feat: ADR-0033 Slice 2 — transactional Apply implementation (review candidate)

[PhysShell]

Implementation review candidate for ADR-0033 Slice 2 (transactional Apply). The contract was independently accepted at the exact reviewed artifact 47e734cfbf1a6bd90c1bd2a035cdc68692378e96 (acceptance act: docs/decisions.log.md @ bad7b44); this PR is the implementation, which needs its own independent acceptance under the contract's §16. Nothing here is self-accepted or marked closed.

Slice 3, the controlled pilot, and any real-/production-/full-corpus labeling were not started and remain BLOCKED. No real corpus file or label was read or modified — every test runs over synthetic fixtures in process-unique temp directories.

Base / head

• Base: main @ 249b585 · Head: 54639fc (after review repair rounds 1–2)
• Scope: song-curation/ (isolated non-workspace crate; posture unchanged) + one evidence doc in docs/audit/. No production crate, no dependency, no unsafe, no Swang/stage/ADR changes.

Commit sequence (unsquashed — the history is the RED→GREEN proof)

Original nine commits (implementation):

#	SHA	Kind	Content
1	dfa7e06	RED	43 preregistered §14 cases (A1–A8, C1–C10, L1–L9, K1–K9, K12, R1–R3, R5, F3, F5) + fixture/builder module. Evidence in message: both test binaries fail E0432: unresolved import griff_song_curation::apply.
2	4d311f4	TEST-FIX	A8 drift fixtures clear the corpus tree before rewriting (stale files tripped the honest step-3 refusal first).
3	f8c9f1c	GREEN	Apply core: §5 strict wire contracts, §6 ordering, §7 laws (chain equations, already-applied precedence, supersession consistency, replacement authority via the single shared replay carrying acting-event attribution — the one §9-permitted internal Slice-1 accommodation), §8 happy path, §10 preservation + round-trip guard, §11 single preflight. Adversarial hardening deliberately left RED.
4	6ce1a69	FIXTURE	Deterministic fault-injection registry (apply::fault): thread-local one-shot hooks, inert in production; lets concurrency cases run the second applier inline on the same thread.
5	bd2a339	RED	20 adversarial cases; message declares the split: 12 genuinely FAILED (F1, F2, F6, F10–F13, C13, C15, K10, K11, R4), 8 passing characterizations (F4, F7–F9, C11, C12, C14, C16).
6	5cc34b3	TEST-FIX	K10 split (finding 1): serde's derived parse already refuses duplicated known fields at step 3, so the distinct §10.3 pass is proven on its actual residual — duplicates inside unknown members.
7	c9489e1	GREEN	Full §8 protocol: exact step-1 order; prefix-closed lock-marker classification; under-lock temp inspection; create_new no-clobber temp; hardlink refusal; reserved .apply-staging namespace; coordination-path collisions; staged tree-agreement re-run; duplicate-key pass.
8	5bb78fb	WITNESS	Phase-8 falsification pass: 14 mutation targets probed; 4 survivors got dedicated killing witnesses (index schema check; null-prev vs non-empty head; record/report wire strictness).
9	bbc7928	DOCS	Implementation evidence (docs/audit/2026-08-slice2-apply-implementation.md) + truthful crate-README update.

Repair round 1 (review of bbc7928: 4 blockers — reserved-area shape; non-regular lock occupant; swallowed release warning; C16 evidence):

#	SHA	Kind	Content
10	8de362a	RED	Witnesses for blockers 1–2 (0 passed / 3 failed evidence in message).
11	9d505cd	RED	Witness for blocker 3 (double-fault release warning; 0/1).
12	987d0a3	GREEN	Directory-entry-level reserved shape; stat-before-read lock-occupant classification; acquisition split so every post-create exit releases via the §8.2 warning channel.
13	92c97d6	TEST-FIX	C16(a) made exact: live non-empty strict marker prefix. 63/63 holds as of this commit (before it the claim was overstated, as the review found).
14	5aca93a	DOCS	Repair-round-1 evidence section.

Repair round 2 (re-review of 5aca93a: 1 blocker — reserved subtree traversed before the shape law):

#	SHA	Kind	Content
15	94e5c38	FIXTURE	walk:descend trace point (inert in production) making "this subtree was never traversed" observable.
16	60fc228	RED	Two armed witnesses: foreign subtree song-curation/extra/deep/…; reserved root symlinked to an external directory. Both FAILED with ApplyIoError { path: ".../song-curation", op: "walk" } — the walk descended / followed the symlink.
17	96ca755	GREEN	The walk skips the reserved root by relative name before any type check or descent (is_dir would follow a symlink merely to answer); check_reserved_shape stays the single no-follow classifier. Both witnesses flip to CorpusTreeDisagreement with the hook never reached.
18	54639fc	DOCS	Repair-round-2 evidence section + this body refresh.

