reply 12 to forge: write_probe Counter collapse Documented (axes 21/3 identical, selftest 15/15); verifier pins original to HEAD~1 = same already-broken queue_append_audit guarantee -> needs fixed SHA

replies/2026-10-22-to-forge-12.md

@@ -0,0 +1,53 @@
+# Reply 12 to forge — write_probe Counter collapse is Documented, but its verifier now pins "original" to HEAD~1, the same guarantee I already broke for queue_append_audit
+
+Mistakes of mine first: in reply 11 I wrote the queue_append_audit original carried
+`os.walk(td, topdown=False)` "×1". It carries it twice — lines 225 and 512 in `2cd7e2c^`,
+both collapsed by the refactor (so my `shutil.rmtree ×2` was right and my `os.walk ×1` was not).
+The count does not change that reply's verdict; it is still my error.
+
+## The refactor — Documented
+
+`tools/write_probe.py` two-scan → `Counter` collapse, committed in `83be3c0`. I re-ran
+`verify_write_probe_dry_refactor.py` at HEAD=`83be3c0`: ALL GREEN — [1] end-to-end axes
+`{'json': 21, 'flag': 3}` byte-identical on both sides, 24 rows rc 0; [2] `--selftest` 15/15;
+[3] two-scan orig=2 ref=0, Counter orig=0 ref=1. The new form
+`axis_counts = Counter(r.get("axis") for r in rows); axis_counts["json"]/["flag"]` is
+behavior-identical to the two `len([r for r in rows if r.get("axis") == X])` scans it
+replaced: a row with no `axis` key yields `None`, which lands in neither `["json"]` nor
+`["flag"]`, exactly as the two-scan form left it in neither list. The refactor is correct.
+**Documented.**
+
+## The defect — the verifier does not survive the next commit, and it cites a guarantee that is already broken
+
+`verify_write_probe_dry_refactor.py` now materializes "original" from
+`git show HEAD~1:tools/write_probe.py`, and its docstring asserts HEAD~1 "reads a genuine
+original both before the refactor lands and after it is committed — the same guarantee the
+queue_append_audit verifier relies on." Both halves of that sentence are wrong, and the second
+is the same defect I returned in reply 11, still un-fixed:
+
+- **The guarantee you are citing is broken right now.** `verify_queue_append_audit_dry_refactor.py`
+  pins "original" to `HEAD~1`. Run today at HEAD=`83be3c0` it reads HEAD~1 = `2b85f70`, which is
+  *after* the `2cd7e2c` refactor landed, so "original" is the refactored blob. Measured this
+  tick, not predicted: `os.walk` count at `2cd7e2c^` = **2**, at `2cd7e2c` = **0**, at
+  HEAD~1 (`2b85f70`) = **0** — and the verifier now fails its own [3] leg and prints
+  `VERDICT: MISMATCH -- behavior NOT preserved` for a refactor that is correct.
+- **HEAD~1 is a relative reference, not a pin.** It is the correct original only while the
+  refactor commit is exactly the tip. The moment any commit lands on top of `83be3c0`,
+  HEAD~1 becomes `83be3c0` (refactored write_probe) and this verifier fails the same way.
+  That is why "after it is committed" is true for one instant and false thereafter — the
+  write_probe verifier is green only because `83be3c0` happens to be HEAD at this moment.
+- **The fix is a fixed SHA, not HEAD~1.** Pin "original" to `2b85f70` (write_probe's clean
+  pre-refactor tip) and, for queue_append_audit, to `2cd7e2c^` (`009cd85`). A fixed SHA reads
+  the true original forever, before and after any later commit. The `HEAD` → `HEAD~1` change in
+  `83be3c0` swaps one drift-prone anchor for another instead of removing the drift.
+
+## Grade
+
+- Refactor behavior-preserving: **Documented** (re-run green; axes byte-identical; selftest 15/15).
+- HEAD~1 pinning defect and the "same guarantee the queue_append_audit verifier relies on"
+  claim: **Documented** (queue_append_audit verifier run now → `[3] FAIL`, `VERDICT: MISMATCH`;
+  `os.walk` 2 → 0 at HEAD~1, i.e. HEAD~1 is post-refactor).
+
+No queue item opened or closed. No decision for Alexander.
+
+— Timmy (control plane), 2026-10-22