Orchestrata Ultimate › Plans › spec-110-completion-plan

SPEC-110 completion plan — build what the spec still owes

Source: plans/spec-110-completion-plan.md at 8a2cb42ad · last changed 2026-10-07 · first committed 2026-10-06 · 880 lines.

Prose pending.

Plan text

SPEC-110 completion plan — build what the spec still owes

Directive: Mohamed, 2026-10-06: "build spec 110". Worktree: wt-SPEC-110 (feat/spec-110-completion, base origin/master 83c604886). Authority: specs/110-codemod-engine/spec.md (51 REQ ids) + the ctok-parser contract (plans/contracts/ctok-parser.*, REQ-110-120..127). RUL-013: tests cite only ids the spec defines.

0. Measured state (2026-10-06, in this worktree)

Source of truth for "done": specs/110-codemod-engine/checklists/requirements.md (last reconciled 2026-08-13) cross-checked against the tree today.

Spec-cited ids with no citation anywhere in code/tests: 006, 011 (behaviour exists, @traces cites neighbours — a traceability gap, not a feature gap), 031..035, 101..106, 108 (non-functional; cited by gates, not decorators). Code cites ids the spec does not define: REQ-110-050, REQ-110-085 (RUL-013 violation candidates — audit in S5).

Definition-of-Done items (spec §17) already on disk: contracts plans/contracts/spec-110-codemod-engine.{mmd,contract.json}, src/orchestrata_ultimate/prolog/codemod_review.pl, briefs plans/codemod-engine-briefs/, the C extension, 16 feature files. The contract diagram has NO class for the analysis passes or the review engine — RUL-022 requires that before S2/S3 build.

1. Decisions

• D1 — RULED (ADR-0068, Accepted; Mohamed 2026-10-06: "go with recommendatio . build s3'"). REQ-110-034 amended in specs/110-codemod-engine/spec.md: checks run on the ctok token array + the forest's CPython ast overlay, no re-parse/subprocess/external linter, structural checks as ast.NodeVisitor, lexical checks as token scanners, reuse of verification/review/check_*. S3 unblocked; it builds against the S2/S3 contract extension once committed.
• D2 (operational, recorded here). Analysis passes (REQ-110-031) are thin read-only adapters over the existing CodeIntelligenceGraph queries that return the existing _types.py dataclasses (BlastRadius, BreakingChange, CouplingScore, AbstractionLevel); no second graph.
• D3 (operational). REQ-110-025/027 are built exactly per plans/codemod-observability-wiring-design.md (reuse core.patterns.observer.SyncObservable; delete the redundant Observer redeclaration in observability/events.py, re-export the core one).
• D4 (sequencing). S4 (REQ-110-140) touches scripts/codemod.py, which ADR-0067 P4 is also changing (--auto-start → CodemodDaemon.start). S4 builds AFTER P4 lands on master and this branch has merged master.
• D5 (operational, from the S2/S3 contract extension 9f7ee385d). REQ-110-035 assigns Safety no phase; every Safety check is file-local and needs no graph, so Safety runs in phase 1 (phase 1 = 30 ids, phase 2 = 10; phase 3 is PrologSemanticReview, outside the 40).
• D6 (operational — spec-settled, RUL-013). InMemoryReviewEngine takes baseline='absolute'|'delta' and defaults to 'absolute': ERR-110-002 says an error finding aborts the commit, and the spec names no legacy carve-out. 'delta' (findings the pass introduced) is an opt-in. Flipping the default is a spec amendment and needs its own ADR; none is minted until a packet measures a legacy-file abort in practice. Superseded by ADR-0073 (Accepted 2026-10-07): the default is 'delta'; 'absolute' is the opt-in.
• D7 (operational). CodemodWorkspace.commit() gains review_engine= and run_review_engine=True; with reviews=None it builds and runs the default engine before write-back (REQ-110-033/035 say review runs on commit). S3 measures which existing commit tests gain findings and fixes code, not tests (RUL-002). BannedConstructs stays for callers who pass it; its overlap with three Safety checks yields duplicate findings by design. S3 measurement (2026-10-06, whole tests/refactor/codemod/ plus tests/scripts/test_codemod_cli.py, run before the fix): no existing commit test gained a real finding, so no fixture code changed. Two tests failed on the event sequence, not a finding: test_observability_wiring.py::TestCommitEvents::test_real_commit_writes_files_and_completes (asserts exactly COMMIT_STARTED, COMMIT_COMPLETED) and ::test_failed_write_emits_rollback_error_and_aborted (asserts kinds[0] is COMMIT_STARTED and indexes events[1]/events[2]). The default engine adds REVIEW_STARTED/REVIEW_COMPLETED in front, which is the specified behaviour (REQ-110-033/035); both tests now pass run_review_engine=False, an assertion-for-assertion unchanged write-path test, and the review-event sequence of a default commit is asserted in test_review_engine_commit_wiring.py (TST-110-026).
• D8 (operational). scripts/codemod.py analyze keeps the existing --query choices and appends breaking_changes, complexity, test_coverage, dead_code, all-passes plus --json; breaking_changes takes --module with --base <git ref> (the minimal input shape in contract decision D24).
• D9 (operational). The S2/S3 contract's six analysis_gaps (no graph reachability query, CALLS first-match resolution, same-file TESTED_BY, _CSRIndex over all edge types, breaking_changes without signature diff, no complexity query) are S2 scope where the analyzer can compute the answer from the forest's ast overlay, and recorded as owed graph work (backlog) where the fix is a CodeIntelligenceGraph method the contract does not add.

2. Packets

S5 findings (S1 reviewer round 1, 2026-10-06). REQ-110-006 was marked [x] in the checklist with no implementation: refs _update_index and symbols --pattern update_index return nothing, and after AddImportPass rewrote a file the workspace dependency index did not change (reviewer probe probe_index.py). The row is now [ ] NOT IMPLEMENTED and the checklist totals read 43 COMPLETE / 1 superseded / 7 NOT IMPLEMENTED. Owed: an incremental _update_index(paths) on CodemodWorkspace that run() calls for the mutated paths (with @traces for REQ-110-006), then flip the row back. REQ-110-127 is cited by passes.py and is NOT in spec.md, but IS defined in the checklist's FR-CTOK section (the ctok-parser contract, ids 120..127; the text matches RenameSymbolPass's edit-safety guard), so those citations stand; whether spec.md absorbs 120..127 is an ADR matter for the S5 audit.

