docs(p022): bring the status surfaces level with what 4b proves (#259 cp4b.3)

The obligation family is ported, replayed and promoted, so every surface that
still said otherwise is corrected — and none of them gains a number:

* **P-022** row 4b goes from "not started" to complete, with the wording this
  checkpoint earns and links to the generated fragments; the preferred queue
  drops 4b and now reads coordinate-domain decision → #259 final acceptance →
  #260 acceptance / #261. Two stale claims elsewhere in the table go with it:
  cp5's "what remains is row 4b and the coordinate decision", and step 7a's
  typed shadow counts — which 4b changed, which is exactly why that row now
  points at the census instead of restating it.
* **`spec/Bridge.md` §6** no longer lists a protocol-bearing document among the
  declared boundaries; it records that it did until 4b and that a re-declared
  exclusion is a red build, not a note.
* **`spec/BridgeBehaviorMatrix.md`** gains two rows — the analysis (core suite,
  with its own fact-parity family) and the verdict mapping (L3 ✅) — and the
  paragraph in (e) is rewritten: one row family is outside the replayed set
  now, not two.
* **cp4 and cp5 notes** carry a "read as history" banner where they describe
  the refusal, so a reader cannot mistake a checkpoint record for current
  state.
* **The proposals index** records row 4b and carries no measured count at all.
* **Both campaigns are registered** in `render_checkpoint_status.py` (a new
  `p022-cp4b-mutations.md` fragment) and in `test_checkpoint_status.DEFINITIONS`,
  so they are rendered from evidence and re-anchored by the gate like every
  other campaign in the tree.
* Two remaining live claims are fixed rather than left to rot: the verdict
  fixture harness's docstring and the repro manifest's pin for the protocol
  artifact.

The checkpoint note gains its results package: what landed, the frozen
fixtures and their regeneration commands, the one production dependency
change, the zero-on-every-axis differential, what both campaigns found before
they were green, and the two things measured rather than claimed — that the
protocol path does not apply BR-V5's short-slice rule, and that the family's
append position is unobservable end to end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WbgYFv2UW3iRJ3L33naVC3

Author: claude

docs/generated/p022-cp4b-mutations.md

@@ -78,6 +78,13 @@ without regenerating a golden.
 
 ### The unmeasured set is named, not hidden
 
+> **Read the protocol paragraphs below as history.** #259 checkpoint 4b
+> ([note](p022-bridge-verdict-checkpoint4b.md)) ported the obligation
+> analysis, wired it through the bridge and **promoted both protocol
+> documents out of `rust_replay_excluded`**. Where this note says the OBL
+> analysis is not ported, or that a protocol-bearing document is refused,
+> it describes the state at the time it was written.
+
 Each exclusion is an entry in `rust_replay_excluded` with a reason and an
 expectation the replay executes (`rust_refusal: bridge` + an error substring,
 or `door`); the set is also pinned by name, and an exclusion that stops

docs/notes/p022-bridge-verdict-checkpoint4.md

@@ -9,6 +9,13 @@
 > [`p022-cp5-mutations.md`](../generated/p022-cp5-mutations.md); nothing is
 > typed here.
 
+> **Read the protocol paragraphs below as history.** #259 checkpoint 4b
+> ([note](p022-bridge-verdict-checkpoint4b.md)) ported the obligation
+> analysis, wired it through the bridge and **promoted both protocol
+> documents out of `rust_replay_excluded`**. Where this note says the OBL
+> analysis is not ported, or that a protocol-bearing document is refused,
+> it describes the state at the time it was written.
+
 Checkpoint 4 ([note](p022-bridge-verdict-checkpoint4.md)) proved identity,
 anchor, kind and tiering over the replayed set, and left three members of
 `ownir.Finding` carried by the goldens but not compared: `message`, `related`

