continuity(S395): the ~ ruling banked — limb (c) queued where the probe can see it, and the enforcement that should have caught the contradiction

[bryanmaclee]

Continuity-only — no compiler source touched. The fix arc itself is dispatched separately.

The ruling

bryan, user-voice S395 — "lets look at ~" then "your rec". Limb (a) RATIFIED: §17.6.2 governs an if-as-expression arm body. A bare expression statement inside an arm is a side effect — it does not initialize ~, does not rebind the tilde context, does not touch the arm's result; only lift or the §17.6.10 sugar designates it.

Per the S276/S130 durable the terse ratification adopted the full text it answered — "(a) now, with (c) named as the question behind it" — so limb (c) is banked, not closed.

What the reading found

§17.6.2 and §32.2 are in direct conflict about the same three lines. §32.2 ("an expression statement whose value is not bound to any identifier SHALL initialize ~") plus §32.3's exactly-once rule makes { note("a") lift "pos" } an E-TILDE-002. §17.6.2 calls the same statement a side effect. The compiler implements neither — it mints a fresh tilde and rebinds the context, so the lift writes the wrong variable and the binding is silently null.

The dispatched arc owes both halves — codegen and the §32.2 arm-body carve-out with a Rule 4b provenance line — because a codegen-only landing leaves the contradiction standing in the text.

⛑ New HIGH — the enforcement doesn't fire

g-tilde-lin-enforcement-does-not-fire-on-spec-own-examples. Six probes on merged main, all exit 0, all zero E-TILDE: §32.5's verbatim ${ process(~) }; ~ read with no init; double-init without consumption; init never consumed at scope exit; double-init in a function body; and §17.6.6's partial-if example that SPEC says the compiler SHALL diagnose.

Not from absence — TildeTracker, checkLinear and both codes exist with real messages, and checkLinear runs unconditionally at file level (:24470). Cause not traced, and the entry says so rather than guessing: hasNonLiftTildeConsumer gates only loop-body elision, so the obvious explanation is ruled out without a replacement offered.

That silence is the point — it's why two normative sections could contradict each other for as long as both have existed without anyone noticing. The S322 re-examination test in its purest form: a normative SHALL delivered by a state-scanning tracker pass, retrofit rather than by construction, producing exactly the hole that predicts.

⛑ And I banked dpa-040 in a form the probe could not read

I wrote the full ## [dpa-040] section into dpa-queue.md — the right file, per the S319 drain-path rule — and dpa-debt.ts still reported 39 items / 2 UNRUN. The probe reads the status table, not the per-item sections; the script's own header says reading the per-item status: lines instead "would reproduce the exact obligation/probe mismatch this file exists to close." Adding the table row moved it to 40 / 3 UNRUN.

The S319 rule "bank in the queue file" is necessary and not sufficient — the row is the banking act, the section is documentation. Self-inflicted, same base §10 class as the rest of this session, and caught only because the probe was run rather than assumed.

dpa-040

Should an arm body be a ~ context boundary in its own right (§32.4, beside ${} contexts and function bodies)? Under it the conflict cannot recur by construction rather than by carve-out. Constraints recorded so the DD can't drift: ~-as-lin is not on the table (the boundary set is the question); adding a boundary is the LIMIT direction but is semantics-changed and owes a measured migration; and corpus-zero is blast radius only, never demand evidence (bryan, S346).

🤖 Generated with Claude Code

https://claude.ai/code/session_019eHiNS6uvnGPFz55fzinNJ