§14 matrix: 63/63 (as of 92c97d6)

Every preregistered case has a same-named test; the full case → test → RED-commit → result table is in docs/audit/2026-08-slice2-apply-implementation.md. Coverage: 23/24 new typed refusals exercised (+ CuratedManifestPathNotDistinct implemented as the hard guard §12 itself declares structurally unreachable — flagged as finding 3, not silently inherited); 11/11 Apply-reachable Slice-1 refusals exercised through the literally reused verify_plan; the 3 ledger-side members proven intentionally unreachable. The six review-repair witnesses (rounds 1–2) are additional to the preregistered 63.

Validation matrix (current head)

Check	Result
isolated crate suite	118 passed / 0 failed (45 frozen Slice-1 + 73 Slice-2)
frozen Slice-1 suite	45/45, public API and semantics untouched
cargo test --workspace	1535 / 0 (workspace untouched by the repair rounds)
cargo clippy --workspace --all-targets -- -D warnings	clean
crate clippy (deny(all))	clean
cargo fmt --all -- --check	clean
cargo doc --no-deps (workspace + crate)	only two pre-existing warnings (swang ambiguous link; a frozen Slice-1 doc comment), untouched
MSRV cargo +1.92 check (crate, all targets)	clean

Findings (no contract law changed; none required a STOP)

1. Duplicate known fields refuse even earlier than §10.3: serde's derive rejects them at the step-3 parse (CorpusTreeDisagreement); the distinct duplicate-rejecting pass guards its real residual — duplicates inside unknown members (K10 split proves both branches). Fail-closed both ways.
2. Unresolvable non-index inputs (missing corpus dir / output parent) map to ApplyIoError { op: canonicalize… } — the single typed I/O boundary; no new refusal invented.
3. §14's coverage sentence vs the structurally unreachable CuratedManifestPathNotDistinct guard: read together with §12, the guard belongs to the documented-unreachable set; recorded for the reviewer to confirm that reading explicitly.

Stop conditions

None triggered across the implementation and both repair rounds: no §14 case required changing a law; no new refusal, schema change, ordering change, frozen-Slice-1 observable change, new dependency, or unsafe; no contradiction found inside 47e734c.

Do not merge; do not self-accept. This PR stops as the implementation review candidate, pending independent re-review at exact head 54639fc.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kc6r6PhKQCNqArwkijUnzn

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e3b14a6e-7af4-4428-a203-032905cb7633

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[PhysShell]

Hostile implementation review on exact head bbc79288f66e8633a3f3887eeface6632e04ac55: REVIEW FAILED — implementation acceptance blocked.

I reviewed the implementation against the independently accepted contract artifact 47e734cfbf1a6bd90c1bd2a035cdc68692378e96, not against the evidence summary. The commit graph is intact (9 commits ahead of base, unsquashed), scope is confined to the isolated song-curation/ crate plus its evidence doc, and the current GitHub Actions run is green. The core ordering also survives review: lock before temp inspection and parsing, literal verify_plan, already-applied before chain, and the step-11/12 commit point are in the accepted order.

However, I found three implementation blockers and one acceptance-evidence blocker. None requires reopening the accepted contract; all are implementation/test defects relative to it.

1. BLOCKER — reserved-area shape law does not actually reject every foreign entry

Accepted §4.2 / §6 step 3 is stronger than the current implementation: when song-curation/ exists, the only permitted entries are the two tool-owned proof artifacts as regular files directly at the reserved root; any subdirectory or nested entry is foreign.

Current walk() recursively descends directories but never records directory entries themselves, and check_reserved_shape() checks only the relative names that walk() returned. Consequences:

• an empty <corpus>/song-curation/extra/ is completely invisible and passes;
• the allowed names are not checked to be regular files, so a symlink / other non-regular entry at song-curation/manifest.json or song-curation/apply-report.json can satisfy the name-only test.

K12 does not kill the first defect: its nested-directory half creates extra/x.json, so the file is what gets detected; it never tests an empty foreign subdirectory. This violates the contract's recursive shape law and makes the evidence claim for K12 too weak.

