Status: RESEARCH NOTE (post-audit, pre-plan). No code. Per docs/PROCESS.md §1.1, exploratory analysis lives in docs/research/ until committed to a sprint. Date: 2026-07-24 Method: two workflow rounds — round 1 = 10 claims × (1 verifier + 2 adversarial skeptics) + synthesis + completeness critic (32 agents); round 2 = 12 targeted probes closing the critic's findings + a correction pass (13 agents). Subject: the framework-gap claims in `repair-shop-dept-model.md` §11 ("what the framework must originate") and its inline verified-gap assertions.
---
Why this note exists
repair-shop-dept-model.md was committed the same day it was written. Its §11 asserts six things the framework lacks, plus several "X exists in costume" claims. Those assertions are critical-path for harvest planning — if one is wrong in the absent direction we rebuild shipped code (the Gate 0.6 failure class), and if one is wrong in the exists direction we skip a real gap. This note records what survived verification.
Headline: the positive claims held; the absence claims mostly did not. An agent that opens a file and finds a thing produces strong evidence. An agent that greps and finds nothing produces weak evidence, and round 1 presented both with identical confidence. That single conflation is what round 2 had to undo.
---
Two method errors worth carrying forward
1. Clone directories inflate every cross-repo consumer count. Eight sibling dirs under ~/projects — rp-0.98-wt, rp-agent-wt, rp-b007-wt, rp-dlpmt-wt, rp-frozen-95acda76, rp-repo-inventory-wt, wt-harvest-frigate-box, and poppersanddildos/rust-primitives/ — are clones of rust-framework-workspace, not consumers. wt-harvest-frigate-box in particular ships application-travel-compliance / application-runbook wrappers that read as external adoption and are not. Any "N consumers" number that does not strip these is wrong.
2. Deferral rationale in this repo lives in crate READMEs and SQL `COMMENT ON COLUMN`, not in `docs/`. A docs/-scoped search for "is this fence deliberate or abandoned?" is structurally incapable of answering the question here. Round 1 left four fences UNVERIFIED for exactly this reason; round 2 resolved three by reading the READMEs.
Corollary: a same-day document cannot serve as prior justification for anything. Round 1 began citing repair-shop-dept-model.md back to itself as supporting evidence.
---
Corrections owed to repair-shop-dept-model.md
These are factual errors currently circulating in a committed note. Listed with the evidence that overturns them. The note has not been edited — it is a dated snapshot of one session's reconstruction, and rewriting it would destroy that provenance. This section is the correction of record; read the two together.
| Note claim | Correction |
|---|---|
| §11.2 — "'I authorize destroying this drive' is unrepresentable, and a walk-in customer has no login to consent with" | False. operations-approval-workflow ships ApprovalProposal{entity_type, entity_id, workflow_kind, payload, proposer_party_id, reviewer_party_id, …} — object-scoped and party-keyed, so no login is required. It is wired (POST /approvals/:id/approve), permissioned (/staff/approvals), and present in the shipped app schema (application-engine/migrations/050:35). Residual gap: reviewer_party_id has no FK, so it is a staff-asserted attestation, not a customer signature. |
| §11.6 — "Nothing models 'these N objects belong to one job' … neither storage-locations nor inventory has the kit" | False twice. catalog::ItemType::{Kit,Set,Lot,Pair} + BundleItem + bundle_items ship with wired admin CRUD; and production_items + block_finalized_production_edit (application-legal-evidence/migrations/0001:213-226) is a DB-enforced "no add/remove once sealed" guard. The stock_placements half of the claim is correct — its UNIQUE is (item_id, location_id). |
| §5.2 — "the two random 6-char generators … are copy-pasted" | False. Different algorithms and keyspaces: reservations draws the first 6 UUID bytes → base36 (36⁶); scheduling computes (millis ^ uuid) % 1_000_000 → decimal (10⁶). Independent reinventions — there is no single wrapper to fix. |
| §5.2 — "COLLISION-UNCHECKED" | Overstated. Both tables carry real UNIQUE constraints. The defect is the absence of retry: a collision surfaces as an unhandled 23505. Filed as B-014. |
| §9 — runbook has no execution record (implying the framework has none) | Literally true, implication false: domain-curriculum is a persisted template → version → ordered-step → run → per-step-completion → actor-stamped-event engine. Caveat: it has zero consumers anywhere, and its named intended consumer (baloo) is not a Rust project. |
