feat(shadow-infra): the AnalysisTrace — normalize the identifiers, declare the order (#260/#269 cp3)

P-022 step 7a, checkpoint 3. Still INFRASTRUCTURE for shadow mode, no parity
claim, and still not a comparison: the trace is the SHAPE a comparison would
need, and producing it is not performing one.

Checkpoint 2 left two captures side by side. Two things stand between that
pairing and a comparison, and only one should be removed:

* Internal identifiers. The Layer 2 handles are minted from global counters in
  document order (BR-L2) — positions wearing the costume of names. Measured on
  handles_global_counters, reversing the component list turns
  cap_0/sub_1/sub_2/cap_3 into sub_0/cap_1/cap_2/sub_3: four unchanged facts,
  eight names, none shared. A raw comparison would report every handle as a
  difference and bury the one real one.
* Order, which must NOT be normalized away: document and lowering order is
  semantic (BR-D4/BR-L5), and BR-V8 leaves verdict ties in construction order.

So the trace normalizes the identifiers and DECLARES the order.

* Stable ids are `component|file|line|event|handler`, rebuilt from the record
  the bridge attached to the handle; every occurrence is rewritten; the rename
  is a bijection and total, both asserted. The mint KIND is preserved as
  `mint`, so a routing difference stays a comparable value on one step instead
  of splitting into a pair of "only in one engine" addresses.
* `order` is `significant` for lowered and verdicts, `canonical` for
  summaries — read by a comparison to CLASSIFY an ordering difference, never
  to license a sort.
* Both sides project BOTH engines: projecting a capture is not authoring it,
  and doing it twice is what cross-checks the normalization itself.

Proven on the property it exists for, over the whole captured corpus: a
permutation that reshuffles the mint counters must not move a stable id, and
must still change the lowered layer's step order.

FINDING: the two implementations disagreed, and the disagreement was in the
schema. For two functions named `Take`, the reference addressed the second as
functions[Take~1] and the port as functions[Take]~1 — both faithful readings,
and the reference was inconsistent with itself (inside the bracket for
functions, outside for every other list). Resolved by making the rule explicit
and uniform: inside the bracket, everywhere, so a nested prefix composes.
A single implementation would have shipped the inconsistency. A second defect
surfaced from this family's own step-id control: the function disambiguator
reset per function, so two `Take`s collided on one address.

Campaign: round 1 was 10 caught, 1 survivor. M51 guards a state the corpus
cannot reach, so it needed a synthetic unit-level control (added both sides) —
and then still survived, because the campaign never RAN the layer that catches
it. A campaign that does not run a layer cannot see it catch. A `rust-unit`
layer was added to all three campaigns and all three re-run: 30/30, 11/11,
11/11, controls clean.

Gates: cargo fmt --check, cargo clippy --workspace --all-targets (zero
warnings), cargo test --workspace --no-fail-fast, ruff check ., mypy,
python tests/run_tests.py.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kh6wpfbBUNLbeCJZ263gYM

Author: claude

docs/generated/p022-shadow-census.md

@@ -66,6 +66,25 @@ declares rather than a disagreement it stumbled into:
 | `verdict_door_effect_deps_not_strings` | `summaries` | python-ownlang: produced, rust-own-bridge: refused |
 | `verdict_door_effect_deps_not_strings` | `verdicts` | python-ownlang: produced, rust-own-bridge: refused |
 
+## The AnalysisTrace (checkpoint 3)
+
+Each capture is normalized into a walkable shape: internal identifiers are
+replaced by addresses derived from what they identify, and each layer's
+ordering semantics are **declared** rather than normalized away.
+
+| surface | count |
+|---|---|
+| trace layers projected (both engines, every artifact) | 54 |
+| addressed steps | 254 |
+| of those, handle addresses standing in for a mint counter | 12 |
+
+The normalization is proven on the property it exists for, over the whole
+captured corpus: permuting a document's components reshuffles the global mint
+counters (BR-L2) so the raw handle names change wholesale, and the **stable
+ids must not move** — while the lowered layer's step **order** must still
+change, because that difference is real. Both halves are asserted; a trace that
+hid the second would delete the defect the layer exists to expose.
+
 ## Divergence classification
 
