feat(contractiles): fill bust + adjust with 007-lang drift semantics

Task #11.

bust (hard-stops, merge-blocking):
- `bust/Bustfile.a2ml` — 16 hard_stops across six classes:
  banned_pattern  (believe_me, assert_total, Admitted, sorry,
                   unsafeCoerce, Obj.magic, .expect("TODO") antipattern)
  banned_language (python, typescript, package.json, v-lang, makefile,
                   dockerfile)
  proof_regression (canonical-proof-suite scorecard decline,
                    v0-differential floor 17/17)
  spec_drift      (EBNF↔Pest rule-count divergence, Harvard invariant,
                   SCM-file-at-repo-root)
  hype_drift      (commercial/revolutionary register in docs)
  expiry          (0-AI-MANIFEST.a2ml > 12 months stale)
- `bust/bust.ncl` — runner with severity gate (critical/high block
  merge; medium warns; low informs), read-only probes, self-contained
  (no estate _base.ncl dependency).

adjust (allowed drift corrections, advisory):
- `adjust/Adjustfile.a2ml` — 8 adjustments with detect/correct pairs +
  automation flags + frequency hints. Covers: EBNF↔Pest resync,
  symbol-line-number rot (0-AI-MANIFEST design-doc-convention rule),
  6a2 missing-or-stale, duplicate STATE/META root-vs-6a2 (current
  007-lang drift acknowledged), lowercase xfile stubs, k9-under-
  contractiles (fixed 2026-04-20 in commit f6f3c91, retained as
  regression detector), missing SPDX headers, README ↔ Justfile
  recipe drift, .lia.cache hygiene.
- `adjust/adjust.ncl` — runner with `check` / `fix` modes, filesystem-
  write allowed for deterministic fixes only, continue-with-warnings.
- Removed the lowercase `adjustfile.a2ml` stub (generator drift,
  superseded by canonical `Adjustfile.a2ml`).

Justfile:
- `contractile-check` now depends on `bust-check adjust-check` too.
- `bust-check` with per-probe 10s timeout (fast pre-commit gate) plus
  `bust-check-full` for the no-timeout variant. Slow probes
  (canonical-proof-suite, v0-differential) return "deferred" rather
  than failing when they exceed 10s.
- `adjust-check` reports drift entries without blocking.

Known finding (pre-existing, not introduced here): `bust-check`
surfaces one Harvard-invariant violation — `DataExpr` enum in
oo7-core contains control-flow variants (semiring symbols). Tracked
as the `harvard-invariant-violated` bust hit; resolution is out of
scope for this task (either refactor `DataExpr` or record an explicit
variance in the intend trident). `just contractile-check` will
therefore fail on fresh clones until this is addressed — please land
the fix or variance in a follow-up commit.

Assail clean on new files (11 pre-existing Rust weak points unchanged).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/contractiles/README.adoc

@@ -13,8 +13,14 @@ one lowercase `<verb>.ncl` runner.
 * `dust/Dustfile.a2ml` — rollback and cleanup semantics.
 * `intend/Intentfile.a2ml` — north-star intents + horizon wishes + session
   lifecycle hook declarations.
-* `adjust/` — allowed drift corrections (work in progress).
-* (planned) `bust/Bustfile.a2ml` — what breaks and how to react.
+* `adjust/Adjustfile.a2ml` — allowed drift corrections with their
+  authorised (often automated) fix runners.
+* `bust/Bustfile.a2ml` — hard-stops. What must not appear: banned
+  patterns (believe_me / assert_total / Admitted / sorry / unsafeCoerce
+  / Obj.magic), Rust anti-patterns (`.expect("TODO")`), banned
+  languages (Python / TS / V / npm), Makefile/Dockerfile, proof
+  regression, spec drift (Harvard invariant, EBNF↔Pest divergence),
+  and SCM-file-at-root drift.
 
