V48 (specification-only): Freeze historical canon checks; living full-system check

Document meta specifying law: promoted era specs/proofs/version-bound checks are
immutable canon-at-that-time and must not be rewritten for later tree drift; the
living full-system check alone must be all-encompassing and correct for present
sole-canon. Align V48 notes, specifying README, era-pin shims, and glossary.

Author: geraldarthurdavis

BITCODE_SPECIFYING.md

@@ -46,7 +46,8 @@ The priority order for specifying truth is:
 8. named realization/demo specs and adjunct docs, only where the active spec family explicitly references them
 
 Older versioned specs are historical.
-They may be cited for provenance, but the active `SPEC` must not require them for current semantic recovery.
+They may be cited for provenance as **canon at that time**, but the active `SPEC` must not require them for current semantic recovery.
+Promoted historical specs, proofs, and version-bound checks are **immutable** for later realization drift (§4.3); only the living full-system check for the current draft/active pointer is rewritten for present sole-canon correctness (§13.1).
 
 ## 1.1 Drafting Input Rule
 
@@ -435,6 +436,40 @@ Once a version is promoted:
 
 Stale status language is a canonical defect.
 
+## 4.3 Historical Canon Immutability (Promoted Specs, Proofs, and Checks)
+
+**Meta specifying technique:** promoted eras are frozen snapshots of **canon at that time**. Current-tree work must never rewrite history so that historical checks stay green.
+
+### Law
+
+1. **Once promoted, a version's canon artifacts for that era must not change** for the purpose of tracking later realization.
+   That freeze covers, at minimum:
+   - the hand-authored family (`BITCODE_SPEC_VN.md`, `NOTES`, `DELTA`, `PARITY_MATRIX` as promoted),
+   - generated `BITCODE_SPEC_VN_PROVEN.md` and `.bitcode/vN-*` structured artifacts for that promotion,
+   - version-bound gate checkers, package proof generators, and tests that attest **that era's** predicates against **that era's** source and route vocabulary.
+2. **Old version checks must never be edited** to chase later renames, package hierarchy moves, route pluralization, Terminal retirement, component layout moves, vocabulary renames, or sole-canon modularization of a future draft.
+3. **Historical promoted specs remain referenceable as canon-at-that-time.** Auditors, PROPER reconstructions, and provenance citations use them as fixed law for the era they closed — not as living code maps of the current tree.
+4. **The living full-system check is only for current canon** (the draft-target family while drafting, then the newly pointed family after promotion). That check must be:
+   - all-encompassing (full-system, full re-implementability, full auditability — §2),
+   - completely correct for **present** sole-canon realization,
+   - fail-closed when the current tree or current family drifts,
+   - and free of "fix history so the old suite still passes" shortcuts.
+5. When a future realization would make a historical check fail against the new tree, the correct tools are:
+   - **era-pin / skip-with-reason** (or pointer-gated non-execution) for the historical check while the current pointer has moved past that era,
+   - **PROPER** reconstructions (§3.2) when specifying itself is under test against an already-promoted target,
+   - and **new** current-version proofs/checks that restate obligations against the present tree.
+   The incorrect tool is rewriting the historical checker, historical proof file, or historical `.bitcode/vN-*` artifact so it matches today's paths or product names.
+
+### Why this exists
+
+Bitcode treats each promotion as a closed ledger entry of system law. If V43–V47 checks were rewritten every time V48 moved `/read`→`/reads` or retired Terminal, "canon at V47" would cease to exist as an auditable artifact. Era-pinning preserves that ledger without blocking the living draft's obligation to be total and true.
+
+### Relation to drafting
+
+- Draft work on version `N` may freely change `BITCODE_SPEC_VN_*` **until** promotion closes that version.
+- After promotion, version `N` joins the freeze set; version `N+1` carries the living full-system family and living full-system checks.
+- Citation of older specs remains allowed for provenance; recovery of **current** meaning from older specs remains forbidden (§1, §2.4).
+
 ---
 
 # 5. Full `SPEC` Required Structure
@@ -1166,6 +1201,38 @@ When the active version is changing specifying, promotion, or full-canon structu
 
 This dual-family validation is the preferred way to detect a specifying rule that accidentally encodes the quirks of the current draft rather than a reusable full-canon standard.
 
