R.2-R.5: fingerprint, its specification, and the collapsed store

[tom-snyder]

Summary

R.2 (fingerprint + corpus), R.3 (critic), R.4 (store schema), R.5 (migrations + FTS5 guard) — plus fixes for the two blockers R.3 raised.

The critic returned FAIL, and it was right to

R.3 did not accept R.2. Both blockers were proved rather than asserted, and both are fixed here.

Blocker 1 — the algorithm existed only in Go

The critic re-implemented the plan's four-clause spec text in Python and got 55e27b07… where the committed golden is 13c60ccf…. NormalizeMatch applies nine-plus operations documented nowhere: a 193-entry reserved-word list, identifier-preservation rules, comment syntaxes, string-delimiter and escape rules, a number grammar.

That breaks S6 one level up — a second producer implementing from the written spec emits different digests, silently, forever, which is precisely what "one fingerprint algorithm, defined once" exists to prevent. It also left R.16 with no honest way to go green, since its oracle must be built "from scratch, not by importing fingerprint.go".

Ruling: amend the specification, don't weaken the algorithm. The extra rules earn their keep — abstracting a namespace qualifier collapses Ns::Helper(v) and Other::Helper(v) onto one digest. internal/record/FINGERPRINT-SPEC.md is now the authoritative definition of anvil-fp/v1, in-tree rather than in plan/, because plan/ is gitignored and a second producer working from a clone has to be able to read it. fingerprint_spec_test.go asserts the document's word list and every constant match the code — verified by perturbing the document and watching the guard fire.

Blocker 2 — DAST route templating was unimplemented

The spec defines route_template as derived, with numeric/UUID segments replaced by a placeholder; CanonicalRouteTemplate did none of it, and all three DAST fixtures arrived pre-templated so the corpus couldn't see the gap. Two producers seeing one defect at /api/users/12345/orders would emit three digests. Worse than the SAST case — the DAST tier is what earns "verified fixed" under S7, and a reproduction that can't be matched to its prior finding cannot prove a fix.

Ruling: area 40 owns the fingerprint, so area 40 canonicalizes. Pushing it to area D would leave two areas each believing the other did it. Already-templated segments ({id}, :id) normalise onto the same <VAR> token, so the producer's choice of syntax can't fork the digest.

Blocker 1 is closed by evidence, not assertion

An independent agent, forbidden from opening fingerprint.go, wrote a Python oracle from the spec alone and reproduced all 8 digests and 42/42 mutations on the first run, with no iteration. That is exactly the test R.16 will have to pass.

Its honest caveat is recorded as Appendix Z: MATCH means the spec is sufficient for what the corpus exercises, and the corpus exercises a narrow slice. Six under-determined points are listed. Z4 matters most — the ordinal grouping key isn't exercised at all, because every SAST fixture supplies a pre-computed ordinal, so an independent implementation could get that key wrong and still pass every fixture.

Two judgment calls, and which side R.2 changed

• Ns::Helper — changed the implementation. The left operand of :: is a namespace or type in every language that has the operator, never a local. Deliberately not extended to . or ->, whose left operand is usually a receiver bound to a local: a lexer can't tell a package qualifier from a receiver, and guessing wrong there forks the digest of unchanged code, which is the worse failure.
• Ordinals — changed the test, whose want contradicted its own comment eight lines below and would have put two candidates on ordinal 0 in one group.

Digest changes, stated explicitly

Only dast-01 and dast-03 moved, both solely because route templating normalised {id}/{path} onto <VAR>. The other five goldens are byte-identical to their pre-fix values — the algorithm was documented, not altered.

R.4 / R.5

One handoff table carrying all thirteen dispositions and area O's consumption_class, per rulings G9/G10. Forward-only numbered migrations with a checksummed ledger. The FTS5 startup guard creates a real virtual table rather than trusting a version number — kept even though FTS5 is now positively verified on v1.56.0, because a future bump could drop it silently.

Testing

gofmt -l .        clean
go vet ./...      clean
go build ./...    clean
go test -count=1  green: cmd/anvil, internal/record, internal/store

go test -race cannot run on this Windows host (cgo.exe exit 2, no C toolchain) — pre-existing and host-wide. CI runs it on Linux.