S4 measured state (orchestrator, 2026-10-07, at f21ab3af8; P4 has landed so D4's sequencing condition is met). REQ-110-140 is partly built and partly contradicted: (S4-a) scripts/codemod.py main() (:791-813) runs _auto_start_daemon when --auto-start is given and --no-daemon is not (P4, ADR-0067: the deployed unit orchestrata-codemod-daemon@<escaped repo> is started through CodemodDaemon.start), but every command then loads the workspace locally anyway: _cmd_run (:344-414), _cmd_analyze (:696-788) and _cmd_load_bench all call CodemodWorkspace.load(root, …); nothing in the CLI imports CodemodClient, no socket is ever opened, and the library-mode warning REQ-110-140 requires does not exist. (S4-b) the daemon's commit RPC (server.py:_dispatch, branch method == "commit") ignores its changes parameter and commits ChangeSet(entries=()) — a daemon-side run --apply writes nothing (carried item C-c). (S4-c) CodemodWorkspace.run (workspace.py:560-614) replaces self._forest[path] with each mutated tree; commit(dry_run=True) restores nothing, so a pass run through the daemon leaves the daemon's live forest mutated for every later client until a disk change triggers a reload. (S4-d) the query RPCs return CIG node ids (query_dependencies, query_dependents, query_cycles, query_topological_order, query_centrality pairs), while the CLI prints cig.nodes[id].qualified_name; identical CLI output in daemon mode needs a name-resolution method the RPC surface does not have. REQ-110-138 lists the methods the daemon SHALL expose and the Python types; it does not describe the wire representation of a ChangeSet (parsed trees cannot cross a JSON socket). The S4 design (by-reference pending runs on the server, forest restore after a dry run, a node-resolution method, the CLI connection decision and warning text) is a RUL-022 contract entry (D29), not a spec amendment: no spec sentence is contradicted by it, and the methods REQ-110-138 names keep their names and Python-side types. S4 also owns C6 (_sweep_docstrings_and_comments rewrites every simple str/bytes ast.Constant; REQ-110-010 says "docstrings AND comments" — the docstring test is ast.get_docstring's: the first statement of a Module/ClassDef/FunctionDef/AsyncFunctionDef body being an Expr(Constant[str])) and C5 (_parse_string_token drops the r/b/u prefix on rewrite, so a raw docstring loses its prefix and its backslashes change meaning; and the implicit-concatenation span defect at passes.py:779, unreachable for docstrings once C6 restricts the sweep, is closed by a test that proves it).

S4 build (2026-10-07; contract D29 daec60c25; brief 293afd07b; builder commits 3880b35e9, a14be9051, 17178620f, 92f3e1881, 3a29ee3d0). Groups G1 91 / G2 105 / G3 77 / G4 162 passed, 0 failed, 0 skipped; coverage scripts/codemod.py 98%, server.py 99%, client.py 100%, passes.py 99%; ruff, black, pyright, check_spec_authority, gate.py run, check-deps clean. Both-modes equality proven for 13 analyze cases (rc, stdout, stderr identical), run dry and --apply (stdout minus Duration:/Commit report:, report payload minus durations/correlation id, files byte-identical), two stacked passes; forest unchanged after a daemon dry run, restored on disconnect, foreign run_id refused -32602. Sweep over src/orchestrata_ultimate/tools with {"timeout": "deadline"}: 7 files, 18 lines, 17 docstring + 1 comment, 0 code, ast.dump equal after emptying docstrings. Builder's judgment calls, recorded as D29 refinements: (1) the warning prints systemctl --user start <instance> where <instance> is CodemodDaemon._unit_instance(repo) (already the full unit@escaped.service); (2) the server resolves --module through resolve_node_id (the CLI's strategies: module:<path>, raw key, dotted) so both modes agree; (3) the forest is restored on dry run, on a refused review (success=False) and when ws.commit raises, not only on dry run; (4) one pending run per connection, reload refused -32602 while a run is pending (the write lock is non-reentrant); (5) run_pass also returns pass_name; CodemodRpcError(.code) replaces the bare RuntimeError in the client. S4 backlog: breaking_changes, complexity, test_coverage, dead_code, all-passes stay library mode with the notice codemod: '<query>' has no daemon method; parsed locally (breaking_changes needs a git-ref diff of the working tree, _changes_since, which no RPC serves). C7 — fixed in the S4 fix round (not carried): ReplaceStringLiteralPass drops the string prefix (b"", r"", u"", rb"") when it rewrites a literal, so a bytes literal becomes str and a raw literal's backslashes change meaning (the sweep had the same defect, C5a, fixed in 17178620f; both share _parse_string_token, now (prefix, quote, content), and the replace pass's call site still writes quote + new + quote). Rule: write prefix + quote + new + quote; a b/B prefix whose new value is not pure ASCII is left unchanged (a bytes literal cannot carry it) and the pass reports nothing for that literal; tests for b"x", r"x", u"x", rb"x" and the non-ASCII bytes case prove the bytes of the prefix survive. Hygiene: the header of tests/scripts/test_codemod_cli.py still lists "cycles can never materialize" and a _resolve_pass fallthrough as residuals; both are stale (the daemon fixture prints an alpha <-> beta cycle in both modes) — S5.

S4 review and fix rounds (2026-10-07; brief §§5–8). Reviewer round 1 NO-GO on 293afd07b..3a29ee3d0: one blocker (--include ignored in daemon mode — a daemon serving src, scripts, tests wrote 3 files where --include src wrote 1), one major (the inotify reload swapped the workspace outside the write lock), seven others (lease, commit error cause, --auto-start socket wait, C7, quote-char guard, docs). Fix round 1 (162145987, 2cfa5c2c5, 779766945, 6d2fea688): daemon mode only when the daemon's loaded roots equal the folded --include, else one notice and library mode for that run; replace_workspace under the write lock; pending-run lease 120 s with a bounded writer wait; commit failures -32000 <Exc>: <text> and Error: <text> rc 1 in both modes; --auto-start waits for the socket (CODEMOD_AUTO_START_WAIT, default 300 s). Fix round 2, the round-1 builder's own left-alone list (brief d9a5bf005; d67591e4c, 7a7fc6599, 83b01aed1, 3d96149d6): reload keeps include_roots/cache_dir; the quote guard refuses a raw newline into a non-triple literal; connect retries 3 × 50 ms across the bind/listen window; pyright narrowing in the CLI tests — G1 124 / G2 115 (+82 daemon-mode) / G4 198 passed. Confirmation review GO with six minors (probes rev2_cli.py, rev2_server.py, rev2_stale.py); fix round 3 (brief 8ff72592b; f8039d2da, fe68dbdd4, 8a44cdca9, dff2c63f6): commit_generation guard so a reload loaded before a commit is dropped (probe: disk NewWord, forest OldWord, dry run reported file_count 0); lease expiry re-checked under _pending_lock (20 same-instant commit/run_pass pairs: A committed then B ran, 20 of 20; pending_runs 0, forest == disk, no ConcurrentEditError); the shared literal guard finally runs ast.literal_eval (the five probe cases \N, \x, \u12, """C:\OldWord""", NUL leave the file unchanged, rc 0, both modes); bind/listen test margin ≥ 120 ms; --auto-start ends on a dead unit with daemon <instance> failed before serving (<state>); docs. Measured after round 3: G1 131 / G2 119 / G3 121 / G4 214 passed, 0 failed, 0 skipped; coverage server.py 98 %, passes.py 99 %, scripts/codemod.py 98 %; gate.py run PASS (421,978 facts), ruff, black, pyright, check_spec_authority, check-deps clean. The round-3 builder's one deviation — CodemodDaemon.start() waited the whole 10-s MainPID poll on a launcher that died at once — is fix round 4 (brief §8, 524b62fae; amendment 114be9ce4 after the wirer measured a second window: the first show after systemctl start still carries the dead launcher's MainPID), the RUL-024 disposition being FIX: start() settles 1 s (START_SETTLE_SECONDS) and raises the same failed before serving text when the unit leaves active. Round 4 landed as 12b5e8188 (wirer; second amendment e324c3849 added the H5 test's stale 1.0 <= elapsed lower bound to FILES): the new TestDaemonStart dying-launcher test 10 of 10 (2.0–2.8 s each), the H5 CLI test 5 of 5, lifecycle + daemon-coverage modules 65 passed, -k auto_start 9 passed, daemon.py 92 % (the deadline raise and the zero-MainPID raise are the uncovered branches: the measured window puts the dead launcher's pid in the first show, so the settle is the branch that fires), ruff/black clean. Failure text before <instance> reported no MainPID within 10s (ActiveState=<state>); after daemon <instance> failed before serving (<state>) at once, and … (no MainPID within 10s, ActiveState=<state>) at the deadline. Contract D29 carries all 21 S4 commits and refinements R1–R13.