+## 13.1 Living Full-System Check vs Frozen Historical Checks
+
+Validation must separate **living current-canon checks** from **frozen era checks** (§4.3).
+
+### Living full-system check (current canon only)
+
+The check that guards the **draft target** (and, after promotion, the **newly pointed** active family) must be:
+
+- **all-encompassing** — full-system, full re-implementability, full auditability, full promotion-derivability (§2, §5, §12),
+- **completely correct** for the present sole-canon tree and present product vocabulary,
+- **fail-closed** on drift in hand-authored family, generated canon, parity, tests, and package realization,
+- and **sole authority** for "may this version promote / is this pointer honest?"
+
+That living check is rewritten as the draft advances **before** promotion. After promotion, it freezes with the era and a new living check is born for the next draft target.
+
+### Frozen historical checks (prior promoted eras)
+
+Version-bound checkers, package proof tests, and generated-artifact checks for **already-promoted** versions:
+
+- **must not be modified** to match later package layouts, routes, or component paths,
+- **must remain runnable or era-pinnable** as evidence of canon-at-that-time,
+- **must not be deleted** solely because the current tree moved (prefer pointer-gated skip / era-pin with an explicit reason),
+- and **must not be used** as the living gate for the current draft — only as historical attestation or PROPER inputs.
+
+### Operational pattern (package and CI)
+
+- Pointer-gated workflows: historical version promotion workflows stay on disk; they do not re-fire as current required gates once the pointer has advanced.
+- Specifying package tests: historical proof files that hard-code prior-era paths may import an era-pin shim that skips with reason when the current realization has superseded that era (for example `packages/specifying/test/era-pinned-superseded-routes.js`).
+- Required CI for draft work: green the **living** uapi/package suite and the **current draft's** specifying proofs — not by rewriting V2x–V(n−1) checkers.
+
+If a historical check becomes impossible to execute even under era-pin, record that as an accepted boundary in the **current** draft's parity/notes; do not "repair" the historical checker.
+
 ---
 
 # 14. Operator and Pedagogy Requirements

BITCODE_SPEC_V48_NOTES.md

@@ -587,22 +587,21 @@ become MASTER-DETAIL:
  detail attaches to any asset-pack pipeline row, labeled by the RUN's lens.
  Read dispatch persistence lands with the read gate.
 
-Checker posture: all gate checkers literal-matching the old routes are
-era-pinned (V43–V47) and do not run at the current pointer; frozen `.bitcode/`
-era artifacts and promoted spec families keep the historical route names. The
-standalone `.mjs` gate checkers are pointer-gated in the workflow; the
-`@bitcode/specifying` **test suite** (`node --test test/*.test.js`, run
-unconditionally by Gate Quality) was NOT — its V43–V47 route-realization proofs
-read the historical singular-route source in place and moved to `false !== true`
-once the pluralization moved the files to `uapi/app/deposits|reads`. Those 16
-superseded proof files import `test` from
+Checker posture (meta specifying — `BITCODE_SPECIFYING.md` §4.3 / §13.1):
+**old version checks never change**; **promoted era specs/checks stay frozen as
+canon-at-that-time**; the **living full-system check** for the draft/active
+pointer must be all-encompassing and completely correct for present sole-canon.
+Gate checkers literal-matching the old routes are era-pinned (V43–V47) and do
+not run at the current pointer; frozen `.bitcode/` era artifacts and promoted
+spec families keep the historical route names. The standalone `.mjs` gate
+checkers are pointer-gated in the workflow; the `@bitcode/specifying` **test
+suite** (`node --test test/*.test.js`, run unconditionally by Gate Quality)
+era-pins superseded V43–V47 route-realization proofs via
 `packages/specifying/test/era-pinned-superseded-routes.js` (a `node:test` shim)
-instead of `node:test`: it skips every test WITH A REASON when the current
-plural realization is present (`uapi/app/deposits/DepositPageClient.tsx` exists)
-and runs them unchanged on the promoted V47 canon where the singular
-realization still stands. The proofs are NOT re-pointed at the plural routes —
-Gate 3 rewrote those files, so their historical content predicates would not
-match, and the frozen proofs attest their own era.
+instead of rewriting those proofs to chase plural routes / components layout.
+The pin skips WITH A REASON when the current realization is present and would
+run unchanged on a tree that still held the historical realization. The proofs
+are NOT re-pointed — frozen proofs attest their own era (canon-at-that-time).
 
