# WAL — checkpoint 2026-08-29: R4.1 fallible discovery T6a landed; identity positions T6b next {#root} @status:impl/work ## Current phase {#current-phase} [p01] @fact:WAL-PHASE The active epic is `campaigns/packages-2026-09/TZ-LIFECYCLE-EXTENSIONS-v0.1.md`; its granular authority for execution state is `campaigns/packages-2026-09/LIFECYCLE-EXTENSIONS-IMPLEMENTATION-LEDGER.md`. R3.4 is integrated, green and mirrored. R7.4 is now complete on exact tree `6f074e66`: `lifecycle_tasks` and strict hosted/no-spend `lifecycle_run` share bounded/pinned state, selected-node/run ownership, the outermost lifecycle lease, one lower application/trace command, real package-source composition and generated report semantics with the CLI. Agent rows park without constructing a provider; ordinary algorithmic rows remain complete without an LLM. The final panel executed all 54 dynamic gates and ended `self-check: all green` after the named wire-ratchet decision and a deterministic Windows mandatory-lock repair found by the boundary run. R7.5 P0 is landed at `41abb4db`, `cd9999cc`, `653a3c32` / `e8e67280`: exact evidence means declared input manifests plus independent artifact and run witnesses, never an arbitrary tree hash or a relabelled execution fingerprint. Requirements exposes four independent observations through a future `vibe-requirements` library and one CLI/MCP query, with specmap only an optional provider above lifecycle. No `unmet` synthesis, duplicate evidence command, coding agent or automatic loop exists. P1 is now landed at `6d843467`, `d3a9d59b` / `55937044`: canonical evidence fragments, additive strict lifecycle state/report, the metadata-only requirements root, relational validators and corpora are generated and green. P2 now extracts the read-only facts/query libraries, relation adapter and the lifecycle measurement/reconciliation runtime without changing that wire. Its first atom is landed at `1dac7531` / `65b0cba6`: `vibe-facts` now owns the canonical root scanner and four-state adoption join, while CLI facts reuses it. Architecture correction `1898382d` / `7a5b6837` separates hosted inclusive-chain resume from uninterrupted stale→recompute and pins the failure-carried evidence/member identity laws before A4/A5 code. A2/A3 are now landed through one-read witnesses `5fb4246d`, shared query `6a300cf8`, lock authority `a1095d8e` and relation adapter `ea031767`, with maps/trust refinements through `8a05d344`. P2/A4a is landed at `c3e51139` / `172c854d`: one prepared declared-input walk preserves the legacy fingerprint while independently producing the exact scoped input manifest. P2/A4b is landed at `5b01d71c`: the exact declaration sibling, stable two-read input observation and current-run state carriage are green. A4c0 is landed at `d24de1ff`: multi-gigabyte artifact content streams through one held no-follow handle without a byte cap. A4c1 is landed at `2cabc7a7`: produced/host-accepted artifact baselines, transient current re-observations, exact file/tree witnesses and hosted-output B3 are green. P2/A5 is landed at `594734a3` / `63c35c85`: the lifecycle library now produces one validated verification member, the complete phase epoch gates verify before its suffix, and CLI/MCP carry the same value through success and failure. P3 is landed at `1ff0ad64`, `e9301051`, `fdb1c465` / `46f9321b`: thin requirements surfaces, installed-skill discovery and the fake external PDSA reference are complete with no engine policy/back-edge or provider call. Boundary repairs `5eeb4283`, `8b871fb1`, `b7515063` closed the stale decoder/shape/sync ratchets. The final exact tree ran all 54 dynamic gates through `self-check: all green`; R7.5 is complete. R4.0 is landed at `6af1b86f` / `8531cf82`: the pure registry kernel owns one collector below lifecycle; compatibility is type-identical; dependency, syntax-complete ambient and public-root identity fences are green. Root accepted kernel 22, lifecycle 287/3 ignored, orchestrator 126 + doctests, strict clippy/check/conform