S2 backlog (D9; owed CodeIntelligenceGraph work, S2 builder 2026-10-06). The S2 analyzers add no graph method; each reduced result below names the method the graph still owes. (1) GAP-1: reachable(roots, edge_types) plus a public edge-type accessor and an entry-root definition, so DeadCodeDetector can report symbol-level dead code (today granularity == "module", unreachable_symbols empty). (2) GAP-2: CALLS resolution by qualified name instead of the first node inserted under a callee name. (3) GAP-3: cross-file TESTED_BY resolution (test-module IMPORTS edge plus name match). Two defects found while building it: the builder writes TESTED_BY as function -> test (sink_edge_from_key) while CodeIntelligenceGraph.affected_tests reads edges INTO the function, so affected_tests returns nothing on a built graph (TestCoverageMapper._edge_tests reads both directions); and _visit_func types a callable Test only for methods under tests/ (and binds before or), so a top-level tests/test_x.py::test_foo stays Function (the mapper adds a path rule). (4) GAP-4: per-edge-type coupling and blast radius (IMPORTS only). (5) GAP-5: a signature diff inside breaking_changes (HAS_PARAMETER edges) with symbol-level consumers instead of module importers. (6) GAP-6: cyclomatic, nesting and cognitive complexity as graph queries. (7) New finding: CodemodWorkspace.load() collects files with an unsorted rglob, and the builder resolves an IMPORTS edge only to a module already registered, so the IMPORTS edges inside one directory depend on filesystem listing order (the S2 fixtures put importees in earlier include directories to stay deterministic). CLOSED in S2 fix round 1 (see the S2 review log): load() sorts the file list, the builder resolves IMPORTS in a second pass over the finished module table, and the dotted name is mapped through the include roots, packages and relative levels (the first S2 build resolved only 324 of the repo's IMPORTS edges, 2 of them into src/). (8) NOTE-1 (S2 fix round 2): a roots option for DeadCodeDetector that excludes tests/. 132 src/ modules are reachable only from tests on this repo (265 are unreachable with scripts-only roots), so with the shipped roots (every tests/ module is a root) the detector reports 0 unreachable and the option is the way to a useful production dead-code answer. No code change in S2. (9) Reviewer round 3 (GO) MINOR-A/B, resolver layout heuristic: _ImportResolver._roots_for bounds the root list only when the importer's package sits below a non-package directory (src layout); a package at the repo root (mypkg/__init__.py) falls back to every top-level directory, so mypkg/m.py: import utils binds tests/utils.py, and inside a repo-root package bare names try alphabetical top-level dirs before the importer's own (tests/test_x.py: import helpers binds scripts/helpers.py over tests/helpers.py). This repo is unaffected (src layout; edge set identical before/after, verified by the reviewer's full-repo identity run). Fix: for a repo-root package add only the importer's own top-level directory to [own_root, "", *pkg_roots], own directory first. (10) Reviewer round 3 NOTE: INHERITS = 0 and OVERRIDES = 0 over all 3,226 modules at both 4f31851c6 and HEAD — an unresolved edge kind that AbstractionAnalyzer/BreakingChangeDetector may depend on; audit item. (11) The loader reads gitignored paths (scripts/_janus_patched/build/lib* becomes an inferred package root and janus_swi binds its build artefact); exclude build//gitignored paths at load time. (12) test_node_ids_follow_sorted_file_order carries REQ-110-031 though it tests loader id ordering; retag when the loader REQ is settled. (13) Pre-ship verified RTM regen (2026-10-06, after the master merge): REQ-110-031/032 graded FAILING because tests/refactor/codemod/analysis/__init__.py cited both ids in its docstring; generate_rtm_evidence.py --verify runs pytest on every citing file, a package __init__ collects nothing (exit 5), and that FAIL outweighs the nine passing test modules. Fixed in this packet by dropping the ids from the __init__ docstring (a non-test file claims no requirement) and regenerating. The verifier behaviour itself (exit 5 on a non-test citing file graded as FAILING; tests/conftest.py has been in the FAIL list for the same reason since S1) is the S5 N4 "RTM false confidence" item: a citing file that collects no tests is a MALFORMED citation, not a failing one. (14) Prod identity drift measured 2026-10-06 after ship attempt 3's rollback: /opt/orchestrata/VERSION reads commit 7a5347cc… deployed 2026-09-23T18:14:11-04:00 while the tree HEAD is 287826a9 (the 2026-09-23 run-evidence commit). record_version captures the previous VERSION text and rollback restores it verbatim, so every failed promote re-asserts the stale file, and the identity verifier reads VERSION as "what is deployed". Owner: P6/PH1 with the consumer fix (ADR-0072); the next promote that reaches a green verify rewrites VERSION to its own sha and closes this. (15) S3 pre-ship verified RTM regen (2026-10-07, 48952a12a): REQ-110-033/034/035 graded TESTED; the 7 FAILING rows are not SPEC-110's and fall into two shapes of the same (13) verifier defect plus one doctrine violation. Shape A, marker-deselected modules: tests/e2e/test_full_pipeline.py and tests/orchestrator/test_pipeline_e2e_{analysis,docs_session,review}.py carry pytest.mark.llm_integration, which the default lane excludes by design (pyproject.toml markers), so the verifier collects nothing (exit 5) and grades REQ-003-FR24-100..103 FAILING, although they were never run. Shape B, non-test citing file: tests/conftest.py (REQ-008-006, REQ-021-069), as in (13). Doctrine violation: tests/knowledge_graph/test_context_pack_performance.py carries pytest.mark.skip and skipif (REQ-106-044), against the no-skip rule; owner SPEC-106. The grading fix (a deselected or non-test citing file is MALFORMED or UNVERIFIED, not FAILING) is the S5 N4 item; the skip removal is its own hygiene item.

Each packet: builder → reviewer → fix → bash deploy/ship.sh from this worktree (prod promote refusal stands until ADR-0067 P5; expected).

S1 review log.

