 305+15, focused orchestrator / CLI / MCP e2e and goldens, strict clippy, workspace check, conform 0 new and facts 508/0.
• The R7.5 gate found and repaired the conform Windows cache bug: colon-bearing content hashes created NTFS alternate streams until OS error 665. Portable cache filenames, exact RED, sync-engines 51/51 and a cold 1,404-file rebuild are green.
• R7.5 P3 is complete: CLI and MCP expose the same bounded read-only requirements root; the installed skill names the tool; the fake external PDSA cells prove both hosted remeasurement and stale→external-second-invocation with no paid call or engine back-edge. Commits 1ff0ad64, e9301051, fdb1c465 and 46f9321b; final specmap 6826/2281/2051 at zero suspects/orphans/ unresolved.
• R4.0 is complete: pure kernel 6af1b86f, generated map 8531cf82, public compatibility and dependency/ambient fences accepted. R4.1 owner-control carriage and package-own projection are complete at 52a59dcc; unit publication is transactional at 91142777 / ab68d145. T1 config/digest b65f9958, T3 selector/enabled view 48d7dc75, exact frame freeze d5fcd92d and T2 plan identity 49e944f0 / borrowed hash 87ef2df6 and T4 carriage a252fcc8, T5 registry 0eb46c82 and T6a fallible discovery 01f1522e are complete; map ce3e62bf. Remaining R4.1: T6b four identity positions, T6c lane witness, then typed document subject/selector/verifier, emitted ownership, owner adapter, active-only header and per-unit plan fingerprint.
• R8.1 project-only package-skill binding and R8.2a mechanism/artifact/deploy grammar are complete. Runtime mechanisms, build/package providers and deploy reconciliation remain.
• Final R3.4 panel on 3656a889: workspace tests and clippy green; host check 0 errors; conform 27 acknowledged / 0 new; codegen, wire-diff, package/MCP suites, self-traces, markup validation and both user-home tripwires green. The script executed 54 gates while its lexical denominator printed 47; the green ordered tail, not that denominator, is evidence.
• The final warm R3.4 worktree returned 66,787,222,941 bytes after all eleven branch commits proved patch-equivalent and nine unique reports/corrections were archived. Only main remains.

Architecture decisions in force

• 03Lifecycle is a passive extensible framework, not a coding agent. PDSA is a non-normative external-agent scenario; Plan/Act policy, automatic back-edges and task choice remain outside VibeVM. A reference agent is a future campaign.
• Verification evidence is valid only for the exact tree/artifact/run identity measured. R7.5 may expose optional read-only requirements facts keyed by full spec://…#fact addresses. Authoring status, consumer adoption, edge provenance/provider freshness, lifecycle status and typed gap/staleness observations stay distinct. A measured witness and its run id are one pair; requirements source identity is one package coordinate with one host/package kind, and every relation result binds that base source. An external long-running agent may use them to understand remaining requirements and choose its direction; VibeVM exposes facts, not that choice. Absence of that adapter changes no lifecycle.
• VibeVM remains fully useful without an LLM. Paid enhancement is explicit per feature (off|assist|required), binds a provider lazily and never replaces the algorithmic baseline.
• Scheduled extension contributions answer when; sibling qualified mechanisms answer how. Builtins are replaceable providers. R4.0 extracted one pure registry kernel and lifecycle consumes it now; R4.1 makes compiler/workspace share it, and later R8 selection extends the same plane. A second collector is forbidden.
• Install materialises the dependency world; package creates portable artifacts; deploy reconciles named destinations through plan/effect/intent/verify/receipt. Clean never silently undeploys. Static skills, Agent Plugins, Cargo applications, client projections, ~/.vibe/bin, custom installers and future system resources share this plane.

Current operational constraints

• 04Development uses exact affected tests. A touched gated Rust crate also runs scoped conform; new or moved source spec edges run specmap in the same atom. Full panel runs only at coherent batch/final boundaries.
• Every machine wire starts from JTD + registry + corpus + codegen. Never edit formats/EPOCHS.toml or generated Rust by hand.
• The subscription-backed external GLM launcher was retired by the owner on 2026-09-08 and MUST NOT be invoked. Native Codex collaboration workers are the current campaign default; root reviews in-context and retains all acceptance authority. Root owns architecture, review, commits and gates. Accepted worktrees are reclaimed immediately.
• Current self-check runtime prints [54/47] because STEP_TOTAL counts lexical call sites while seven calls execute dynamically. Do not use that total as coverage evidence; tooling follow-up is queued in PROP-055.

Next

05Implement T6b of R4-TRANSFORM-PLAN-ABI-v0.1.md: resolve the whole plan against one injected private registry before parsing, then wire stable plan-order identity wrappers at source-before-parse, document-after-parse, lane-after-assemble and emitted-after-emit. Preserve the explicit interim refusals. T6c then lands the immutable lane witness and transition validation. The world snapshot/owner adapter follows over the landed control carriage; all byte-changing work rides the landed per-unit transaction. Exact affected gates per atom; no full panel until coherent R4.

Known issues

• 06Final main judging debt: 2,501 unjudged facts in 154 files, 0 orphaned verdicts, 484 stale files. No re-judgement or sealing occurred in R3.4.
• EntryProof and proved-removal code currently cite PROP-054 REPLY-SHAPE, which does not semantically govern identity-bound filesystem ownership. The harvest queues one safe-output ownership anchor for R8, then repointing the six existing code edges. Do not multiply the wrong citation.
• Commit 7fac07c8 cites a nonexistent guide anchor; the real fact id is SWEEP-TESTS-OUT-SPLIT. Published history is not rewritten; the harvest is the durable correction and future commits resolve anchors before citing them.
• B-112 records that VIBEVM-SPEC §4.2 still diagrams the pre-relayout spec//root vibedeps//Markdown boot tree. R7.5 P0 corrected only its vocabulary; a separate present-truth sweep must derive or repoint the whole layout family rather than make one picture plausibly incomplete.
• The complete R7.5 checkpoint through b1fc94f3, plus tags, is mirrored ff-only to GitVerse and GitHub. Both targets reported synced; the next coherent batch repeats the same rollout after its green panel.