docs(adr): address four external reviews of ADR-016 and ADR-017

[Polichinel]

Reviews arrived from the views-appwrite seat (#231, #232) and the views-faoapi/crafdapi seat (#233, #234). Both accepted both ADRs; both found real defects; two independently found the same one. Consolidated response posted on #233.

The load-bearing finding, verified before acting

protect_main [active]   bypass_actors: NONE
branches/main/protection -> 404 Branch not protected

ADR-016 §7's third justification was false. It said the maintainer administers this repository and can therefore merge over a failing check. A ruleset applies to everyone except the actors it names, and it names none.

Withdrawn in place rather than deleted: the section now states there is no escape hatch, that adding a bypass actor is a console change nobody has made, and that such an override would in any case be one person's judgement available only while that person is. The coupling stands on the two reasons that survive on their own.

The sharpest finding — a green window that proves nothing

From #232. After the registry row lands and we switch our check to read it, but before the consumer-side check exists, the build is green and what it verifies is that two values this platform authored agree with each other — and the check that consulted the consumer's real source would by then be deleted. Strictly weaker than today, and exactly the objection ADR-016 raises against copies.

Sequence now constrained: adding the registry check does not remove the source-reading one. That goes only when the consumer-side check lands. Slightly redundant for a while, which is the right price.

One finding was a code hole, not a wording problem

From #233. G4 fired only on ci_checkout=False — so the note recording that the crafdapi fetch is temporary was enforced by nothing. Prose about another repository that nothing can check, which is §3's failure reintroduced for the one download the ADR itself calls temporary.

G4 now follows the note, not the flag: any note present must name a record. Both fetched siblings gained one — crafdapi's records its temporariness and cites ADR-017 §7; appwrite's records that its fetch is load-bearing and that pruning it would silently disable two checks. Mutation-proven both ways, including that a permanent fetch with no note is correctly left alone.

Everything else

finding	source	resolution
coupling rate unstated	#231 F2	§7a — five registry editions in four days, four observation-only, each would have blocked a release
moving-main vs pin-by-tag	#233 F3	§7b — drift tripwires vs reachability checks
G7's explanation embeds a decaying fact	#231 F3	now a dated observation
crafd's third leg never filed	#232 F2	views-crafdapi#39 filed; Appendix B step 4
crafd's label value isn't decided yet	#234 F1	Appendix B records the block; asked views-appwrite#75 to split the halves so the FAO row lands independently
ADR pre-claimed another repo's assent	#232 F3	§5 now "subject to views-appwrite accepting"
wrong fact carrying §5 item 3	#234 F3	it is free because the registry is public, not because we are — the consumer never reads us at all
edition skew unstated	#234 F2	stated: the label is contract-immutable
§9 over-reaches for behaviour	#232 F4	scoped to declarable facts; semantics for behaviour, with views-models#327/D-05 named

Declined, with the reason

#234 F4 — an interim tripwire failing CI if the manual check goes stale. The sequencing fix removes its premise: the source-reading check now survives until the consumer-side one exists, so the interim state is not weaker than today. A dated assertion needing periodic refresh is a guard whose likeliest first firing is a non-event — which is what G8 did in this very file before being deleted.

Verification

ruff check .        # clean
pytest -q           # 399 passed, 40 xfailed

Falsification probes re-run over both documents after editing; the widened G4 also caught its own stale table row in ADR-016.

🤖 Generated with Claude Code