Spec repair · LEAD FOLD v2 · for red-pen

Structure Verbs — the rearrange family, repaired

Ten verified gaps, ten cures folded into the spec. Eight are repair and they’re done; two change the car’s scope and carry your pen.

Awaiting Robert’s red pen on the two starred calls · build dispatches after S-MOUTH lands
RED PEN

The two calls that are yours

An independent verification pass found ten gaps in the rearrange spec — three bad enough to ship a broken undo. Eight of the ten cures are repair work and they’re done. Two change the car’s scope, so they carry your pen, not mine. Everything proceeds on my recommendation unless you redraw either one.

1 — Ship “move X above Y” even when X and Y live in different sections?

The whole point of this verb is a sentence like “move the hours above the map.” On real pages those two things usually don’t sit inside the same box — and the version we specced could only shuffle things within one box. As written, the verb couldn’t say its own headline sentence.

My call: ship the cross-box move within a page, in this car. The moving machinery already exists in the book — this is a lift-out-and-place-elsewhere recorded as one change with one undo. Moving things between pages stays in the next car. Cost: a modestly bigger car. The alternative is a verb that fails its first real wish on walk day.

↘ go deeper — what the builder reads
Compound op: delete-on-container-A + insert-on-container-B, same page, one attributed commit, ONE arrangement record (so undo stays one record). Both shipped primitives (DeleteArrangement/InsertArrangement) exist and are hash-guarded; the two-shard position-bookkeeping obligation is already specified in item 4. Cross-page move/copy (S4/S5) remains next-car. Full text: LEAD FOLD cure 1.

2 — “Remove that section” waits one more car — agree?

Deleting a section honestly means parking everything the book knows about it inside the change itself, byte-for-byte, so undo can put every bit of it back. That parking machinery is exactly half of “move a section to another page” — so my call is it ships next car, as one coherent piece, not as a weak half now.

Until then, a teammate who asks hears an honest “not built yet” that routes to what does work today, and the wish is written down with its reopen trigger. One real bug dies today either way: the rulebook was about to accept deletion records that no machinery can produce — that acceptance is removed.

↘ go deeper — what the builder reads
Item 5’s authorization rows narrow to ops a shipped writer produces (reorder + within-page move). DeleteArrangement entries are unauthorized on this car — admitting deltas no writer produces is a widening past capability. Deleted-span anchor rows will be PARKED byte-identical inside the arrangement record in the S4/S5 car, restored on undo. Full text: LEAD FOLD cure 8.
LOCKED

What this car holds constant

The reader carries the meaning — no code ever parses a teammate’s words to pick a section, a direction, or an undo
Refusals on the teammate path may only fall — every stop this car adds is a routed question or an honest absence, registered before it can fire
Undo is one rule — last change unwinds first, restores byte-identical, proven with three different phrasings including plain “undo that”
The door advertises only what is real — its capability list is derived from what’s actually built, never hand-written
No live site content inside any check — every count and every example derives from the book at run time
THE SPINE

The journey of one move

Follow a single wish — “move the hours above the map” — through the repaired car:

