docs: record C5b19 write-history recovery slice

.planning/c5b19-settlement/implementation-handoff.md

@@ -0,0 +1,45 @@
+# G3a3 implementation handoff
+
+Status: PASSED for local implementation verification; BLOCKED pending fresh G3a3 independent review. Parent full Gate3 IN_PROGRESS — TRENDING_GOOD; Gate4+ and product admission BLOCKED.
+
+Source frozen in shared lead-owned /tmp/capsule-c5b19-recovery branch codex/c5b19-benign-teardown, base2274a6c7c751ded537541438f473e81ccd293457. No branch/commit/push/PR actions or subagents. Scope report /tmp/c5b19-g3a3-scope.md implemented in full. Only four owned files changed: PLAN.md, inputs/ORIGINS.json, tests/oracle.go and tests/model_test.go under experiments/typed-guest-transport-c5b19-benign-teardown. Existing oracle_test.go unchanged; its literal fixtures/helpers are reused.
+
+## Defensive scope and implementation
+
+Controlled inert in-memory repository fixtures only. No test subprocess, filesystem, network, clock, goroutine, child/guest, signal/wait, service or credential effects. Normal Go compilation/test process only. No added dependencies, go.sum or source manifest paths. No control or permission stubs.
+
+Constructor validates and copies immutable bindings. A fixed three-ID/three-kind history retains one privately copied397-byte pending request; applyReply accepts only reply bytes and validates against that retained request. The value snapshot distinguishes pending and last-settled presence, exact operation/outcome and confirmed68-byte projection. All refusal paths validate before mutation.
+
+All nine accepted invariants covered: immutable bindings/owned copies; single pending through explicit application; next generation and globally fresh IDs; prep first and confirmed before optional runner/terminal, kinds maxonce and terminal closes; exact settlement/replay refusal; uncertainty consumes settlement but never promotes candidate; terminal preserves confirmed runner prefix; terminal absence matches attempted runner even after failed publication, while direct prep→terminal stays valid; no hidden control state. Nil/uninitialized receivers refuse operations. No importer/reset/retry/timeout/record-loading APIs.
+
+applyReply models simulated accepted control application, NOT worker arrival or actual fsync confirmation. Positive byte history is not evidence of custody, timing, start/completion/capacity authority.
+
+## Tests and TDD
+
+Custom primitive BUILD-NARROWLY checklist was written in PLAN before behavior. Compiler-red /tmp/c5b19-g3a3-red.log shows undefined writeHistory/newWriteHistory before implementation. New tests cover24 runner/terminal/disposition combinations,2 failed/indeterminate preparations, valid varied bindings/process/operation IDs, ownership, zero/nil/invalid construction, sequencing/freshness/kind retries/overlap/fourth requests, exact settlement/byte mutations/candidate and cross-attempt substitutions/replays, and continuity after all outcomes. Rejection helpers compare entire private history; queued replies and repeated snapshots do not settle anything.
+
+## Exact offline commands/results
+
+Cwd /tmp/capsule-c5b19-recovery/experiments/typed-guest-transport-c5b19-benign-teardown.
+Use /Users/dsteele/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.13.darwin-arm64/bin/go with GOCACHE=/tmp/c5b19-g3a3-go-cache GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off.
+
+- go test ./... -count=1: PASSED,0.276s.
+- go test -race ./... -count=1: PASSED,1.312s.
+- go vet ./...: PASSED,no diagnostics.
+- go build ./...: PASSED,no diagnostics.
+- git diff --check: PASSED.
+- Six separately applied/restored mutants compiled and failed via intended assertions (exit1): pending overlap, next-generation equality, fresh-ID guard, uncertain projection promotion, attempted-runner terminal identity, exact pending settlement validation.
+- Exact source SHA256 restored; post-restoration go test ./... -count=1 PASSED,0.201s.
+
+Logs /tmp/c5b19-g3a3-{red,green,race,vet,build,restored}.log and /tmp/c5b19-g3a3-mutant-{overlap,generation,fresh-id,uncertainty,terminal-identity,settlement-binding}.log. PLAN retains command/results, red and mutant excerpts and every log SHA256 rather than relying only on ephemeral files. ORIGINS preserves historical g3a2 source hashes at reviewedc4d3c33 and adds separate current g3a3 hashes, canonical080e920 reference, log hashes and review-pending status.
+
+## Review and limits
+
+This is a distinct G3a3 review (max3), preserving all G3a/G3a2 prior review history. No old verdict is rewritten. New review should inspect full archive delta and current canonical plan. None of this closes full model/trace/native/store/build/run gates. Actual trace pairing, stop/start races, timing, creation/wait custody, storage faults and real publication evidence remain deferred. Root owns final review/commit/publication and immutable canonical links.
+
+## Frozen changed-file SHA256
+
+- `PLAN.md`: `9ca93e5349e71c7be3fa346e980e7e88897d162f159be51533d19ca86e71fdaa`
+- `inputs/ORIGINS.json`: `4649172116ce6275c7f4cf7b78e51c96b93de5bd22032d2f6fe68ec32f68c3fc`
+- `tests/oracle.go`: `fe36b0504a4a69623b1f64e791487e35ae78869c8e1524ff131d9790d3180dc2`
+- `tests/model_test.go`: `b0f3b9d063c225eb887cecaf16f4058f0ed07ae8f14c3d92c49acacabb0a931e`