| §11.3 — "`workflow_transition_history.at` supplies it correctly BUT ONLY for entities using the CAS store" | Two errors. (a) encounters supplies an equally trustworthy entry timestamp via an AFTER UPDATE trigger with no CAS requirement (encounters/migrations/001:118-133). (b) The ledger is written in production — ~/projects/support migration 00028 + ticket/service.rs:295 passes a real actor. |
| §11.1 — "`storage_locations.default_workflow` … has no users" | Misleading. It has CRUD/API users, on a vendored copy of the column on a different table (application-catalog), and a behavioral consumer in another repo (~/projects/rust-inventory-ai/src/repo/locations.rs:17). Accurate wording: "a write-only pass-through — nothing reads the slug to dispatch a workflow." Its COMMENT ON COLUMN records it as a deliberate Gate-1.5 decoupling; do not delete it. |
§11 closing — legal-evidence / travel-compliance / legal-matter::LegalHold are general kits "in costume" | All three wrong as written. legal-evidence has no custody type (the ledger is DB-plane in the forge module). travel-compliance is coupled to animal/species/country and has no migrations. LegalHold is only "non-expiring" — it is single-matter_id-keyed, has zero readers, and its ON DELETE CASCADE is the inverse of a lien. The genuinely domain-free substrate is application-core::sql_invariants. |
---
What round 2 changed about the proposed gaps
| Gap | Round 1 | Round 2 |
|---|---|---|
| Department node (six-facet binding) | NEW HARVEST, large; "facets disjoint across five crates" | CHEAPENED to wiring. The facets are co-located on one type in one file — Guard :107, Action :132, with_roles :367, requires_approval :380, StateType::{Blocking,Waiting} :164-165, available_transitions_for_role :505. Role gating is already live and tested. |
entered_state_at + dwell budget | Blocked — "the deployed app DB has no state-entry source" | BLOCKER WITHDRAWN. Capture ships and runs live in ~/projects/support. The work is read-side (there is no query API) + generalizing the budget out of decisioning's hardcoded 'processing' literal. |
| Attested destruction record | NEW HARVEST | CHEAPENED. WipeMethod{QuickWipe,DdZeros,Shred,SecureErase} exists with a production consumer in rust-inventory-ai. Only the wiring into DeletionRequest::complete() is missing. |
| Identifier allocator | ABSENT | Conclusion holds, reasoning rewritten. Round 1 never opened identity-identifiers / application-identifiers — crates named for the gap. They turn out to be store-only (they bind caller-supplied values). Two exact lift bases exist in-fleet. Filed as B-014. |
| Multi-object custody kit | HYBRID | NARROWED. foundation-decisioning and operations-workitem both ruled OUT as candidate homes. |
| Bailment fence | HYBRID | No delta — never re-probed. UNVERIFIED. |
---
Filed from this audit
- B-012 — SLA verdict inverts across reopen;
pause_on_waitinghas zero read sites (P1) - B-013 —
waiting_on_clientis a one-exit trap; SLA accrues during customer silence (P2) - B-014 — confirmation-code collision surfaces as a 500; uniqueness test asserts nothing (P2)
- B-015 —
operations-workflowguards/actions declarative-only, no host interprets them (P2) - TECH-DEBT —
TD-FMT-WORKSPACE-RED,TD-DECLARED-SHADOWED-DEPS,TD-ARCH-MD-NO-STATUS,
TD-INVARIANTS-MD-MISSING, TD-TAB-DISCIPLINE-DOC-CONFLICT
- HARVEST-BACKLOG — candidate rows 14–23 (lead list; spot-check before executing)
Each B-NNN above was independently re-verified by direct file read before filing, not transcribed from an agent report. The backlog rows were not — they carry the existing preamble's "lead list, not ground truth" caveat.
Still unverified — not papered over
1. The bailment fence (is ownership consulted before a disposal decision?) — no probe touched it. 2. Whether the `production_items` seal generalizes to a physical multi-object custody manifest — nobody opened the catalog/production code to check. 3. Whether `decisioning`'s stale-reclaim budget can be generalized without regressing its three live IdempotencyStore consumers — a Gate 4.5 producer-side question. 4. Whether the `application-tickets` gaps are worth fixing at all — it has zero in-tree hosts while two external consumers mount its router. Bringing it to parity vs. deprecating it in favour of the encounters path is undecided, and it materially changes B-013's scope. 5. `ARCHITECTURE.md` blast radius — the defect class is proven for one crate; how many of the 231 generated per-crate docs share it was never counted.