§22. Changes from v3

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

• Restored principles (now 12) and invariants (I1–I14) that v3 referenced but omitted.
• Desired/observed/health separated; conditions (AfterLogin, DeviceConnected, power); suppressions; Unknown, Transitioning, stale evidence; user-scoped units. Fixes the login-screen and user-stopped-service faults.
• Edges typed (Ordering/Requires/Diagnostic); After= no longer implies dependency.
• Probe contract: sandbox, limits, side effects; disruptive probes OnDemand only; establishes field.
• Sensitivity composable; Disruption and Recovery as separate properties; Decision::Reject separate from tiers; max_tier can no longer make a forbidden action approvable.
• Policy facts derived by the executor from the evaluated generation (I14); OptionChange.sensitivity removed from proposals; refinement check and executor-owned requirements made explicit.
• Approval bound to the concrete candidate, base, policy version, cumulative hash, derived facts; re-validated at execution; single-use.
• Transaction kernel with write-ahead journal, Partial/Unknown outcomes, recovery watchdog as a separate unit, daemon restart reconciliation, self-protection during activation; live_tested vs boot-confirmed known_good.
• Change catalog with handlers replaces free-form ConfigDiff in proposals; override file promoted only on commit; user config pinned per transaction.
• Incident lifecycle: defer to systemd, backoff, durable budgets, regression and flap handling, cooldowns, escalation.
• Gym: lifecycle and intent families; unnecessary-intervention and disruption metrics; held-out families for B; GA includes the kill-mid-activation demonstration.
• Verification narrowed to schema/policy/txn with docs/assumptions.md; re-observation claim corrected; store-integrity claim corrected for input-addressed paths.
• GC: in-flight candidates protected; space budgets.
• mark-good authorization; log record contents; dyn/generics contradiction resolved.
• Phase A scope kept full and Asterinas target kept non-gating, per owner decision.