docs/notes/p022-bridge-verdict-checkpoint4b.md

@@ -41,7 +41,7 @@ proposal is marked `done` with a pointer.
 | [P-017](P-017-multi-stack-frontends.md) | Multi-stack frontends (OwnTS / OwnJVM: OwnJava + OwnKotlin) | draft |
 | [P-020](P-020-ownts-react-effects.md) | OwnTS React effects profile (`Own.React`) — the effect-storm angle | draft |
 | [P-021](P-021-async-audit-pack.md) | Async audit pack (`Own.Async`) | draft |
-| [P-022](P-022-rust-core-migration.md) | Rust core migration: crate DAG, patterns, prior art, differential oracle (Python = golden) | in execution — steps 0–4 built (#214/#249); step 5a done (full diagnostic contract, #255 via #319/#320/#321); step 5b SARIF done (#256; `.ownreport.json` struck — a buffer report needing the AST, not a diagnostics surface); step 6a done (`spec/Bridge.md`, #258); step 6b underway (`own-lowered`/`own-bridge`, #259: lowering and MOS parity landed; strict-door validation complete at 216 controls with no known divergence — the first 0/0/0 proved to be the ledger agreeing with its own author, and the second omitted two families that a Python-first defensive-limit change (#326) had to close before the third could measure them; analysis wiring complete at the checkpoint-4 surface — `check_facts` through the real analyses, Layer 3 goldens built, with an executable exclusion ledger naming the protocol boundary, the `u32` coordinate boundary and the OD-1 door controls; **cp5 complete at its surface** — the replay now compares EVERY `Finding` member (the BR-V4 wording matrix and the BR-V5 evidence slices included) and every refusal in full, and a second fixture family freezes the BR-V9 rendered surfaces byte for byte, all against goldens none of which was regenerated; what remains for #259's final acceptance is row 4b (the obligation-protocol analysis) and the coordinate-domain decision. Every count is generated: `docs/generated/p022-cp4-census.md` and `docs/generated/p022-cp5-inventory.md`); step 7a shadow-mode INFRASTRUCTURE **complete for everything the row listed as sliceable now** — checkpoints 1–4 (`ownlang/repro.py` + `own-shadow`: canonical same-input `OwnIR` identity, the reproduction-artifact format, the engine protocol, the `AnalysisTrace` (#269) with stable-ID normalization, and first-divergence reduction over the lowered/MOS layers); the corpus digest-pinned and re-hashed with zero Python, its artifacts, traces and reductions reproduced byte-for-byte, every campaign fully caught, and the computed divergence classification zero on every axis over the lowered+MOS scope, with the declared-boundary status observations named — all of it counted in `docs/generated/p022-shadow-census.md` and `docs/generated/p022-shadow-mutations.md`, never here; the findings are recorded and closed as contract decisions. NOT shadow mode and not parity: the reducer REFUSES the verdict layer and records the refusal, since acceptance compares end diagnostics and stays blocked by #259, and #260's raw-byte same-input invariant is not proved either — cp1 establishes shared CANONICAL document identity, which is the weaker claim; three departures from the slice's brief (checkpoint grouping, the `-0` domain narrowing, `sha2`) are ratified in [the owner-decision ledger](../notes/p022-shadow-infra-owner-decisions.md); Python authoritative until cutover |
+| [P-022](P-022-rust-core-migration.md) | Rust core migration: crate DAG, patterns, prior art, differential oracle (Python = golden) | in execution — steps 0–4 built (#214/#249); step 5a done (full diagnostic contract, #255 via #319/#320/#321); step 5b SARIF done (#256; `.ownreport.json` struck — a buffer report needing the AST, not a diagnostics surface); step 6a done (`spec/Bridge.md`, #258); step 6b underway (`own-lowered`/`own-bridge`, #259: lowering and MOS parity landed; strict-door validation complete with no known divergence — the first 0/0/0 proved to be the ledger agreeing with its own author, and the second omitted two families that a Python-first defensive-limit change (#326) had to close before the third could measure them; analysis wiring complete at the checkpoint-4 surface — `check_facts` through the real analyses, Layer 3 goldens built, with an executable exclusion ledger naming each declared boundary; **cp5 complete at its surface** — the replay compares EVERY `Finding` member (the BR-V4 wording matrix and the BR-V5 evidence slices included) and every refusal in full, and a second fixture family freezes the BR-V9 rendered surfaces byte for byte, all against goldens none of which was regenerated; **row 4b complete** — the obligation-protocol analysis (OBL001–005) is ported into `own-analysis`, its typed values come from the ONE grammar in `own-ir` that the strict door already delegated to, an analysis-level fact-parity family freezes every violation member with zero Python, the bridge maps BR-P3 in its BR-V1 place, and both protocol documents are promoted out of the exclusion ledger without regenerating either golden; what remains for #259's final acceptance is the coordinate-domain decision. Every count is generated: `docs/generated/p022-cp4-census.md`, `docs/generated/p022-cp5-inventory.md` and `docs/generated/p022-cp4b-mutations.md`); step 7a shadow-mode INFRASTRUCTURE **complete for everything the row listed as sliceable now** — checkpoints 1–4 (`ownlang/repro.py` + `own-shadow`: canonical same-input `OwnIR` identity, the reproduction-artifact format, the engine protocol, the `AnalysisTrace` (#269) with stable-ID normalization, and first-divergence reduction over the lowered/MOS layers); the corpus digest-pinned and re-hashed with zero Python, its artifacts, traces and reductions reproduced byte-for-byte, every campaign fully caught, and the computed divergence classification zero on every axis over the lowered+MOS scope, with the declared-boundary status observations named — all of it counted in `docs/generated/p022-shadow-census.md` and `docs/generated/p022-shadow-mutations.md`, never here; the findings are recorded and closed as contract decisions. NOT shadow mode and not parity: the reducer REFUSES the verdict layer and records the refusal, since acceptance compares end diagnostics and stays blocked by #259, and #260's raw-byte same-input invariant is not proved either — cp1 establishes shared CANONICAL document identity, which is the weaker claim; three departures from the slice's brief (checkpoint grouping, the `-0` domain narrowing, `sha2`) are ratified in [the owner-decision ledger](../notes/p022-shadow-infra-owner-decisions.md); Python authoritative until cutover |
 | [P-023](P-023-architecture-guard.md) | Architecture guard (`Own.Arch`): rules.yaml intent model + dependency-graph gate + baseline ratchet | draft |
 | [P-024](P-024-security-audit-profile.md) | Security audit profile (external tools + SARIF adapters; rejects own scanner engine) | draft |
 | [P-025](P-025-obligation-protocols.md) | Obligation protocols (`Own.Protocols`): barrier-sensitive project invariants (OBL001–005) | first slice built (core + bridge + fixtures; extractor pending) |

