Phase 10: deviation reconciliation — the checklist, the drained inbound list and the release register

[Wahbeh-Mohammad]

Closes #34. Third and last PR of phase 10's stack — the documentation and the phase record. 34 files, +1,190 / −179. With it, all eleven phases of the v1 roadmap are on main. Nothing is published: every gem stays at 0.0.0, no tag is cut.

What lands

• The checklist, written from what was built: 124 own rows (108 MUST / 15 SHOULD / 1 MAY; ✅ 107 · 🚫 11 · N/A 4 · ⏳ 2 in the docs/first-release.md unsatisfied-MUSTs entry) plus 81 cross-reference rows, and two tables phase 9's did not need — the repairs (each with its failing test) and the inbound list, dispositioned.
• Phase 10's inbound list is emptied by disposition. All 65 bullets (32 from 2026-09-13, 33 added since) carry a dated bracket: 18 repaired · 14 verified already fixed · 32 moved to docs/first-release.md (thirteen of them the amendment set) · 1 withdrawn — none carried forward. The ~30 reviewer leftovers from the per-phase notes that had been routed nowhere are dispositioned in their own table.
• docs/first-release.md walked line by line: the frozen-chapter amendment blocker now names C1–C19 and the consolidation of every phase's ledger rows into design §10 (a human's act — the trees are frozen); a new blocker enumerates the one-time surface choices phases 4–8 said to "decide before the first tag"; port readings, post-release residues and the closed XCUT-12 trigger.
• The design's As-built addendum (P10-21–P10-38) and its dated R1 widening; dated bracketed corrections in eighteen earlier-phase documents (placement only, no rewrites); the roadmap's phase-10 status note.
• CLAUDE.md, README, docs/README.md, docs/sdk-documentation/ (quality-gates page's three new rows; Protocol/Status/URL behaviour on the http, transport and serde pages), and the housekeeping skill's nine checks.

One process-rule change for the maintainer to confirm: CLAUDE.md's routing rule now says the inbound list was drained on 2026-09-25 and audit-or-repair work found from here goes to docs/first-release.md.

Verification

Four independent reviews by fresh agents, a fix round between each: round 0 1 blocking / 8 / 3 → round 1 0 / 3 / 2 → round 2 0 / 1 / 1 → round 3 approve, 0 / 0 / 0. 89 mutations across the rounds, 86 caught, every survivor accounted for. The review record is in the comment below. At this tip, run by the maintainer: full bundle exec rake (24 gates) green on 4.0.6, honest RuboCop over 784 files clean, the probe clean with nine checks, the knowledge verifier OK; 3.2.11 and 3.3.12 matrix sets green; frozen trees untouched.

Known follow-ups

None from the final review. What this phase did not repair is now a dated docs/first-release.md line with its pick-up condition — there is no later phase.

[Wahbeh-Mohammad]

Review record for the phase 10 stack (#102 → #103 → #104)

4 independent reviews, each by a fresh agent with no memory of the previous one, each re-running every gate itself on every tip (4.0.6 every gate individually at the code tip and the full rake at the tests and docs tips; the matrix set on 3.2.11, 3.3.12 and 3.4.10) and applying its own mutations on both interpreters, with a fix round by a fresh agent between each. The stack was cut from main at b242de6.

Round	Verdict	Blocking	Should-fix	Nits	Mutations (caught)	Disposition
0	changes required	1	8	3	31 (29)	all 12 addressed in fix round 1
1	changes required	0	3	2	29 (28)	all 5 addressed in fix round 2
2	changes required	0	1	1	27 (27)	all 2 addressed in fix round 3
3 (final)	approve	0	0	0	2 (2)	nothing left open

Nothing was skipped.