and the acyclic metadata DAG. R4.1 is current: one lock-ordered workspace snapshot produces owner-scoped plans; each manifest activates its own lane, uninstall regeneration uses the in-memory post-removal future lock, per-unit lanes fingerprint their owner plan and node lanes always recompute transactionally. R4.1 has now landed package control carriage/projection at `52a59dcc` and crash-safe per-unit publication at `91142777` with governing law `ab68d145`; map `3883f15e`. T1 semantic config/compiler digest is landed at `b65f9958`; T3 typed dependency/host/path selector and subject-less enabled view are landed at `48d7dc75`. Central review forced four-digit TOML dates, composable host+path subjects, one-collection plans and canonical OR-set equality. Exact T2 construction authority/refusals/byte frames are frozen at `d5fcd92d`; T2 implementation is landed at `49e944f0` over borrowed hash validation `87ef2df6`. Root accepted exact frames/refusals after three mutation REDs; map `b768bcb8` is 6831/2318/2091 with zero suspects, gated orphans or unresolved host edges. T4 carriage is landed at `a252fcc8`: legacy constructors pin empty, nonempty is schedule/byte/error-inert and opaque retargeting forwards the whole plan. T5 is landed at `0eb46c82`: production catalog empty, one cfg-test identity catalog, exact bounded name/epoch/stage resolution and no schedule change. T6a is landed at `01f1522e`: typed callback errors cross every discovery recursion and the three legacy callers eliminate `Infallible` exhaustively. Map `ce3e62bf` is 6831/2344/2117 at zero suspects/orphans/unresolved. T6b is current. @status:impl/work ## Landed evidence {#landed} - [p02] @fact:WAL-R1 R1 diff materialisation, strict slot ownership, mutable hash gate, verify-heal and hook-on-nonempty-diff are complete. @status:impl/done - @fact:WAL-R2 R2 nine-phase lifecycle, contribution collection/order, controls, envelope, handlers, freshness, presets/query and owner scenario §10.1 are complete. @status:impl/done - @fact:WAL-R3 R3 explicit six-carrier compiler IR, named pass schedule, verifier and command-owned compile trace are complete. Current R4.1 checkpoint specmap: 6831 units, 2344 tagged items, 2117 edges, 0 suspects, 0 gated orphans, 0 unresolved host edges, 25 standing warnings. @status:impl/done - @fact:WAL-R7 R7.1 provider, R7.2 CLI agent output contract, R7.3 hosted exact-run park/resume and R7.4 MCP lifecycle surfaces are complete under `R7-MCP-LIFECYCLE-ARCHITECTURE-v0.1.md`: one lower application service, selected-node/run ownership, bounded/pinned state, outermost lease, strict JTD tasks query and hosted/no-spend MCP run. Its first wave is landed through `17d94f8f`; A4 is complete at `0225ce41` / `970520d4` with safefs prerequisite `31ca1e7d`; the selected-node lower mapping is `7bd335e2` / `b3ff308c`; A5 outermost lease is complete at `7e330974` / `93177db6`; A6 selected-node state ownership is complete at `e1121d9b`, `b4d91749`, `8debdf2e`, `c82012c3`, exact-gated and independently reviewed. A7–A8 tasks query is complete at `cf5ec17d`, `ee741f2e` / `d338e880`, `30534ff9` / `7b9732f0`, `df678d7b` / `c62177fe`: exact state bytes, final-name-safe tasks, four-attempt optimism and strict MCP projection are narrow-gated. The coherent A0–A8 full panel is green on `a4253de7`: 54 dynamic gates, both home tripwires, workspace/package/MCP tests+clippy, conform 0 new, codegen/specmap/wire and markup 508/0 all ended `self-check: all green` after boundary repairs `4ecd2cc5`, `21567b6c`, `a4253de7`. A9 execution ports, A10 lower projection and A11 neutral plan are landed; A12 is complete at `053b7e37` / `ba874cdf`. Its opaque provenance and sealed-plan gates, exact clean error chain, registry epoch, 74 unit + 50 doctest + compile-fail, 566 CLI unit and focused lifecycle family passed, and the final independent review returned PASS. A13 is complete at `3f01e2dc` / `afdd3adc`: one lower trace owner and generic exact-error carrier, inherent `RunPrelude` trace-home join and a real