 **Python-only 0 / Rust-only 0 / Changed 0 / Ordering-only n/a / Unexplained 0**,
@@ -92,6 +111,11 @@ artifacts and nothing reads one against the other. The gates:
 - `own-shadow/tests/engine.rs::a_partial_projection_names_exactly_the_members_it_carries`
 - `own-shadow/tests/engine.rs::both_engines_report_the_same_layers_in_the_same_order`
 - `own-shadow/tests/engine.rs::this_engine_reproduces_its_committed_capture`
+- `own-shadow/tests/trace.rs::a_mint_order_shift_moves_the_order_but_not_the_stable_ids`
+- `own-shadow/tests/trace.rs::a_refused_layer_carries_no_steps`
+- `own-shadow/tests/trace.rs::every_trace_golden_is_reproduced_byte_for_byte`
+- `own-shadow/tests/trace.rs::no_counter_shaped_handle_survives_anywhere_in_a_trace`
+- `own-shadow/tests/trace.rs::the_declared_order_semantics_are_the_frozen_ones`
 
 ## The unmeasured set, named
 
@@ -136,7 +160,7 @@ that each recorded result is internally consistent
 | survived | **0** |
 | compile errors (reported as such, never as "caught") | 0 |
 | harness-honesty controls reporting zero failures | 1 |
-| catches by layer | `python` 19, `rust` 38 |
+| catches by layer | `python` 19, `rust` 40 |
 | mutations with exactly **one** catching layer | 15 — M04, M05, M06, M07, M08, M09, M10, M11, M12, M14, M15, M21, M24, M25, M26 |
 
 | id | mutation | caught by |
@@ -159,8 +183,8 @@ that each recorded result is internally consistent
 | M16 | the port's canonical form stops sorting object keys | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::every_shared_document_hashes_to_the_recorded_digest`, `rust::this_engine_reproduces_its_committed_capture`, `rust::verify_refuses_each_structural_violation` |
 | M17 | the port escapes U+007F, which the reference emits raw | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::every_shared_document_hashes_to_the_recorded_digest`, `rust::this_engine_reproduces_its_committed_capture` |
 | M18 | the port escapes control code points with uppercase hex | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::every_shared_document_hashes_to_the_recorded_digest`, `rust::this_engine_reproduces_its_committed_capture` |
-| M19 | the port renders the artifact with a different indent width | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::the_canonical_form_ignores_only_insignificant_text_formatting` |
-| M20 | the port renders an artifact's objects in sorted rather than document order | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::the_canonical_form_ignores_only_insignificant_text_formatting` |
+| M19 | the port renders the artifact with a different indent width | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::every_trace_golden_is_reproduced_byte_for_byte`, `rust::the_canonical_form_ignores_only_insignificant_text_formatting` |
+| M20 | the port renders an artifact's objects in sorted rather than document order | `rust::every_committed_artifact_round_trips_and_verifies`, `rust::every_trace_golden_is_reproduced_byte_for_byte`, `rust::the_canonical_form_ignores_only_insignificant_text_formatting` |
 | M21 | the port resolves a duplicate key first-wins instead of last-wins | `rust::the_canonical_form_ignores_only_insignificant_text_formatting` |
 | M22 | the port wraps an out-of-i64 integer instead of refusing it | `rust::every_declared_unnameable_document_is_refused`, `rust::values_outside_the_canonical_domain_are_refused_at_parse` |
 | M23 | the port accepts a float as an integer instead of refusing it | `rust::every_declared_unnameable_document_is_refused`, `rust::values_outside_the_canonical_domain_are_refused_at_parse` |
@@ -196,3 +220,28 @@ that each recorded result is internally consistent
 | M39 | the port reports a typed-door refusal on one layer instead of all three | `rust-engine::this_engine_reproduces_its_committed_capture` |
 | M40 | the port's verification stops rejecting a 'full' projection that names members | `rust-repro::verify_refuses_each_structural_violation` |
 | M41 | the port's verification accepts an EMPTY reason on a partial projection | `rust-repro::verify_refuses_each_structural_violation` |
+### checkpoint 3 — AnalysisTrace and stable-ID normalization (`p022-shadow-cp3`)
+
+| | |
+|---|---|
+| mutations | **11** |
+| caught | **11** |
+| survived | **0** |
+| compile errors (reported as such, never as "caught") | 0 |
+| harness-honesty controls reporting zero failures | 1 |
+| catches by layer | `python` 9, `rust-trace` 4, `rust-unit` 3 |
+| mutations with exactly **one** catching layer | 7 — M42, M43, M45, M46, M48, M50, M51 |
+
+| id | mutation | caught by |
+|---|---|---|
+| M42 | the reference derives a handle's stable id from the counter instead of the record's identity | `python::non-zero exit with no FAIL line` |
+| M43 | the reference drops `line` from a handle's identity, fusing two facts on one line-distinct site | `python::trace-golden` |
+| M44 | the reference stops disambiguating a repeated address | `python::trace-golden`, `python::trace-shape` |
+| M45 | the reference declares the lowered layer's order canonical, licensing a sort | `python::trace-golden` |
+| M46 | the reference declares the verdict layer's order canonical, hiding a tie-order defect | `python::trace-golden` |
+| M47 | the reference narrows the minted-handle pattern so `loc_` names leak through unrewritten | `python::trace-golden`, `python::trace-normalization` |
+| M48 | the reference gives a refused layer an empty step list AND drops its error | `python::trace-golden` |
+| M49 | the port derives a handle's stable id from the counter instead of the record's identity | `rust-trace::a_mint_order_shift_moves_the_order_but_not_the_stable_ids`, `rust-trace::every_trace_golden_is_reproduced_byte_for_byte`, `rust-unit::trace::tests::a_fully_listed_document_normalizes` |
+| M50 | the port declares the lowered layer's order canonical, licensing a sort | `rust-trace::every_trace_golden_is_reproduced_byte_for_byte` |
+| M51 | the port stops asserting that the handle rewrite is total | `rust-unit::trace::tests::a_handle_reference_the_rename_cannot_reach_is_refused` |
+| M52 | the port drops the mint kind from the handle record | `rust-trace::every_trace_golden_is_reproduced_byte_for_byte`, `rust-unit::trace::tests::a_fully_listed_document_normalizes` |

