dmitrii-f-t27 · Oct 10, 2026 · Oct 14, 2026 · Oct 14, 2026
@@ -0,0 +1,41 @@
+{
+  "built_by": "t27c-bootstrap@0.5.2+99b700c5d",
+  "closure": [
+    {
+      "spec": "specs/memory/graph/scope.t27",
+      "spec_hash": "sha256:10369b02a460abcf6f8ea37d1044850e64a442b3932c66759a2db79ffbcda50b"
+    },
+    {
+      "spec": "specs/memory/graph/temporal.t27",
+      "spec_hash": "sha256:f1742b445b704609175217318a66693b5cd19eac3e1e99922a827cc1878bffdc"
+    },
+    {
+      "spec": "specs/memory/graph/types.t27",
+      "spec_hash": "sha256:1949fa1d3c8ed27d04c0a70ad328ec1a06c14a225ddf0b0e8a2ad918cd770ce3"
+    }
+  ],
+  "config": "gen=c,rust,verilog,zig;tests=zig",
+  "gen_hash_c": "sha256:2794c3cde2a166b9403a5420bdd48412d2753a3eea6dcfacf664c281997eb791",
+  "gen_hash_rust": "sha256:cd910c492634bdc15969652a336efc48a77ef3550859c15f9612865661bc04bf",
+  "gen_hash_verilog": "sha256:b0ed2cd6eaa9a016fb72d0c318241e41f65c096c0321865ac50def95b663a49e",
+  "gen_hash_zig": "sha256:b8d7c95641dc7feaa58bf521006b182fee44da2857009556169d2346f6838735",
+  "module": "MemoryGraphIngest",
+  "ring": 12,
+  "seal_schema": 2,
+  "sealed_at": "2026-10-14T02:41:17Z",
+  "sealed_by": "t27c-bootstrap@0.5.2",
+  "spec_hash": "sha256:a5b4350410639e5939bb8a4a154bfa58889b0ca95f231f618c84fad06d60c794",
+  "spec_path": "specs/memory/graph/ingest.t27",
+  "tests": {
+    "failed": 0,
+    "failing": [],
+    "forced": false,
+    "passed": 12,
+    "total": 12,
+    "vacuous": 0
+  },
+  "toolchain": {
+    "test_runner": "sha256:1982ae948e24d00c5d221ccec12dfce1eb01204b53e37b0f857f93b16d64629d",
+    "zig": "0.16.0"
+  }
+}
@@ -139,7 +139,7 @@ has had it: `tri types dup` no longer reports the name, and its row is gone.
 
 Every remaining DRIFT row needs a decision about which module owns the concept.
 
-## DISTINCT -- 48 names
+## DISTINCT -- 47 names
 
 Two concepts that met on a name. Nothing to converge; the question is only
 whether to rename.
@@ -156,7 +156,6 @@ whether to rename.
 | `Diagnostic` | 2 | 2 files | Leave both, but rename the protocol one LspDiagnostic (or require the qualified `lsp-schema::... |
 | `Entry` | 2 | 2 files | Leave both: a consensus-chain step (mvp_v3) and a hash-table cell (port). If a reader ever collides, rename the port's to HashEntry -- port-side renames are established (#7491). |
 | `EnvVar` | 2 | 2 files | Two fixes, unrelated: (a) leave the types alone, they are genuinely different; (b) fix the fi... |
-| `Episode` | 2 | 2 files | Nothing to converge. If the name ever collides in one reader, rename lotus.t27's loop entry to `LotusStep`. |
 | `Info` | 3 | 3 files | Two things: have account/repo.t27 `use account::schema` instead of re-declaring Info and the ... |
 | `Inputs` | 4 | 4 files | Nothing to converge: the Verilog port-list convention -- every module's wire bundle is named Inputs the way every clock is clk. Follow blink_working.t27's BlinkInputs prefix if the noise ever matters. |
 | `Instance` | 3 | 3 files | Leave the three types; the ambiguity is in the name. If cross-spec resolution matters, qualif... |