docs/notes/p022-bridge-verdict-checkpoint5.md

@@ -24,6 +24,8 @@
 * `docs/generated/p022-cp5-mutations.md` — checkpoint 5's recorded mutation
   campaigns, one section per sub-checkpoint, through the same
   `summarize()` as every other campaign in the tree.
+* `docs/generated/p022-cp4b-mutations.md` — checkpoint 4b's two campaigns (the
+  obligation ANALYSIS and its BRIDGE half), rendered the same way.
 * `docs/generated/p022-shadow-census.md` — the step-7a (#260/#269)
   shadow-mode INFRASTRUCTURE census, from
   `tests/shadow_census.compute_shadow_census()` over the committed
@@ -88,6 +90,7 @@
 CENSUS_MD = "p022-cp4-census.md"
 INVENTORY_MD = "p022-cp5-inventory.md"
 CP5_MUTATIONS_MD = "p022-cp5-mutations.md"
+CP4B_MUTATIONS_MD = "p022-cp4b-mutations.md"
 MUTATIONS_MD = "p022-cp4-mutations.md"
 SHADOW_CENSUS_MD = "p022-shadow-census.md"
 SHADOW_MUTATIONS_MD = "p022-shadow-mutations.md"
@@ -109,6 +112,14 @@
     ("checkpoint 5.2 — the refusal text and the core message it quotes", "p022-cp5-2"),
     ("checkpoint 5.3 — the rendered surfaces", "p022-cp5-3"),
 )
+# Checkpoint 4b, on the same one-campaign-per-sub-checkpoint rule: the analysis
+# and the bridge are measured separately because they fail separately — a walk
+# that decides wrongly and a wording that phrases wrongly are different defects
+# with different catchers.
+CP4B_CAMPAIGNS = (
+    ("checkpoint 4b.1 — the obligation analysis", "p022-cp4b-1"),
+    ("checkpoint 4b.2 — the bridge mapping (BR-P3)", "p022-cp4b-2"),
+)
 SELF = "scripts/render_checkpoint_status.py"
 
