[verify.spec.rho.D7+] the spec's own staleness rule, applied to the spec

§7's ledger exists so every load-bearing number carries the command that
produced it. Re-ran all six today. M03 had moved: 14|24|9|68 → 57|67|18|68. The
interesting half is producers 9→18 — that is PRODUCER_VERSION deriving itself
from the source hash, exactly as designed, and it costs nothing now only because
reads had already moved onto METHOD currency. Had the derivation landed first,
every source edit would have emptied the cache. Annotated rather than
overwritten: the movement is the finding, and a ledger that silently updates its
numbers is a ledger nobody can date.

Four new rows, each with a control on the part that can lie:
- M07 meta shape parity across cache paths. Its control is on the CACHE STATE,
  not the parity: `computed db` proves both paths ran, `db db` means the claim
  was never exercised. The first execution printed computed→computed and I
  nearly filed a regression — the async persist simply had not committed. 2 s is
  measured, and the seed is now $RANDOM so the row stays exercisable instead of
  degenerating into a cache hit forever.
- M08 cache health. Control is on the DENOMINATOR: max_generations_per_unit = 0
  would make the ratio infinite and the metric a fabrication.
- M09 both new gates' red proofs. The control is that the EXPERIMENT RAN — the
  mutation is asserted to have changed the bytes before any verdict is read.
- M10 the red proof must leave the tree clean, with a control proving the
  instrument can see dirt at all (git status non-empty elsewhere). A "0 files
  dirty" from a command that cannot detect dirt is the null-output shape.

MECHANISATION DEBT: four rows moved from prose to mechanism, and the note now
says why in the place the debt is tracked. Each was a law I had already written
down and then violated within hours — the meta-shape law sat in normalize_meta's
own docstring while both response paths ignored the function; the
gates-must-convict law sat in §4.7 while two gates ran green with no evidence
they could see anything. Prose I wrote myself is the weakest enforcement
available, because I am the reader it fails to bind.

All four new commands executed with the values recorded; spec_lint 0 BLOCK.

Author: ivanicu

SPEC.md

@@ -208,10 +208,14 @@ condition below fires and the incumbent wins.
 |---|---|---|---|
 | M01 | 1 | `curl -s 127.0.0.1:8901/health \| grep -c '"ok": true'` | `curl -s 127.0.0.1:8901/health \| grep -c rss_mb` |
 | M02 | True 571745 | `cd /home/ivan/dirac && backend/env/bin/python -c "import json,urllib.request as u; e=json.loads(u.urlopen(u.Request('http://127.0.0.1:8901/embed',json.dumps({'smiles':'CC(=O)Oc1ccccc1C(=O)O'}).encode(),{'Content-Type':'application/json'})).read()); f=json.loads(u.urlopen(u.Request('http://127.0.0.1:8901/field',json.dumps({'molfile':e['molfile'],'kind':'mep'}).encode(),{'Content-Type':'application/json'})).read()); print(f['ok'], len(f['cube']))"` | `cd /home/ivan/dirac && backend/env/bin/python -c "print(571745 > 0)"` |
-| M03 | 14\|24\|9\|68 | `psql -U ivan -d dirac -tA -c "SELECT (SELECT count(*) FROM app.field_cube),(SELECT count(*) FROM app.blob),(SELECT count(*) FROM meta.producer),(SELECT count(*) FROM chem.compound)"` | `psql -U ivan -d dirac -tAc "SELECT count(*) FROM chem.compound" \| grep -vc '^0$'` |
+| M03 | 57\|67\|18\|68  *(was 14\|24\|9\|68 when written; re-run 2026-08-11. producers 9→18 is the derived-version change working as designed, and it no longer costs cache currency because reads moved onto METHOD currency first — that order was load-bearing)* | `psql -U ivan -d dirac -tA -c "SELECT (SELECT count(*) FROM app.field_cube),(SELECT count(*) FROM app.blob),(SELECT count(*) FROM meta.producer),(SELECT count(*) FROM chem.compound)"` | `psql -U ivan -d dirac -tAc "SELECT count(*) FROM chem.compound" \| grep -vc '^0$'` |
 | M04 | 2 | `cd /home/ivan/dirac && rg -lc 8901 src/app.frontend.facets.molstar-rdkit.editable/index.ts src/app.frontend.facets.molstar-rdkit.editable/facets/field-wells/index.ts \| wc -l` | `cd /home/ivan/dirac && rg -l field_cube backend/db \| wc -l` |
 | M05 | 0 | `cd /home/ivan/dirac && rg -l definitely_not_a_symbol_xyzq src backend \| wc -l` | `cd /home/ivan/dirac && rg -l field_cube backend/db \| wc -l` |
 | M06 | 27 | `cd /home/ivan/dirac && git log --oneline --since="24 hours ago" \| grep -cE "(fix\|guard)\."` | `cd /home/ivan/dirac && git log --oneline --since="24 hours ago" \| wc -l` |
+| M07 | 21\|21 · 22\|22 identical | meta SHAPE PARITY across cache paths — `backend/env/bin/python -c "import json,time,urllib.request as u; from rdkit import Chem; from rdkit.Chem import AllChem; m=Chem.AddHs(Chem.MolFromSmiles('CCO')); AllChem.EmbedMolecule(m,randomSeed=int(__import__('os').environ.get('SEED','5551'))); mb=Chem.MolToMolBlock(m); r=lambda: json.loads(u.urlopen(u.Request('http://127.0.0.1:8901/field',json.dumps({'molfile':mb,'kind':'mep'}).encode(),{'Content-Type':'application/json'})).read())['meta']; a=r(); time.sleep(2); b=r(); print(len(a),len(b),set(a)==set(b),a['cache'],b['cache'])"` run it as `SEED=$RANDOM backend/env/bin/python -c ...` — a FRESH conformer is what makes the first read a compute. The command must print `computed db`. Both `db` ⇒ the parity claim was never exercised; both `computed` ⇒ the async persist has not committed (2 s is the measured wait — the first run of this measurement read computed→computed and I nearly filed a regression against an instrument that was simply faster than the write) |
+| M08 | 18 generations \| max 3 per unit \| 6× | `curl -s 127.0.0.1:8901/admin/cache \| python3 -c "import sys,json; d=json.load(sys.stdin)['data']; print(d['producer_generations'], d['max_generations_per_unit'])"` | `psql -U ivan -d dirac -tAc "SELECT max_generations_per_unit > 0 FROM app.v_cache_health"` — a zero denominator makes the ratio infinite and the metric a fabrication, so the control is on the DENOMINATOR |
+| M09 | 2 convictions \| 4 convictions | both new gates prove themselves: `node scripts/check_contract_drift.mjs --redproof \| tail -1` · `node scripts/check_physics_contract.mjs --selftest \| tail -1` | each harness asserts its own mutation CHANGED the bytes before any verdict is read (scripts/lib/mutate.mjs) — the control for a red proof is that the experiment ran at all |
+| M10 | 0 | the red proof must not dirty the tree: `node scripts/check_contract_drift.mjs --redproof >/dev/null && git status --porcelain contracts backend/envelope.py \| wc -l` | `git status --porcelain \| wc -l` must be NON-zero, proving the instrument can see dirt at all |
 