• Round 1 (2026-10-06): HOLD. Blocker: two passes editing one file could not commit (ConcurrentEditError, the second pass's original_tree was the first pass's output). Minors: observer dedupe, failure-path test depended on chmod (not root-proof), @traces missing on observable/subscribe, REQ-110-006 checklist row false ([x], see S5 findings). Fixed in fabc26225, f570bd781, b9bac8a9c; master 2893e2b6b merged in f05ed90f8; checklist wording 1c96fb717.

• Round 2 (2026-10-06, against 1c96fb717): HOLD. Round-1 blocker confirmed fixed by an independent probe (both edits on disk; external edit between load and commit still refused; ChangeSet.merge correct for three passes and a path touched only by a later pass). New findings:

  • B1 commit() now writes through txn.commit_changes, whose _write_atomic creates the temp file with mkstemp (0600) and renames it over the target without copying the original mode: a 0755 script becomes 0600 and every touched file loses group/other read. Reached from scripts/codemod.py run --apply; 23 tracked scripts/*.py are 100755. No test asserted file mode. Fix: fstat the target and fchmod the temp file before the rename, plus a test that commits a 0755 file and reads the mode back.
  • M1 checklist row REQ-110-034 (line 110) still carries the pre-ADR-0068 LibCST wording; only the summary at line 158 was updated.
  • M2 checklist line 156 says FR-001..FR-007 are COMPLETE while REQ-110-006 is [ ].
  • M3 the five REQ-110-026 observers have no production constructor: _default_observers() is called only by a test. Design §5/§7 sanction an empty default, so REQ-110-027 is met in letter but "override defaults" is vacuous. Resolution recorded as D10 below.
  • M4 dedupe is identity-based in _Operation.__init__ but core.patterns.observer._SubscriptionRegistry.subscribe uses not in (equality): an observer with __eq__ (a dataclass) equal to one already subscribed is dropped. All five built-ins are identity-eq. The core module is out of S1 scope (as for ERR-110-011); S1 documents the limitation in design §8 and the checklist row; the core fix is owed to the owner of core/patterns/observer.py (identity check in the registry).
  • N1 @traces story ids on the observability code cite US-110-009 / US-110-003; the observability story is US-110-005.
  • N2 run(p1) → commit(dry_run=True) → run(p2) → real commit raises ConcurrentEditError "modified concurrently" although nobody edited the file (p2's original_tree is p1's in-memory output). Refusal is defensible, the message is wrong.
  • N3 _Operation snapshots the workspace bus at construction; an observer subscribed by another thread mid-operation can be delivered twice. Rare.
  • N4 reports/rtm-evidence.md marks REQ-110-140 TESTED on the strength of tests/scripts/test_check_requirement_corpus.py while the checklist says NOT IMPLEMENTED — RTM-generator false confidence, separate owner.
  • Gates: check_spec_authority.py PASS (REQ-110-127 lives in the checklist FR-CTOK section and the gate unions every REQ- token under specs/, so the passes.py citation stands); check-deps --include-tests exit 0; gate.py run exit 2 (fact base stale, 38 files; refresh with scripts/gates.py then re-run); targeted pytest 139 passed / 0 skipped. The ship-log coverage note "perf-band tests excluded" names neither the tests nor the reason.

• Fix round 2 (2026-10-06): B1, M1, M2, M3 (D10), M4 (documented), N1, N2 and the ship-log coverage note closed in 41bd131d5. N3 stays a recorded note (rare double delivery, no change) and N4 stays with the RTM-generator owner. Gates after the fix: gates.py ALL PASS, gate.py run 0, check-deps --include-tests 0, check_spec_authority.py 0; targeted suites 153 passed, 0 skipped.

• Round 3 (2026-10-06, against 7bea607dd): HOLD. B1, M1, M2, M3/D10, M4, N1, N2 and the 43/1/7 counts confirmed closed; the --observe run attaches and closes all five observers on the success and failure paths (reviewer probe). New findings:

  • R3-B1 regression from the B1 fix: _write_atomic now copies a 0444 target's mode onto the replacement, so _rollback's write_bytes gets EPERM on that file. A two-file commit whose second write fails leaves the first (read-only) file with the NEW content, masks the original exception with the rollback's PermissionError, and never emits ROLLBACK_TRIGGERED — REQ-110-014's byte-exact rollback is broken for read-only targets. Pre-fix, the same scenario rolled back. Fix: _rollback restores through the same tempfile + rename path with the snapshot's mode applied after the write; a test with a 0444 first target and a forced second-write failure (root-proof: the latin-1 CommitVerificationError technique, not directory permissions).
  • M-a setuid/setgid are dropped: fchmod runs before os.write and the kernel clears them on write (0o4755 → 0o755, 0o2755 → 0o755). Either fchmod after write + fsync, or narrow the "keeps its permission bits" wording in docs and design §8 to what holds.
  • M-b test_run_observe_apply_attaches_the_five_observers proves only the DebugPanel artefact; a default_observers() returning one observer would pass. test_run_without_observe_attaches_no_observers has no @traces.
  • M-c docs/design §8 claim "a new file gets the mkstemp default 0600" but commit() cannot create a file (_check_concurrent_edits raises FileNotFoundError); the branch is reachable only when the target is deleted between the check and the write, and then the file is silently resurrected at 0600. Pre-existing race; the wording is new and must be honest. Resurrection itself is recorded as owed (REQ-110-015 hardening).
  • M-d the ship-log coverage note omits test_memory_guard, the test that failed under --cov (3.7634 GB vs the 3.5 GiB = 3.7581 GB band), and does not say the round-2 coverage run had failures.
  • N-a checklist row 034 abridges spec.md:943 (drops the lexical-check list and "rather than re-implement it"); meaning unchanged.
  • N-c --observe attaches after load(), so WORKSPACE_LOADED / INDEX_BUILT never reach the trace; docs say "for this run and commit", which is accurate. Gap for US-110-005, not a defect.
  • N-d the two coverage-run failures are unrelated to 41bd131d5 (it touches neither load() nor any daemon module); the orchestrator's idle no-coverage rerun of both modules: 87 passed.
  • N-e _write_atomic leaks the temp file if fchmod/write/fsync raise after mkstemp (pre-existing for write/fsync).
  • Gates: check_spec_authority.py 0, check-deps --include-tests 0, gate.py run 2 (fact base stale again: the refreshed plans/ast-*.json are restored as hook litter before every commit, so gate.py run passes only immediately after scripts/gates.py; record the pass at that moment); four targeted modules 153 passed, 0 skipped.

• Fix round 3 (2026-10-06): R3-B1, M-a, M-b, M-c, M-d and N-e closed in ecd2ca88c. N-a and N-c need no change. Measured as uid 1001 (non-root): 0o4755 and 0o2755 both round-trip through commit_changes (fchmod now runs after os.write; docs and design §8 state exactly this, no narrowing needed). _rollback restores through the tempfile + rename path with the snapshot's mode (_FileSnapshot.mode); a vanished target raises ConcurrentEditError ("no longer exists"), so _write_atomic no longer creates files and the new-file 0600 test is replaced. The --observe CLI test records which observer classes' on_event ran (profile hook, no mocks) and requires all five. Coverage over the codemod suite + test_codemod_cli.py (814 passed, 0 skipped; perf/benchmark/memory-guard excluded): codemod.py 96%, txn.py 93%, workspace.py 98%. Gates after the fix: gates.py ALL PASS, gate.py run 0, check-deps --include-tests 0, check_spec_authority.py 0.

