Captured observations

Observed-behavior captures cited by clean-room derivation notes (CLEANROOM.md rule 3). Each capture has a stable ID and the SHA-256 of the raw capture. Scrubbed captures may live in-repo as test fixtures in a text-safe encoding; unscrubbed ones are retained privately and can be produced against their hash if a derivation is ever questioned.

Rows carry only the ID, hash, and an observable description. A storage path may be named elsewhere in-tree for a capture of public source, and only while all of these hold: the artifact lives in a tree this repository already materializes by pin, so naming its path discloses no location the build does not; the revision that tree is pinned at is an immutable identifier — a full commit hash, never a branch or a movable tag; the license is named and permits the use (a named but disqualifying license fails this, which is rule 1's business, not a formality this clause discharges); and the hash — never the path — remains the citation of record. For anything else, and for private recordings above all, the location is not written down. Two reasons, and the second survives even where the first does not: a citation must not disclose where a private capture is kept, and a path is not a stable identifier, so a claim resting on one can come to point at different bytes without saying so. The immutability condition is that second reason spelled out — a path plus a branch name is a moving target wearing a pin's clothes.

Captures this repository made itself, of behavior it is willing to publish, live in a registered in-repository public-capture tree; every file in that tree is a capture. Neither reason above applies: there is no private location to disclose, and the second is answered rather than waived, because cleanroom-gate verifies that every file in the public-capture tree — dotfiles and nested files included, which the first version of the check missed — hashes to something a row carries. Edit the bytes and the gate rejects the change. That check deliberately does not consult the changed-path list, since docs/ is not a gated prefix and a change touching only a capture would otherwise never be looked at.

The rows themselves get the mirror-image guarantee. Once a Derivation: marker cites a row, the row is part of the reviewed surface: the gate folds cited row text into the review subject and treats an edit to a cited row — even in a change touching no gated path — as touching every gated file that cites it, so rewriting what a past review vouched for re-opens that review instead of passing in silence. An uncited row carries no such weight and stays free to add or amend.

An earlier version of this paragraph asserted that same guarantee before anything implemented it, and the reviewer who caught it was right to treat a rule amendment written in response to a review finding as the likeliest place for one. The rule is the same; what changed is that it is now true.

Whether a recording can be published is judged per capture, not assumed: anything carrying a real session's contents is not covered by this and takes the private path, where the hash is still the citation and the retention is ours to honor.

IDs are CAP-<nnn>, allocated in order and never reused: a Derivation: marker in shipped code cites one, so a recycled ID would silently re-point an existing citation at a different observation. cleanroom-gate resolves every cited ID against this table or SPECS.md and fails the build on one that is in neither.

CAP-001 takes the public-source clause: crates/gwk-pty/fixtures/PROVENANCE.md names its repository, revision, license and path. What that clause requires is that the tree is materialized by pin, and it is — pins.env fixes the repository at a full commit hash and tools/pty-toolchain.sh checks it out — so naming a path inside it discloses no location the build does not. It does not require that the artifact itself is read: nothing in this build or its tests opens the harness file, and an earlier version of this note claimed otherwise, justifying the row on the very ground the clause was amended to abandon. The corpus beside it is read; the harness is not. The hash above stays the citation of record either way, so "the harness says this" remains falsifiable against bytes rather than against a location.

CAP-002 takes the own-observation clause: the capture is this repository's, one of the registered in-repository public captures, and it carries the probe that produced it so the observation can be re-run rather than believed. It is registered because the behavior has no permitted spec to cite — POSIX gives read an EIO for a background process group reading its controlling terminal, which is a different condition entirely, and citing it would be a false citation dressed as a real one.

CAP-003 also takes the own-observation clause. CLAUDE-STREAM-JSON's cli-reference page documents --verbose and --output-format as independent flags and states no dependency between them; CLAUDE-HEADLESS pairs them only inside an example ("Use --output-format stream-json with --verbose to see...") without ever saying one requires the other. Neither page states that --print plus --output-format stream-json is refused absent --verbose, so citing either for that requirement would be the same false-citation-dressed- as-real shape CAP-002's note names. The capture records only the refusal: a probe with --verbose added was also run, and is deliberately not recorded here — it launched a real, live session against this repository's own project configuration and its output carried this operator's local session state, not stable, publishable protocol behavior. The negative probe alone is what this row cites.

CAP-004 takes the own-observation clause for the same reason CAP-002 does, and the mistake it corrects is worth publishing. An earlier version of the change that added it cited TERM-UNICODE-CORE for the RESET-mode behavior. That document defines no reset-mode segmentation rule; it says several times over that the unset state is undefined, and its only sentence about joined sequences sits inside the mode-enabled requirement and runs the other way. Citing it for what a terminal does with the mode off was exactly the false citation dressed as a real one CAP-002's note names — an escalation from "the specification declines to say" to "the specification says". The behavior is real, and this row records it as measured, through the crate's own public API against the engine the build pins, so the claim is falsifiable by re-running the probe rather than by reading a rule into a document that refuses to state one. TERM-UNICODE-CORE keeps the citations it earns: what the mode requires when set, and that the reset state is undefined — which argues for pinning both sides better than the invented rule did.

CAP-005 takes the own-observation clause. The capture carries the exact probe and both transient-unit invocations, and its output was regenerated when the row was registered. It records the deployment behavior narrowly: device nodes being present did not make PTY allocation usable under PrivateDevices=yes, while the otherwise-identical control was clean. The row does not generalize that result to every systemd or kernel version.