= μή: the prohibitions
:toc: macro
:toclevels: 2
Greek has two negatives. οὐ negates the indicative: statements of fact, what
is not the case. μή negates the other moods: commands, wishes, fears,
conditions, everything willed or forbidden rather than described. The crate's
xref:target_arch/non-goals.adoc[non-goals] and the
xref:horizons.adoc[horizons] anti-avenues are its οὐ: facts about what
minerva is not and will not become, each with its recorded ground. This
document is the μή: what a *working session* must not do, in the moods a
session actually inhabits, since an agent lives in the subjunctive until it
acts.
Three rules govern the document itself. Authority lives elsewhere: every
entry points at the ruling, note, or discipline that grounds it, and this
page is the muster, never the source (an entry with no ground to point at
does not enter). Entries enter by *recorded* ruling or *observed* failure,
never by plausibility. And entries leave by being struck in place, naming
the ruling that lifted them; overrule freely, as with everything else here.
toc::[]
== On evidence (μὴ believe without the live source)
. *Do not act on a relay, summary, or memory of a consumer; read their live
source.* The sibling repos sit beside this one on disk, and every claim a
consumer makes about its own code is verified against that code before it
moves anything here. The S38/S40 discipline, standing in
xref:horizons.adoc[horizons]; the intake checklist there is the procedure.
. *Do not treat adjacent interest as a fired signal.* Most "fires," on close
reading, are interest near a trigger, not the named trigger. Check the
row's signal and the governing ruling in
https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[`owner-comments.adoc`]
(repository only; not shipped in the crate archive) before treating a gate
as open (the xref:horizons.adoc[horizons] intake discipline).
. *Do not trust remembered state over the tree.* A session memory, a status
table, or a prior summary describes the repo as it was; verify a surface
still exists and still says what the memory claims before recommending or
building on it.
. *Do not inscribe a quotation, locus, or Greek wording you have not
verified this session.* The S76/S77 peristyle criterion: a quotation is
admitted only if it holds up the architecture itself, its locus checked
against the text, and Greek is used only where the wording is certain.
The convention and demotion ledger live in the owner's inscriptions brief
(`docs/miscellany/`, local and untracked).
== On shipping (μὴ ship without the license)
. *Do not build because the object is beautiful.* The queue of obviously
good lattice math is infinite; the license is the R-6 discretion test,
and if the counterweight paragraph does not write itself, the answer is
no (https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-6]; the model instances are R-7 and
R-10).
. *Do not carve a seam nobody has called through.* A trait, hook, or
parameter added ahead of its caller is framework drift wearing
foresight's clothes; the thesis sentence ("the machine never chooses,"
xref:target_arch/index.adoc[the target architecture]) is the test every
new surface must pass, and a seam is a surface.
. *Do not complete a symmetry.* That a read shipped on one type does not
entitle its twin on another; each half faces the R-6 test alone. The
standing example: `try_glue` is deliberately vector-only, because
knowledge merges while testimony glues, and a `DotSet` carries no
testimony (xref:prd/0013-metis-relative-base-change.adoc[PRD 0013]'s
surface, the reasoning in the session notes).
. *Do not evolve a wire frame in place.* Byte identity is protocol, not
format: frames are signature preimages and network contract (ruling
https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-8]). New shapes are sibling codecs with
their own version byte, their fuzz target, and a coordinated bump, never
an edit.
. *Do not ship a surface that chooses.* Joins, meets, bounds, reads, one
linearization by a fixed public rule, and typed refusals carrying
evidence: that is the whole permitted vocabulary. A surface that picks a
winner, sleeps, retries, schedules, or owns a policy fails the corollary
(xref:target_arch/index.adoc[the thesis]) no matter how small it is.
. *Do not ship a meet-shaped read without stating its empty-family value.*
The empty meet is the lattice top, "everything," the maximally unsafe
fabrication; every right adjoint over a possibly-empty index carries the
trap, and the shipped watermark deliberately overrides the canonical
value at exactly that input
(xref:metis-adjoint-ledger.adoc[the adjoint ledger];
xref:prd/0011-metis-causal-stability-watermark.adoc[PRD 0011]).
. *Do not mint a witness for a fact outside the machine.* A witness type
is a claim that the crate observed something; it may only brand facts
the crate performs. Durability is the standing refusal, no local
ground truth exists for a caller's fsync, so a shipped `Durable` brand
would be `try_observe` theater (ruling
https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-51]), and availability is the same
refusal one promise longer: not "these bytes were written" but "these
bytes will be served," about a body the crate never holds
(xref:metis-checkpoint-availability.adoc[the availability note]; ruling
https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-82]). The crate's contribution to a
checkpoint is determinism, which is why a digest means anything at all;
possession and service belong to whoever owns the disk.