docs/notes/p022-shadow-infra-checkpoint1-data/campaign.json

@@ -4,7 +4,8 @@
   "comment": "A RECORDED run, not a CI gate: mutating the tree and running every layer takes minutes and cannot be part of the per-commit gates. What IS gated is the campaign DEFINITION (every anchor still resolves) and this file's internal consistency — see tests/test_generated_docs.py.",
   "layers": [
     "python",
-    "rust"
+    "rust",
+    "rust-unit"
   ],
   "totals": {
     "mutations": 30,
@@ -201,6 +202,7 @@
       "status": "caught",
       "caught_by": [
         "rust::every_committed_artifact_round_trips_and_verifies",
+        "rust::every_trace_golden_is_reproduced_byte_for_byte",
         "rust::the_canonical_form_ignores_only_insignificant_text_formatting"
       ]
     },
@@ -211,6 +213,7 @@
       "status": "caught",
       "caught_by": [
         "rust::every_committed_artifact_round_trips_and_verifies",
+        "rust::every_trace_golden_is_reproduced_byte_for_byte",
         "rust::the_canonical_form_ignores_only_insignificant_text_formatting"
       ]
     },

docs/notes/p022-shadow-infra-checkpoint1-data/mutations.json

@@ -1,6 +1,6 @@
 {
   "campaign": "p022-shadow-cp1",
-  "comment": "The mutation campaign for P-022 step 7a checkpoint 1 (shadow-mode infrastructure layer 0: the same-input capture and the reproduction artifact). Every mutation edits a PRODUCTION surface — ownlang/repro.py or rust/crates/own-shadow/src/ — never a test, because P-022 discipline 2 makes a test evidence only once its mutation fails through the surface it claims to protect. Both layers run for every mutation (discipline 3: no fail-fast), so the recorded result names every catching layer, not the first. M00 is the harness-honesty control. Run: python scripts/mutate_campaign.py docs/notes/p022-shadow-infra-checkpoint1-data/mutations.json --out docs/notes/p022-shadow-infra-checkpoint1-data/campaign.json Re-anchored when checkpoint 2 reshaped the layer envelope: M11 and M15 lost their anchors, which the --check gate caught before the recorded result could go on describing a tree that no longer exists.",
+  "comment": "The mutation campaign for P-022 step 7a checkpoint 1 (shadow-mode infrastructure layer 0: the same-input capture and the reproduction artifact). Every mutation edits a PRODUCTION surface — ownlang/repro.py or rust/crates/own-shadow/src/ — never a test, because P-022 discipline 2 makes a test evidence only once its mutation fails through the surface it claims to protect. Both layers run for every mutation (discipline 3: no fail-fast), so the recorded result names every catching layer, not the first. M00 is the harness-honesty control. Run: python scripts/mutate_campaign.py docs/notes/p022-shadow-infra-checkpoint1-data/mutations.json --out docs/notes/p022-shadow-infra-checkpoint1-data/campaign.json Re-anchored when checkpoint 2 reshaped the layer envelope: M11 and M15 lost their anchors, which the --check gate caught before the recorded result could go on describing a tree that no longer exists. A `rust-unit` layer runs the crate's own unit tests: without it a rule that is only reachable off the production path (a defensive assertion the corpus cannot trigger) has its catcher invisible to the campaign, and the mutation reads as a survivor when the control exists and works. Found exactly that way on cp3's M51.",