Required repair: add failing witnesses for empty subdirectory and allowed-name non-regular entry, then make the shape check inspect directory entries/file types rather than infer shape from the file-only corpus walk. No refusal or spec change is needed: both are CorpusTreeDisagreement exactly as accepted.

2. BLOCKER — pre-existing non-regular lock occupant is not classified at the lock boundary

On create_new(lock) → AlreadyExists, acquire_lock() immediately does fs::read(lock_path) and only then performs prefix classification. That assumes every pre-existing occupant is a readable regular file.

The accepted step-1 law says pre-existence is classified at the lock boundary: marker-prefix content → ApplicationIndexLocked; anything else/unproven → ApplicationIndexLockPathOccupied. §12 explicitly reserves ApplyIoError for lock-acquisition I/O causes other than pre-existence.

Concrete counterexamples:

• a directory at .foo.lock produces AlreadyExists, then the read fails, so the run returns ApplyIoError instead of ApplicationIndexLockPathOccupied;
• a FIFO/special file is worse: reading it can block, contradicting the fail-closed/no-wait coordination protocol.

C15 only covers a regular second-index file and therefore misses this class.

Required repair: classify file type without following/reading unsafe non-regular occupants; only read content when the occupant is a regular file for which content classification is meaningful. Non-regular/unproven occupants must fail closed as ApplicationIndexLockPathOccupied and remain untouched. Add a deterministic witness at least for a directory occupant; do not add a new refusal.

3. BLOCKER — marker-publication failure can swallow a failed lock release

After create_new(lock) succeeds, the lock has been acquired. If lock:after_create or the marker write_all fails, acquire_lock() does best-effort remove_file(lock_path) via let _ = ... and returns the I/O refusal directly. apply() treats every acquire_lock error as pre-acquisition and returns it with lock_release_warning: None.

If that cleanup/remove also fails, the stale lock remains but the release failure is silently discarded. Accepted §8.2 explicitly fixes the observable shape for this state: refusal stays the primary outcome and failed release is attached as the orthogonal lock-release warning. Release failure must never disappear merely because the primary failure happened during marker publication.

Required repair: preserve the distinction between “lock was never acquired” and “lock acquired, then marker publication failed”; route the latter through the same release-warning semantics as every other post-acquisition exit. Add a deterministic fault witness for primary marker-write failure + release/cleanup failure. No taxonomy change is needed.

4. ACCEPTANCE-EVIDENCE BLOCKER — C16 is not the preregistered live-partial-marker case

The evidence doc claims §14 63/63, but current C16(a) observes an empty marker: the hook runs immediately after create_new, nested Apply observes zero bytes, and the assertion explicitly says “an empty prefix is a Griff lock”. C16(b) covers a non-empty partial marker only as stale/crash debris.

The accepted C16 specifically requires a non-empty partial marker in both manifestations: (a) observed live by a concurrent applier while marker publication is incomplete; (b) left permanently by a crash. That distinction was the final r6→r7 contract blocker and is load-bearing evidence, not decorative wording.

The implementation's prefix check appears capable of classifying a live partial marker correctly, but the required witness is absent, so 63/63 is presently overstated. The existing lock:after_create hook is sufficient to make the live half exact: write a non-empty strict prefix at the held lock path inside the hook before invoking the nested second Apply, then allow the first writer to continue. Update the evidence only after the exact case is green.

What held

I did not find a reason to reopen 47e734c. The following survived this pass: the 12-step ordering around parse/index/verify/already-applied/chain/authority; literal Slice-1 verify_plan reuse; the single replay attribution accommodation; hardlink refusal; under-lock temp inspection; create_new temp commit; raw-copy/touched-file preservation split; duplicate-key pass; staged tree re-read; the single real song_holdout_preflight; commit-point primary-outcome semantics in the normal step-12 paths. I also did not promote an artificial curated-manifest-corruption scenario to a blocker: the accepted §5.3 equality is established by construction plus the real preflight, and the production construction satisfies that law.

The public apply::fault::{set, clear} harness is a minor surface/documentation smell because the evidence calls it “test harness, not contract surface”, but I am not blocking acceptance on that alone.

Required history discipline

Please repair this as evidence, not as a flattened patch:

1. tests-only RED witnesses for the reserved-area and non-regular-lock defects;
2. fixture-only support if needed for the marker-write + release-failure double fault;
3. tests-only RED for that result-shape defect;
4. GREEN implementation repair;
5. exact C16 live non-empty-partial witness / test correction;
6. docs/evidence update with the corrected matrix statement and new SHAs.