. *Do not cure a cost you have not attributed.* An aggregate timer, a
profile guess, or a literature-ranked plan does not license a
performance slice; split the measurement until the dominant term has a
name, then cure that term. The standing exhibit: the S270 phase split
found the epoch boundary's ranked-first cure worth three percent and an
unranked term worth seventy (https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-54]; the
instrument discipline is S268's, one deterministic seed, structural
columns as the free agreement oracle).
== On proof and test (μὴ prove past the ruling)
. *Do not add a proof harness beyond ruling R-9's classes.* No Kani for the
application machines, and no harness that reaches symbolic collection
structure (the `BTreeMap` rule is hard, owner's amendment); map-touching
laws belong to shaped property tests and fuzz
(https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-9]).
. *Do not retire a sampled test because a stronger rung landed.* The rungs
are complements, not upgrades; a proven law keeps its always-on property
test as the gate (the assurance-ladder entry in
xref:glossary.adoc[the glossary]).
. *Do not report a gate you did not run this session.* State which checks
ran and their counts; a status table row is a dated fact, not a standing
truth.
. *Do not copy a harness into the fuzz crate once the harness is itself
the thing under test.* A small codec twin is fine and is what every
parser target carries; at fleet scale a copy is a fork that drifts
from the tree it defends. The lawful shape is a build-cfg-gated
exposure of the in-tree harness (`cfg(fuzzing)`, which no Cargo
feature can reach), holding one entry point and no mechanism
(https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[R-71]'s reservation, taken in R-81).
== On documents (μὴ re-derive, μὴ pad)
. *Do not re-litigate a ruling in a new document.* Rulings are edited in
place, superseded by appending, never argued with from a distance
(the convention at the head of
https://github.com/OwlRoute/minerva/blob/main/owner-comments.adoc[`owner-comments.adoc`]).
. *Do not re-derive what another note owns.* Point at the owning note; the
repo's documents form a dependency graph, not a set of essays (the model:
xref:prd/0013-metis-relative-base-change.adoc[PRD 0013] deferring the
gate rows to xref:metis-gate-algebra.adoc[the gate-algebra note], which
then took them).
. *Do not add an entry that does not change what a future session does.*
The peristyle criterion governs the glossary, the horizons map, and this
document alike: recording that something was considered is not a
function.
. *Do not use an em dash anywhere in the tree, and do not run repo-wide
`cargo fmt`.* The house voice is em-dash-free (the gate has been green
since the convention was set; commas, colons, and parentheses carry the
clauses). The repo is deliberately not globally fmt-clean
(`src/kairos/mod.rs` holds intentional compact layouts); format only the
files you touched. Previously session lore; this entry is now the tracked
home of both rules.
. *Do not cite an untracked file from a tracked document without saying
so.* `archive/` and `docs/miscellany/` are local; a tracked reference to
them is qualified "(local, untracked)" or it is a broken promise to a
fresh clone (the S87 sweep discipline).
. *Do not promote miscellany residue untested.* The untracked notes are
deliberately lower-confidence; a claim moving from residue to tracked
standing re-runs the gates on the way (verification, statuses, xrefs,
indexing). And one standing cap, proposed in the S90 session notes and
adopted into this guide at the owner's direction (overrule freely): *no
third lens document until a standing prediction of the first two fires
in code* (xref:prd/0010-metis-spectrum-algebraic-geometry-horizon.adoc[PRD
0010] and xref:prd/0013-metis-relative-base-change.adoc[PRD 0013] are the
two; the ledger's pre-committed laws are the pending predictions).
_Condition met (S95, ruling R-11): the ledger's residual section fired as
xref:prd/0014-metis-difference-reads.adoc[PRD 0014]'s tested law suite, so
the cap no longer binds; a third lens document still enters only with a
function of its own (the peristyle criterion), and the intersection
prediction stays pending._
== On the record (μὴ vanish)
. *Do not end a slice without its record.* The posture paragraph in
https://github.com/OwlRoute/minerva/blob/main/todos.adoc[`todos.adoc`], the DOCS status and map rows, the
archive entry, and, where discretion was exercised, the ruling with its
grounds and unwind note. The continuity principle this whole repo runs
on: the self that persists across sessions is the discipline, not the
instance, and an unrecorded slice did not happen.
. *Do not commit unbidden.* Leave the tree clean and gated, offer the cut
with a message; the owner calls it.
. *Do not write "held in reserve" casually.* Reserve status is honest only
while rare (xref:glossary.adoc[the glossary]'s term of art;
xref:horizons.adoc[horizons] carries the warning in its intake
discipline).
== Maintaining this document
An entry earns its line the way everything here earns anything: by changing
what a future session does. When a prohibition is lifted, strike the entry
in place and name the ruling that lifted it; when a new failure mode is
observed and ruled on, it enters with its ground or it does not enter. The
document should stay one page: a μή that cannot be held in the head while
working is a filing cabinet, not a prohibition.
μὴ γένοιτο: may none of it happen.