measurement→registered-root double-hop RED. Central gates passed 101 orchestrator unit, 63 doctest + compile-fail, 546 CLI command units, the focused lifecycle/trace matrix, strict clippy, conform 0 new and specmap. A14 is complete at `cd793ca9` / `2b08c818`: one credential-free `SelectedWorldPromptResolver`, exact self/lock-selected embed resolution, eleven lower REDs, 213 unit + 14 doctest and 36 CLI integrations green. A15a/b/c are complete at `5df76260` / `23044cfd`, `0ef2f8f5` / `a4336ea2`, `1027ca5e`, `9c340df8` / `a0276a0d`; the named boundary repairs are `602ef5e8`, `9fc6c2bb` / `6f074e66`. The final R7.4 panel on `6f074e66` ran workspace tests/clippy, host check, conform 0 new, codegen/specmap/wire, every package/MCP suite, both user-home tripwires and markup 508/0 through `self-check: all green`. Config, credentials, network transport and completion remain CLI-only; provider presence activates nothing by itself. @status:impl/done - @fact:WAL-R75 R7.5 P0 and P1 are complete: PROP-054 owns the five evidence outcomes, exact scoped witness identity, read-only fact/query contract, independent authoring/adoption/relation/ verification axes, external-only PDSA and LLM enhancement modes. The foundational vocabulary now admits lifecycle/phase/plugin precisely without widening package kinds. Architecture `R7-EXTERNAL-ORCHESTRATION-ARCHITECTURE-v0.1.md` fixes the cycle-safe crate graph, shared JTD fragments, one requirements root/query, fake external stale→recompute scenario and mutation matrix. P1 lands canonical-decimal witness counts, exact measured-run attribution, portable artifact paths, additive strict state/report, one neutral requirements root, base/enrichment source matrices and prose/verdict fences without widening `ExecutionRecordStatus`. Root passed 245/245 vibe-wire tests, strict clippy, conform 27 known / 0 new, check-codegen/wire-diff, host check 0 errors, markup 508/0 and specmap 6814/2218/1987 with no suspects, gated orphans or unresolved host edges. P2/A1 is also complete: dependency-clean fact scanning/adoption joins are shared by the CLI, MD/XML split brains refuse, and all 16 unit + 8 doctest + 6 CLI oracles are green. P2/A2–A5 and P3 are complete through the evidence/query/runtime/surface facts below and the all-green boundary panel. @status:impl/done - @fact:WAL-R75-QUERY R7.5 requirements library and relation enrichment are complete: one read-only query, one-read source/registry witnesses, three exact digest domains, explicit partial source states, one provider call and current/carried adapter. Carried maps are record/hash/capability proven and current namespace is exact; root gates passed query 37+3, trace 57+8 and workspace 449 with strict clippy/conform/workspace check and specmap 6814/2230/1999 at zero suspects/orphans/unresolved. @status:impl/done - @fact:WAL-R75-INPUTS R7.5 A4a/A4b input measurement is complete: one enumeration and one logical union row feed exact legacy replay plus a separate declared-scope witness; accepted evidence uses two equal capability reads and zero raw fallback, while an evidence refusal preserves old fingerprint bytes and stores no partial measurement. Declaration identity and current-run carriage are durable. Root passed 10 declaration + 11 observation + 7 carriage REDs, all 10 A4a inputs, lifecycle 255+15, strict clippy, workspace check and conform 0 new. @status:impl/done - @fact:WAL-R75-ARTIFACT-STREAM R7.5 A4c0/A4c1 streaming substrate is complete: safefs produces a stable raw content digest using two passes over one held handle, final-name identity and bounded directory enumeration, without a byte cap or content-sized allocation; lifecycle adds exact file/tree outer witnesses, per-artifact baselines, invocation-local current observations and identity-only hosted probing. Safefs 97+10 and lifecycle 292+15, strict clippy/workspace/ conform are green. A4 is complete. @status:impl/done - @fact:WAL-R75-VERIFY R7.5 A5 verification reconciliation is complete at `594734a3` / `63c35c85`, with