protocol: bind the gated-field list to the call sites it claims #233

Merged

natsukium merged 1 commit from issue-175 into main 2026-09-08 21:56:04 +09:00

Conversation 0 Commits 1 Files changed 1 +390 -134

natsukium commented 2026-09-08 20:51:59 +09:00

Owner

Copy link

GATED_FIELDS recorded every post-baseline field twice — once in a hand-written list, once at the Requires::when call site inside the owning requires() arm — with nothing binding the two. Deleting a call site left the field listed and claimed by the prose ledger while the send gate quietly stopped authorizing it, and the ledger-coverage test could not see it because it walked the list rather than the gate.

Each gated field is now one table entry pairing its requirement with the predicate that decides whether a value carries it (GatedField<T>), and a requires impl folds its owner's table instead of naming fields one by one. The list gated_fields() reports is derived from those entries, so a field cannot be listed without a call site. A new per-field test (every_gated_field_is_authorized_where_it_is_carried) closes the remaining freedom: for each field it routes a message that omits it and a message that carries it through the owning impl, requiring the carrier to answer exactly the field's declared requirement. Removing a table fold from any requires impl fails it, naming the field.

just check passes (fmt, clippy, 3428 nextest tests, deny, proto-compat, release self-test).

Fixes #175

`GATED_FIELDS` recorded every post-baseline field twice — once in a hand-written list, once at the `Requires::when` call site inside the owning `requires()` arm — with nothing binding the two. Deleting a call site left the field listed and claimed by the prose ledger while the send gate quietly stopped authorizing it, and the ledger-coverage test could not see it because it walked the list rather than the gate. Each gated field is now one table entry pairing its requirement with the predicate that decides whether a value carries it (`GatedField<T>`), and a `requires` impl folds its owner's table instead of naming fields one by one. The list `gated_fields()` reports is derived from those entries, so a field cannot be listed without a call site. A new per-field test (`every_gated_field_is_authorized_where_it_is_carried`) closes the remaining freedom: for each field it routes a message that omits it and a message that carries it through the owning impl, requiring the carrier to answer exactly the field's declared requirement. Removing a table fold from any `requires` impl fails it, naming the field. `just check` passes (fmt, clippy, 3428 nextest tests, deny, proto-compat, release self-test). Fixes #175

natsukium added 1 commit 2026-09-08 20:51:59 +09:00

protocol: give a gated field one home in the minor ledger ... d9c2efa85b

The gated-field list and the `Requires::when` calls the send gate reads
were written separately, so deleting a call site left the field listed,
claimed by the prose ledger, and no longer authorized by anything --- a
gap the ledger-coverage test could not see because it walked the list,
not the gate.

Each field is now a table entry pairing its requirement with the test
that decides whether a value carries it; a `requires` impl folds its
owner's table instead of naming fields one by one, so the list is
derived from the same entries the gate reads. A per-field sample pair
pins the remaining freedom: a message that carries the field must answer
exactly the field's requirement, which fails the moment an impl stops
folding its table.

Assisted-by: Claude Code

natsukium merged commit 5f9e8ef073 into main 2026-09-08 21:56:04 +09:00

natsukium deleted branch issue-175 2026-09-08 21:56:04 +09:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!233

No description provided.