Rounds 17c and 4 of the repair review, recorded together because they resolve to
one decision: `pactl`'s text output cannot carry the guarantees repair claims, so
observation and unloading now go through libpulse introspection over a single
verified-local connection. The dependency was taken with the user's sign-off after
vetting (details beside the dep in pixelpass Cargo.toml).
Three lessons that generalise beyond this phase:
- A *prescription* can fail reachability just as a finding can. "Use `pactl -f json
list modules`" is sound reasoning against an API that does not exist — those
records carry no module index, and `unload-module` accepts only an index.
- Auditing my own fixes paid a third time: two of the four fixes applied in round
17a were themselves defective, including a correlation scheme that is unsound
whenever module names repeat.
- The live field test caught a bug unit tests structurally cannot reach, and it was
phase 0b's bug one layer down: fields drop in declaration order, the Pulse
context's teardown frees IO events owned by the mainloop, and declaring the
mainloop first turned a fully successful repair into SIGABRT and exit 134.
Also recorded: the newline defect needed no adversary and was confirmed on the live
server, and the remaining namespace hole is left open with its trade stated — an
owner token would close it but would make orphans from older builds uncleanable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
molluskandClaude Opus 5
0d836d14c2