Design grammar process and controls#

Analytical state v1; exploratory mode. See model.md and evidence.md.

Reconstruction and compression controls#

RC1 Reconstruct current Date control: P1(Date), each supplied carrier P2, E1 tag mapping P3, E2 queries P4, direct core/node SQLite P5, passing control P6. RC2 Reconstruct current Temporal failure: P1(Instant/PlainDate), E1 enumerable object mapping yields {}, so R1 fails. SQL/residual and identity sort remain P4 observations; grammar records failure rather than inventing preservation. RC3 Reconstruct current #2002 receipt law: P5 wrapper plus E7 FIFO/publication law constrains R7 independently of any P3 format. No source transition is reimplemented in this grammar. RC4 Reconstruct index and cap paths: E4 shared SQL shape/upgrade plus E5 IN and whole-statement cap, with P4 operations and P5 scoped-driver capability. All four source arrangements are representable. This is an analytical reconstruction, not an executed implementation refinement proof.

Ablation record: P1→cannot distinguish type erasure/spoofing; P2→loses metadata-only/literal carrier reach; P3→cannot express old bytes or query representation; P4→cannot distinguish persisted value from meaningful filter/order; P5→incorrectly borrows wrapper/host evidence; P6→green but unreached or correlated judgment admitted. R1→{} accepted; R2→top-level-only fix admitted; R3→canonical-string order conflated with semantic order; R4→false-negative prefilter admitted; R5→IN/cursor/index translation can diverge; R6→invalid overwritten action disappears; R7→durable rollback falsely claimed as public rollback; R8→direct-core results lend wire support; R9→old index/reader mismatch hidden; R10→competing scheduler/model owner. O1 removal erases same-order/different-equality distinctions; O2 literal/index encoding diverges; O3 failure scope conflates durable and public state; O4 constructor registration substitutes for transport; O5 index presence substitutes for matching SQL. Each relation is retained for that distinguishing loss. Demoted candidates: provider brand/version is a boundary annotation, not a primitive; retry/generation machinery is excluded because no new lifecycle is needed to express the repair; generic custom codecs are outside this extraction.

Model-checking status: not applicable to this static compatibility grammar. No new concurrency/state-transition model is asserted. Existing stateful contracts are imported constraints whose tests remain with their primary owners. No TLC run or proof of their integration is claimed.

Range status: UNTESTED. No independently held-out marginal source was supplied. All dates/calendars/precision cases used here are construction or future test obligations, not independent range evidence. Negative control: a plain object with Symbol.toStringTag='Temporal.Instant' and a toString method is not thereby an admitted native Temporal value. R1 requires real brand validation. Another exclusion: assigning lexical order to a Temporal kind with no DB-defined ordering is not generated by R3.

Process freeze and projection support#

Analytical state v1 freezes E1–E10, I1–I10, P1–P6, R1–R10, O1–O5, RC1–RC4, U1–U4 and F1–F3 before a human brief or stress readings are drafted. Projection claims must map to these IDs: type preservation→I1/R1/R2; query triangle→I3/I4/R3–R5/O1/O2; oracle ownership→I5–I8/R6–R10; limits→U1–U4/range/distortion. Later stress readings may expose conditions but must not silently rewrite this frozen grammar or count as held-out range tests.

The source reconstruction used one read-only subagent for existing oracle ownership. The primary agent owned extraction, reconstruction, compression, and the fracture/tension scans. A separate fresh subagent received only C1 and its source basis for the hostile assay; it could not see F1–F3 or the other stress readings. No new Field Log or broader workflow was started.

Post-freeze probes belong to the fracture scan; they are not held-out grammar range evidence. Node 24.19.0, SQLite 3.53.3, temporal-polyfill 0.3.0 produced:

{"instant":{"a":"1970-01-01T00:00:00Z","b":"1970-01-01T00:00:00.000000001Z","semanticCompare":-1,"sqliteLexicalEarlier":0},"plainDate":{"a":"2026-01-02","b":"2026-01-02[u-ca=japanese]","semanticCompare":0,"sameKindAndText":false}}

No source compiler or serializer was changed for these probes. They constrain plausible implementations without claiming any candidate is implemented.

Post-freeze hostile reading and projection audit#

The fresh hostile auditor completed its reading against C1 at e21c280f3 without sibling forms or the fracture/tension readings. The primary agent checked the cited mechanisms and saved all five attacks as HA1–HA5 in hostile.md, including their repair conditions and dispositions. No material attack was dropped and no finding was ranked. The agent's probe results are attributed observations; its source-derived failure scenes were not executed against a candidate patch.

Two qualifications matter when reading the frozen layers:

• E8's separately callable SingleProcessCoordinator method projects wire values, but ordinary wrapper routing bypasses the remote-demand queue for that coordinator (persisted.ts:3238). Neither source fact proves every public single-process query rejects Temporal. HA5 retains a non-single-process receiving witness as open.
• I4/R4's matching-row containment does not by itself establish preservation of rejection outcomes. HA3 records this additional observation-contract question; it does not silently strengthen the frozen rule or invent a guarantee that every Boolean branch must execute. HA4 similarly treats format reversibility as unresolved rather than attributing that promise to C1.

The README projects the frozen grammar, then separately reports the requested stress readings. These readings are addenda, not independent grammar range tests and not a revised grammar version. A future revised grammar must explicitly carry any adopted condition into a new version.

Layer reconstruction audit: the primary brief preserves each consequence that changes the result: type preservation, existing-data compatibility, distinct query relations, durable/public checkpoints, binding/driver constraints, boundary-qualified support, owner reuse, unranked alternatives and unresolved mechanisms. The linked Model retains I1–I10, P1–P6, R1–R10 and O1–O5; Evidence retains source authority and owner limits; Process retains RC1–RC4 and all ablations, range/model-check exclusions and this support map. The three stress records preserve failure constructions, controls, weakening evidence and induced distortions. No confidence, recommendation, priority or support claim was added by compression. User selection among the provisional tensions is still pending; it is not inferred from silence.