docs(r3): §1.8 row #62 status refinement — file-ingestion ratified shape (b) FileAttachment extending #53 per Director msg_09df44c6

[briansrls]

Summary

• Updates §1.8 row Workflow capabilities next steps #62 (substrate_gap_file_ingestion_closed) status: DECLARED → DECLARED-with-ratified-shape-and-sub-canvas-pending
• Records Director ratification of disposition (b) — workflow-substrate FileAttachment carrier extending gate Cursor/lane b workflow 2281 #53
• Enumerates disqualified candidates (A/C/D), anti-patterns for post-ratification reviewers, sub-canvas queue, and include_str! audit at HEAD

Authority

• Director ratification msg_09df44c6 (zesty-bear-812) on canvas PR docs(r3): gate #62 file-ingestion substrate-shape canvas #2820 (warm-wolf-698 / R3 Substrate Mgr)
• docs/r3-program-plan.md §4.3 line 505 verbatim: "T-Workflow-As-Data file-ingestion substrate (workflow_substrate_carriers_landed extended to file-attachment)"
• docs/r3-program-plan.md §1.8 row Cursor/lane b workflow 2281 #53 (parent gate for sibling-carrier extension)
• Recursive feedback_substrate_shape_belongs_in_mgr_canvas for sub-canvas trigger

Director rationale (preserved on-ledger)

(b) wins on 5 axes:

1. §4.3 verbatim authority — locked design names the closure path; (a) doesn't match
2. Lane fit — gate Workflow capabilities next steps #62 is T-WAD; carrier extension is canonical pattern
3. Sibling-carrier precedent — WorkflowSecret + CronExpression in Cursor/lane b workflow 2281 #53 establish the pattern
4. Construction-first — model workflow concept, not compile-time intrinsic
5. No parallel-authority risk — (a)+(b) coexistence violates §P1

Disqualified:

• (a) compile-time read_utf8_file — P5-style intrinsic, doesn't match §4.3; re-introduces include_str! semantics under new syntax
• (c) precedent-mirror — no precedent enumerated; §4.3 already names answer
• (d) A+B bundle — structural parallel-authority

Cascade

• PR substrate_gap_file_ingestion_closed #2819 (bright-otter-731 candidate-A draft) STAND DOWN per Director disposition (bright-otter-731 audit msg_e85224dc preserved as diagnostic-trail input)
• Sub-canvas pending: Substrate Mgr authors FileAttachment carrier-shape canvas (type def + fields + workflow-context coupling)
• Worker dispatch follows sub-shape ratification

Test plan

• §1.8 row Workflow capabilities next steps #62 reflects ratified shape + sub-canvas pending + disqualified candidates + anti-patterns + audit-at-HEAD
• Authority chain cites Director msg + §4.3 line 505 + §1.8 row Cursor/lane b workflow 2281 #53
• No drift vs Director rationale (5 axes, 4 candidate dispositions, anti-pattern list)

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 3fcd374e · Trigger: manual
• Comparison: main @ 5bc6ad44 ... docs/r3-row-62-ratified-shape-2026-05-13 @ 3fcd374e
• Conversation: View conversation

---

1. Story of the diff

This PR is a docs-only refinement of the R3 §1.8 program ledger in docs/r3-program-plan.md. It first fixes the ledger arithmetic so the 104 closure gates are explained as 97 + 6 T-WAD + 1 Miss-class dissolution at docs/r3-program-plan.md:207. It then turns gate #62 from a vague file-ingestion gap into an executable substrate direction: file ingestion is to be modeled as a workflow-substrate FileAttachment carrier extending gate #53, with exactly the ratified five fields and explicit rejected alternatives such as include_str!, AttachmentEncoding, WorkflowAssetPath, and premature List<FileAttachment> coupling at docs/r3-program-plan.md:290. Finally, it corrects gate #104’s Miss-dissolution scope after review: the substrate/testgen migration is now scoped to 70 Lookup<...> matches across six files, with explicit terminal grep predicates and a required collapse to Witness<C>::Violates { reason, at } at docs/r3-program-plan.md:332.

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — the diff does not mutate Dag or add implementation code, but where it defines future substrate work it names the carrier and exact substrate shape instead of leaving the worker to infer it: FileAttachment { subject_node: NodeId, content_digest: ContentHash, producer_id: WorkflowProducerId, workflow_run_id: WorkflowRunId, attached_at_ns: Nanoseconds } at docs/r3-program-plan.md:290.

1. INVARIANTS.md + modeling-discipline.md.

Compliant — the diff actively protects modeling discipline: gate #62 rejects parallel or lossy shapes by forbidding path authority, an AttachmentEncoding coproduct, field deviations, and include_str!-style ingestion at docs/r3-program-plan.md:290; gate #104 removes the Lookup<C>::Miss parallel class by requiring collapse into Witness<C>::Violates { reason, at } and zero-match terminal predicates at docs/r3-program-plan.md:332.

1. CODING.md.

N/A — this is markdown planning text only; it adds no Rust functions, APIs, helpers, methods, result shapes, or implementation naming surface.

1. TESTING.md.

Compliant — no executable behavior changes, so no same-PR test is required, but the planning rows name the test obligations that must land with implementation: gate #62 requires a bootstrap ratchet test and existence-proof use case at docs/r3-program-plan.md:290, and gate #104 requires universal-coverage TestClaim rows plus grep-zero regression guards at docs/r3-program-plan.md:332.

1. LOCKED DESIGN DECISIONS.

Compliant — the diff records ratified/locked decisions rather than diluting them: gate #62 preserves the Director-ratified FileAttachment shape and disqualified candidates at docs/r3-program-plan.md:290, and gate #104 preserves the locked Miss dissolution to Witness<C>::Violates while correcting the scope from 64 to 70 matches at docs/r3-program-plan.md:332.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the new follow-on work is bounded and tracked. Gate #62 names the follow-on blob-store trigger, the unresolved content_digest → bytes resolution question, strict field bounds, anti-patterns, and the next worker brief acceptance shape at docs/r3-program-plan.md:290; gate #104 bounds the migration with Part A/Part B phases, status progression, and terminal predicates at docs/r3-program-plan.md:332.

2.5. Top-down PM intent review

Compliant — the PR tightens the plan rather than changing its meaning. The count correction at docs/r3-program-plan.md:207 makes the R3 ledger internally coherent; the gate #62 refinement at docs/r3-program-plan.md:290 keeps file ingestion inside modeled workflow substrate instead of allowing hand-written compile-time file reads; and the gate #104 correction at docs/r3-program-plan.md:332 prevents a worker from executing an under-scoped 64-site Miss cleanup when the ratified scope is 70 sites across six files. I do not see a diff-cited mismatch between the PM-level direction and the edited plan.

3. Verdict

APPROVE

This is a docs-only authority refinement that makes the R3 work plan more precise, not looser. The substrate and test obligations it introduces are named, bounded, and tied to dissolution triggers; I did not find a diff-cited invariant violation.