Round 0 → fixed in round 1

• R0-1 blocking — docs/work/mvp/phase10/2026-09-13-phase10-deviation-reconciliation-and-release-readiness-checklist.md:68: Seven own rows carry a copied verdict that is false for their ID. Fixed on docs (91f0d51): SEAM-6..9 now cite phase 2's Dexpace::Registry (registry.rb) and its tests. IO-30, IO-31 and IO-39 now say 'retired apparatus', each taken from 3a's own row. A mechanical check of all 124 own rows against their owners' marks found no other contradictions; the
• R0-2 should-fix — docs/sdk-documentation/transport-net_http.md:341: sdk-documentation still describes the pre-repair Protocol and Status behaviour. Fixed on docs (91f0d51): transport-net_http.md, http.md (both the Status and Protocol bullets) and transport-async_http.md now describe the built behaviour: Protocol admits http/1.0 (HTTP_1_0), Status is total over Integer with #standard?, and an HTTP/1.2 head still raises.
• R0-3 should-fix — CLAUDE.md:1478: CLAUDE.md says phase 10 reached net_http only through sig/, which the diff contradicts. Fixed on docs (91f0d51): CLAUDE.md now says phase 10 reached net_http through its sig/ header, two YARD comments and two invalidated tests, per the R1 addendum.
• R0-4 should-fix — gems/dexpace-core/lib/dexpace/proxy/resolution.rb:186: Proxy warning still leaks a password prefix when the password holds /, ? or #. Fixed on code (0d830c2): ProxyResolution#scrub_userinfo runs on the raw value before the redactor. It replaces everything from the start of the authority (after scheme:/+ or a leading run of '/', never after a bare 'user:') through the LAST '@'. The unanchored belt still runs after th
• R0-5 should-fix — gems/dexpace-core/lib/dexpace/http/status.rb:270: HTTP-10 marked ✅ repaired (MUST), but Status.of still throws outside 0..999 with no ledger row. Fixed on code (0d830c2): I made Status total over every Integer rather than record 0..999 as a narrower reading, since HTTP-10 says 'any code MUST return a Status'. Only a non-Integer is refused. The existing status_test and response_test pins were invalidated, so they moved on the co
• R0-6 should-fix — docs/deviations.md:33: Row 10's evidence implies a bypass the tree does not have. Fixed on code (0d830c2): docs/deviations.md row 10 is now 'confirmed, narrower': send(:new) runs the validating #initialize (HTTP-7 raises, measured on 4.0.6 and 3.2.11), and the residual holes are Request.allocate (all-nil members) and duck typing. Added C19 against §4:45 and §10 ite
• R0-7 should-fix — docs/work/mvp/phase10/2026-09-13-phase10-deviation-reconciliation-and-release-readiness-checklist.md:450: Two leftover items are not routed, and one cites a routing line that does not exist. Fixed on docs (91f0d51): Added both items to first-release.md's post-release residues line, each with its pick-up condition: 5c's probe-claims check not reading the spelled lib-file count, and 7b R1-1 sse.md. Corrected the checklist leftover rows to point at that line.
• R0-8 should-fix — .claude/skills/housekeeping/chapters.rb:48: The chapters check treats 'appears in' as a negation, so the usual positive attribution is never checked. Fixed on code (0d830c2): Removed 'appears in' from NEGATION. It is now a FORWARD binding: an ID run followed by 'appears in' pairs with the chapter it introduces, or with nothing when that chapter is on the next line. This fixes the phase-5 :538-539 shape without an exemption. Live fi
• R0-9 should-fix — docs/work/mvp/phase10/2026-09-13-phase10-deviation-reconciliation-and-release-readiness-checklist.md:78: SEAM-22's mark drops the owning row's '🚫 mechanism' half. Fixed on docs (91f0d51): SEAM-22 is now marked '🚫 mechanism (§10.14); surviving clause ✅', matching phase 2. The tally is now ✅ 107 · 🚫 11.
• R0-10 nit — docs/work/mvp/phase7/2026-09-10-phase7-segmentation-design.md:652: Some dated brackets are placed on the wrong item or in the middle of a sentence. Fixed on docs (91f0d51): Moved brackets to the end of the sentence or item that cites the key: phase 7 seg item 23, phase 0 plan :908-910, phase 5 seg :772-773 (it was inside a bold span), and phase 8b plan :337-338. Reworded the repeated tail in all eight 5bc538ba brackets to 'Only t
• R0-11 nit — docs/first-release.md:764: The struck XCUT-12 trigger leaves its old instruction unstruck. Fixed on docs (91f0d51): The old body of the struck XCUT-12 trigger is now inside … as well.
• R0-12 nit — CLAUDE.md:1475: CLAUDE.md says C14 was 'found by the as-built audit'. Fixed on docs (91f0d51): CLAUDE.md: C14 is reconciled from phase 4b's filing; the as-built audit found C15–C19.