 ### Legacy terminal browser-proof eradication (Garrett, 2026-07-05)
 

FAMILIARIZATION.md

@@ -1052,11 +1052,14 @@ Guide: `packages/agent-generics/TOOLS-IN-PTRR.md`.
 | --- | --- |
 | **Active canon** | Version pointed by `BITCODE_SPEC.txt` on `main` (currently V47 until V48 promotion). |
 | **Canon / canonical** | Spec family + proven artifacts treated as rebuild law for a version. |
+| **Canon at that time** | Frozen promoted era (specs + proofs + version-bound checks) — never rewritten for later tree drift (`BITCODE_SPECIFYING.md` §4.3). |
 | **Complete Implementation Derivability** | A reader rebuilds current Bitcode from the active family alone (`BITCODE_SPECIFYING.md`). |
 | **DELTA** | Version decision log (`BITCODE_SPEC_VN_DELTA.md`). |
 | **Draft target** | Version under construction (V48 on `version/v48`) — not yet `BITCODE_SPEC.txt` pointer. |
+| **Era-pin** | Skip-with-reason for historical package proofs when current realization superseded that era (do not rewrite the frozen proof). |
 | **Gate** | Bounded acceptance slice (e.g. V48 Gate 3); branch `v48/gate-N-topic`. |
 | **Gate PR** | Pull request closing a gate into the version branch. |
+| **Living full-system check** | All-encompassing, completely correct validation for the **current** draft/active pointer only (`BITCODE_SPECIFYING.md` §13.1). |
 | **NOTES** | Architecture intent ledger (`BITCODE_SPEC_VN_NOTES.md`) — weaker than SPEC body. |
 | **Parity matrix** | Spec claim ↔ source ↔ tests ↔ gates ledger. |
 | **Promotion** | Version PR to `main` after all gates closed; updates `BITCODE_SPEC.txt` pointer under workflow rules. |

packages/specifying/README.md

@@ -7,6 +7,14 @@
 
 Bitcode specifying tooling package (gate generators, canon posture, transitional demo-engine bridge). The monorepo itself is protocol canon.
 
+**Meta specifying (historical freeze):** promoted version specs, proofs, and
+version-bound checks are **immutable canon-at-that-time** — they must not be
+edited to chase later tree moves. The **living full-system check** is only for
+the current draft/active pointer and must be all-encompassing and completely
+correct for present sole-canon. See `BITCODE_SPECIFYING.md` §4.3 and §13.1.
+Era-pin shims under `test/era-pinned-*.js` skip superseded historical package
+proofs with reason; they do not rewrite those proofs.
+
 V29 Gate 8 made this package the package-native boundary for canonical helpers
 that were originally ported from the standalone `protocol-demonstration`
 witness. Commercial scripts, API/runtime code, and workflow checks must import

packages/specifying/test/era-pinned-superseded-browser-proofs.js

@@ -8,12 +8,12 @@
  * `/reads`). The V39/V40 canonical proofs that read those terminal-ux files as
  * evidence therefore attest a superseded era.
  *
- * As with `era-pinned-superseded-routes.js`, the frozen historical proofs are
- * NOT re-pointed (they attest their own era); they are era-pinned: a superseded
- * proof file imports `test` from here instead of `node:test`, and every test it
- * registers is skipped WITH A REASON once the terminal-ux browser proof is
- * gone. On the promoted V39/V40 canon — where the terminal-ux files still
- * exist — `SUPERSEDED` is false and the proofs run unchanged.
+ * Meta law (`BITCODE_SPECIFYING.md` §4.3 / §13.1): **old version checks never
+ * change**; frozen historical proofs attest **canon at that time** and are NOT
+ * re-pointed. Era-pin: a superseded proof imports `test` from here instead of
+ * `node:test`, and every test is skipped WITH A REASON once the terminal-ux
+ * browser proof is gone. On a tree that still holds those files, `SUPERSEDED`
+ * is false and the proofs run unchanged.
  */
 
 import nodeTest from 'node:test';

packages/specifying/test/era-pinned-superseded-routes.js

@@ -9,13 +9,13 @@
  * realization lands they are validating a superseded era against source that
  * has legitimately moved forward.
  *
- * Rather than mutate the frozen historical proofs to chase the current routes
- * (they exist to attest their own era, and the `.bitcode/` artifacts + promoted
- * spec families keep the historical route names), these proofs are ERA-PINNED:
- * a superseded proof file imports `test` from here instead of `node:test`, and
- * every test it registers is skipped WITH A REASON once the current (plural)
- * realization is present. On the promoted V47 canon — where the singular
- * realization still exists — `SUPERSEDED` is false and the proofs run normally.
+ * Meta law (`BITCODE_SPECIFYING.md` §4.3 / §13.1): **old version checks never
+ * change**; promoted proofs attest **canon at that time**. Do not rewrite these
+ * files to chase current routes/packages. ERA-PIN instead: a superseded proof
+ * imports `test` from here instead of `node:test`, and every test is skipped
+ * WITH A REASON once the current realization is present. On a tree that still
+ * holds the historical realization, `SUPERSEDED` is false and proofs run
+ * unchanged.
  *
  * This mirrors the `.mjs` gate checkers' era-pinning (pointer-gated in the
  * workflow); the difference is that the specifying package test suite runs