docs(vrs): correct the spec against what implementing it revealed

Building the model surfaced four defects and two divergences. Implementation
is the cheapest review a spec gets, and it found things four readers did not.

Defects, now fixed:
- Divergence conflated a permanent fact with an open problem. A divergence
  can never be removed from a lineage, so a tool that cannot tell open from
  settled reports every past disagreement as outstanding forever — and a
  report that is always on carries no information. Open vs settled is now in
  the ontology (CMP.DM-R05a) rather than invented at the call site.
- CMP-R22 contradicted the borrowed "content wins on mismatch" convention.
  Resolved in favour of rejection: identity is not a default, and a misfiled
  file admitted under no-delete replication is permanent. Compass departs
  from the convention here deliberately, and now says so (CMP.INT-R01a).
- Retiring a Step silently strands its dependents forever. A consequence of
  retirement rather than a defect, but it was undocumented (CMP.DM-R05b).
- Progress records cite a version, and under divergence several head members
  may carry the same Step. Left arbitrary, progress would itself become a
  source of divergence (CMP.DM-R11a).

Divergences, recorded as deltas rather than papered over:
- 02-artifacts DELTA-001 — CMP.FS-R11 requires repair and the CLI spec
  requires it be a separate command; no such command exists.
- 05-integrations DELTA-001 — convergence is reported honestly as unknown on
  every command, because no substrate is queried. The guarantee that reads
  depend on is structurally correct and currently vacuous.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QzRc44KbA3wfYYKFF9UDMa
agent-session-id: cdf2c185-eeb3-4a4d-8ce0-52885f145cac
agent-tool: Claude Code
agent-tool-version: 2.1.215
agent-model: claude-opus-4-8
agent-runtime-profile: /nix/store/acr8a3l2v366jgmwiq8xdrhgz1py0db5-coding-agent-runtime-profile/share/coding-agents/profile.json
agent-skills-manifest: /nix/store/sj1v5j91h8v8d1w9lca4040302lwrd6v-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@unknown-dirty

Author: schickling-assistant

context/01-data-model/requirements.md

@@ -29,6 +29,19 @@
   Rationale. Nothing reconciles automatically, and a reconciliation may itself
   diverge. _refines: CMP-R03, CMP-R04._
 
+- **CMP.DM-R05a Open divergence is distinguishable from settled.** A divergence
+  is open until its sides share a descendant. Because a divergence is a
+  permanent feature of the lineage, a system that cannot tell open from settled
+  reports every past disagreement as outstanding forever — and a report that is
+  always on carries no information. Only open divergence may prompt action.
+  _refines: CMP-R04._
+
+- **CMP.DM-R05b Retirement may strand dependents.** Retiring a Step that others
+  depend on leaves them permanently unsatisfiable, because a retired Step never
+  becomes accepted. This is a consequence of retirement, not a defect, but it
+  must be visible at the moment of retirement rather than discovered later
+  through readiness that never advances. _refines: CMP-R01._
+
 - **CMP.DM-R06 An absent predecessor is not divergence.** A version whose
   predecessor is unknown must be distinguished from one that disagrees. The
   first ordinarily means state is still arriving; treating it as the second
@@ -61,6 +74,13 @@
   and never create a version. Correction is a further record, never an edit.
   _refines: CMP-R02._
 
+- **CMP.DM-R11a Progress names one version, deterministically.** A record cites
+  the version it was observed against. Under divergence there may be several
+  head members carrying the same Step, so the choice must be deterministic and
+  disclosed rather than arbitrary. A record whose cited version differs between
+  two machines observing identical state would make progress itself a source of
+  divergence. _refines: CMP-R04._
+
 - **CMP.DM-R12 Acceptance is evaluable.** A Step's acceptance criterion is
   expressible in a form Compass can evaluate against recorded evidence. Prose
   may accompany it but is not the criterion, because readiness cannot fold over

context/02-artifacts/.delta/DELTA-001-repair-has-no-command.md

@@ -0,0 +1,36 @@
+# DELTA-001: Repair has no command
+
+Status: open
+
+## Divergence
+
+Damage can be detected but not repaired through a dedicated operation.
+
+## VRS
+
+[requirements.md](../requirements.md) CMP.FS-R11 requires that recovery from
+damage proceed by authoring new content that records the damage and continues
+from the last intact predecessor. [04-cli/spec.md](../../04-cli/spec.md) states
+that verification and repair are separate commands, and gives the reason:
+verification is safe to run anywhere, while repair authors permanent content
+that replication makes irreversible, so collapsing them would put the
+irreversible operation one keystroke from the safe one.
+
+## Implementation
+
+`compass verify` detects and reports rejected files and orphans. There is no
+`compass repair`. The repair *path* exists — an operator can author a
+damage-recording version with `compass revise` — but it is neither named,
+guided, nor distinguished from ordinary revision, so nothing enforces the
+separation the spec relies on.
+
+## Direction
+
+update implementation
+
+## Resolution Signal
+
+A distinct command authors a damage-recording version: it identifies the last
+intact predecessor, requires a Rationale, records which versions are
+unverifiable and why, and refuses to run when verification reports nothing
+wrong. Verification remains read-only.

context/02-artifacts/spec.md

@@ -88,8 +88,14 @@ unwritten.
 