Round 1 → fixed in round 2

• R1-1 should-fix — gems/dexpace-core/test/dexpace/instrumentation/downstream_wirings_test.rb:310: The proxy scrub's 'through the LAST @' rule is untested: a first-@ mutant survives and leaks password fragments. Fixed on tests (8ec8f16): The R0-4 case now includes three spellings with an '@' inside the password ahead of a reserved character: http://user:se@c/ret@proxy.corp (c/), http://user:a@b#c@proxy.corp:1 (b#) and user:x@y/z@proxy.corp:3128 (y/). I ran the index-for-rindex mutant against i
• R1-2 should-fix — docs/work/mvp/phase10/2026-09-13-phase10-deviation-reconciliation-and-release-readiness-checklist.md:44: Two lib repairs have no requirement row, although the checklist says the 15 added rows cover every ID a repair changed. Fixed on docs (795d30a): Added two cross-reference rows. HTTP-19 (MUST, owner 1, repair 6 / Guards x3). BODY-9 (SHOULD, owner 3b, repair 7 / Guards x4). Levels come from appendix C. The added set goes from 15 to 17 and the total from 203 to 205. I checked the count mechanically: 124 o
• R1-3 should-fix — tools/ledger_audit.rb:77: A rubocop:disable was added without a reason. Fixed on code (b21031c): tools/ledger_audit.rb:77 now has an inline '-- reason' on its disable: the module keeps no state, so the root and resolver for each run are passed down to every row check. RuboCop with --ignore-parent-exclusion is clean.
• R1-4 nit — .claude/skills/housekeeping/chapters.rb:55: The forward binding turns 'does not appear in X' into a positive attribution. Fixed on code (b21031c): Chapters::NEGATION now also matches 'not appear in', 'does not appear' and 'do not appear'. I measured that the reviewer's sentence now matches NEGATION. On the tests branch (8ec8f16), chapters_test gains 'a negated appears-in is not an attribution' (does/do/d
• R1-5 nit — docs/first-release.md:605: A Post-v1 gem entry still points at the XCUT-12 trigger as live. Fixed on docs (795d30a): The dexpace-async-async entry in docs/first-release.md now says only SEAM-24's bridge rides on it. It also says the XCUT-12 fiber-scheduler trigger was closed on 2026-09-25 by phase 10's fiber verification.

Round 2 → fixed in round 3

• R2-1 should-fix — docs/first-release.md:251: The RBS-baseline entry still says NFR-4 'stays ⏳ until a v* tag exists', contradicting P10-35 and the checklist's NFR-4 ✅. Fixed on docs (91b4dca): I rewrote docs/first-release.md:251-257, the RBS-baseline entry. It now says the entry is design §9's release-tag mechanism, not NFR-4. Appendix C's NFR-4 is a checked-in snapshot that fails the build on drift, and gates:surface_snapshot is exactly that, so NF
• R2-2 nit — .claude/skills/housekeeping/chapters.rb:48: Two other negated spellings of 'appears in' still bind forward: 'never appears in' and 'doesn't appear in'. Fixed on code (a857785): Chapters::NEGATION gains 'never appear' and "n't appear" ('appears nowhere' was already there). On the tests branch (9b9aa7e), the negated-verb case also covers 'never appears in', "doesn't appear in", "don't appear in" and 'appears nowhere in'. I removed each

Round 3 (final) — approve, no findings

What the final reviewer verified by experiment, both interpreters

• Deviations row 10's claims: Request.send(:new) with a GET and a body; Request.allocate — InvalidArgumentError 'a GET request must not carry a body (HTTP-7)'; allocate gives [nil, nil, nil, nil]. This matches the row.
• 12 malformed or credentialed HTTPS_PROXY spellings through Proxy.resolve, $stderr captured (the four R3-1 shapes, the last-@ shape, leading space and tab, bracketed, bare userinfo) — 0 of 12 leak 'secret' on either Ruby, and every warning shows :@.
• Protocol HTTP/1.0, Status 999, URL.parse!('mailto://host') by hand — http/1.0; standard? is false; InvalidArgumentError.
• Search for any statement pairing NFR-4 with ⏳ across the register and the docs at the docs tip — None found.

Tips reviewed at the final round: code a857785, tests 9b9aa7e, docs 91b4dca on main b242de6.

Before the push, run by the maintainer

In a detached worktree at the docs tip: full bundle exec rake on 4.0.6 green (all twenty-four gates), bundle exec rubocop --fail-level=convention --ignore-parent-exclusion over 784 files clean, probe.rb clean with nine checks, verify_knowledge_structure.rb OK. The matrix set (test:gems gates:gemspec_audit gates:require_allowlist gates:clean_bundle gates:single_instance) green on 3.2.11 at the tests tip (4,040 runs / 5 skips / 96.11 %) and the code tip (4,023 / 5 / 96.05 %), and on 3.3.12 at the tests tip (4,232 / 9 / 99.82 %). The stack is linear on b242de6 and the diff over docs/product-spec*, docs/sdk-design-ruby* and docs/knowledge/harvested is empty.

Before the review started, a read-only cross-check read the phase-10 plan (written 2026-09-13, before phase 3 existed as code) against the tree and fed 35 as-built points plus the maintainer's eight decisions into the implementer's brief — among them dropping Task 8 (its defect is absent), turning Task 9 into a verification, the "small repairs" task, and repairing phase 5b's live proxy credential leak rather than filing it.