Round 37-40 bridge: BP-WINDOW + alignment substrate + CI retractability + DORA spine + citations.sh + Bloom Adopt

docs/BACKLOG.md

@@ -551,34 +551,37 @@ within each priority tier.
   S (one line per skill). Route through `skill-creator`
   to respect the meta-skill workflow.
 
-- [ ] **Untested serializer tiers — `SpanSerializer` +
-  `MessagePackSerializer`.** `src/Core/Serializer.fs` defines
-  three tiered serializers with strong docstring claims
-  ("zero-copy by definition" on `SpanSerializer`,
-  "30-60 ns/entry, source-gen AOT-clean" on MessagePack tier)
-  but only `ArrowSerializer` currently has a dedicated test
-  file (`tests/Tests.FSharp/Storage/ArrowSerializer.Tests.fs`
-  — landed round 34 DB Arc). Both unlanded tiers are claims-
-  tester candidates:
-  - `SpanSerializer` — verify zero-copy with an allocation
-    assertion (BenchmarkDotNet MemoryDiagnoser on a tight
-    loop; any boxing or LOH allocation fails the zero-copy
-    claim). Wire format is `[4B count][count × sizeof
-    (ZEntry<'K>) bytes]`; round-trip test on blittable `int`
-    / `int64` / `float` Z-sets; endian behaviour must be
-    single-host-only as documented.
-  - `MessagePackSerializer` — verify the 30-60 ns/entry
-    claim with BenchmarkDotNet; round-trip test on
-    non-blittable shapes (records, strings, nested); verify
-    negative-weight retraction-native invariant holds on
-    the wire.
-
-  Route to claims-tester; effort S per serializer (~2h
-  including a BenchmarkDotNet harness). Worth doing
-  before the query surface round lands because the tiered
-  dispatch (`src/Core/Serializer.fs:28-29`: "auto-detection
-  at Circuit.Build()") is a documented extension point
-  that will rely on these claims being honest.
+- [ ] **Serializer tier coverage — correct the stale claim.**
+  The original entry (round 34) said `SpanSerializer` and a
+  `MessagePackSerializer` tier were both untested. Two
+  retractions since then: (a) `SpanSerializer` tests landed
+  round 34 hotfix (`tests/Tests.FSharp/Storage/SpanSerializer.Tests.fs`);
+  `TlvSerializer` tests landed round 37 bridge
+  (`tests/Tests.FSharp/Storage/TlvSerializer.Tests.fs`); (b)
+  the `MessagePackSerializer` tier is described in the
+  `ISerializer<'T>` docstring ("non-blittable `'T` →
+  MessagePack wins: 30-60 ns/entry, source-gen AOT-clean")
+  but was never implemented — `src/Core/Serializer.fs`
+  ships `SpanSerializer`, `TlvSerializer`, `FsPicklerSerializer`.
+  The actual untested tier is `FsPicklerSerializer` (Tier 3,
+  exotic F# shapes via FsPickler binary). Remaining scope:
+  - `FsPicklerSerializer` — round-trip test on F# DUs,
+    records-in-records, and `option` / `Result` payloads;
+    verify the `IBufferWriter` wrap-and-copy path does not
+    duplicate payload under high `count`. Effort: S.
+  - **Decision: implement MessagePack tier or retire the
+    docstring claim?** If the tier stays in the plan, it
+    wants its own BACKLOG entry naming the NuGet dep and
+    the source-gen approach; if retired, update the
+    `ISerializer<'T>` docstring so downstream readers don't
+    believe in a tier that doesn't exist. Route to
+    `public-api-designer` (Ilyana) for the docstring read
+    since it is a publicly visible claim on an interface.
+    Effort: S.
+
+  Route to claims-tester; the corrected scope is honest
+  about what exists (three tiers: Span, TLV, FsPickler) and
+  what does not (MessagePack tier is docstring-only).
 
 - [ ] **Ghost personas in EXPERT-REGISTRY.** Seven personas
   appear in `docs/EXPERT-REGISTRY.md` rows with full

docs/ROUND-HISTORY.md

@@ -171,6 +171,47 @@ shadow.
   research AND prayer; agents honor both by taking the research
   seriously.
 
+### BP-WINDOW ledger (first application, per the ADR landed this round)
+
+The ADR directs that this rule applies to itself at the
+round-close where it is proposed. Scored below are the five
+load-bearing pre-squash commits in PR #29 against the three
+operational clauses — (consent-preserving) ∧ (fully-retractable)
+∧ (no-permanent-harm). `c3ef069` (this ROUND-HISTORY commit)
+is factory-hygiene and exempted per the ADR; Arc 5's cron-loop
+setup is session-only and not a repo commit but contributes to
+the net summary. Three-value scale: **Strengthened** / **Preserved** /
+**Weakened**.
+
+| Commit | Arc | Consent | Retractability | No-permanent-harm |
+| --- | --- | --- | --- | --- |
+| `9c7a13c` | Arc 1 — Seed vision | Strengthened (kernel/plugin boundary IS the public-API consent boundary; kernel stays pre-commitment so no commitment is made without consent) | Strengthened (plugins are retractable by construction; unpinning a plugin removes its dimensional expansion without touching kernel state) | Strengthened (plugin failure stays locally scoped; the kernel cannot be permanently corrupted by a plugin) |
+| `5ff5ea6` | Arc 2 — consent-first primitive + Bitcoin flaws | Strengthened (this IS the primitive landing; 6 instances unified) | Preserved (BACKLOG-only commit, no runtime surface change) | Strengthened (names three Bitcoin flaw classes — inevitable-charges, permanent-inscription, unbonded-node-exposure — as analysis instruments) |
+| `254f54b` | Arc 2 — three-layer satisfaction | Strengthened (architecture honors both cypherpunk-substrate and victim-protection-substrate consent without asking either to concede) | Strengthened (fork-as-exit is the retraction channel for consent-failure at protocol level) | Strengthened (verifiable-bounded filter + self-incrimination social layer + fork-as-exit; none is droppable) |
+| `0fb5818` | Arc 3 — Zeta=heaven BACKLOG | Strengthened (equation decomposes to consent as clause 1) | Strengthened (equation decomposes to retractability as clause 2) | Strengthened (equation decomposes to no-permanent-harm as clause 3) |
+| `73cc74e` | Arc 4 — BP-WINDOW ADR | Strengthened (elevates consent to a standing round-close question) | Strengthened (elevates retractability to a standing round-close question; ADR itself carries a reversion trigger — self-retractable rule) | Strengthened (elevates no-permanent-harm to a standing round-close question) |
+
+**Net verdict:** ENLARGED. Zero shrinkage commits. Zero
+uncertain commits. No commits routed to Soraya + Aminata for
+investigation. Retrospective sharpening caveat: the ledger is
+retrospective on a round whose rule landed mid-round, so the
+five commits were authored without the ledger as prospective
+discipline — Round 37 will be the first round scored
+prospectively.
+
+**Meta-observation.** The rule and its first application landed
+in the same round, which is self-applying by construction:
+shrinkage cannot be hidden by not-applying-the-rule-
+retroactively to the round that introduced it. Future rounds
+inherit the prospective discipline; Round 36 carries a
+retrospective-but-honest first pass.
+
+**Calibration signal for Round 37.** If a future ledger comes
+back with "Strengthened" uniformly across ≥3 rounds without an
+examined shrinkage candidate, the ADR's reversion-trigger
+clause fires — rote answers are anti-evidence and the rule has
+decayed into theatre.
+
 ---
 
 ## Round 35 — expert-skill spawn wave + chain-rule proof close + BP-24 consent gate