 
@@ -637,6 +648,19 @@ def fragments() -> tuple[dict[str, str], list[str]]:
         CP5_CAMPAIGNS)
     out[CP5_MUTATIONS_MD] = cp5
     problems.extend(f"mutation campaign {p}" for p in cp5_problems)
+    cp4b, cp4b_problems = render_campaign_set(
+        "# P-022 checkpoint 4b — mutation campaigns",
+        "The obligation-protocol family, measured in two halves: the ANALYSIS "
+        "(`own-analysis/src/obligation.rs` plus the half of the shared grammar it "
+        "reads) and the BRIDGE mapping (BR-P3 — codes, wordings, identity "
+        "derivations, the evidence slice and the tolerant-door rules). Every "
+        "mutation edits a **production** surface (P-022 discipline 2) and every "
+        "workspace member runs for every mutation (discipline 3: no fail-fast); the "
+        "counts are derived from the recorded runs by "
+        "`scripts/mutate_campaign.summarize()`, never typed.",
+        CP4B_CAMPAIGNS)
+    out[CP4B_MUTATIONS_MD] = cp4b
+    problems.extend(f"mutation campaign {p}" for p in cp4b_problems)
     return out, problems
 
 

docs/proposals/P-022-rust-core-migration.md

@@ -367,8 +367,8 @@ committed regeneration path and a zero-Python steady state:
   shared cases — its `Rejected` golden pins the identical error text on both
   sides — so there are **no `rust_replay: false` snapshots left**. Layer 1
   landed in `own-ir` (#259 cp1: 216 controls, 0/0/0); Layer 3 is built and fully
-  compared (below); #259 as a whole remains open on **row 4b** (the
-  obligation-protocol analysis) and the coordinate-domain decision.
+  compared (below); #259 as a whole remains open on the coordinate-domain
+  decision alone, row 4b (the obligation-protocol analysis) having landed.
 - **Layer 3 — final normalized diagnostics.** The findings list per facts
   fixture, and its SARIF/github/msbuild renderings — the outer contract, in
   **two families**. Built at #259 cp4, fully compared at cp5:
@@ -399,11 +399,14 @@ committed regeneration path and a zero-Python steady state:
     SARIF key order is part of this surface.
 
   The manifest's `rust_replay_excluded` ledger names the documents the Rust
-  core **refuses by a declared boundary** — a protocol-bearing document (OBL
-  analysis not ported), a coordinate outside the core's `u32` line domain, a
-  shape the typed Rust door rejects before the bridge runs (OD-1) — each with
-  its reason and an expectation the replay executes, so an exclusion cannot
-  rot. The `summaries` dump (INF-R1) covers the MOS sub-surface. Which BR-V4
+  core **refuses by a declared boundary** — a coordinate outside the core's
+  `u32` line domain, a shape the typed Rust door rejects before the bridge runs
+  (OD-1) — each with its reason and an expectation the replay executes, so an
+  exclusion cannot rot. It listed a third boundary until #259 checkpoint 4b:
+  a protocol-bearing document, which the bridge refused rather than answer for
+  with the OBL analysis unported. Both such documents are now **promoted** —
+  the family is ported (BR-P3), and a re-declared exclusion is a red build
+  rather than a note, because the replay runs every entry it names. The `summaries` dump (INF-R1) covers the MOS sub-surface. Which BR-V4
   wording, BR-V5 slice family and BR-V9 rule the corpus reaches — and the
   recorded disposition of every one it does not — is the generated ledger
   [`p022-cp5-inventory.md`](../docs/generated/p022-cp5-inventory.md).
@@ -452,7 +455,8 @@ Five points belong to this spec rather than to those notes.
    separately; this composition does not.
 
 Nothing there is shadow mode: comparing end diagnostics as an acceptance
-surface is #260's acceptance and is blocked on #259 (cp5 and 4b).
+surface is #260's acceptance and is blocked on #259 — on its final acceptance,
+now that cp5 and 4b have both landed.
 