   "layers": [
     {
       "id": "python",
@@ -22,6 +22,19 @@
         "--no-fail-fast"
       ],
       "parser": "cargo_test"
+    },
+    {
+      "id": "rust-unit",
+      "cwd": "rust",
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "own-shadow",
+        "--lib",
+        "--no-fail-fast"
+      ],
+      "parser": "cargo_test"
     }
   ],
   "mutations": [

docs/notes/p022-shadow-infra-checkpoint2-data/campaign.json

@@ -5,7 +5,8 @@
   "layers": [
     "python",
     "rust-repro",
-    "rust-engine"
+    "rust-engine",
+    "rust-unit"
   ],
   "totals": {
     "mutations": 11,

docs/notes/p022-shadow-infra-checkpoint2-data/mutations.json

@@ -1,6 +1,6 @@
 {
   "campaign": "p022-shadow-cp2",
-  "comment": "The mutation campaign for P-022 step 7a checkpoint 2 (the engine protocol: how each engine reports its per-layer outputs, and what it declares it could produce). Separate from the cp1 campaign on purpose — each checkpoint's evidence stays frozen at what it measured, so a later checkpoint cannot quietly restate an earlier one's numbers. Every mutation edits a PRODUCTION surface — ownlang/repro.py or rust/crates/own-shadow/src/ — never a test. Three layers run for every mutation (discipline 3: no fail-fast), including the port's own engine suite. M00 is the harness-honesty control. Run: python scripts/mutate_campaign.py docs/notes/p022-shadow-infra-checkpoint2-data/mutations.json --out docs/notes/p022-shadow-infra-checkpoint2-data/campaign.json",
+  "comment": "The mutation campaign for P-022 step 7a checkpoint 2 (the engine protocol: how each engine reports its per-layer outputs, and what it declares it could produce). Separate from the cp1 campaign on purpose — each checkpoint's evidence stays frozen at what it measured, so a later checkpoint cannot quietly restate an earlier one's numbers. Every mutation edits a PRODUCTION surface — ownlang/repro.py or rust/crates/own-shadow/src/ — never a test. Three layers run for every mutation (discipline 3: no fail-fast), including the port's own engine suite. M00 is the harness-honesty control. Run: python scripts/mutate_campaign.py docs/notes/p022-shadow-infra-checkpoint2-data/mutations.json --out docs/notes/p022-shadow-infra-checkpoint2-data/campaign.json A `rust-unit` layer runs the crate's own unit tests: without it a rule that is only reachable off the production path (a defensive assertion the corpus cannot trigger) has its catcher invisible to the campaign, and the mutation reads as a survivor when the control exists and works. Found exactly that way on cp3's M51.",
   "layers": [
     {
       "id": "python",
@@ -38,6 +38,19 @@
         "--no-fail-fast"
       ],
       "parser": "cargo_test"
+    },
+    {
+      "id": "rust-unit",
+      "cwd": "rust",
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "own-shadow",
+        "--lib",
+        "--no-fail-fast"
+      ],
+      "parser": "cargo_test"
     }
   ],
   "mutations": [