  1. Measure before building. A whole-book census asks: can every page’s structure be read cleanly under the named rule? A page that can’t, keeps working the old way with its reason written down — and if too many can’t, the car stops and comes back to me for a re-cut instead of improvising.
    ↘ go deeper
    Losslessness falsifier over every page, never a sample: the nested read must reproduce the page’s own bytes exactly. Per-page report: container count, max depth, fallback reason. Red proof: hand-corrupt one page’s lift → RED naming the page. Cures 6 & 10 bind the depth rule and forbid pinned counts.
  2. Pages grow real sections. The rule for what counts as a section is named in the spec, not left to the builder — the structural boxes a person would point at, never every paragraph and list item.
    ↘ go deeper
    Containers form only at the named structural tag set plus the theme’s own row/column classes (a named constant, lead-reviewed at court). One container per boundary; an empty candidate collapses into glue; the partition invariant fails closed at build time. Cure 6.
  3. The gather. Every section gets a plain name derived from itself (its own heading), and the book knows whether it lives on this page alone or on every page — a menu is one thing wearing 180 costumes, and moving it is a different job. Code gathers and reports; the reader decides.
    ↘ go deeper
    Shared-vs-local is pure record arithmetic (a container hash occurring on ≥2 pages = SHARED); the hash the gather reports is the CURRENT PROJECTED state so a second move stamps against reality (the stacking cure). Shared containers route to the menu-wiring lane with an honest reply — without this, a one-page menu reorder silently diverges the site and the byte-isolation check certifies the divergence. Cures 2 & 4.
  4. The writer records the move. One attributed change: the move itself, plus rewriting every position record it displaced, plus the bookkeeping call that keeps in-flight safety checks reading truth. Omitting that last call is the load-bearing failure this car must be able to catch.
    ↘ go deeper
    Re-stamp is pure arithmetic over the permutation and stored widths; fails closed at the offset-integrity receipt. Every rewritten shard goes to updateAnchorFactIndexPage in the same operation. Red proof: omit the keeper → guard reads stale offsets → the fixture must go RED. Item 4 + cure 3.
  5. The guard’s arrange column. Forward and inverse are authorized together — a change you can make but not take back is the worst door in the system, so neither ships alone. And every page the move didn’t name must come out byte-identical.
    ↘ go deeper
    Four red proofs run at the sibling entry point (runGuardOnStructureOp): foreign op kind, stale container hash, orphaned row removal, honest undo admitted. The born-covered rail ships now at the guard seam; its door-through proof is a recorded obligation on the next car (the first op that authors bytes). Cures 3 & 7; item 5.
  6. Undo. One rule: remove the record and restore the positions, both halves in one change. Stacked moves unwind last-first — “undo that” after two moves takes back one, not both. Byte-identical every time, proven with three phrasings.
    ↘ go deeper
    The v1 spec’s undo — delete the record, re-produce — THROWS as written (the position shard still holds post-move offsets). Cure 3 makes undo a two-record inverse with the inverse permutation re-stamp + the same keeper call; cure 4 makes removal LIFO-only so surviving stamps stay valid by construction. Same proof bar as a word change: ci:roundtrip’s own restoration assert.
  7. The door. “Arrange” appears in the door’s vocabulary carrying only what’s real. Three ruled stops, all registered before they can fire: a stale move replays as a question with the answer already gathered; an unreadable page is an honest absence routed to what works today; a shared region routes to the menu-wiring lane.
    ↘ go deeper
    Advertised op set DERIVES from registered writer capability (cure 5); unbuilt ops keep their labeled-absence rows with reopen triggers. Every stop: code + bin + census row in the same change that adds it. A refuse where an ask belongs fails the walk. Item 8 + cures 1, 2, 5.
  8. The gates go merge-blocking in the same change. The checks that today exist but guard nothing get wired into the merge gate as part of this car — and both proof suites gain a move-and-undo leg, because they prove different things.
    ↘ go deeper
    Typecheck + resource-fingerprint parity enter the gate workflow in this diff (verify at the actual dispatched base — the gap analysis ran at an older tip). ci:roundtrip gains the arrange/undo restoration leg; ci:door-run gains the real-door move wish. An instrument in package.json with no workflow entry does not ship. Cure 9.
REFERENCE

The ten cures, one line each

Each cures one verified gap; full text lives in the spec’s LEAD FOLD. Severity as graded by the verification pass.

1 · highest — within-page cross-section moves ship (your call #1); the headline wish becomes expressible.
2 · highest — shared regions (menus, footers) are classified from the record and routed — no more silent one-page divergence that the checks would certify.
3 · high — undo becomes a two-record inverse; the version that would throw on its first real use is dead.
4 · high — stacked moves stamp against projected reality and unwind last-first; the second move no longer falsely conflicts.
5 — the door’s capability row narrows instead of striking; nothing advertised that isn’t built.
6 — the section-boundary rule is named in the spec, with the census histogram that lets me re-cut it if it’s wrong.
7 — the one proof this car cannot honestly run through its own door is scoped to the seam and RECORDED as the next car’s obligation — never silently unfalsifiable.
8 — section-delete deferred whole (your call #2), and the rulebook stops accepting deletion records nothing can produce.
9 — orphaned checks get wired merge-blocking in this same diff; the silently re-homed proof obligation is restored to both suites.
10 — the fixture law extends to denominators and shipped copy — no site content or today’s counts pinned into any check.
NAMED, NOT SILENT

Not in this car

Move or copy a section between pages — next car, dispatched against this car’s result; it inherits the parked-record machinery and owes the door-through authored-bytes proof (cure 7’s ledger entry).  Remove a section — rides with it (your call #2).  Below-block-level arrangement (an image inside a paragraph, two columns swapped) — reopen trigger lives on the census: if a common wish falls below block level, it becomes its own increment, never an accepted gap.

The build dispatches only after S-MOUTH lands on trunk and your pen clears the two calls above. Feasibility (stage 1) gates everything — a book that won’t nest cleanly comes back to me for a re-cut, never gets patched around.