@@ -0,0 +1,79 @@
+# Executable memory graph extraction policy (#8752)
+
+Author: Dmitrii Fedorov (@dmitrii-f-t27). Validation base: master
+`1c72b2786`, t27c-bootstrap 0.5.2 built from this tree, Zig 0.16.0.
+The same tree's t27b was built with `cargo build --release -p t27b`.
+
+## Problem and behavior
+
+The merged slice-4 source did not parse: an apostrophe in an in-function
+semicolon comment became an unterminated string. Its sibling calls used
+nonexistent signatures, and ordinary functions named `test_*` were not
+executable TestBlocks. This repair implements the criteria of #8425 in
+actual `.t27`, preserving the scope of the extraction policy.
+
+`admission` calls `scope::may_write`, `temporal::known_as_of` and
+`scope::raw_expired` with their actual signatures. `result_status` calls
+`types::fact_endpoints_ok` and `types::fact_well_formed` before commit,
+when extraction results exist. Scope, retention and fact validity are
+not independently reimplemented.
+
+`step` returns one `u64`: next state, emitted/committed/plaintext flags,
+reason, emission domain and attempts. Its only emitting transition is
+ADMITTED/EMIT; its only committing transition is EXTRACTING/RESULT.
+Both check the fresh admission verdict provided by the caller. This is
+a pure policy; the caller must obtain that verdict from current data.
+There is no runtime, stored receipt, external protocol or real LLM call.
+
+An emitted request requires explicit domain consent and carries both
+plaintext and domain markers. Every other result clears both markers.
+FAIL retries through RECEIVED and a new admission, with three requests
+maximum. Both terminal states absorb all events; a repeated RESULT
+commits nothing and reports SETTLED. Unknown codes refuse. The atomic
+layout is documented in the spec; no other repository spec imports the
+old, noncompiling API.
+
+## Executed evidence
+
+| Check | Result |
+|---|---|
+| `t27c test-report specs/memory/graph/ingest.t27` | 12/12 pass, 574 runtime asserts, 0 vacuous passes |
+| Native arm64 `t27b test ... --check --time` | 12/12 pass, 574 asserts; JIT/interpreter check passes |
+| State/event matrix | 64 pairs, including invalid codes; exactly one emitting and one committing pair |
+| Domain/consent matrix | 35 pairs, including invalid codes; emission iff explicitly covered |
+| Terminal-state matrix | Both terminals, 8 event codes each; no effect or second commit |
+| Full failed-effect sequence | Three fresh admissions and requests, then REJECTED |
+| Wrong expected ADMIT outcome, temporary source copy | Exactly one test fails, exit 1 |
+| Widen EMIT to RECEIVED as well, temporary source copy | Exhaustive state/event test fails, exit 1 |
+| `t27c seal ... --save`, then `--verify` | Tests and spec/closure/C/Rust/Verilog/Zig hashes verified |
+| `tools/dupe_scan.py --like specs/memory/graph/ingest.t27` | No copied function bodies |
+
+The seal is generated, not edited. Its closure records the three sibling
+spec hashes. The t27b expectations row is based on the executed native
+test, not a corpus-wide ledger blessing. The two negative-control copies
+and their unchanged dependencies live outside the repository in
+`/Users/ssdm4/trinity-results/graph-ingest-8752/negative-corpus/`.
+Raw command outputs are in that evidence directory's parent.
+
+There is no `make t27-test` target. Embedded exhaustive vectors and the
+two independent executing backends provide the documented equivalent.
+Generated C, Rust and Verilog are hashed by the seal; this report does
+not claim that those three outputs were separately executed.
+
+## Task-chain disposition
+
+1. Request: repair and publish eligible owner-authored specs.
+2. Instructions and existing work checked; an isolated worktree preserves it.
+3. Own repair issue #8752 references the merged #8425 slice criteria.
+4. Source of truth and behavior are the `.t27` spec.
+5. No handwritten foreign implementation or CI gate change.
+6. Executable vectors, negative controls and seal are recorded above.
+7. Own PR references #8752 and #8425.
+8. Self-review covers the actual dependency signatures and final diff.
+9. All applicable latest-head CI must pass before merge; inherited red is red.
+10. Maintainer action is needed only if an ordinary merge is unauthorized.
+11. Merge and issue closure are pending.
+12. Publication is the accepted spec version; there is no service to deploy.
+13. No production conversations, KMS, physical FPGA, model inference, reward
+    or measured privacy against an operator are claimed.
+14. This report, seal and PR retain the evidence and remaining work.
@@ -397,6 +397,7 @@
   {"path": "specs/math/constants.t27", "t27b": "pass"},
   {"path": "specs/math/gf_competitive.t27", "t27b": "pass"},
   {"path": "specs/memory/graph/crypt.t27", "t27b": "pass"},
+  {"path": "specs/memory/graph/ingest.t27", "t27b": "pass"},
   {"path": "specs/memory/graph/scope.t27", "t27b": "pass"},
   {"path": "specs/memory/graph/temporal.t27", "t27b": "pass"},
   {"path": "specs/memory/graph/types.t27", "t27b": "pass"},

@@ -19,7 +19,6 @@
     "Diagnostic",
     "Entry",
     "EnvVar",
-    "Episode",
     "ErrorResponse",
     "EvalResult",
     "FFNConfig",

@@ -2,7 +2,7 @@
   "note": "Classification of every conflicted type name reported by `tri types dup`. DRIFT = one concept that grew two definitions; DISTINCT = two concepts that collided on a name. Evidence is the reading that decided it. Regenerate the observation with `tri types dup`; cross-check this file against it with `tri types classified`.",
   "verdicts": {
     "DRIFT": 62,
-    "DISTINCT": 48
+    "DISTINCT": 47
   },
   "names": [
     {
@@ -197,15 +197,6 @@
       "confidence": "Certain on the verdict (a cloud deploy variable and a shell environment variable are different things in unrelated subsystems). Certain also that the railway field list is key/value/is_secret \u2014 read directly from the file, since the tool would not show it.",
       "suggested_action": "Two fixes, unrelated: (a) leave the types alone, they are genuinely different; (b) fix the field reader in `tri types dup` to accept `pub` on fields \u2014 it currently reports three structs as fieldless."
     },
-    {
-      "name": "Episode",
-      "sites": [
-        "specs/memory/graph/ingest.t27:63",
-        "specs/queen/lotus.t27:65"
-      ],
-      "verdict": "DISTINCT",
-      "evidence": "ingest.t27:63 `pub struct Episode { id: u64, group_id, principal, owner, thread, valid_at, created_at, content_hash, plaintext_consent, trust_domain, attempts, state }` is the memory graph's append-only provenance record (ENTRY_INVARIANT 'Episode log is append-only, no deletions', agents/e.t27:32). lotus.t27:65 `struct Episode { id: usize, timestamp, context, evaluation, plan, result, outcome }` (nested in module lotus, beside `var episode_buffer : [EPISODE_BUFFER_SIZE]Episode`) is the Lotus runtime's loop-step entry for PHASE_OBSERVE..PHASE_LEARN. Provenance ledger record vs agent-loop step: two concepts, one name."
-    },
     {
       "name": "ErrorResponse",
       "sites": [