(3D) PRINT-8: manufacturing manifest — seal the printer-asset join, refuse until a machine is registered

[briansrls]

First slice of PRINT-8: the manufacturing manifest binds a printed thing to the process that produced it.

This is the declared route of a live obligation, not a new idea. coupon_v1_open_obligations already carries PhysicalPrintInstanceAttributionUnsolved routed to AttributeByManufacturingManifestAndHandling. Two coupons off two printers are geometrically identical — the orientation datum makes one orientable, never attributable — so the binding cannot be recovered by inspecting the plastic and must be captured while the part is still on the bed.

No second identity for a printer

product.placement_supply.PhysicalAsset already carries instance identity, a catalog DeclarationRef naming the vendor product row, an optional physical serial and procurement provenance — and its charter already assigns vendor/product facts to extdeps and owned inventory to the product layer. A machine that produces parts rather than occupying a shelf is the same physical object with a role.

Minting PrinterNodeIdentity would have been two names for one unit — the net-concepts-by-re-invention failure of §2. I nearly did: the brief calls it "node-ness of the printers", and that name is what made a new concept look necessary. It was avoided by DFSing the concept DAG first, not by insight.

Why an admission exists at all

PhysicalAssetIdentity is a branded NonEmptyStr. A brand stops an arbitrary NonEmptyStr standing in for one; it does not make a duplicate or unregistered identity unwritable. So a consumer handed a bare identity has a string that looks authoritative and may name nothing.

The repair is deliberately not a stronger printer-only identity — that would put two identities on one machine and re-open what the section above closed. It is a sealed admission at the consuming boundary, the same shape as AdmittedRealizationV0: a value only a join against the authority can mint. A later corpus-wide migration of PhysicalAssetIdentity to an allocator-minted identity replaces this bounded wall without disturbing its consumers.

PrinterAssetAdmission has four arms rather than one refusal carrying a reason string, because a consumer cannot act on — and an operator holding the machine cannot be told — what a collapsed refusal means:

• PrinterAssetAdmitted { binding }
• PrinterAssetAbsent { requested }
• PrinterAssetDuplicate { requested, matches } — the count, so the fold cannot silently take whichever row it reached first
• PrinterCatalogMismatch { requested, expected_module, found_module } — a registered asset is not automatically a printer this program can qualify

The empty inventory is the point, not a gap

owned_printer_inventory is empty, and a witness asserts that the live roster therefore admits nothing. Until a serial is read off a machine, no coupon can be attributed to it. Pre-populating a plausible row would be a fabricated fact about hardware nobody has inspected, and every attribution built on it would inherit that. The tempting arm — admit an unregistered identity "for now" so a print can proceed — is the absorbing fallback, and it fails open exactly when the operator most needs the binding to be real.

Evidence

Six witnesses green by execution. The discrimination claim is verified by mutation, not asserted: replacing the identity join with a => true leaves the empty-inventory and single-row witnesses green and turns w_the_admitted_asset_is_the_one_requested_not_the_first_row red. That witness's annotation claims an implementation returning the first row regardless of the request would pass everything else and fail there — that claim is now executed.

w_the_expected_catalog_module_comes_from_the_manifest reads a1_mini_catalog_module rather than restating the path, so the witness cannot pass by testing a string it wrote itself. That is the exact defect PRINT-1 was reopened for.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TuCmz2HjuYzP6GWLgw11E4