runtime laws `38a5c8f1` and specmap `97919def`: current declarations/inputs and every accumulated artifact produce one generated, validated member; an empty verify phase cannot bypass it; partial install epochs cannot fire it; stale/missing/unstable stop before the suffix while matched/unavailable continue. The exact member survives later handler/generic failure into CLI and MCP. Root gates passed lifecycle 305+15, focused orchestrator / CLI / MCP e2e and goldens, strict clippy, workspace check, conform 0 new and facts 508/0. @status:impl/done - @fact:WAL-R75-CONFORM-CACHE The R7.5 gate found and repaired the conform Windows cache bug: colon-bearing content hashes created NTFS alternate streams until OS error 665. Portable cache filenames, exact RED, sync-engines 51/51 and a cold 1,404-file rebuild are green. @status:impl/done - @fact:WAL-R75-SURFACES R7.5 P3 is complete: CLI and MCP expose the same bounded read-only requirements root; the installed skill names the tool; the fake external PDSA cells prove both hosted remeasurement and stale→external-second-invocation with no paid call or engine back-edge. Commits `1ff0ad64`, `e9301051`, `fdb1c465` and `46f9321b`; final specmap 6826/2281/2051 at zero suspects/orphans/ unresolved. @status:impl/done - @fact:WAL-R4 R4.0 is complete: pure kernel `6af1b86f`, generated map `8531cf82`, public compatibility and dependency/ambient fences accepted. R4.1 owner-control carriage and package-own projection are complete at `52a59dcc`; unit publication is transactional at `91142777` / `ab68d145`. T1 config/digest `b65f9958`, T3 selector/enabled view `48d7dc75`, exact frame freeze `d5fcd92d` and T2 plan identity `49e944f0` / borrowed hash `87ef2df6` and T4 carriage `a252fcc8`, T5 registry `0eb46c82` and T6a fallible discovery `01f1522e` are complete; map `ce3e62bf`. Remaining R4.1: T6b four identity positions, T6c lane witness, then typed document subject/selector/verifier, emitted ownership, owner adapter, active-only header and per-unit plan fingerprint. @status:impl/work - @fact:WAL-R8 R8.1 project-only package-skill binding and R8.2a mechanism/artifact/deploy grammar are complete. Runtime mechanisms, build/package providers and deploy reconciliation remain. @status:impl/work - @fact:WAL-R34-GATE Final R3.4 panel on `3656a889`: workspace tests and clippy green; host check 0 errors; conform 27 acknowledged / 0 new; codegen, wire-diff, package/MCP suites, self-traces, markup validation and both user-home tripwires green. The script executed 54 gates while its lexical denominator printed 47; the green ordered tail, not that denominator, is evidence. @status:impl/done - @fact:WAL-R34-GC The final warm R3.4 worktree returned 66,787,222,941 bytes after all eleven branch commits proved patch-equivalent and nine unique reports/corrections were archived. Only `main` remains. @status:impl/done ## Architecture decisions in force {#architecture} - [p03] @fact:WAL-C-FRAMEWORK Lifecycle is a passive extensible framework, not a coding agent. PDSA is a non-normative external-agent scenario; Plan/Act policy, automatic back-edges and task choice remain outside VibeVM. A reference agent is a future campaign. @status:spec/done - @fact:WAL-C-EVIDENCE Verification evidence is valid only for the exact tree/artifact/run identity measured. R7.5 may expose optional read-only requirements facts keyed by full `spec://…#fact` addresses. Authoring status, consumer adoption, edge provenance/provider freshness, lifecycle status and typed gap/staleness observations stay distinct. A measured witness and its run id are one pair; requirements source identity is one package coordinate with one host/package kind, and every relation result binds that base source. An external long-running agent may use them to understand remaining requirements and choose its direction; VibeVM exposes facts, not that choice. Absence of that adapter changes no lifecycle. @status:spec/done - @fact:WAL-C-ALGORITHMIC VibeVM remains fully useful without an LLM. Paid