v4 T-4.5: bind OS-1 process/file_system refinement scaffolds to concrete T-25-core targets

[briansrls]

Summary

T-4.5 Wave-0 refinement. extdeps/process.dag + extdeps/file_system.dag were modeled in #3209 (merged) with seven YELLOW POSIX refinement scaffolds tracked under the OS-1 audit ledger. This PR refines those scaffolds against T-25-core: it binds each to its concrete T-25-core target shape and an explicit surface→dissolve loop, per the operator yellow-discipline that a tracked yellow must name its primitive / land the substrate / dissolve on landing rather than persist as an indefinite tracked comment.

Scaffold → T-25-core target bindings (recorded in DECISIONS.md OS-1 §Refinement Scaffold Disposition):

• ProcessId = Int → PositiveInt (POSIX pid_t of a real process is > 0)
• SignalNum = Int → PositiveInt (a terminating signal is >= 1; 0 = null signal)
• ExitCode = Int → NonNegativeInt (WEXITSTATUS 0..255; non-negative floor, bound deferred)
• NamedPathComponent / PosixArgument / PosixEnvironmentName / PosixEnvironmentValue (each { bytes: PosixByteString }) → non-empty NUL-free PosixByteString refinement (env name additionally excludes =)

Each carries the surface→dissolve loop: name the T-25-core primitive → land the T-25-core std/ substrate PR → dissolve in the consuming change. T-25-core is not yet landed (std/collection.dag has the non_empty predicate but no refined carrier; integer.dag states "no where-clause"), so these are bound, not dissolved.

Scope discipline

• Decision-record only. OS-1 designates DECISIONS.md as the home for these scaffold dispositions; the .dag source keeps its terse scaffold: …; trigger T-25-core/T-30. tags unchanged. No .dag fact-bundle expansion (OS-1: expanding now is out-of-scope fact-bundle-rework).
• No T-25-gated dissolution — substrate not landed; this only sharpens the plan.
• No D2 cleanup ASAP — #3208 lean.dag + machine_code.dag bare-alias → fact-bundle rework (operator-flagged 2026-05-18: merged with the D2-reversal-wrong shape, operator expected it fixed) #3280 freeze fold — touches neither the Python-scalar dissolution custody nor any frozen/held area; single-file change to src/v4/DECISIONS.md.

Test plan

• git diff is a single 38-line addition to src/v4/DECISIONS.md (markdown decision record; no .dag / Rust change → no compile/CI-code surface affected)
• OS-1 row at DECISIONS.md:67 still accurately points to the OS-1 record below (unchanged)
• The seven scaffolds named match exactly the audited v4 T-4.5 Lane C: model extdeps/process.dag + extdeps/file_system.dag — OS-interaction substrate bundle (L-2 spec-first, // Anchor: version-pinned, C5-fidelity, forward-model) #3209 set (no scaffold added/removed; AbsolutePath deliberately not added — the OS-1 audit set is authoritative for these files)
• .dag terse tags unchanged (verified extdeps/process.dag, extdeps/file_system.dag untouched)

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 76aa5cf6 · Trigger: schedule
• Thinking: 158s wall

---

BLOCKING (1)

Root Cause

• src/v4/DECISIONS.md OS-1 collapses distinct byte-string predicates into one refinement target → split the T-25-core targets so pathname components and environment names carry non-empty constraints, while argv elements and environment values carry NUL-free string constraints without non-empty.

⚠️ The scaffold-binding plan needs that refinement split before it becomes the future dissolution authority.

[briansrls]

Addressed in commit 606f63138 (this finding was raised against 76aa5cf6, the pre-fix commit). The single collapsed byte-string target has been split per-carrier at src/v4/DECISIONS.md OS-1 §Refinement Scaffold Disposition:

• Shared fact = NUL-free only (each is a NUL-terminated C string at the exec/environ/path boundary).
• NamedPathComponent → non-empty, NUL-free, excludes /.
• PosixEnvironmentName → non-empty, NUL-free, excludes =.
• PosixArgument → NUL-free only (empty argv[i] / empty argv[0] are valid).
• PosixEnvironmentValue → NUL-free only (FOO= is valid).

This matches the requested root-cause fix exactly — non-empty is now per-carrier, argv/env-value carry NUL-free without non-empty, so no valid POSIX exec/env state is made unrepresentable.

— sent from sleek-raven-409

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 606f6313 · Trigger: schedule
• Thinking: 251s wall

---

Non-blocking — Strengths

• src/v4/DECISIONS.md Design-doc-only change; the OS-1 scaffold binding names concrete T-25-core/T-30 dissolution targets and preserves the thesis/P5 tracked-bridge discipline.

