diff --git a/apps/api/src/cora/run/aggregates/run/state.py b/apps/api/src/cora/run/aggregates/run/state.py index a4316cb1c0f..e9ad2e890d2 100644 --- a/apps/api/src/cora/run/aggregates/run/state.py +++ b/apps/api/src/cora/run/aggregates/run/state.py @@ -338,12 +338,23 @@ class SafetyEnvelopeVerdict: """A recorded reading of the two live facility signals at a witnessed genesis: did the enclosure permit hold, was beam available. - Plain bools only, deliberately. The record exporter's disposition - generator drops bare `str` and `Any`; `keep:number` covers `bool`, so - this VO survives export and redaction whole. Naming WHICH enclosure or - WHICH shutter failed is not this VO's job: that detail goes to the log - line at the moment of the reading and stays reconstructible from the - Enclosure stream in the same exported bundle. + Plain bools only, deliberately: these are yes/no readings, and `bool` + is the honest domain type. That is NOT an export guarantee, and an + earlier version of this docstring wrongly claimed it was. `_SCALAR_KEEP` + does map `bool` to `keep:number`, but `gen_record_dispositions.py`'s + `_OVERRIDE_DISPOSITIONS` sends BOTH fields to `drop:text`, because a + point-in-time reading of live PSS/interlock and beam-shutter state is + the same class of fact `EnclosurePermitObserved.from_status` / + `.to_status` already drop. So this VO is present in the FULL, + unredacted bundle and ABSENT from the published one. Read that + override and its rationale before restoring any survives-export claim + here; the fields stay `bool` for domain correctness, not for their + disposition. + + Naming WHICH enclosure or WHICH shutter failed is not this VO's job: + that detail goes to the log line at the moment of the reading and + stays reconstructible from the Enclosure stream in the same exported + bundle. Clearance and Supply are deliberately absent. Per the roadmap's rule ("refuse on what CORA can fix, witness what CORA cannot"), those two