.planning/c5b19-settlement/plan.md

@@ -0,0 +1,104 @@
+# C5b19 Gate-3 continuation after PR #386
+
+Status: PASSED for G3a3 implementation and review. Brain owns PR delivery.
+Base: 080e9203c6c96d1494ea3a52e8855816fec3fa38, merged PR #386 at
+2026-10-15T22:38:46Z after exact-head CI/CodeQL and normal pinned-head squash.
+Parent full Gate3: IN_PROGRESS — TRENDING_GOOD; Gate4–6/product admission BLOCKED.
+
+## Objective and scope
+
+Select and deliver the next bounded pre-run C5b19 component after the completed
+G3a2 wire/record substrate. Selected: pure one-attempt pending-write/settlement conformance,
+with the nine acceptance invariants in the [scope report](scope.md). Existing archive PR38 at
+2274a6c7c751ded537541438f473e81ccd293457 remains the implementation destination.
+Canonical branch codex/c5b19-settlement-conformance receives retained decisions,
+verification/review evidence and an exact archive pin in one new PR.
+
+Defensive environment: owned Shrimpworks/capsule-experiments checkout and inert
+in-memory fixtures only. No child fixture, guest, process target, signal/wait,
+network, user content, credential, service, live store or installed authority.
+Use only frozen manifest files and exact offline Go1.25.13, no dependencies.
+No new ABI, host profile, toolchain or authority interpretation. Child execution
+remains gated by separate implemented-byte review and explicit owner authorization.
+
+## Internal assignments
+
+- G3a3-SCOPE: read-only packet/model analysis; exact bounded behavior and tests.
+- G3a3-IMPLEMENT: worker owns only assigned archive oracle/test/metadata paths.
+- G3a3-DOCS: Brain owns canonical merge/status/evidence reconciliation.
+- G3a3-REVIEW: fresh-context independent reviewer, maximum3 instances for this
+  distinct increment. Preserve every prior slice's review count and limitations.
+
+No child creates branches, commits, pushes or PRs. All retained code shares the
+lead-owned archive branch. Brain collects handoffs, freezes candidates, responds
+to findings, runs integration checks and publishes both destinations. No full
+Gate3 completion or runtime evidence is inferred from this child slice.
+
+## Acceptance
+
+1. Scope grounded in the unchanged exact Gate2 packet and normative C5b18 source.
+2. Failing tests precede behavior; positive/negative and targeted restored mutants
+   exercise the selected stateful invariants without lifecycle/store effects.
+3. Exact offline archive test/race/vet/build and source/provenance checks pass.
+4. Canonical required gates pass; report known unfiltered #217 lint debt separately.
+5. Fresh review returns Ready within maximum3 instances; no historical reset.
+6. Push all retained commits, verify PR body/newlines/head/base/draft and hosted
+   checks, retain immutable archive pin and report deferred gates.
+
+## Progress
+
+- PASSED: #386 merged normally with head36bc83f and both workflow runs successful.
+- IN_PROGRESS — TRENDING_GOOD: read-only G3a3 scope assigned; implementation waits
+  for its exact acceptance boundary. Brain prepares the canonical continuation.
+
+## Frozen G3a3 acceptance boundary
+
+The scope handoff is PASSED and accepted. The checker consumes synthetic write
+requests and explicitly simulated control applications. It enforces one pending,
+exact next generation, fresh operation IDs, one operation of each allowed kind,
+confirmed-only projection changes and terminal candidate/identity continuity.
+It permits preparation→terminal without an intervening runner write. If runner
+publication was attempted, terminal absence must match that attempted identity.
+These are necessary byte-history relations; no actual custody, absence, clock,
+stop/start, durable publication or completion decision is supplied.
+
+Use private fixed arrays and value snapshots; no reset/retry/restore API, new
+dependency or source file. Rejected begin/application preserves all state.
+The constructor and uninitialized state must fail closed. Worker owns oracle.go,
+model_test.go and archive PLAN/ORIGINS; Brain owns canonical docs. No child edits
+are committed or published independently. Historical G3a2 hashes remain tied to
+their original reviewed commit; G3a3 records its own current hashes.
+
+- PASSED: scope handoff collected; exact unchanged packet/model reads support the
+  boundary. Graph coverage best-effort; archive is unindexed and read directly.
+- IN_PROGRESS — TRENDING_GOOD: G3a3 implementation dispatched with test-first and
+  four targeted restoration mutations; source freeze precedes fresh review.
+
+- PASSED: canonical frozen install, make ci and standalone pnpm test; 177 workspace
+  and132 script tests, full Go suite/vet/build, schema/ADR/site/audit and scoped lint.
+- BLOCKED: unfiltered lint exposes existing #217 revive debt (50-output cap, not total).
+- PASSED: post-merge main CI38818521284; latest scheduled run predates repairs.
+
+- PASSED: implementation handoff collected; four owned archive files frozen. Offline
+  Go1.25.13 test/race/vet/build and six targeted guard mutants/restoration checks pass
+  their expected outcomes. Historical hashes remain scoped to their old commit.
+- IN_PROGRESS — TRENDING_GOOD: fresh G3a3 review instance1/3 dispatched against the
+  explicit working diff and canonical reconciliation. No source edits during review.
+
+## Accepted result and integration destinations
+
+- PASSED: fresh independent review instance1/3 **Ready**, no actionable findings.
+  Full report and preliminary ledger retained; no correction loop required.
+- PASSED: source freeze hashes independently verified; acceptance metadata only
+  appended after review, with no Go or test changes.
+- PASSED: archive commit6575898a32ff4a3d24ca4c757f42b1807798a372 pushed to existing
+  draft PR38 on codex/c5b19-benign-teardown. It contains the reviewed G3a3 source
+  and acceptance records; all older slice provenance remains preserved.
+- Canonical branch codex/c5b19-settlement-conformance receives all roadmap/evidence
+  changes in one PR; final URL, exact head and hosted results are recorded in its body.
+- All internal handoffs collected; no retained child changes lack a PR destination.
+- Deferred: full control/event/timing oracle, native/store/build closure, custody/
+  absence and durable evidence, Gate4 implemented-byte/host review and explicit
+  first-run authorization, Gate5–6. Full Gate3 IN_PROGRESS — TRENDING_GOOD;
+  child execution and product admission BLOCKED.
+- Next: accept this increment, then scope the next frozen-manifest component.

