Codex adversarial review found no merge-blocking defects. Five
worth-checking items, all triaged for reachability:
- F1 (spurious pre-ready revoke): unreachable — the AEC's four nodes are
two Stream/* legs + a null-sink-like virtual sink/source, none claiming
a device.id, so the phase-3 observer never withholds them; index_present
goes false only on a genuine full unload. Documented why revoke is NOT
gated on graph_ready, and why gating it would reopen the reused-index
alias trap (F4) during a hot-reload-under-churn. Pinned with
revokes_on_empty_even_while_not_ready (mutation-verified: `&& graph_ready`
on the revoke guard dies here).
- F4 (test relies on observing the empty gap): documented the phase-5/6
integration contract it rests on (one observe per graph event, no
coalescing across a module lifetime boundary) and owed the robust fix
(serial-continuity / observer-generation) to a later hardening round.
- F2 (late positive evidence beats the deadline): intentional and correct
— a demonstrably-present identity is ground truth. Documented +
late_positive_evidence_wins_over_expired_deadline (both arms: node-first
validates, Tick-first fails closed and stays sticky).
- F3 (real P3 coverage hole): strengthened deadline_is_not_armed_until_
graph_ready to prove the budget starts at first-ready, not construction
(mutation-verified: a construction-relative deadline now dies).
- F5 (`+7` grammar mismatch): documented the producer contract — peerspeak
emits bare decimal (pactl returns unsigned decimal), the narrow parser
is deliberate. Unreachable on the measured stack.
No core logic change. 24 pure aec tests, cargo test --bins green (145 unit
+ 1 ignored live), clippy -D warnings + fmt clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
molluskandClaude Opus 4.8
4a844ac6fa