plan(v0.58): "Delete the thing you replaced" — the North Star, corrected by measurement

[avrabe]

Asked for an honest review of whether the codebase needs a new north star. Measured rather than opined.

The finding: the goal is right, the strategy is not working

v0.42.0 → v0.57.0, fifteen releases:

	v0.42.0	v0.57.0
workspace source	130,658	174,578	+34%
instruction_selector.rs	24,909	29,616	+19%
selector churn since v0.42	—	5,515 added / 808 deleted	6.8 : 1
VCR-SEL-001 verified rules	40	50	flat since v0.50

Epic #242 exists to replace the patch-accreting code generator. The thing it replaces grew 4,707 lines while the replacement gained ten rules and then stalled for seven releases. We are not replacing it — we are building a verified path alongside it, and the unverified one is winning on volume.

Supporting evidence: 105 wildcard _ => arms in the selector; 57 files say "mirror", 11 "hand-maintained", exactly 1 "single source of truth".

The mechanism, visible in v0.57

VCR-SEL-001 made 50 ops Rocq-proved through a byte-invisible flip — the proofs are real and the shipped path did change, but the hand-written arms stayed. So every release adds a proof, plus a checker for the proof, plus a doc claim about the checker, plus a ledger pin for the doc. All hand-maintained.

v0.57 then found 5 of its 10 defects were in checkers, and three doc claims had rotted behind a green 43/43 — including a capability that release shipped still listed as a loud decline. The verification machinery has become its own defect surface, and it grows because nothing is ever retired.

The correction — not a replacement

A rule is not done when it is proven. It is done when the hand-written arm it replaces is DELETED.

That turns the epic's thesis into a metric that can go the wrong way — this repo's own standard for whether a gate is worth anything. It is currently going the wrong way and nothing notices, because nothing measures it. Recorded in CLAUDE.md's North Star section.

v0.58 — ten artifacts, subtraction first

artifact
RQ-58-METRIC	pin the numbers — ceilings that must fall, floor that must rise; adding an arm without deleting one must red the gate
RQ-58-RETIRE	delete the hand-written arms for the 50 DSL-covered ops — must be byte-identical, since the DSL already emits those bytes
RQ-58-WILDCARD	the selector's 105 _ => arms — same class as #946 but with miscompile consequence; rank, convert, state the denominator
RQ-58-MIRRORS	generate-don't-mirror over the 57; fixing the FEATURE_MATRIX freshness gate (render-vs-template, never template-vs-code) is highest-leverage — it hid three of the others
RQ-58-SELDSL	un-stall 50 → 70 rules, each landing with its deletion
RQ-58-SPLIT	split the 29,616-line file along the existing #197 seam, byte-identical
RQ-58-SELECT973	#973 ARM select miscompile and the CI gap that hid it — ARM fixtures are never compiled in CI
RQ-58-VERIFYWIRE	#981 shift-decline wiring
RQ-58-OBJECT	#938 breaking 0.x-minor on the crate the differentials depend on
RQ-58-FLAKE	#977 — whose silent direction is reading a stale ELF and passing

What this deliberately is not

Not "clean up the codebase." Refactoring 29k lines of instruction selector without a per-step execution oracle is how you inject the miscompiles this project exists to prevent — and v0.57 supplies the cautionary case, since the gpio differential could not have caught its own miscompile. Every subtraction lane is gated on byte-identity or an execution differential; a deletion that moves emitted bytes without an oracle proving the new bytes correct is refused, not explained.

Gates

rivet 50 errors before and after (unchanged); warnings +20 — the standard pair every artifact carries × 10. claim_check 43/43.

Refs #242

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!