Merge pull request #166 from AdaWorldAPI/claude/ruling-never-pin-bump

ledger: D/E-NEVER-PIN-BUMP — float-on-main ruling; non_exhaustive rejected

Author: AdaWorldAPI

.claude/board/EPIPHANIES.md

@@ -1,12 +1,18 @@
 # EPIPHANIES.md — findings log for OGAR
 
 > **APPEND-ONLY.** Newest at top. Each entry is a dated insight with a
-> `**Status:**` line (FINDING / CONJECTURE / FRAMING / SUPERSEDED). Only
-> the Status line is mutable — body and date are immutable. Corrections
-> append as new dated entries citing the original.
+> `**Status:**` line (FINDING / CONJECTURE / FRAMING / SUPERSEDED /
+> RULING). Only the Status line is mutable — body and date are immutable.
+> Corrections append as new dated entries citing the original.
 
 ---
 
+## 2026-07-06 — E-NEVER-PIN-BUMP — float-on-main is doctrine; non_exhaustive rejected
+
+**Status:** RULING (`[G]`, operator 2026-07-06).
+
+Operator, verbatim: *"wir machen NIEMALS pin bump."* Float-on-main is not a convenience, it is the doctrine: an upstream additive field breaking a downstream build *now* is the FEATURE (immediate surfacing, fix-forward in minutes — ruff #45 → OGAR #162 proved it twice in one day), not a defect to engineer away. Rejected on this basis: `#[non_exhaustive]` on `ruff_spo_triplet::{Function, Model}` (the #45-audit nit) — a permanent org-wide ergonomics tax and signal loss, bought against a break class that costs minutes. Guard-rails that remain: COUNT_FUSE-style fuses, workspace sweeps, the `..Default::default()` fixture convention. Meta-Lehre: **audit nits are candidates, not decisions** — the trade-off analysis belongs BEFORE the decision point; this one reached implementation-planning before the analysis caught up, and the operator caught it.
+
 ## 2026-07-06 — E-BEHAVIOR-AT-COMPILE-TIME — behavior facts are substrate, not runtime beiwerk
 
 **Status:** FRAMING (`[G]` for the effect-annotation facts now wired; `[H]` for source-body lowering).

docs/DISCOVERY-MAP.md

@@ -1059,3 +1059,5 @@ isolation. The map's job is to keep them visible.
   identical dedup (explicit `foreign_key`, PR #156 finding (b)) across both
   paths from one implementation. Behavior-preserving; `classify_woa_domain`
   lockstep left as a separate, named follow-up.
+
+- **D-NEVER-PIN-BUMP** — 2026-07-06 operator ruling `[G]`: *"wir machen NIEMALS pin bump."* Every cross-repo dep floats on `branch = "main"`; the drift protection is loud compile breaks + fuses + fix-forward (proven same-day: ruff #45 `guarded_writes` → OGAR #162 within minutes, twice). Consequently the #45-post-merge-audit nit "make `ruff_spo_triplet::{Function, Model}` `#[non_exhaustive]`" is **REJECTED by ruling** — it would erase the loud-break signal and tax every construction site org-wide forever (non_exhaustive forbids struct literals even with `..Default::default()` outside the defining crate, including ruff's own frontend crates). The standing pattern stays: downstream fixtures construct with `..Default::default()` (established in #162); a rustdoc note on `ruff_spo_triplet::{Function, Model}` documenting this construction convention is a named follow-up (no companion PR yet).