 TRACE: `cd /home/ivan/dirac && backend/env/bin/python -c "import json,urllib.request as u; e=json.loads(u.urlopen(u.Request('http://127.0.0.1:8901/embed',json.dumps({'smiles':'c1ccncc1'}).encode(),{'Content-Type':'application/json'})).read()); f=json.loads(u.urlopen(u.Request('http://127.0.0.1:8901/field',json.dumps({'molfile':e['molfile'],'kind':'mep'}).encode(),{'Content-Type':'application/json'})).read()); assert f['ok'] and len(f['cube'])>100000, f; print('TRACE OK', f['meta']['units'])"`
 
@@ -226,3 +230,14 @@ falsified. Run at S5 completion; scheduled: within this week's S0–S5 execution
 | coordSpace '2d' refused by 3D consumers | prose | unit test feeding sketch2d ligand to FieldCache.fetch → must throw [T-01] |
 | envelope v2 dual-read window | prose | contract test against both shapes [T-02] |
 | tripwire split (degrade vs exit) | prose | startup test: same-version+new-source must exit 1 [T-03] |
+| meta shape identical across cache paths | **MECHANISED** 2026-08-11 | `normalize_meta` at both exits + gate 7 check 4 (emitted keys ⊆ FIELD_META_SCHEMA); M07 |
+| every SCF route bounded before AND during | **MECHANISED** 2026-08-11 | gate 8 `check_physics_contract.mjs`, ships a 4-conviction selftest; M09 |
+| a gate must be SHOWN to convict | **MECHANISED** 2026-08-11 | gates 7 and 8 run their red proof FIRST and its failure IS the gate failure; M09, M10 |
+| a red proof must not be a silent no-op | **MECHANISED** 2026-08-11 | `scripts/lib/mutate.mjs` throws NoOpMutation before any verdict is read |
+
+Four rows moved from prose to mechanism in one day, and the reason belongs here rather than in a
+commit nobody re-reads: **each was a law I had already WRITTEN DOWN and then violated within hours
+of writing it.** The meta-shape law was stated in `normalize_meta`'s own docstring while both
+response paths ignored the function entirely. The conviction law was stated in §4.7's proxy ledger
+while two gates sat green with no evidence they could see anything at all. Prose I authored is the
+weakest enforcement available, because I am the reader it fails to bind.