Keep the existing 9 commits intact; do not squash/rewrite the prior RED→GREEN record.

State at exact bbc7928: IMPLEMENTATION REVIEW FAILED / DO NOT MERGE / DO NOT RECORD ACCEPTANCE. Contract acceptance at 47e734c remains valid; Slice 3, controlled pilot, and real/full-corpus labeling remain blocked.

[PhysShell]

Repair round 1 (5aca93ad6f7b8b9137d278d5ce95caa7786f306c) — all four review blockers addressed under the mandated history discipline. The original nine commits are untouched (no squash/rewrite); the repairs are five new commits in the required RED-witness → GREEN → evidence order. No contract law changed; every expected refusal is the one §12 already assigns.

Blocker	RED witness	GREEN / correction
1 — reserved-area shape law incomplete (empty foreign subdir invisible to the file-only walk; allowed names checked by name only)	8de362a: review1_empty_foreign_reserved_subdir_refuses, review1_reserved_allowed_name_must_be_a_regular_file — RED evidence: both wrongly applied	987d0a3: check_reserved_shape inspects the reserved root at the directory-entry level — an empty subdirectory is foreign, and manifest.json / apply-report.json must be regular files (symlink_metadata, no following); both refuse CorpusTreeDisagreement naming the entry
2 — non-regular lock occupant fell through fs::read into ApplyIoError	8de362a: review2_directory_lock_occupant_classifies_occupied — RED evidence: returned ApplyIoError	987d0a3: classify_lock_occupant stats before ever reading; a non-regular (directory/FIFO — never read, so nothing can block the no-wait protocol), unstatable, or unreadable occupant fails closed as ApplicationIndexLockPathOccupied and stays untouched; prefix classification is reached only for regular readable files; ApplyIoError stays reserved for non-pre-existence causes
3 — marker-publication failure swallowed a failed release	9d505cd: review3_marker_failure_with_release_failure_keeps_the_warning — double fault (marker + release) and single fault; RED evidence: warning was None on the double fault	987d0a3: acquisition split at the true acquisition point — create_lock (never-acquired failures, no warning channel) vs publish_marker (post-acquisition); every post-create exit now releases through the single release_lock §8.2 channel, so a failed release always attaches as the orthogonal warning with the primary refusal preserved
4 — C16(a) observed an empty, not a non-empty, live partial marker	—	92c97d6: the lock:after_create hook materializes a non-empty strict prefix at the held lock path, asserts the observed bytes are exactly that prefix, then runs the inline second applier (must classify ApplicationIndexLocked); the first writer completes marker publication and commits. The crash half was already exact and is unchanged

Evidence update: 5aca93a appends the repair-round section to docs/audit/2026-08-slice2-apply-implementation.md, including the corrected matrix statement — 63/63 holds as of 92c97d6; before it the claim was overstated, exactly as the review found. New totals: isolated crate 116 passed / 0 failed (45 frozen Slice-1 + 71 Slice-2, including the four review witnesses); crate clippy deny(all) clean; fmt clean; cargo +1.92 check --all-targets re-verified clean. The repairs touch only the isolated crate; workspace results are unaffected.

State: implementation acceptance pending independent re-review at exact head 5aca93a. Not merged, not self-accepted; contract acceptance at 47e734c unaffected; Slice 3 / controlled pilot / real-corpus labeling remain BLOCKED.

---

Generated by Claude Code

[PhysShell]

Independent implementation re-review on exact head 5aca93ad6f7b8b9137d278d5ce95caa7786f306c: REVIEW FAILED — one remaining implementation blocker.

The four findings from the previous review are genuinely repaired:

1. reserved-area empty subdirectories and allowed-name non-regular entries now refuse as CorpusTreeDisagreement;
2. pre-existing non-regular .lock occupants are classified without reading them, so directory/FIFO-style occupants cannot fall into ApplyIoError or block the no-wait lock protocol;
3. marker-publication failure is now correctly post-acquisition and every such exit flows through the single release_lock warning channel;
4. C16(a) now exactly witnesses a live non-empty strict marker prefix, so the preregistered 63/63 claim is no longer relying on the prior empty-prefix approximation.

