Cassette Build Report 040 — The Green Review Was Not the S14 Close

Scope note: This report covers the S14 repair after the first closeout and the review that exposed its remaining malformed-input boundary. It does not reopen the earlier reports about reviewer routing or claim that every future Cassette step inherits this exact fixture.

S14 had passed. Thirty macOS fixtures were green, the ledger was clean, and the implementation had a closeout commit. I was still looking at the review transcript because the first closeout had been written before the last objection had finished moving through the tree.

That is the detail that matters. A green closeout can be accurate about the tests it ran and still be too broad about the contract it claims to have finished.

I had asked the implementation agent what our earlier steps had taught us. It answered with useful lessons: identify the attack surface before trusting a fixture, separate caller-controlled values from caller-controlled structures, and make consequential guards prove their necessity. Then I asked it to execute S14, and it began inventing a parallel method around those lessons. The new method had its own language and order. It was becoming a second plan.

I stopped it. “Are you still following IMPLEMENTATION.md?” The answer had to be yes. A question about what the build had taught us was not permission to replace the numbered row. The lessons belonged inside S14’s proof. They did not become a new queue because they sounded sensible.

The first implementation did real work. It joined the native and compiled page paths, checked page identity and content before one pinned MLX submission, reproduced seeded stochastic correction, and preserved retry state across timeout and cancellation. The fixture used three SafeTensors pages in a scratch cartridge. It caught false prefetch claims, exact and sampled corruption, two seeds, and incomplete page routes.

Then the independent review became less independent than it sounded. Kimi K3 Max ran the Mac suite, built an oracle for the seeded draw law, and removed ten guards in a disposable tree. It called S14 sound. A later rebuttal did not accept the verdict as a package. It checked the types and shapes entering the runtime.

The first defect was ordinary Python doing something too permissive. False == 0 and 0.0 == 0. A page-map step could carry the wrong type and still compare equal to the certificate’s integer. The second defect was earlier than the useful error. A missing route, a foreign cancellation object, or an unhashable compiled selection could reach iteration, hashing, or error construction before Cassette had a chance to return its own typed refusal.

Those were not dramatic failures. They were worse for a contract: they were small, coherent inputs that crossed a boundary in the wrong shape.

The repair gives that boundary a visible operation:

def _runtime_u64(value: object, object_id: str, invariant: str, label: str) -> int:
    if type(value) is not int or not 0 <= value <= _MAX_U64:
        raise _runtime_error(
            "CAPABILITY_MISMATCH", object_id, invariant,
            f"{label} requires an unsigned 64-bit integer",
        )
    return value

The runtime integer guard in pager.py is implemented at the repaired S14 boundary. It rejects booleans, floats, negative values, and oversized integers before the value can borrow Python’s equality or enter arithmetic. It does not prove the whole pager. It proves that one class of page-map scalar is checked before comparison.

Sol then added the same kind of pre-use validation to identifiers, digest identities, routes, candidate collections, cancellation controls, deadlines, and confidence values. The fixture gained boolean and floating steps, an extra catalog unit mapped onto an existing page, noncanonical map material, malformed native and compiled records, invalid cancellation objects, oversized numeric fields, and an illegal transition.

I cared about the mutation report more than the count of new cases. Eleven protections were removed one at a time in disposable copies: exact integer typing, identifier typing, digest typing, error translation, transition legality, deadline bounds, cancellation typing, timeout translation, confidence bounds, description binding, and sampling-catalog equality. Every removal made the fixture fail at the missing boundary.

The comparison between the agents is not that one was careful and another was careless. Kimi brought Mac execution and independent arithmetic, but its first battery did not attack every shape that its prose said it had closed. The coding agent’s rebuttal found the shape-level holes. Sol took the reproduced findings and made them executable. Drew’s role was to keep the plan and the evidence from being collapsed into one agreeable account.

The final corrected tree passed all thirty repository tests in 127.53 seconds, with no skip and a clean ledger. That is the measured result. The broader consequence is narrower and more useful: the S14 closeout now says what the fixture can kill, and the fixture kills the guards the closeout names.

S14 was not closed by its first green run. It closed when the malformed records had a typed boundary, the guards were removable only at the cost of a red fixture, and the written claim matched the evidence that survived the review.