• Round 4 (2026-10-06, against e73d1ede3): HOLD. M-a, M-b (mostly), M-d, N-e and the written-0444 R3-B1 scenario confirmed closed (probe: original exception surfaces, ROLLBACK_TRIGGERED with 2 files, both restored, 0444 kept; all six modes round-trip; no temp files on any injected failure; the sys.setprofile CLI test is observation, audit_test_purity.py 0 violations). One root cause remains:

  • R4-B1 _rollback rewrites EVERY snapshot entry, including entries that were never written. (i) When the forward write failed because the target's directory is not writable, the rollback's mkstemp fails in the same directory inside the except block: the rollback's PermissionError surfaces with the original as __context__, ROLLBACK_TRIGGERED is never emitted (regression from ecd2ca88c: write_bytes on an unchanged writable file used to succeed). (ii) A target deleted between the concurrent-edit check and the write correctly raises ConcurrentEditError("no longer exists") and is then RECREATED by the rollback, so the docs/design claims "commit() never creates a file" and "instead of being recreated" are false; test_write_atomic_refuses_a_vanished_target calls _write_atomic directly and never reaches the rollback. Fix: restore only files_written (unwritten entries are unchanged on disk by construction) and catch per-file rollback errors so the original exception and the event always win; add commit_changes-level tests for a vanished target and for a never-written entry whose rollback cannot write (root-proof: target path is a directory).
  • M1 the setgid bit survives but the GROUP does not: the rename swaps in an inode owned by the writer's egid (gid 100 → 1007), so "0o2755 survives" is literally true and semantically false; the same holds for uid ownership since the round-2 rename approach. Fix: fchown(fd, -1, st_gid) before fchmod where the caller may, or narrow the docs to what holds (uid cannot be preserved without root).
  • M2 the five-observer CLI test fills ONE set across codemod.main; an observer that saw only run() or only commit() events passes. Record (type, event_type) pairs and require each type to have seen a pass_* and a commit_* event.
  • M3 the ship-log row says "N-d records two" coverage failures but names only test_memory_guard. The second (builder round-2 report) was a tests/refactor/codemod/test_daemon_lifecycle.py argv probe that failed once under --cov and a different test in that module failed on the solo re-run; both modules pass at idle load without coverage (87 passed). Name it.
  • Notes: the setprofile hook restores to None rather than sys.getprofile() (clobbers an outer profiler; none in this suite); the stat→rename TOCTOU window still resurrects a file deleted inside mkstemp (inherent without renameat2; docs must not overstate); a 0200 target the user owns fails cleanly in _check_concurrent_edits; ConcurrentEditError(vanished=) is keyword-only and backward compatible.
  • Gates: check_spec_authority.py 0, check-deps --include-tests 0, gate.py run 2 (stale fact base, as before); four targeted modules 157 passed, 0 skipped.

• Fix round 4 (2026-10-06): R4-B1, M1, M2, M3 closed in fdfc5b25b. R4-B1: _rollback receives only files_written; each per-file restore is wrapped, logged, attached to the original exception with add_note and listed in the ROLLBACK_TRIGGERED payload (rollback_failures), and the event is always emitted. The brief's "target path is a directory" never-written probe does not reach the write: _check_concurrent_edits fails first on the directory (os.read raises IsADirectoryError, outside the rollback try), so the never-written and rollback-failure tests use RLIMIT_FSIZE (EFBIG for every uid; Python ignores SIGXFSZ). That needed one production change in _replace_file: os.write is looped, because with the cap it returned a short count and the truncated temp file was renamed over the target. M1, measured as uid 1001 (gid 1007, member of 100/0/1/65534): fchown(fd, -1, gid) on a member group is kept, on foreign group 2000 it gives EPERM and the file keeps gid 1007; so fchown runs before fchmod and a PermissionError is swallowed only for a non-member group. The uid cannot be preserved without root; docs and design §8 say so. The stat to rename TOCTOU window is stated as open. M2: the CLI test records (observer class, event type) pairs, asserts each of the five saw a pass_* and a commit_* event, and restores sys.getprofile()'s prior value. M3: ship-log coverage column names the second failure. Gates: gates.py 0, gate.py run 0, check-deps --include-tests 0, check_spec_authority.py 0, purity audit 0 violations. Coverage (codemod suite + test_codemod_cli.py, same three exclusions): txn.py 95%, workspace.py 98%, scripts/codemod.py 96%.

• Round 5 (2026-10-06, against d4d7da71a): HOLD. R4-B1 confirmed closed by the round-4 probes A/D/F (original exception surfaces, ROLLBACK_TRIGGERED always emitted with files_rolled_back and rollback_failures, nothing resurrected); write loop correct under RLIMIT_FSIZE (target never replaced by truncated bytes, no leftovers); add_note survives the re-raise; M2 and M3 closed; the rlimit tests are per-process and the 8-worker executor is one process per module; purity, parallel-safety and isolation audits 0 violations. New findings:

  • R5-B1 regression from fdfc5b25b: _replace_file's fchown(fd, -1, gid) catches only PermissionError. Under unshare -r (rootless containers, bubblewrap) a host group the writer is in but which is not their primary group stats as gid 65534 (unmapped) and fchown raises OSError(EINVAL), so EVERY commit of such a file fails; the parent commit committed fine. Inside the namespace os.getgroups() also reports every unmapped group as 65534, so the membership check is wrong there too. Fix: treat EPERM and EINVAL as "group cannot be preserved", log a warning naming the path and both gids, continue; regression test runs the commit in a child under unshare -r against a file chgrp'd to a non-primary group the writer belongs to. Preserving gid before fchmod does NOT reintroduce the setgid clearing (probe: 0o2755 gid 100 survives).
  • M-a test_rollback_of_the_written_set_never_recreates_a_vanished_path calls _rollback with a hand-built dict that never contains the vanished path, so it cannot fail for the bug it names; only the inode assertion in test_rollback_restores_only_written_entries guards the rollback scope. M-b test_commit_refuses_a_target_deleted_before_the_write fails in _check_concurrent_edits before the try; its name overstates. Resolution: one commit_changes-level test where another thread deletes the second target once the first entry's temp file appears (first payload large enough to make the window reliable; run it 20× before trusting it); if it cannot be made deterministic, rename both tests to what they prove and record the gap in design §8.
  • M-c rollback recreates a WRITTEN file deleted after its write, and overwrites an edit made after its write (probes R/S). Intended semantics (restore the pre-commit state), but docs and design §8 must say so.
  • M-d (P4 code, for the P5 owner) TestPidIsCodemodDaemon flakes because Popen returns before the kernel fills /proc/<pid>/cmdline (measured 163/300 empty right after spawn); the production predicate returning False on an empty cmdline is the fail-safe direction, the race is in the TEST — wait_until the cmdline is non-empty and contains -m before asserting. Failed 2 of 5 runs without coverage; coverage is not the cause.
  • Notes: rollback_failures elements are "path: ExcType: message" strings (document the shape); "never replaces the original exception" holds for the production sink (SyncObservable.emit swallows observer errors) but not for a direct on_event callable that raises — qualify the docs or wrap the sink call.
  • Gates: check_spec_authority.py 0, check-deps --include-tests 0, purity audit 0, gate.py run 2 (stale fact base); targeted pytest 145 passed, 0 skipped.