The repair history is also valid evidence: bbc7928 -> 5aca93a is exactly five appended commits, the two RED commits are tests-only and reproduce the old failures, 987d0a3 is the GREEN repair, 92c97d6 is the exact C16 evidence correction, and 5aca93a is docs-only. Current GitHub Actions run is green.

Remaining BLOCKER — the reserved area is shape-checked only after the recursive corpus walk, so it is not actually excluded from enumeration

Accepted §4.2 / §6 step 3 says the reserved song-curation/ subtree is excluded from corpus-content enumeration and independently shape-checked: only the two proof artifacts as regular files directly at its root are allowed; any subdirectory/nested/non-regular entry is foreign.

Current load_snapshot does the opposite order:

1. walk(corpus, corpus, &mut files) recursively traverses the whole tree;
2. only after that does it call check_reserved_shape(&reserved_root);
3. reserved paths are filtered out only after both operations.

walk() uses Path::is_dir(), which follows directory symlinks. Therefore a foreign reserved-root directory/symlink is traversed before the shape law gets a chance to refuse it. This is more than wasted work:

• song-curation -> <external directory> causes Apply to enumerate outside the corpus even though the contract says that subtree is excluded;
• song-curation -> <corpus root> (or a loop beneath the reserved area) can recurse through the alias repeatedly until a path-length / recursion failure, surfacing ApplyIoError or nontermination-like behaviour instead of the required immediate CorpusTreeDisagreement for the foreign reserved entry;
• an arbitrarily large foreign tree under song-curation/extra/ is recursively walked even though the immediate extra entry is already sufficient to refuse under the accepted shape law.

The new witnesses cover an empty real subdirectory and a symlink file at an allowed name, but they do not cover a reserved-root / nested directory symlink that Path::is_dir() follows before check_reserved_shape.

Required repair is still entirely inside accepted 47e734c: make the corpus walk skip the reserved root before descending into it, and shape-check that root independently at directory-entry level. Add a witness that proves a reserved directory symlink/foreign subtree is refused as CorpusTreeDisagreement without being traversed. A safe deterministic fixture is preferable to an actual self-loop; a fault/trace hook proving “walk never enters reserved root” is fine if needed. No new refusal, schema, or contract change is required.

Non-blocking cleanup

The PR's actual head is 5aca93a, but its body still says Head: bbc7928 and still shows the pre-repair 112/0 validation summary / original 9-commit sequence. The evidence document is current, so I am not treating this as a contract blocker, but update the PR body after the final repair so the review surface does not point at a stale candidate.

State at exact 5aca93a: IMPLEMENTATION REVIEW FAILED / DO NOT MERGE / DO NOT RECORD ACCEPTANCE. Contract acceptance at 47e734c remains valid; Slice 3, controlled pilot, and real/full-corpus labeling remain blocked.

[PhysShell]

Repair round 2 (54639fc) — the remaining re-review blocker addressed under the mandated history discipline. The prior 14 commits are untouched; the repair is four appended commits in FIXTURE → RED → GREEN → DOCS order. No contract law changed; the refusals involved are the ones the accepted taxonomy already assigns.

Blocker

Repair

Reserved subtree shape-checked only after the recursive walk — load_snapshot ran walk() over the whole tree before check_reserved_shape, and Path::is_dir() follows directory symlinks, so a foreign reserved subtree was traversed (a symlinked reserved root even enumerated outside the corpus; alias loops could degrade into ApplyIoError/path-length failures) before the §4.2 / §6 step-3 law could refuse

94e5c38 FIXTURE: walk:descend trace point, firing before every descent below the corpus root — inert in production, it makes "this subtree was never traversed" observable. 60fc228 RED: two armed witnesses over corpora with no legitimate subdirectory — a foreign subtree song-curation/extra/deep/… and song-curation -> <external dir>; RED evidence in the message: both FAILED with the identical defect signature ApplyIoError { path: ".../corpus/song-curation", op: "walk", detail: "injected fault" }, i.e. the walk descended into / followed the symlinked reserved root. 96ca755 GREEN: the walk computes each entry's relative name first and skips the reserved root before any type check or descent (is_dir would follow a symlink merely to answer); check_reserved_shape stays the single, no-follow, directory-entry-level classifier of that root. Both witnesses flip to the shape law's own CorpusTreeDisagreement — the foreign subtree refused on its immediate root entry, the symlinked root refused as "not a directory" via symlink_metadata — with the trace hook never reached. The post-walk is_reserved filter remains only as a redundant invariant.