docs/notes/p022-shadow-infra-checkpoint3-data/campaign.json

@@ -0,0 +1,132 @@
+{
+  "campaign": "p022-shadow-cp3",
+  "generated_by": "scripts/mutate_campaign.py",
+  "comment": "A RECORDED run, not a CI gate: mutating the tree and running every layer takes minutes and cannot be part of the per-commit gates. What IS gated is the campaign DEFINITION (every anchor still resolves) and this file's internal consistency — see tests/test_generated_docs.py.",
+  "layers": [
+    "python",
+    "rust-repro",
+    "rust-engine",
+    "rust-trace",
+    "rust-unit"
+  ],
+  "totals": {
+    "mutations": 11,
+    "caught": 11,
+    "survived": 0,
+    "compile_errors": 0,
+    "control_clean": 1
+  },
+  "mutations": [
+    {
+      "id": "M00",
+      "what": "harness-honesty control: no mutation at all, which must report zero failing layers",
+      "rule": "campaign hygiene",
+      "status": "control_clean",
+      "caught_by": []
+    },
+    {
+      "id": "M42",
+      "what": "the reference derives a handle's stable id from the counter instead of the record's identity",
+      "rule": "trace: internal identifiers are normalized away by IDENTITY, never by position",
+      "status": "caught",
+      "caught_by": [
+        "python::non-zero exit with no FAIL line"
+      ]
+    },
+    {
+      "id": "M43",
+      "what": "the reference drops `line` from a handle's identity, fusing two facts on one line-distinct site",
+      "rule": "trace: the rename is a BIJECTION — it may not fuse two facts into one address",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden"
+      ]
+    },
+    {
+      "id": "M44",
+      "what": "the reference stops disambiguating a repeated address",
+      "rule": "trace: a duplicate address takes a ~<n> suffix, inside the bracket",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden",
+        "python::trace-shape"
+      ]
+    },
+    {
+      "id": "M45",
+      "what": "the reference declares the lowered layer's order canonical, licensing a sort",
+      "rule": "trace: order is DECLARED, never normalized away — lowered order is semantic (BR-D4/BR-L5)",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden"
+      ]
+    },
+    {
+      "id": "M46",
+      "what": "the reference declares the verdict layer's order canonical, hiding a tie-order defect",
+      "rule": "trace: BR-V8 leaves ties in construction order, so position carries information",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden"
+      ]
+    },
+    {
+      "id": "M47",
+      "what": "the reference narrows the minted-handle pattern so `loc_` names leak through unrewritten",
+      "rule": "trace: the rename is TOTAL — no counter-shaped name survives",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden",
+        "python::trace-normalization"
+      ]
+    },
+    {
+      "id": "M48",
+      "what": "the reference gives a refused layer an empty step list AND drops its error",
+      "rule": "trace: a refused layer carries its error and no steps",
+      "status": "caught",
+      "caught_by": [
+        "python::trace-golden"
+      ]
+    },
+    {
+      "id": "M49",
+      "what": "the port derives a handle's stable id from the counter instead of the record's identity",
+      "rule": "trace: internal identifiers are normalized away by IDENTITY, never by position",
+      "status": "caught",
+      "caught_by": [
+        "rust-trace::a_mint_order_shift_moves_the_order_but_not_the_stable_ids",
+        "rust-trace::every_trace_golden_is_reproduced_byte_for_byte",
+        "rust-unit::trace::tests::a_fully_listed_document_normalizes"
+      ]
+    },
+    {
+      "id": "M50",
+      "what": "the port declares the lowered layer's order canonical, licensing a sort",
+      "rule": "trace: order is DECLARED, never normalized away",
+      "status": "caught",
+      "caught_by": [
+        "rust-trace::every_trace_golden_is_reproduced_byte_for_byte"
+      ]
+    },
+    {
+      "id": "M51",
+      "what": "the port stops asserting that the handle rewrite is total",
+      "rule": "trace: a claim nothing can falsify is not a contract",
+      "status": "caught",
+      "caught_by": [
+        "rust-unit::trace::tests::a_handle_reference_the_rename_cannot_reach_is_refused"
+      ]
+    },
+    {
+      "id": "M52",
+      "what": "the port drops the mint kind from the handle record",
+      "rule": "trace: the mint kind is preserved as a comparable VALUE so a routing difference stays one step",
+      "status": "caught",
+      "caught_by": [
+        "rust-trace::every_trace_golden_is_reproduced_byte_for_byte",
+        "rust-unit::trace::tests::a_fully_listed_document_normalizes"
+      ]
+    }
+  ]
+}