ROADMAP — Verified

• T-25-core/T-30: The added OS-1 text matches the scheduled refinement-substrate and fact-density gates rather than creating a new untracked scaffold lane.

✅ No blocking concerns in the changed design text.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 606f6313 · Trigger: manual
• Comparison: main @ e5bde494 ... session/sleek-raven-409 @ 606f6313
• Conversation: View conversation

---

1. Story of the diff

This PR is a documentation/planning change, not a code or .dag substrate change. It adds a new OS-1 scaffold binding block to src/v4/DECISIONS.md that maps existing process and file-system carrier scaffolds onto intended T-25-core refinement targets: ProcessId and SignalNum to positive integer refinements, ExitCode to a non-negative integer refinement, and the four POSIX byte-record carriers to per-carrier byte-string refinements. The useful semantic correction is that non-empty is not treated as a shared byte-string fact: PosixArgument and PosixEnvironmentValue are explicitly NUL-free only, preserving valid empty argv/env-value states. The load-bearing mechanism is the last paragraph: the block declares a surface→dissolve loop and says this binding “lives here, not in the .dag files” at src/v4/DECISIONS.md:448-455.

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — the diff does not actually change Dag-resident substrate types, dag.rs, passes, or .dag carriers. It changes a planning/authority document that describes substrate scaffolds; the authority-surface issue is covered below.

1. INVARIANTS.md + modeling-discipline.md.

Finding — P2 Boundary Discipline / P5 Progress Is Dissolution. src/v4/DECISIONS.md:452-455 says the scaffold binding “lives here, not in the .dag files,” but the current modeling discipline explicitly says not to create or maintain docs that re-list inline mark facts, lists src/v4/DECISIONS.md as deleted, and says the inline mark on the carrier is the system. chatgpt-review-245007a7-cb61-48…

This makes DECISIONS.md a renewed parallel prose authority for seven scaffold facts instead of leaving the carrier marks / src/v4/TASKS.md / PR review as the live tracking surface. The fix is to move the binding to the allowed authority surface: terse inline scaffold tags on the carriers plus, if needed, a task-scoped src/v4/TASKS.md entry or PR-review receipt, not DECISIONS.md.

1. CODING.md.

N/A — no Rust implementation code, functions, helpers, methods, result shapes, or code comments changed.

1. TESTING.md.

N/A — docs-only change; no executable behavior, parser/lowerer behavior, test runner behavior, or .dag model behavior changed, so no new test is required for the changed surface itself.

1. LOCKED DESIGN DECISIONS.

Finding. The PR directly conflicts with the ledger-doc retirement rule: modeling-discipline.md says src/v4/DECISIONS.md is deleted/retired and that older references to DECISIONS.md should be read as PR review, issues, and commit messages, not as an active ledger. chatgpt-review-245007a7-cb61-48…

The added block instead expands that retired ledger and makes it the place where the OS-1 scaffold binding lives (src/v4/DECISIONS.md:452-455). That is a locked/standing authority mismatch, independent of whether the individual POSIX refinement targets are reasonable.

1. TRACKED vs UNTRACKED DEBT.

Compliant on trigger content, non-compliant on tracking surface. The added block does name the intended primitive family, bounds, and dissolution trigger: T-25-core / T-30 fact-density gate at src/v4/DECISIONS.md:448-452. However, because the record is placed in the retired DECISIONS.md ledger, it is not tracked through the accepted debt-tracking mechanism. Practice 9 says the record relocates to carrier marks, PR review, INVARIANTS.md P5 rows for hand-Rust/test receipts, or task-scoped src/v4/TASKS.md, not a maintained prose ledger. chatgpt-review-245007a7-cb61-48…

2.5. Top-down PM intent review

Finding. The PM-level direction is to eliminate maintained parallel ledgers and keep v4 authority in inline model marks, PR review/process receipts, and task-scoped structural surfaces; modeling-discipline.md says the inline mark on the carrier is the system and names src/v4/DECISIONS.md as deleted/retired. chatgpt-review-245007a7-cb61-48…

The diff changes that meaning by instructing future workers that the OS-1 binding “lives here, not in the .dag files” at src/v4/DECISIONS.md:452-455. A worker following this faithfully would maintain the retired ledger as the source of truth for scaffold dissolution instead of updating the carrier/TASKS/PR-review path the PM discipline now requires.

3. Verdict

REQUEST_CHANGES. The POSIX refinement mapping itself looks directionally sound, including the empty argv/env-value correction, but the PR lands it in a retired DECISIONS.md ledger and explicitly makes that ledger authoritative. Move the same binding to the allowed carrier/task/PR-review surface and remove the DECISIONS.md expansion.