The chosen witness mechanism is the trace-hook option the review explicitly allowed ("a fault/trace hook proving 'walk never enters reserved root' is fine"): the fixture corpora contain no subdirectory other than the planted reserved subtree, so an armed always-fail walk:descend hook means any descent at all degrades the run — a clean CorpusTreeDisagreement is possible only if the reserved root was never entered. This avoids an actual self-loop fixture entirely.

Non-blocking cleanup done as requested: the PR body now describes the real head (54639fc), the full 18-commit sequence across both repair rounds, and the current validation matrix.

Evidence: 54639fc appends the round-2 section to docs/audit/2026-08-slice2-apply-implementation.md. §14 matrix unchanged — 63/63 continues to hold (round-2 witnesses are additional, like round 1's). New totals: isolated crate 118 passed / 0 failed (45 frozen Slice-1 + 73 Slice-2); crate clippy deny(all) clean; fmt clean; cargo +1.92 check --all-targets clean. Only the isolated crate is touched; workspace results unaffected.

State: implementation acceptance pending independent re-review at exact head 54639fc. Not merged, not self-accepted; contract acceptance at 47e734c unaffected; Slice 3 / controlled pilot / real-corpus labeling remain BLOCKED.

---

Generated by Claude Code

[PhysShell]

Independent implementation re-review on exact head 54639fc8bb2c993211ca8ca13e8e7fee4765f6e1: IMPLEMENTATION REVIEW PASS — no remaining contract-level or implementation blockers found.

This re-review was against the independently accepted contract artifact 47e734cfbf1a6bd90c1bd2a035cdc68692378e96 and includes the full repair history, not only the final diff.

Round-2 blocker closure

The remaining §4.2 / §6 step-3 defect is closed correctly. walk() now computes the relative entry name before any type query and skips the exact reserved root song-curation before Path::is_dir() or descent. The reserved root is then classified independently by check_reserved_shape using no-follow metadata and directory-entry inspection. Therefore:

• a foreign subtree below song-curation/ is never corpus-enumerated before refusal;
• a reserved-root symlink to an external directory is never followed;
• an alias loop at the reserved root cannot degrade into recursive walk / path-length ApplyIoError;
• the accepted refusal remains CorpusTreeDisagreement, with no taxonomy or ordering change.

The evidence is load-bearing and valid: 94e5c38 is fixture-only; 60fc228 is tests-only RED and demonstrates both old failures via the walk:descend trace hook; 96ca755 is the GREEN repair; 54639fc is docs-only. The two new witnesses prove non-traversal, not merely the eventual refusal.

Previous repair round

I rechecked the four round-1 findings while reviewing the new flow. They remain closed: recursive reserved-area shape including empty subdirectories/non-regular allowed names; non-regular lock occupants are classified without unsafe reads; marker-publication failure preserves the §8.2 release-warning channel after true acquisition; C16(a) is the exact live non-empty partial-marker case.

Head-wide evidence

• PR feat: ADR-0033 Slice 2 — transactional Apply implementation (review candidate) #191 remains open, unmerged, mergeable, exact head 54639fc8bb2c993211ca8ca13e8e7fee4765f6e1.
• Branch is exactly 18 commits ahead of base 249b585; prior history was not rewritten.
• Scope remains the isolated song-curation/ crate plus its audit document; no production/workspace/ADR/Swang scope creep appears in the diff.
• The preregistered §14 matrix is 63/63 as of 92c97d6; six review-repair witnesses are additional.
• The documented CuratedManifestPathNotDistinct non-exercise is acceptable: the accepted contract itself marks that v1 guard structurally unreachable, so it is not an untested reachable refusal.
• Current GitHub Actions run on this exact head is completed successfully, 14/14 jobs, including check and msrv.
• The public apply::fault harness remains the previously noted minor surface/documentation smell; it is not a blocker and does not alter production runs unless explicitly armed.

I found no reason to reopen 47e734c, no missing refusal, no schema/order deviation, and no remaining witness mismatch.

Substantive decision: implementation at exact SHA 54639fc8bb2c993211ca8ca13e8e7fee4765f6e1 is independently ACCEPTED on review merits. Per the repository's established governance pattern, merge itself is not the acceptance act; record the implementation acceptance separately in docs/decisions.log.md against this exact reviewed SHA after merging the PR without changing the reviewed head/history.

That acceptance opens no later scope: Slice 3, the controlled pilot, and any real/full-corpus labeling remain BLOCKED behind their own gates.