• Fix round 5 (2026-10-06): R5-B1, M-a, M-b, M-c and both notes closed in a4bc5e436 (M-d stays with the P5 owner). R5-B1: _replace_file treats OSError with errno EPERM or EINVAL from fchown as "group cannot be preserved" (warning with path, wanted gid, resulting gid) and continues; the os.getgroups() test is gone. Measured as uid 1001 (egid 1007, member of 100) with a file chgrp'd to 100 and committed under unshare -r: at HEAD (678114085) fchown raised OSError(22) and the commit exited 1, file unchanged; with the fix the namespace saw file gid 65534, warned "wanted gid 65534, file keeps gid 0", exited 0, and the host sees the new file with gid 1007. The regression test test_commit_succeeds_when_the_group_is_unmapped_in_a_user_namespace runs that commit in a child (/usr/bin/unshare -r, sys.executable, worktree src on PYTHONPATH); with no supplementary group it falls back to a foreign gid 2000 through _replace_file. M-a/M-b: one commit_changes-level test (test_commit_refuses_a_target_deleted_during_the_first_write, an 8 MB first payload, a second thread deleting the second target once the first *.tmp appears) ran 20/20 green in 20 separate pytest processes, so it ships; the hand-built-dict _rollback test was deleted (it could not fail for the bug it named) and the pre-check test was renamed test_commit_refuses_a_target_already_deleted_when_commit_starts. M-c and the rollback_failures shape are in docs/codemod-observability.md and design §8. Note: a raising on_event sink is now logged and swallowed in commit_changes (test test_a_raising_event_sink_never_masks_the_commit_failure). Gates: gates.py ALL PASS (0), gate.py run 0, check-deps --include-tests 0, check_spec_authority.py 0, purity audit 0. Codemod suite + test_codemod_cli.py (perf, benchmark and memory-guard excluded): 822 passed, 0 skipped; txn.py 95%.

• Round 6 (2026-10-06, against bb93967bb / a4bc5e436): GO. No blocker. Reproduced by the reviewer on HEAD: probe_ns.py under unshare -r on a fresh chgrp 100 fixture (namespace sees gid 65534, warning names path and both gids, commit OK, host file gid 1007 mode 644); probe_r4/probe_r5 scenarios all match the documented semantics (R: a deleted written file is recreated with the old bytes; S: a later edit is overwritten; U: rollback_failures is a list of "path: ExcType: msg" strings); the unshare test's child imports the worktree src (txn.__file__ under wt-SPEC-110, PYTHONPATH ahead of the editable .pth) and has no skip path (missing unshare errors, disabled userns fails the rc assertion, a hang hits timeout=120); pre-fix src (git archive a4bc5e436^) fails both child modes with OSError(22); the vanished-target test passed 10/10 in separate processes (0.45–0.97 s) with no vacuous path and a bounded deleter thread (30 s deadline, join in finally); caplog is pytest's built-in LogCaptureFixture; the surfaced PermissionError has __context__ None. Nothing else imports _FileSnapshot/_rollback; _rollback's failure branch is still covered. Branch diff vs origin/master: 23 files, all S1 scope. Gates (run directly, not via gates.py, to avoid ruff --fix/black edits): check_spec_authority.py 0, check-deps --include-tests 0 (59 declared), purity audit 0, gate.py run 2 (stale fact base, expected outside a fresh gates.py), four targeted modules 165 passed / 0 skipped. Three MINORs, all record-level: (1) design §8 still stated the round-4 group-membership rule in present tense — rewritten as history (fixed in this commit); (2) the ship-log S1 row stopped at the round-3 numbers — filled at ship time below; (3) the fix-round-5 record says gate.py run 0 where the reviewer measured 2 — the 0 holds only immediately after gates.py refreshes the fact base (the standing note in §0 applies; both figures are consistent with that), and the fix-round-4 "145 passed" vs the reviewer's 165 differ by module set (round 4 ran three modules, round 6 ran four). Notes (no action, owner S5 hygiene): fchown runs even when the temp file's gid already equals the target gid, so a filesystem rejecting chown with EOPNOTSUPP/ENOSYS (some FUSE mounts) fails a commit that succeeded before group preservation — skipping fchown when os.fstat(fd).st_gid == gid closes it; the unshare test asserts rc/content/no-litter but not the warning text in stderr; the raising-sink test asserts the log line but not __context__ is None. Not re-verified by the reviewer: the 20/20 loop and the 822/95% coverage run (outside the targeted scope). Reviewer evidence under the session scratchpad (r6_loop10.txt, r6_targeted.txt, r6a/, r6old/, r6m_*).

• D10 (operational). The default observer set stays empty (design §5/§7). scripts/codemod.py run gains --observe, which attaches the five REQ-110-026 observers for that run and commit, so the built-ins have a production constructor and REQ-110-027's "override" has a referent. _default_observers becomes the public default_observers(). No ADR: the design already fixed the empty default; this is wiring (RUL-023).

Packet Definition of Done (ADR-0069 / RUL-034, Mohamed 2026-10-06: "do not forget annotations, rtm, documentation, wiki update and 90% code coverage" … "it should br the definition of done for all specs"). No packet is shipped until all five hold in the same ship: (1) @traces on every added/changed symbol and test, spec-defined ids only; (2) RTM regenerated (generate_rtm_evidence.py, trace_intel.py untraced-reqs before/after for SPEC-110); (3) checklist rows flipped in the code commit + docs/ and plans/ design status updated; (4) knowledge-wiki SPEC-110 page updated and shipped; (5) ≥90% line coverage per touched source file, measured. The S1 brief was amended in flight with these on 2026-10-06; S2–S5 briefs carry them from the start. The ship log below gains the five as columns.

S2 review log.

• Review round 1 (NO-GO, against cae1f22a4) → fix round 1 (2026-10-06; RTM restore 147b47979, code f6a67f847, docs and plan in the commit after it).