 K9 templates and validators live at `.machine_readable/svc/k9/` per
 ADR-001 (2026-04-18). `contractiles/` is reserved for the pure verb

.machine_readable/contractiles/adjust/Adjustfile.a2ml

@@ -0,0 +1,107 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Adjustfile — allowed drift corrections for 007-lang
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# Paired runner: adjust.ncl
+#
+# Supersedes: adjustfile.a2ml (lowercase stub, removed in the same
+# commit; stub was generated 2026-04-08 and never ratified).
+
+@abstract:
+Drift corrections that are allowed (and often automated). Each entry
+names a detected drift + the authorised correction. Distinction from
+Bustfile: Bustfile hard-stops "this must not appear at all"; Adjustfile
+acknowledges "this may drift, and here is the authorised correction".
+Distinction from Dustfile: Dustfile concerns end-of-life / deprecation
+rollback; Adjustfile concerns ongoing housekeeping.
+@end
+
+## Spec / grammar drift
+
+[[adjustments]]
+id = "ebnf-pest-resync"
+description = "EBNF and Pest grammar rule counts drift during development"
+detect = "just spec-check 2>&1 | grep -qE 'DRIFT|mismatch'"
+correct = "just grammar-check && human-review-required"
+automatable = false
+frequency = "per-commit"
+notes = "The correction isn't mechanical; it requires deciding whether EBNF or Pest is authoritative for a given rule. Log drift in 6a2/DRIFT.a2ml when not immediately corrected."
+
+[[adjustments]]
+id = "symbol-line-number-rot"
+description = "Design docs / audits cite line numbers that have shifted (design-doc-conventions rule in 0-AI-MANIFEST.a2ml)"
+detect = "grep -rnE ':[0-9]+\\b' docs/ audits/ 2>/dev/null | grep -E '\\.(rs|idr|v)\\b' | head -20"
+correct = "Re-anchor the citation to a symbol path (e.g. `eval.rs :: ControlStmt::EnterDiscourse`) per 0-AI-MANIFEST.a2ml design-doc-conventions. The rule was added 2026-04-13 after T6 step-semantics flagged citation rot as bot-hostile."
+automatable = false
+frequency = "ad-hoc"
+
+## 6a2 hygiene
+
+[[adjustments]]
+id = "6a2-file-missing-or-stale"
+description = "One of the six A2ML files (STATE, META, ECOSYSTEM, AGENTIC, NEUROSYM, PLAYBOOK) is missing or older than the others by more than 30 days"
+detect = "find .machine_readable -maxdepth 2 -name '*.a2ml' -mtime +30 | grep -qE '(STATE|META|ECOSYSTEM|AGENTIC|NEUROSYM|PLAYBOOK)\\.a2ml$'"
+correct = "Regenerate or touch the stale file — per MEMORY rule '6a2 = six a2ml files — Update ALL SIX together', drift in one implies staleness across the set."
+automatable = false
+frequency = "monthly"
+
+[[adjustments]]
+id = "duplicate-6a2-root-vs-subdir"
+description = "STATE.a2ml / META.a2ml exists BOTH at .machine_readable/ root AND at .machine_readable/6a2/ (drift currently present in 007-lang as of 2026-04-19)"
+detect = "test -f .machine_readable/STATE.a2ml && test -f .machine_readable/6a2/STATE.a2ml"
+correct = "Reconcile to a single canonical location — currently root is active (2026-04-19 timestamps) and 6a2/ copies are 2026-04-04 stale. Either delete the stale 6a2 copies or adopt 6a2/ as canonical estate-wide and refresh."
