Working state — a note taken while the work happens, not a specification. The system as it is meant to be is in Architecture.

Rejected / narrowed findings — verified as non-defects at the recorded commit

Journal, harvested from the retired defect inventory (2026-07-24). These are claims that a code-vs-design audit raised and that verification then rejected or narrowed. They are kept so a fresh audit against the website does not spend effort re-raising them. Each entry records the original claim, the verdict, and the evidence.

Each verdict was true at the commit and evidence it names. Code moves; a verdict does not expire but it can go stale. Re-verify against the cited evidence before re-raising — and if the evidence no longer reads that way, that is a new finding, not a re-raise.

• "mach.md’s immutability guarantee is false; stone is compiler-enforced only." Rejected — the write guards use objhdr_s() (mach.c:4590,5667,5702), not the grepped mist_is_stone; the spare-capacity bypass was deliberately closed (mach.c:5664-5670). Narrow surviving issue: the four-way claim (array/record/blob/text) is over-broad — only arrays are guarded.

• "endowments: ["*"] inverts the security posture." Narrowed — it grants every endowment the executable explicitly claimed (policy.ce:262 iterates requirements), not everything. A permissive default over a sound claim-gated mechanism, not ambient authority. The real ambient holes were the fail-open start policy and the use()-imports-C lane (both since addressed in the target design).

• “numrep makes the variant plan collision-safe.” Narrowed — true at the realization layer, false at the mcode-artifact layer; the fix was to fold the target-neutral compiler stamp into the mcode derivation key, not the numeric rep.

Source: plans/rejected-findings.md