  • BLOCKER-1 IMPORTS edges almost never resolved. Cause in _cig_builder_ast.py: _record_import linked an import only to an ALREADY-registered module, and _module_name_to_path turned pkg.mod into pkg/mod.py, ignoring include roots (src/), packages (pkg/__init__.py) and relative levels. Fix: the extractor records raw imports (sink_import; op "i" in the parallel op log); _CIGBuilder.build resolves them in a second pass over the finished module table with _ImportResolver (ancestor directories of a non-package importer, repo root, top-level directories, inferred package roots; relative imports by level; from pkg import name prefers pkg/name.py, else pkg/__init__.py; a package directory is not an implicit import root, so import logging inside a package never binds a sibling logging.py). One IMPORTS edge per (importer, importee) pair. The Import node now carries its statement's real line, level, is_relative and a resolved_module property. CodemodWorkspace.load() sorts its file list (one line; commit() untouched). No CodeIntelligenceGraph method and no CSR shape change (D9 stands). Existing assertions: none encoded the old behaviour; two comments that described the one-pass limitation were rewritten (test_cig_builder_ast.py, test_workspace_load.py docstring) and the analysis conftest docstring (it told fixtures to order importees first).

  • MAJOR-2 RTM: git checkout 95d00f7ee -- reports/rtm-evidence.{json,md} committed (147b47979). The committed RTM is the S1-verified one (verified true; TESTED 329, FAILING 15, DECLARED 2975, identical to 95d00f7ee) pending the orchestrator's verified pre-ship regen; --verify was not run here.

  • MINOR-3 _signature_of ignored async-ness: an async marker now heads the signature tuple (def to async def, and back, is a changed signature, US-110-003). test_each_changed_signature_reaches_each_importer had locked the old behaviour in ("keep became async: not a signature change"); it now expects keep: signature changed once per importer.

  • MINOR-4 BreakingChange.consumer_line was the module node's line 1. The detector reads the Import nodes (resolved_module + line) and reports the first importing statement's real line; the CLI fixture's app/user_a.py now has a docstring so the line is 3 and the assertion app/user_a.py:3 <- src/lib.py is distinguishable from the old :1.

  • MINOR-5 ComplexityAnalyzer mixed path:name (class dropped, duplicates for same-named methods) with path:Class.method. qualified_name is now always <path>:<dotted scope> from the AST walk; the graph only resolves the target module. test_fixture_functions_have_exact_metrics keyed src/lib.py:mul; it now keys src/lib.py:Calc.mul.

  • MINOR-6 all-passes --json without --module: chosen option = summary counts for the per-module mapping (D24 allows either). A BlastRadius entry becomes {affected_node_count, affected_file_count, impact_score}; coupling and abstraction entries were already numbers. Real repo: 160 MB / 2m32s before, 14.0 MB / 1m51s after (the per-module mappings total 1.1 MB; the remaining 12.6 MB is the repo-wide per-function complexity report, which is the pass's content, not the mapping; the time is the per-module blast-radius BFS plus the 21 s load).

  • NOTE _changes_since runs git show <base>:./<path>, so --repo may be a subdirectory of a git repository.

  • Probe (CodemodWorkspace.load(Path("."), parallel=True) on this worktree, then DeadCodeDetector, CouplingAnalyzer):

    	cae1f22a4	f6a67f847
    modules	3226	3226
    IMPORTS edges total / into src/	324 / 2	7926 / 7422
    unreachable modules (all) / non-__init__ src/ modules	818 / 818	0 / 0
    core/base/traces.py coupling	efferent 7, afferent 0, instability 1.0	efferent 7, afferent 620, instability 0.0112

    0 unreachable is correct for the shipped roots (every module under tests/ is a root and the tests import nearly every src/ module); a stricter probe rooted at scripts/ plus __main__.py only, run once, reports 265 of 833 non-__init__ src/ modules unreachable, so the resolver discriminates rather than marking everything reachable.

  • Tests that fail on the pre-fix code (git checkout cae1f22a4 -- <the five src/scripts files>, run, git checkout HEAD -- <the same files>): 26 failures: test_cig_builder_ast.py 8 (TestImportResolution x7, test_node_ids_follow_sorted_file_order); analysis/ 15 (test_breaking_change.py: the async test, the changed test_each_changed_signature_reaches_each_importer and the three layout cases; test_complexity.py 2; test_coupling.py and test_dead_code.py, test_read_only.py, test_test_coverage.py: the src-layout and relative-import cases each); test_codemod_cli.py 3 (..._exit_zero_with_json_output, ..._print_text_sections, test_breaking_changes_base_reads_the_repo_subdirectory_not_the_toplevel). The three real layouts (src layout, importer sorts before importee, relative imports) are the import_layout fixture in tests/refactor/codemod/analysis/conftest.py; TST-110-016, -018 and -019 each gained a case over it, plus a coupling and a dead-code case.

  • Memory note (corrected in fix round 2; the round-1 text, "+67 MB", came from one sample each and is superseded). test_memory_guard measures load(..., parallel=True).stats().rss_delta_bytes against 3,758,096,384 B (3.5 GiB). The S1 loader already sat at the band; S2's own delta is within the run-to-run noise (about +30 MB in the reviewer's four samples each; see the fix round 2 table). The guard is CLOSED in fix round 2 by reducing RSS, not by touching the band (see below).

  • Gates (recorded in the ship-log row below).

• Review round 2 (GO except MAJOR-1, against 4f31851c6) → fix round 2 (2026-10-06; code 83e74cbad on feat/spec-110-completion).
  • MAJOR-1 test_memory_guard (REQ-110-004; band 3,758,096,384 B). OUTCOME A: the test is green and every sample is under the band.

    • Where the memory is (stage RSS in one fresh process, parallel=True, this worktree, 3226 files, 40.6 MB of source): parse of the forest +3,428 MB (89%, the S1 LosslessModule token stream plus ast per file, not touched); the decoded sources dict +87 MB (non-ASCII files widen the str to 2-4 bytes per character: 87 MB for 40.6 MB of text); CIG build +330 MB (169,573 nodes, the per-module op logs, one CIGEdge object per edge plus a second tuple per edge for the CSR input, the transpose edge list _CSRIndex makes inside). tracemalloc over the full tree does not finish in 10 minutes under the 3.14t free-threaded allocator hooks, so the profile above is the per-stage RSS split plus the object accounting of the builder; the S2 additions (_pending_imports tuples, the per-module import path strings) are a few MB and the resolver's _ImportResolver is dropped when build() returns.

    • Reductions applied (all in _cig_builder_ast.py and workspace.py, no behaviour change; commit() untouched): (1) _ForestSources, a lazy Mapping over the forest, replaces the eager decoded dict, so no second copy of the tree's text is made (build_cig_ast reads text only for a path with no pre-parsed tree); (2) the parallel path frees each module's op log as it is replayed, so the logs and the finished graph are not both live; (3) one (source, target) tuple per edge serves the CSR input and the per-type list, replacing a CIGEdge object per edge and a rebuilt tuple list (CIGEdge stays defined in _types.py; the builder was its only user).