+automatable = false
+frequency = "once (drift cleanup)"
+notes = "The duplicate is acknowledged drift, not an intent. Do not automate the fix — estate-wide consensus needed on canonical location."
+
+## Contractile structure drift
+
+[[adjustments]]
+id = "lowercase-xfile-stub"
+description = "Lowercase `mustfile.a2ml` / `trustfile.a2ml` / `dustfile.a2ml` co-exists with the canonical capitalised form — the lowercase copy is generator drift"
+detect = "ls .machine_readable/contractiles/*/mustfile.a2ml .machine_readable/contractiles/*/trustfile.a2ml .machine_readable/contractiles/*/dustfile.a2ml 2>/dev/null | grep -q ."
+correct = "Delete the lowercase stubs; the capitalised files are canonical per estate rule ('verb dir = ONE <Verb>file.a2ml + ONE <verb>.ncl runner')."
+automatable = true
+fix_command = "rm -f .machine_readable/contractiles/*/mustfile.a2ml .machine_readable/contractiles/*/trustfile.a2ml .machine_readable/contractiles/*/dustfile.a2ml"
+frequency = "ad-hoc"
+
+[[adjustments]]
+id = "k9-under-contractiles"
+description = "K9 templates found under contractiles/k9/ rather than svc/k9/ (ADR-001 2026-04-18)"
+detect = "test -d .machine_readable/contractiles/k9"
+correct = "git mv .machine_readable/contractiles/k9 .machine_readable/svc/k9 and update any references"
+automatable = false
+frequency = "once"
+notes = "Fixed 2026-04-20 in commit f6f3c91. Kept here as a regression-detection entry."
+
+## License / header hygiene
+
+[[adjustments]]
+id = "missing-spdx-header-on-new-source"
+description = "A staged Rust/Idris/Zig/Scheme/A2ML/NCL file lacks SPDX-License-Identifier"
+detect = "git diff --cached --name-only | grep -E '\\.(rs|idr|zig|scm|a2ml|ncl)$' | xargs -I{} grep -L 'SPDX-License-Identifier' {} 2>/dev/null | grep -q ."
+correct = "Prepend: `# SPDX-License-Identifier: PMPL-1.0-or-later` (or per 0-AI-MANIFEST.a2ml policy for dual-use code)"
+automatable = true
+fix_command = ".machine_readable/scripts/maintenance/add-spdx-headers.sh || just must-spdx-headers"
+frequency = "pre-commit"
+
+## Docs drift
+
+[[adjustments]]
+id = "readme-adoc-outdated-tool-list"
+description = "README.adoc references an oo7 CLI recipe that no longer exists in the Justfile"
+detect = "grep -oE 'just\\s+[a-z-]+' README.adoc 2>/dev/null | awk '{print $2}' | sort -u | xargs -I{} sh -c 'just --list | grep -q \"^\\s*{}\\s\" || echo {}'"
+correct = "Update README.adoc or re-introduce the recipe. Often signals a recipe was renamed without doc sync."
+automatable = false
+frequency = "ad-hoc"
+
+## Cache / build artefacts
+
+[[adjustments]]
+id = "lia-cache-committed-risk"
+description = ".lia.cache file present (Coq tactic cache — benign but should not enter git)"
+detect = "find . -name '.lia.cache' -not -path './.git/*' | head -1 | grep -q ."
+correct = "Add `.lia.cache` to .gitignore if not already present; remove from working tree."
+automatable = true
+fix_command = "grep -q '^\\.lia\\.cache' .gitignore || echo '.lia.cache' >> .gitignore"
+frequency = "ad-hoc"
+notes = "Observed in 007-lang working tree 2026-04-19 under both repo root and proofs/canonical-proof-suite/."

