Round four of the independent review found seven record and coverage
defects. The functional side it verified by running; these are the fixes.
- `_tracked` asked the current checkout's index, so a reviewer in a worktree
pointing at the main checkout's committed report was told it was untracked.
It now asks the repository that owns the path, and the guard no longer
compares directories: any tracked file is committed evidence.
- `retrieval.py` claimed the dense index "catches up inside search". It does
not: `_stale` is only used by `sync()` and `stats()`, so a store upgraded
from v11 ranks an empty dense leg until `ely-eye build-dense-index` runs.
The docstring now states that, and `doctor` already names it.
- Four wirings had no discriminating test, each proven by mutation:
a stubbed `_tracked` (now a test uses the real git index), `copy_store`
claiming the scratch (now a live holder blocks the copy before a byte is
copied), `_stale` reading the atoms table (now a closed memory that loses
its vector is owed one), and the v10/v11 to v12 `DROP VIEW` gate (now a
hand-made v11 store is upgraded and its view body re-checked).
- The record corrected against the reviewer's measurements: the five
mutations did not each turn one test red (M1 turned two, M3 turned two,
`_stale` alone turned none), the pyright/mypy file set was wrong, and the
round added seven tests rather than three.
Gates: 422 passed; ruff clean; filesize clean; audit clean; mypy 24 errors in
9 files repo-wide, equal to the 9cb46c1 baseline; pyright 0 on the nine
touched files; zero whole-line comment blocks over 157 tracked files.
A scratch copy is one run's working store. The video harness defaults to
bench/runs/video_audio and copy_store() copies straight over it, so a smoke
run started while the full run was mid-ingest replaced the database under it:
the full run's after-arm would have scored a store whose speech atoms had been
swapped out, and the smoke itself died on "database is locked" inside
text_index. Six harnesses share that copy path, so the claim lives in
bench/scratch.py: a live pid in held_by refuses the path, a stale one is taken
over, and the same process may re-copy per arm.
The reviewer's smoke knob also measured nothing instead of saying so. With
--limit the probe sample narrows to video only, and a small --probes strides
past that modality entirely, so the run crashed in aggregate() after the
ingest. probe_sample() now switches the arm off at --probes 0 and fails in
half a second otherwise.
The frozen-report guard had two holes found by running it: it compared
cwd-relative parents, so an absolute path to the frozen file passed, and it
refused the harness's own default destination once that file existed, which
would have stopped the shipped run. It now compares resolved paths and refuses
only committed evidence.
Record fixes from review round 3: the round-2 line credited a reproduction to
the wrong round and quoted a git log -S hit for a string that never existed in
code; the suite counts now name the commit each was measured on (401 at
83dfc14, 406 at eab6bd7, 410 at cf2de31, 411 at 92237c8).
Gates: pytest -q 418 passed; ruff clean; bench.filesize_check OK; mypy cold
cache and pyright clean on the four touched files.
Round 2 found the functional side true and six record/discipline defects.
- D9: the write-path line said "comparison uses secrets.compare_digest" as if
it covered both tokens. It does not: the operator's plaintext is compared with
compare_digest (api_auth.py:54, :110), a holder token is SQL equality on its
sha256 digest (holder_store.verify_token) because no plaintext is stored. The
boundary is now stated in verify_token's docstring as well as the record.
- D10/D13: three historical numbers were written as if they were current. The
four-file 59 is pinned to 2ea48d8 (test_trust_quarantine.py was 25 tests there,
26 from d56996b on), and both 401 gate lines are pinned to the commit they were
measured on (83dfc14, 89c880f) with the current 406 named next to them.
- D12: the compiler cache-key line overstated one direction. The old key had no
identity part at all, so whoever compiled first got served to the next caller;
an empty pack reaching the operator is one direction, not the mechanism.
- D11: the p2-5 acceptance cell's suite count is pinned the same way.
- D14: bench/video_audio_check.py wrote straight into bench/reports/, so a
reviewer running it in its own worktree would have overwritten frozen
evidence. It now takes --report/--payload and refuses a destination that
already holds a frozen report; refuse_frozen_overwrite is tested, along with
the guards that stop the harness from measuring nothing.
Gates: pytest -q 410 passed; ruff clean; bench.filesize_check OK;
bench.audit --product 33 harness files / 2 reports / 6 set files, clean;
pyright 0 errors on the three touched files; mypy cold cache Success on the same
three.
ZacharyZhang-NY