    • Measured (load(src, scripts, tests, parallel=True), standalone, fresh process per sample, load average under 4 before each sample, MB):

      state	samples	mean	min / max
      base cae1f22a4	3826.7, 3824.8, 3834.6, 3759.2	3811.3	3759.2 / 3834.6
      HEAD before, 4f31851c6	3768.3, 3750.5, 3763.9, 3761.4	3761.0	3750.5 / 3768.3
      HEAD after, 83e74cbad	3642.5, 3635.7, 3663.4, 3639.3	3645.2	3635.7 / 3663.4

      Three more interleaved pairs (HEAD, then after, swapping the two files between samples): HEAD 3768.6 / 3757.4 / 3763.1, after 3632.6 / 3687.7 / 3620.7. Over n=7 each: HEAD before mean 3761.9 (3750.5-3768.6), HEAD after mean 3646.0 (3620.7-3687.7), reduction about 116 MB; the highest sample is 70 MB under the band. The resolver fixes alone (HEAD memory structure plus the round 2 resolver) measured 3766.3 / 3756.7 / 3774.8 against HEAD 3764.9 / 3758.5 / 3768.1, so they cost nothing. A first measurement of the resolver-only state at 3,827.7 MB (n=4) was taken in a different load window and is not reproduced by the interleaved runs: the same code moves by about 70 MB between windows, which is the reviewer's 3,839 MB for HEAD. A window that inflates by 70 MB leaves HEAD after at about 3,716 MB, still under the band by about 40 MB.

    • Not done (out of the brief's files): _CSRIndex.__init__ builds the transpose edge list as a second full list of new tuples ([(to, frm) for frm, to in edges]), a transient of about one tuple per edge; _csr_index.py is not in this round's FILES. It is the next lever if the margin has to widen, and the S1 token stream (89% of the delta) is the only lever that moves the floor by hundreds of MB.

  • MINOR-1 _relative_roots climbed past the top package (pkg/m.py: from .. import y bound y.py; Python raises "beyond top-level package"). Fix: a climb above the importing package must land in a directory registered as a package (<dir>/__init__.py), else no roots. test_external_self_and_overshooting_imports_make_no_edge was false-confidence (nothing existed to bind): it now carries a root far.py; test_overshooting_relative_import_does_not_bind_past_the_top_package and test_relative_climb_into_an_enclosing_package_still_binds are new.
  • MINOR-2 every top-level directory was a root for every importer, so import logging inside src/pkg could bind scripts/logging.py or a root json.py. Fix: absolute names in sys.stdlib_module_names never resolve; an importer inside a package nested below the repo root tries only its own package root, the repo root and the other package roots. The brief said "package importer"; scripts/ has an __init__.py here, and treating it as a package dropped 13 real scripts/ to scripts/ sibling edges (27 to 14, the probe figure below; the builder's first write-up said 10, which no run reproduces) (a script run from its directory imports _irc_conversation by bare name), so a package directly under the repo root (scripts/, tests/) keeps the top-level directories like any script directory (stated in docs/codemod-analysis.md). Tests: test_stdlib_name_never_binds_to_a_same_named_repo_file, test_package_importer_does_not_bind_into_scripts_or_tests_by_bare_name.
  • MINOR-3 from A import B tried A/B.py under every root before A/__init__.py under an earlier root. The loops are swapped (roots outer, names inner); test_from_import_prefers_an_earlier_roots_package_over_a_later_submodule.
  • MINOR-4 @traces(spec="110", story="US-110-006", reqs=["REQ-110-031"]) on TestImportResolution and test_node_ids_follow_sorted_file_order (the form analysis/ uses; the spec lists no per-story REQ mapping, and analysis/ ties REQ-110-031 to US-110-006); the new TestLazySources class is US-110-001 / REQ-110-004. reports/rtm-evidence.* untouched.
  • Tests that fail on the pre-fix code (src file swapped to 4f31851c6 and back): 5 of the 6 resolver tests fail (the overshoot false-confidence test, the new overshoot test, the stdlib test, the bare-name test, the package-over-submodule test); the sixth, the enclosing-package climb, is a guard that passes before and after.
  • Edge-count probe (build_cig_ast over every .py under src/, scripts/, tests/; 3226 modules): IMPORTS edges 7,927 before and 7,927 after; src/ to scripts/ edges 12 before and 12 after (the brief expected 14 and a drop for janus_swi). The edge SET is identical: this repo has no stdlib-named file for a package module to hit, and no bare name that crossed into scripts/ or tests/, so MINOR-2 and MINOR-3 are guards against layouts this repo does not have today. janus_swi still binds scripts/_janus_patched/build/lib.linux-x86_64-cpython-314t/janus_swi/__init__.py: that directory is an inferred package root (it holds an __init__.py chain), which is what the rule keeps. The first cut of MINOR-2 (own package root plus repo root only) took tests to src from 4,335 to 1,510 and scripts to scripts from 27 to 14, which is how the orchestrata_ultimate package root and the scripts/ rule above were found.
  • Verification: analysis/ + test_cig_builder_ast.py + tests/scripts/test_codemod_cli.py + test_workspace_load.py = 179 passed, 0 failed, 0 skipped (includes test_memory_guard); the remaining tests/refactor/codemod/ modules + tests/scripts/test_codemod_fast.py = 880 passed, 1 failed, 0 skipped: the known test_daemon_lifecycle.py::TestPidIsCodemodDaemon /proc argv race (the P5 carry-over; the failing test varies by run). Coverage (line, this round): _cig_builder_ast.py 99% (3 of 374 missed: 720-721, the _extract_annotation except branch, and 806, the keep < 0 relative-import guard), workspace.py 93%. Gates after the fix: gates.py ALL GATES PASS (exit 0), gate.py run exit 0 immediately after, check-deps --include-tests 0, check_spec_authority.py 0.
• Review round 3 (GO, against 3e4fe1e6d, 2026-10-06). The reviewer re-ran the fix-round-2 claims under the authoritative observer plugins (the round had to wait for the suite to go idle; the monitor was stopped and the reviewer resumed when the load dropped).
  • Memory: test_memory_guard peak RSS 3,631 / 3,633 / 3,621 MB over three runs against the 3,758 MB band, a margin of 125 MB at the worst sample; the ~116 MB reduction from fix round 2 is real and repeatable.
  • Resolver identity: build_cig_ast over every .py under src/, scripts/, tests/ (3,226 modules) at 4f31851c6 and at 3e4fe1e6d gives the identical IMPORTS edge SET (7,927 edges), which is the number this repo's edge-count probe above also reports; the resolver fixes change nothing in this tree and are guards for the layouts named in MINOR-A/B.
  • Tests: the 179-test group (analysis/, test_cig_builder_ast.py, test_codemod_cli.py, test_workspace_load.py) 179 passed, 0 failed, 0 skipped; the remaining tests/refactor/codemod/ modules plus test_codemod_fast.py 785 passed, 0 failed, 0 skipped. The builder's "880 passed, 1 failed" figure for that second group is not reproducible from the module list the plan names: the reviewer's count of the same list is 785, and TestPidIsCodemodDaemon did not fail in the reviewer's run. The 880 figure stays in the fix-round-2 record as the builder's own report; the shipped number is 785 + 179 = 964 passed, 0 failed.
  • Carried items: MINOR-A/B (resolver layout heuristic), the INHERITS = 0 / OVERRIDES = 0 audit, the gitignored-path loader note and the REQ-110-031 retag are backlog items (9) to (12) in the S2 packet record above; none blocks the ship.

3. Ship log

Related

• Plans
• Orchestrata Ultimate — project index
• Workflow
• Tasks