.machine_readable/contractiles/adjust/adjust.ncl

@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Adjust — drift-correction runner for 007-lang
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+#
+# Pairs with: Adjustfile.a2ml (same directory)
+# Verb:       adjust
+# Semantics:  each entry declares a detected drift + its authorised
+#             correction. Runner in `check` mode reports; in `fix`
+#             mode it runs the `fix_command` for every entry where
+#             `automatable = true`. Non-automatable entries are
+#             surfaced to the user.
+# CLI:
+#   contractile adjust check   — report drift hits without fixing
+#   contractile adjust fix     — apply automated fixes; list manual items
+#
+# Self-contained: does not import an estate _base.ncl.
+
+{
+  pedigree = {
+    contractile_verb = "adjust",
+    semantics = "allowed drift corrections",
+    security = {
+      leash = 'Kennel,
+      trust_level = "deterministic fixes only; human review required for non-automatable",
+      allow_network = false,
+      allow_filesystem_write = true,    # `fix` mode edits files
+      allow_subprocess = true,
+    },
+    metadata = {
+      name = "007-adjust-runner",
+      version = "1.0.0",
+      description = "Evaluates the 007-lang Adjustfile and applies deterministic fixes. Advisory: continue-with-warnings rather than hard-gate.",
+      paired_xfile = "Adjustfile.a2ml",
+      author = "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
+    },
+  },
+
+  schema = {
+    adjustments
+      | Array {
+          id | String,
+          description | String,
+          detect | String,                 # shell predicate; exit 0 = drift present
+          correct | String,                # prose description of the correction
+          automatable | Bool | default = false,
+          fix_command | String | optional, # shell cmd applied when automatable + `fix` mode
+          frequency | [| 'per_commit, 'ad_hoc, 'monthly, 'once, 'pre_commit |] | optional,
+          notes | String | optional,
+          status | [| 'declared, 'verified, 'failing, 'partial |] | default = 'declared,
+        }
+      | optional,
+  },
+
+  run = {
+    on_pass = "continue",
+    on_any_fail = "continue-with-warnings",   # advisory, not blocking
+    report_format = "a2ml",
+    emit_summary = true,
+    auto_fix_when_available = true,
+    manual_items_to_stdout = true,
+  },
+}