.planning/c5b19-settlement/review-1-preliminary.md

@@ -0,0 +1,17 @@
+# C5b19 G3a3 preliminary independent review
+
+Review instance: 1 of 3. Status: IN_PROGRESS — TRENDING_GOOD.
+
+This record precedes reading the author handoff, archive PLAN/ORIGINS, author logs and canonical outcome claims. Bootstrap scope and scope.md acceptance recommendation were available. Read-only review; no source edits or lifecycle fixtures.
+
+Frozen archive HEAD 2274a6c7c751ded537541438f473e81ccd293457, branch codex/c5b19-benign-teardown, four changed paths match bootstrap. Source SHA256s match oracle.go fe36b0504a4a69623b1f64e791487e35ae78869c8e1524ff131d9790d3180dc2 and model_test.go b0f3b9d063c225eb887cecaf16f4058f0ed07ae8f14c3d92c49acacabb0a931e. Canonical HEAD 080e9203c6c96d1494ea3a52e8855816fec3fa38 has the three declared modified docs and untracked planning directory.
+
+No actionable implementation defect identified on the first pass. Exact source and tests were checked against Gate-2 fixed transport/durable/trace requirements and teardownpassive/types.go and model.go, particularly beginWrite, SettleWrite, BeginRunnerIdentityWrite and BeginTerminalWrite. New history enforces initialization, frozen bindings, a copied sole pending request, first/next generation, consumed IDs and kinds, confirmed preparation, terminal closure, preserved confirmed runner prefix and attempted runner identity. It mutates only after validation and exposes only value-owned snapshots. applyReply explicitly represents simulated control application. No lifecycle permission methods, imports or dependency extensions occur.
+
+Test review: positive outcome/disposition matrix covers skipped, confirmed, failed and indeterminate runner publication; separate tests cover failed preparation, pending versus worker-arrival, stale replies and every reply byte, generation/order/freshness, state-preserving rejections, terminal continuity, initialization and copying, varied valid bindings. Helpers build replies independently of new history. A dedicated pending runner → otherwise-valid terminal replacement test avoids accidental rejection by unrelated guards.
+
+Residual checks before final verdict: independently run unit/race/vet/build checks; reconcile red/green/mutant/restoration claims and metadata against actual logs; inspect recovery integration and status boundaries. Initial unit test command started, result pending when this record was written.
+
+Graph: codebase-memory skill applied. list_projects paginated 57 projects; no index for exact archive. Canonical capsule-corp generation 2026-10-04T22:18:10Z reports metadata_match/no_recorded_issue for packet/types/model and scope with no more pages; best-effort only. Focused exact source reads used for archive and canonical worktree. git diff confirms canonical packet/types/model unchanged between primary fc8af2df and target080e920. No graph completeness claim.
+
+Full Gate3 remains IN_PROGRESS — TRENDING_GOOD; Gate4+ BLOCKED; child execution gated.