 ## Discovery
 
-The catalog is walked and files are admitted per the rules above. Path segments
-may supply defaults; content wins on disagreement.
+The catalog is walked and files are admitted per the rules above.
+
+Path segments may supply values the content omits. They do not override
+identity: where content and location disagree about *which* Plan a version
+belongs to, or where content disagrees with the hash in its name, the file is
+rejected rather than reinterpreted. The borrowed catalog convention resolves
+such disagreements in favour of content; Compass departs from it here, because
+a misfiled file admitted under no-delete replication is permanent.
 
 Discovery parses every candidate file to classify it, which bounds catalog size
 to what can be scanned in interactive time (CMP-A03). The threshold is

context/05-integrations/.delta/DELTA-001-convergence-is-always-unknown.md

@@ -0,0 +1,45 @@
+# DELTA-001: Convergence is always unknown
+
+Status: open
+
+## Divergence
+
+The convergence guarantee is structurally correct and currently vacuous. Every
+command reports `unknown (no sync configured)`, and will do so regardless of
+what the replication substrate is actually doing.
+
+## VRS
+
+[requirements.md](../requirements.md) CMP.INT-R06 requires the
+converged-or-arriving signal to come from the replication mechanism's own state.
+CMP.INT-R07 requires Compass to confirm the declared replication carries
+no-delete semantics. Root CMP-R05 makes observable convergence a property of the
+system, and it is the correction that
+[decision 0002](../../.decisions/0002-plans-are-immutable-versions-with-a-derived-head.md)
+Amendment 1 introduced in response to the derived head removing the only
+completeness signal.
+
+## Implementation
+
+Compass reports convergence on every command and reports it honestly as unknown.
+No declaration to a replication mechanism is made, no substrate is queried, and
+no policy is verified. The honest report is the whole implementation.
+
+## Direction
+
+update implementation
+
+## Resolution Signal
+
+Compass declares its catalog to the replication substrate, queries it for
+convergence, and reports settled, arriving, or unknown from that answer rather
+than by default. Policy verification reports a delete-propagating configuration
+as a misconfiguration. Until then the reported `unknown` is accurate, and the
+guarantee that reads depend on remains unrealized.
+
+## Note
+
+The declaration must cover the catalog recursively (CMP.INT-R04). A path filter
+that does not cross directory separators propagates nothing for this layout
+while reporting itself healthy — a silent failure already observed in an
+adjacent consumer of the same substrate.

context/05-integrations/requirements.md

@@ -17,11 +17,19 @@
 ## Requirements
 
 - **CMP.INT-R01 Adopt the catalog form, do not restate it.** Content-based
-  discovery, path segments supplying defaults with content winning, and
-  retirement as an authored flag are conventions Compass follows. It must not
-  publish a competing definition of them.
+  discovery, path segments supplying defaults, and retirement as an authored
+  flag are conventions Compass follows. It must not publish a competing
+  definition of them.
   _refines: CMP-R06, CMP-R08._
 
+- **CMP.INT-R01a Identity is not a default.** The borrowed convention that
+  content wins over path applies to values a path may supply when content omits
+  them. It does not extend to identity: a file whose content disagrees with the
+  location or name that identify it is rejected, not reinterpreted. Compass
+  diverges from the convention here deliberately, because under no-delete
+  replication a misfiled file cannot be removed once admitted.
+  _refines: CMP-R07._
+
 - **CMP.INT-R02 Define only the document.** What a version and a progress record
   contain — lineage, identity, the required Rationale, the field set — is
   Compass's own. No existing contract covers it, and Compass must not push it

context/ontology.md

@@ -40,6 +40,14 @@ _Avoid_: current pointer, HEAD file, latest symlink
 Two or more Plan Versions sharing the same predecessor — the observable result
 of concurrent revision on different machines. Divergence is a legitimate state,
 not an error: both versions survive replication and both are visible.
+
+A Divergence is **open** while its sides have no common descendant, and
+**settled** once a Reconciliation descends from all of them. The distinction is
+load-bearing rather than cosmetic: a Divergence is a permanent fact of the
+lineage and can never be removed, so a tool that does not distinguish the two
+reports every historical disagreement as an outstanding problem forever, and
+operators learn to ignore the report. Only an open Divergence asks anything of
+anyone.
 _Avoid_: conflict, collision, fork
 
 **Orphan**: