SPEC-v0.11 review round two: fifteen findings, ten in round one's own fixes

[arpanghoshal]

Stacked on #195, because pushing to a green PR's branch is how the last four commits got stranded.

Fifteen findings, all demonstrated, ten of them in text round one wrote. The distribution is the
lesson: round one finds what the author did not know, round two finds what the author did while
fixing it. That is why v0.9 and v0.10 each needed three.

The one nobody looked for in either round

Items 2 and 3 cancelled each other. §3 never contained the word prune; §4 contained the word
anchor once. An honest prune deletes the prefix every older anchor's seq lives in:

C. after an honest prune through seq 3 (checkpoint written)
   checkpoint-seeded verify_chain   ok=True verified=2 breaks=[]
   an anchor taken at seq 2 before the prune
   -> [('anchor_broken', 2, 'the anchored seq is absent')]

The chain verifies and the anchor reports tampering. Anchoring hourly and pruning at ninety days,
every anchor older than the retention window is permanently broken, so under rule 2 a deployment
must either refuse every prune or accept a permanent tamper signal.

§4.6 is new: a prune anchors its checkpoint before it deletes, and an anchored seq below a
checkpoint is evaluated against that checkpoint's anchor. Its third row is what stops "superseded"
becoming the hole: an attacker who erases a prefix and writes a checkpoint to explain it must also
anchor that checkpoint, and anchoring goes through the provider, which is outside the store.

The round-one fixes that fixed the argument and not the artifact

Round one fixed	Round two found
§2.4's append claim, rewritten as a table	the claim survived in §8's G28 row, the text that becomes the graded guarantee, and on ROADMAP.md's Exit line
anchor_missing moved out of CHAIN_BREAKS so it stops failing G11	its definition was untouched. One honest action after an anchor: [('anchor_missing', 5, ...)]. It failed G28 universally instead
§4.4's release rule replaced with settlement	§10 carried the unconditional version
§9's three unwritable rows named	the migration row still cannot be an attribute path
§11.1 declared the citation class closed	three new citation defects in the new text

The ledger one is demonstrated and is the sharpest:

third 100 on a 250 budget: REFUSED -> budget 'amount' on grant 'payer' ... is exhausted
pruned COMMITTED ledger rows: 2
SAME action after pruning the COMMITTED rows: ALLOWED   <-- authority manufactured

Round one replaced "un-released" with settlement and dropped SPEC-v0.9.md §7.3's window on the way
through. §10 is the table an implementer codes refusals from.

Also

• anchor_unavailable had no name in the closed set and no verification-time row: §10's row was
  written from the make side only.
• The prune's receipt cannot be written inside the prune's transaction. put_receipt opens
  BEGIN IMMEDIATE: OperationalError: cannot start a transaction within a transaction. §4.2 and
  §4.5 were unsatisfiable together. The order is now forced, and the crash window is the safe one.
• "Any break" made retention permanently impossible on pre-v0.6 stores. unchained survives a
  prefix prune and can never be in a prefix. The rule is now "a break the prune caused".
• §4.4's state table omitted EXECUTING, one of the five states effect.py persists.
• The MCP operator server blinds on the same read as the CLI, so item 1's scope is the shared
  read and not the terminal. A fix in cli/main.py alone leaves the network console blind.
• Four citation defects and six bare internal § references this document does not have.
• ## 11.1 became ## 12, because a review is not a subsection of Out of scope.

Every file-qualified cross-reference resolves. No em dashes. §12 records both rounds in the spec,
because a spec is believed and a commit message is not.

A third round is warranted, on exactly the evidence above.

Not merging.

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c3e5d934-7cfd-44a5-9aa5-999ab7f160d9

📥 Commits

Reviewing files that changed from the base of the PR and between de640c5 and 01760e8.

📒 Files selected for processing (1)

• docs/SPEC-v0.11.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}