.machine_readable/contractiles/adjust/adjustfile.a2ml

@@ -0,0 +1,181 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Bustfile — hard-stop / must-not-run declarations for 007-lang
+# Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+# Paired runner: bust.ncl
+#
+# Complement to Mustfile: Mustfile says "this must hold"; Bustfile
+# says "this must not appear". Catches re-introduction of banned
+# patterns by AI assistants, proof-regression, and spec drift.
+
+@abstract:
+What breaks. Hard stops that trip CI and block release. Three
+categories: (1) banned code patterns — unsafe Idris2 / Coq escape
+hatches, Rust anti-patterns, banned languages; (2) proof regression —
+the canonical-proof-suite scorecard getting worse between commits;
+(3) spec drift — grammar.ebnf out of sync with grammar.pest, or
+Harvard invariant violated. Each entry declares: probe (detects the
+break), severity (what CI does), and a recovery pointer (how to fix).
+@end
+
+## Banned-pattern re-introduction (Idris2 / Coq escape hatches)
+
+[[hard_stops]]
+id = "idris-believe-me"
+description = "Use of `believe_me` in Idris2 sources (banned estate-wide)"
+class = "banned_pattern"
+probe = "grep -rnE '^[^-|]*\\bbelieve_me\\b' proofs/ crates/*/src 2>/dev/null | grep -v '\\-\\-\\|//.*banned\\|^[^:]*:[0-9]+:\\s*--' | grep -q ."
+severity = "critical"
+recovery = "Replace with a well-typed proof; use partial + idris_crash for stubs (see memory project_cerro_torre_postulate_conversion.md)"
+notes = "Code-only grep per feedback_code_only_grep_for_banned_patterns.md — string-literal tables and comment mentions don't count as violations."
+
+[[hard_stops]]
+id = "idris-assert-total"
+description = "Use of `assert_total` in Idris2 sources"
+class = "banned_pattern"
+probe = "grep -rnE '^[^-|]*\\bassert_total\\b' proofs/ crates/*/src 2>/dev/null | grep -v '\\-\\-\\|//.*banned' | grep -q ."
+severity = "critical"
+recovery = "Rework the termination argument; if genuinely partial, annotate `partial`."
+
+[[hard_stops]]
+id = "coq-admitted"
+description = "Admitted. in Coq proofs (unfinished proof committed)"
+class = "banned_pattern"
+probe = "grep -rn '^\\s*Admitted\\.' proofs/ 2>/dev/null | grep -q ."
+severity = "critical"
+recovery = "Either finish the proof, convert to a postulate with explicit narrow axiom, or move the result to wishes."
+
+[[hard_stops]]
+id = "coq-sorry"
+description = "sorry in Lean-style comments — shouldn't appear in 007's Coq corpus"
+class = "banned_pattern"
+probe = "grep -rnE '\\bsorry\\b' proofs/ 2>/dev/null | grep -v 'Sorry\\|TODO.*sorry\\|not.*sorry' | grep -q ."
+severity = "high"
+
+[[hard_stops]]
+id = "haskell-unsafecoerce"
+description = "`unsafeCoerce` in any source tree"
+class = "banned_pattern"
+probe = "grep -rnE '\\bunsafeCoerce\\b' crates/ 2>/dev/null | grep -q ."
+severity = "critical"
+
+[[hard_stops]]
+id = "ocaml-obj-magic"
+description = "`Obj.magic` in any source tree"
+class = "banned_pattern"
+probe = "grep -rnE '\\bObj\\.magic\\b' crates/ 2>/dev/null | grep -q ."
+severity = "critical"
+
+## Rust anti-patterns
+
+[[hard_stops]]
+id = "unwrap-to-expect-todo-antipattern"
+description = "`.expect(\"TODO\")` and similar fake-debt markers. Per memory feedback_unwrap_to_expect_antipattern.md — identical panic semantics to .unwrap(), just disguised."
+class = "banned_pattern"
+probe = "grep -rnE '\\.expect\\(\"TODO\"\\)|\\.expect\\(\"FIXME\"\\)|\\.expect\\(\"unwrap\"\\)' crates/ 2>/dev/null | grep -q ."
+severity = "high"
+recovery = "Replace with real error handling (Result<_, E>) or convert to a typed anyhow context with a root cause. Reverting to .unwrap() is acceptable when the invariant genuinely guarantees Ok — but prefer the typed path."
+
+## Banned-language re-introduction
+
+[[hard_stops]]
+id = "python-reintroduction"
+description = "Python source files (banned estate-wide)"
+class = "banned_language"
+probe = "find . -type f -name '*.py' -not -path './.git/*' -not -path './target/*' 2>/dev/null | grep -q ."
+severity = "critical"
+
+[[hard_stops]]
+id = "typescript-reintroduction"
+description = "TypeScript source files (convert to ReScript)"
+class = "banned_language"
