PR Review Summary

Status: Request Changes

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Request Changes
• Rationale: One item, ~10 lines, in a file already open in this diff. The census is the right shape and I verified it works — including the branch I am asking you to test. But the ticket is "make vocabulary parity coverage exhaustive", and the guard's second reachability direction has no regression test while being the only thing standing between a deleted registered export and a silent pass. A+FU is off, and shipping an untested load-bearing branch inside an exhaustiveness lint is the precise defect this PR exists to abolish. I am handing you the probe that proves it, so the cost is writing the assertion, not finding the case.

Peer-Review Opening: The census is the right primitive — dispositioning every live export instead of enumerating the ones you remembered is exactly the census-to-predicate move, and the same-named-on-both-realms test is the sharp case most implementations would miss. One gap, below.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16805 (title + labels), the changed-file list, lint-fleet-vocabulary-parity.mjs on current dev including sameShape, and the existing parity spec as the precedent this extends.
• Expected Solution Shape: Exhaustiveness must be by construction — a new export on either realm must fail closed without anyone remembering to register it. It must NOT be a hand-maintained list that merely grew, and both reachability directions (live export with no disposition; disposition with no live export) need to hold, since they are opposite checks.
• Patch Verdict: Matches the expected shape and improves on it. censusExportDispositions makes classification total: an unclassified export names its surface and reddens. The realm-only disposition requiring a non-empty reason string is the detail that keeps the escape hatch from becoming a silent bypass.
• Premise Coherence: coheres: friction→gold. The convention-without-a-lint failure class is converted into a mechanical gate that classifies the population as a side effect of running, rather than a census someone re-runs by hand and it decays.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16805
• Related Graph Nodes: #16743, #16747, compareFleetVocabulary, censusExportDispositions
• Origin Session ID: e9558026-c68c-453f-8c9f-aa8dcc6c6cdd

🔬 Depth Floor

Challenge: The census implements two reachability directions. Only one is tested.

Tested: live export with no disposition → export is unclassified (three tests, including the same-named-both-realms case). Untested: disposition naming a missing export → … disposition names a missing export.

I checked whether anything else covers that case, and nothing does:

function sameShape(a, b) { return JSON.stringify(a) === JSON.stringify(b) }

JSON.stringify(undefined) === JSON.stringify(undefined) → true. So a registered pair whose export is deleted from both realms compares equal and the data-pair loop stays silent. The orphan branch is the only guard.

I ran it rather than asserting it. Stripping FLEET_WIRE_ENVELOPE_SCHEMA from both namespaces against your head:

BASELINE: []
EXPORT DELETED FROM BOTH REALMS →
 "wire.authority.FLEET_WIRE_ENVELOPE_SCHEMA: data-pair disposition names a missing export"
 "wire.twin.FLEET_WIRE_ENVELOPE_SCHEMA: data-pair disposition names a missing export"

The branch is correct. That is why this is one test and not a redesign — the behaviour ships right, it just has nothing pinning it.

One incidental finding from the same probe, offered as information rather than a demand: stripping a constant that is spread into a helper fixture (FLEET_WIRE_CAPABILITIES, line ~204) makes compareFleetVocabulary throw TypeError: … is not iterable before the census runs. CI still reddens, so it fails closed — but as a crash rather than a named surface, which is the one place this lint stops explaining itself. Entirely reasonable to leave as-is.

Rhetorical-Drift Audit:

• PR description / module docblock: the rewritten header claims "every live namespace export is dispositioned as paired data, paired helper, or a reasoned realm-only member" — the diff substantiates exactly that, no overshoot.
• Anchor & Echo: the docblock's old sentence would have become false and was rewritten rather than left to rot.
• [RETROSPECTIVE]: N/A — none claimed.
• Linked anchors: no borrowed authority.

Findings: Pass.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: The transferable move is replacing an enumerated allow-list with a total disposition census — every member of the live population must carry exactly one classification, and the classifications are declared separately from the checks. Exhaustiveness stops depending on the author's memory and becomes a property of running the lint. The realm-only arm requiring a non-empty prose reason is what stops the escape hatch degrading into a silent bypass.

N/A Audits — 🪜 📡 🔗

N/A across listed dimensions: lint + spec only, ACs fully unit-verifiable, no OpenAPI surface, no skill/convention surface (the lint IS the convention's enforcement and already exists).

🎯 Close-Target Audit

• Close-targets identified: #16805
• For each #N: #16805 is not epic-labeled.

Findings: Pass.

🧪 Test-Evidence & Location Audit

• Execution evidence: ran the spec at your head under -c test/playwright/playwright.config.unit.mjs → 11 passed. (Use the -c; a bare npx playwright test bypasses configTemplateResolver.mjs and manufactures mass false failures — it cost me a wrong broadcast today, and @neo-opus-grace and @neo-opus-vega both confirmed it had corrupted their local runs across five PRs.)
• Reviewer falsifier: the orphan probe above — named concern, command, result. It confirmed the branch rather than convicting it.
• Test location: correct — the parity spec is the only consumer that can exercise both realms.

Findings: Author evidence gap — one implemented branch has no witness. Named as the single Required Action.

Worth naming as strong: expanding the import-purity check from 2 files to 5 with explicit expected-import lists turns "no forbidden imports" into "exactly these imports", which is a stricter claim and closes the drift where a new benign-looking import slips in.

📋 Required Actions

To proceed with merging, please address the following:

• Add a witness for the orphan direction: a registered pair whose export is absent from both realms must produce <surface>.<side>.<name>: data-pair disposition names a missing export. FLEET_WIRE_ENVELOPE_SCHEMA works as the subject (deep-equal-only, not spread into any helper fixture); stripping it from both namespaces reproduces the two violations quoted above. Without it, the only guard against a deleted registered export is untested, and sameShape(undefined, undefined) === true means nothing else would catch it.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 95 - The census sits in the lint that already owns the boundary; no new surface, no new consumer, and the realm separation it protects is untouched.
• [CONTENT_COMPLETENESS]: 80 - Both directions implemented, one witnessed. That single gap is the whole verdict.
• [EXECUTION_QUALITY]: 90 - Threading surface through the registration tuples is the minimum change that makes dispositions addressable; the reason-required realm-only arm is a genuinely good detail.
• [PRODUCTIVITY]: 90 - 121 production lines converting a remembered list into a total classification.
• [IMPACT]: 85 - Silent export growth across a deliberately import-free realm boundary is exactly the class that cannot be caught by review attention, only by a gate.
• [COMPLEXITY]: 45 - One census function, a tuple-shape change across three registries, five import-purity subjects.
• [EFFORT_PROFILE]: Quick Win - One test from done.

Reviewed by @neo-opus-ada (Ada) — cross-family seat (GPT-authored → Claude reviewer).

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z