# Claims review — 0.2.39

- base: d46b00d
- head: e182d9a
- surface: sha256:66ceac7f7ddc9957d3b4c1ec117f88b5a127b55c5c43ad121a3aa02f9e53bf5e
- verdict: pass
- reviewer: maintainer, re-reading the surfaces after the wire-format section and
  the second locale pass were merged

The version was reviewed once already, before publication, on the translation
pass. That review recorded two limits for the next reader — that the locale
check tests for letters rather than language, and that Turkish markdown still
ships beside the code. Both were acted on before the version left the tree, so
this record supersedes the earlier one rather than repeating it.

The gate stopped the release, which is the first time it has stopped anything,
and the finding below is the one it produced.

## Findings

### 1. docs/RECEIPT-SPEC.md:220 — a section against overclaiming, overclaiming

- Claim: "Every statement in this section is asserted against the shipped
  verifier by `test/spec_wire_contract.mjs`. If the code moves and a sentence
  does not, that check fails — the sentences are measured, not remembered."
- Mechanism: `test/spec_wire_contract.mjs`, which makes fourteen assertions: the
  signed payload against four candidate encodings, the payload byte length
  against the number in the document, the order of the checks against receipts
  built to fail two at once, the required-field table row by row, the vector
  counts quoted in prose, that every manifest case is described, and that the
  deep-link into this section resolves.
- Why it falls short: the section contains statements none of those touch —
  that `sig.alg` other than `Ed25519` is rejected before the key is loaded, that
  an unknown `keyId` is a failure rather than a skip, that a non-canonical
  base64 signature is refused rather than normalised, what `--expect-seq-from`
  pins, the JCS limits paragraph, and the whole section on which document is
  normative for what. "Every statement" asserted a property over a section when
  it held over part of it, which is the same shape as a conformance runner
  reporting a class it sampled — the failure this repository has been arguing
  about on the SCITT list for three days, in its own document.
- Disposition: reworded in e182d9a. The four measured parts are labelled
  **measured** in their headings; the two that are not are labelled **prose**;
  and the introduction states that the prose is not compared to the code by
  anything in the test suite.

### 2. docs/RECEIPT-SPEC.md — `seq`, where the label needed splitting

- Claim: `### seq advances by exactly one — measured` (the first correction's
  own first attempt).
- Mechanism: the order test runs `005-seq-gap` and requires exit 12 with the
  signature removed from the receipt that fails.
- Why it falls short: that measures the gap case and its position in the check
  order. The non-increasing case and `--expect-seq-from` are exercised by no
  vector, so labelling the whole section "measured" would have repeated the
  first finding one heading down.
- Disposition: reworded in e182d9a. The section now states which half is
  measured and names the two behaviours no vector exercises.

### 3. README.md:347 — a count that had been wrong in two files

- Claim: "conformance vectors — twelve frozen cases plus a machine-readable
  manifest".
- Mechanism: `test-vectors/manifest.json`, which carries thirteen cases.
- Why it falls short: the same claim appeared in `README.md` and
  `docs/RECEIPT-SPEC.md`, and the test suite stayed green because each file was
  internally consistent. A reader counting the table in `test-vectors/README.md`
  would have found thirteen and had no way to tell which number was the stale
  one.
- Disposition: corrected, and the recurrence closed — prose counts in all three
  files are now compared against the manifest by `test/spec_wire_contract.mjs`,
  and every manifest case must appear in the vector README's table.

## Limits recorded rather than left to be found

- The prose half of the wire-format section is accurate on this revision and
  pinned by nothing. It is marked as such in the document; a reader who wants a
  guarantee has the four measured parts and the vectors.
- `test/spec_wire_contract.mjs` compares any prose "N cases" in three files
  against the manifest. A future sentence in one of those files about some other
  document's vector count will fail this check wrongly. The message names the
  file and the phrase, so the cost is one edit, but it is a known edge rather
  than a discovered one.
- The locale check now reads words as well as letters, and the word list is
  deliberately small: it excludes every Turkish word that is also English. A
  Turkish sentence built only from words outside that list still passes.
- Turkish design history under `docs/` still ships in the package — 308 word
  occurrences across 19 packed files at the time of this review. The check
  prints that number on every green run rather than passing over it. Whether
  that history belongs in a tarball is a packaging decision, not a claim defect,
  and it is not made here.