 Regeneration: each layer gets a `--write` mode mirroring
 `tests/test_cfg_fixtures.py`; a stale committed fixture is a red build; the

docs/proposals/README.md

@@ -10,7 +10,8 @@
 > diagnostics, S = the `summaries` dump) the Rust port must replay it at. A
 > layer marked **L3 ✅** is one whose substance the Rust replay now compares in
 > full rather than carries — the BR-V4 wording matrix and the BR-V9 renderings,
-> which #259 cp4 left deferred and cp5 proved.
+> which #259 cp4 left deferred and cp5 proved, and the BR-P3 protocol rows,
+> which cp4b ported and promoted out of the exclusion ledger.
 > **No family may be silently omitted here**; a new `test_ownir.py` family
 > without a row (or vice-versa) is a red build in spirit — reviewers enforce
 > it until a generated cross-check exists (see OD-7).
@@ -76,7 +77,9 @@
 |---|---|---|---|---|
 | DI graph finders' verdict sets + messages + anchor metadata (DI001/002/003/004/005 unit layer) | `ownlang/di.py` (not the bridge) | BR-B1, BR-P1 | L805–L1048 (18) | (core suite) |
 | advisory codes OWN051/OWN052 registered in `TITLES` (spec↔code drift guard) | `diagnostics.TITLES` | INF-P2/P3 | L1937 | — |
-| effects re-validation skip-not-coerce; protocol first-wins on tolerant door | `_effect_findings`, `_protocol_findings` | BR-D2, BR-P2/P3 | (pinned in `test_effects.py` / `test_obligations.py`) | L3 |
+| effects re-validation skip-not-coerce; protocol first-wins on tolerant door | `_effect_findings`, `_protocol_findings` | BR-D2, BR-P2/P3 | (pinned in `test_effects.py` / `test_obligations.py`) | L3 ✅ |
+| obligation protocols: the lattice, the leaf order, the exits, the loop's single emission, the evidence and the sort key | `ownlang/obligations.py` (not the bridge) | BR-B1, BR-P3 | `test_obligations.py` §1 + `tests/test_obligation_fact_parity.py` | (core suite) |
+| protocol verdict mapping: `(kind, definite)` → OBL001–004, the four line-free wordings, component/handler, the opened→barrier(→late-close) slice, the anchorless OBL005 | `_protocol_findings`, `_protocol_message` | BR-P3, BR-V4/V5/V6 | `test_obligations.py` §3 + the `verdict_protocol_*` Layer 3 cases | L3 ✅ |
 
 ## (e) Verdict mapping
 
@@ -141,9 +144,14 @@ and the BR-V5 `related`/`flow` slices — and every refusal in full; and
 directly-pinned end-to-end surface, and no row's substance is carried without
 being compared. Which wording, slice family and rendering rule the corpus
 reaches — and the recorded disposition of each one it cannot — is the generated
-ledger [`p022-cp5-inventory.md`](../docs/generated/p022-cp5-inventory.md). Two
-row families are outside the replayed set by declaration, recorded in the
-manifest's `rust_replay_excluded` ledger with an executable expectation: the
-protocol rows (§4 BR-P3 — the OBL analysis is not ported, and the bridge
-refuses a protocol-bearing document rather than return an incomplete list) and
-the tolerant-door coercions the typed Rust constructor cannot reach (OD-1).
+ledger [`p022-cp5-inventory.md`](../docs/generated/p022-cp5-inventory.md).
+The **protocol rows** (§4 BR-P3) were the first of two row families outside the
+replayed set: the OBL analysis had no port, so the bridge refused a
+protocol-bearing document rather than return an incomplete list. #259
+checkpoint 4b closed that — the analysis is `own-analysis`'s, the typed values
+come from the one grammar in `own-ir`, the bridge maps them, and both reference
+documents are promoted out of `rust_replay_excluded` and replayed against the
+goldens exactly as they were committed. What is still outside the replayed set,
+recorded in that ledger with an executable expectation, is the coordinate
+boundary (a decision #259 owes) and the tolerant-door coercions the typed Rust
+constructor cannot reach (OD-1).

scripts/render_checkpoint_status.py

@@ -125,7 +125,7 @@
       "name": "protocol_isloaded_violation",
       "corpus": "ownir",
       "pins": [
-        "a document the Rust bridge refuses by a declared #259 boundary (the obligation-protocol analysis is not ported) but the reference captures in full — the artifact records one engine's capture and takes no side on the other's"
+        "a document declaring an obligation protocol: the Rust bridge REFUSED it by a declared #259 boundary until checkpoint 4b ported the OBL analysis, and now produces the verdict layer like the reference. The artifact records each engine's own capture and takes no side on the other's, so what the promotion changed here is one engine's status, not a comparison"
       ]
     },
     {