+probe = "find . -type f \\( -name '*.ts' -o -name '*.tsx' \\) -not -path './.git/*' -not -path './target/*' -not -path './node_modules/*' 2>/dev/null | grep -q ."
+severity = "high"
+
+[[hard_stops]]
+id = "nodejs-package-json"
+description = "package.json at repo root (Deno uses deno.json)"
+class = "banned_language"
+probe = "test -f package.json"
+severity = "high"
+
+[[hard_stops]]
+id = "v-lang-reintroduction"
+description = "V-lang manifests (banned 2026-04-10; detected via v.mod / vpkg.json, not .v — collides with Verilog/Coq)"
+class = "banned_language"
+probe = "test -f v.mod || test -f vpkg.json"
+severity = "critical"
+
+[[hard_stops]]
+id = "makefile-present"
+description = "Makefile or makefile at any level (use Justfile)"
+class = "banned_pattern"
+probe = "find . -type f \\( -name 'Makefile' -o -name 'makefile' \\) -not -path './.git/*' -not -path './target/*' 2>/dev/null | grep -q ."
+severity = "medium"
+
+[[hard_stops]]
+id = "dockerfile-present"
+description = "Dockerfile at any level (use Containerfile + Podman)"
+class = "banned_pattern"
+probe = "find . -type f \\( -name 'Dockerfile' -o -name 'dockerfile' \\) -not -path './.git/*' -not -path './target/*' 2>/dev/null | grep -q ."
+severity = "medium"
+
+## Proof regression
+
+[[hard_stops]]
+id = "canonical-proof-suite-regression"
+description = "canonical-proof-suite scorecard declines between commits (any entry that was 'closed' becomes 'open' or 'in_progress')"
+class = "proof_regression"
+probe = "just canonical-proof-suite 2>/dev/null | grep -E 'regressed|DROPPED|\\bunclosed\\b' | grep -q ."
+severity = "critical"
+recovery = "Identify the regressed entry in audits/canonical-proof-suite/REPORT.a2ml, restore the proof or convert to a variance in the intend trident with justification."
+
+[[hard_stops]]
+id = "v0-differential-floor-broken"
+description = "v0-differential agreement drops below the floor (17/17 per AI-WORK-007.md §3.6)"
+class = "proof_regression"
+probe = "just v0-differential 2>&1 | grep -qE '^(FAIL|[0-9]+/(1[0-6])\\b)'"
+severity = "critical"
+recovery = "Do NOT lower the floor. Either fix the v0 oracle or production to agree; or document the divergence with a variance in the intend trident."
+
+## Spec drift
+
+[[hard_stops]]
+id = "grammar-ebnf-pest-divergence"
+description = "EBNF and Pest grammar rule counts diverge (catches spec ↔ implementation drift)"
+class = "spec_drift"
+probe = "just spec-check 2>&1 | grep -qE '^DRIFT|\\bmismatch\\b'"
+severity = "high"
+recovery = "Run `just grammar-check` to identify unreachable / undefined rules; reconcile spec/grammar.ebnf with crates/oo7-core/src/grammar.pest."
+
+[[hard_stops]]
+id = "harvard-invariant-violated"
+description = "Data expression contains control flow (Harvard invariant broken)"
+class = "spec_drift"
+probe = "just verify-harvard 2>&1 | grep -qE 'violat|FAIL'"
+severity = "critical"
+recovery = "Data exprs MUST NOT contain control flow — this is grammatical, not a lint rule. See 0-AI-MANIFEST.a2ml critical-invariants."
+
+[[hard_stops]]
+id = "scm-file-at-root"
+description = "STATE.scm / META.scm / ECOSYSTEM.scm / AGENTIC.scm / NEUROSYM.scm / PLAYBOOK.scm / LANGUAGES.scm at repo root — SCM files MUST live under .machine_readable/ only"
+class = "spec_drift"
+probe = "ls STATE.scm META.scm ECOSYSTEM.scm AGENTIC.scm NEUROSYM.scm PLAYBOOK.scm LANGUAGES.scm 2>/dev/null | grep -q ."
+severity = "high"
+recovery = "Move to .machine_readable/ or .machine_readable/6a2/ per estate rule. Violation of the core invariant in hyperpolymath/CLAUDE.md."
+
+## AI-failure expiry
+
+[[hard_stops]]
+id = "stale-ai-manifest"
+description = "0-AI-MANIFEST.a2ml not touched in 12 months (stale universal entry point)"
+class = "expiry"
+probe = "test $(find 0-AI-MANIFEST.a2ml -mtime +365 2>/dev/null | wc -l) -eq 1"
+severity = "low"
+
+[[hard_stops]]
+id = "commercial-hype-register"
+description = "Commercial / hype / revolutionary register in project docs (A5 grandiose-scale-hype defense)"
+class = "hype_drift"
+probe = "grep -riE '\\b(billionaire|revolutionary|game.changer|disrupt|monetis(e|ation)|trillion)\\b' README.adoc docs/ 2>/dev/null | grep -v 'banned\\|Bustfile\\|Mustfile' | grep -q ."
+severity = "medium"
+notes = "007 is dual-use, not commercial. This register tips into the wrong framing."