enhancement is explicit per feature (`off|assist|required`), binds a provider lazily and never replaces the algorithmic baseline. @status:spec/done - @fact:WAL-C-MECHANISMS Scheduled extension contributions answer when; sibling qualified mechanisms answer how. Builtins are replaceable providers. R4.0 extracted one pure registry kernel and lifecycle consumes it now; R4.1 makes compiler/workspace share it, and later R8 selection extends the same plane. A second collector is forbidden. @status:spec/done - @fact:WAL-C-DEPLOY Install materialises the dependency world; package creates portable artifacts; deploy reconciles named destinations through plan/effect/intent/verify/receipt. Clean never silently undeploys. Static skills, Agent Plugins, Cargo applications, client projections, `~/.vibe/bin`, custom installers and future system resources share this plane. @status:spec/done ## Current operational constraints {#constraints} - [p04] @fact:WAL-C-GATES Development uses exact affected tests. A touched gated Rust crate also runs scoped conform; new or moved source spec edges run specmap in the same atom. Full panel runs only at coherent batch/final boundaries. @status:impl/done - @fact:WAL-C-WIRE Every machine wire starts from JTD + registry + corpus + codegen. Never edit `formats/EPOCHS.toml` or generated Rust by hand. @status:impl/done - @fact:WAL-C-WORKERS The subscription-backed external GLM launcher was retired by the owner on 2026-09-08 and MUST NOT be invoked. Native Codex collaboration workers are the current campaign default; root reviews in-context and retains all acceptance authority. Root owns architecture, review, commits and gates. Accepted worktrees are reclaimed immediately. @status:impl/done - @fact:WAL-C-PANEL-DENOMINATOR Current self-check runtime prints `[54/47]` because `STEP_TOTAL` counts lexical call sites while seven calls execute dynamically. Do not use that total as coverage evidence; tooling follow-up is queued in PROP-055. @status:impl/work ## Next {#next} [p05] @fact:WAL-NEXT Implement T6b of `R4-TRANSFORM-PLAN-ABI-v0.1.md`: resolve the whole plan against one injected private registry before parsing, then wire stable plan-order identity wrappers at source-before-parse, document-after-parse, lane-after-assemble and emitted-after-emit. Preserve the explicit interim refusals. T6c then lands the immutable lane witness and transition validation. The world snapshot/owner adapter follows over the landed control carriage; all byte-changing work rides the landed per-unit transaction. Exact affected gates per atom; no full panel until coherent R4. @status:impl/work ## Known issues {#known-issues} - [p06] @fact:WAL-I-DEBT Final main judging debt: 2,501 unjudged facts in 154 files, 0 orphaned verdicts, 484 stale files. No re-judgement or sealing occurred in R3.4. @status:impl/work - @fact:WAL-I-SAFEFS-ANCHOR `EntryProof` and proved-removal code currently cite PROP-054 `REPLY-SHAPE`, which does not semantically govern identity-bound filesystem ownership. The harvest queues one safe-output ownership anchor for R8, then repointing the six existing code edges. Do not multiply the wrong citation. @status:spec/plan - @fact:WAL-I-CITATION Commit `7fac07c8` cites a nonexistent guide anchor; the real fact id is `SWEEP-TESTS-OUT-SPLIT`. Published history is not rewritten; the harvest is the durable correction and future commits resolve anchors before citing them. @status:impl/work - @fact:WAL-I-FOUNDATIONAL-LAYOUT B-112 records that VIBEVM-SPEC §4.2 still diagrams the pre-relayout `spec/`/root `vibedeps/`/Markdown boot tree. R7.5 P0 corrected only its vocabulary; a separate present-truth sweep must derive or repoint the whole layout family rather than make one picture plausibly incomplete. @status:impl/work - @fact:WAL-I-PUBLICATION The complete R7.5 checkpoint through `b1fc94f3`, plus tags, is mirrored ff-only to GitVerse and GitHub. Both targets reported synced; the next coherent batch repeats the same rollout after its green panel. @status:impl/done