Every view run rewrites the view wholesale

outcome

Guarantee that whatever a reader finds in the view directory was produced by the last run over the current source.

rule line 18 · specs/consumers/wholesale-view-rewrite.sdp.md:18

A view run rewrites the view wholesale: no page written by an earlier run survives a later one, so a Spec that left the corpus leaves no page behind.

rule line 19 · specs/consumers/wholesale-view-rewrite.sdp.md:19

Pages are written to a temporary sibling of the view directory, the previous directory is removed, and the temporary is renamed into place — one rename, so no half-written view is ever readable and no temporary survives a completed run.

rule line 20 · specs/consumers/wholesale-view-rewrite.sdp.md:20

A run that cannot produce a current view removes the stale one when its output parent remains safe instead of leaving it readable as current: an absent view is honest, a stale view is not.

rule.buildInvalidates line 21 · specs/consumers/wholesale-view-rewrite.sdp.md:21

Before extraction, the shared build removes generated/design-review/, generated/census/, generated/mermaid/ and generated/gherkin/, each with its temporary sibling, so a run that fails before rendering leaves no view behind; a removal failure refuses the build before extraction. Every command that enters this build, including validate and its watch runs and every publisher, has this invalidation effect, so a sibling root the command does not publish stays absent until a later publication. The Studio's root is removed beside these four, as spec:consumers.spec-studio.publisher#rule.buildInvalidates states.

no example exercises it

rule line 22 · specs/consumers/wholesale-view-rewrite.sdp.md:22

Under --check-clean the view is rendered twice from the same graph and the run refuses when the two renders diverge, removing the view it could not certify.

rule line 23 · specs/consumers/wholesale-view-rewrite.sdp.md:23

Validation findings never withhold the view; publication refusals remain separate. A run whose checks report findings still writes the current view and returns the checks' own exit code, because the view is where those findings are read in context.

rule.portablePublication line 25 · specs/consumers/wholesale-view-rewrite.sdp.md:25

A case-insensitive page-path collision refuses the publisher's whole page set, names both ids and paths, removes its stale live and temporary roots when their parents are safe, and exits 1 regardless of validation's exit code. Renderers retain their page names and bytes.

no example exercises it

rule.safeCleanup line 26 · specs/consumers/wholesale-view-rewrite.sdp.md:26

Publication and failure cleanup recheck the physical output parent before each mutation; an escaping, unresolvable or linked generated/ parent is refused without cleanup through it.

no example exercises it

5 unkeyed rules.

Verifying examples

Given an extraction root holding {corpus: "one authored spec"} and a stale view page {stalePage: "spec/probe.departed.md"}
Given the stale page is planted {planted: "before the run"}
When the {command: "build"} command runs at that root
Then the run exits {exitCode: 0}
Then the view directory survives: {viewSurvives: false}
Then the stale page survives: {staleSurvives: false}
Then a temporary view sibling survives: {temporarySurvives: false}

Given an extraction root holding {corpus: "one authored spec the extractor refuses"} and a stale view page {stalePage: "spec/probe.departed.md"}
Given the stale page is planted {planted: "after the build has invalidated the view"}
When the {command: "view"} command runs at that root
Then the run exits {exitCode: 1}
Then the view directory survives: {viewSurvives: false}
Then the stale page survives: {staleSurvives: false}
Then a temporary view sibling survives: {temporarySurvives: false}

Given an extraction root holding {corpus: "one authored spec"} and a stale view page {stalePage: "spec/probe.departed.md"}
Given the stale page is planted {planted: "after the build has invalidated the view"}
When the {command: "view"} command runs at that root
Then the run exits {exitCode: 0}
Then the view directory survives: {viewSurvives: true}
Then the view holds the current page {currentPage: "index.md"}
Then the stale page survives: {staleSurvives: false}
Then a temporary view sibling survives: {temporarySurvives: false}

Given an extraction root holding {corpus: "one authored spec"} and a stale view page {stalePage: "spec/probe.departed.md"}
Given the stale page is planted {planted: "before the run"}
When the {command: "view"} command runs at that root
Then the run exits {exitCode: 0}
Then the view directory survives: {viewSurvives: true}
Then the view holds the current page {currentPage: "index.md"}
Then the stale page survives: {staleSurvives: false}
Then a temporary view sibling survives: {temporarySurvives: false}

Example space

Given an extraction root holding {corpus:"one authored spec"|"one authored spec the extractor refuses"} and a stale view page {stalePage:string}
Given the stale page is planted {planted:"before the run"|"after the build has invalidated the view"}
When the {command:"view"|"build"} command runs at that root
Then the run exits {exitCode:number}
Then the view directory survives: {viewSurvives:boolean}
Then the view holds the current page {currentPage:string}
Then the stale page survives: {staleSurvives:boolean}
Then a temporary view sibling survives: {temporarySurvives:boolean}

Verifier bindings

• spec:consumers.wholesale-view-rewrite.build-invalidates-view · A build that never renders still takes the old view down · declared · example enabled · specs/consumers/wholesale-view-rewrite.build-invalidates-view.sdp.md

  External run evidence from test/self-hosting-projections.test.ts

  Test anchors: test:protocol.binding-language-views.bound-spec-page, test:protocol.binding-language-views.pack-member-table, test:protocol.derived-readiness-banner.dishonest-divergence, test:protocol.derived-readiness-banner.honest-headroom, test:protocol.derived-readiness-banner.idea-floor-unmet, test:protocol.design-review.pure-projection, test:protocol.diagnostic-rendering.composed-location, test:protocol.diagnostic-rendering.table-cell-location, test:protocol.wholesale-view-rewrite.build-invalidates-view, test:protocol.wholesale-view-rewrite.failed-run-view-removed, test:protocol.wholesale-view-rewrite.late-stale-page, test:protocol.wholesale-view-rewrite.stale-page-removed. Specs verified by those bindings: spec:consumers.binding-language-views, spec:consumers.binding-language-views.bound-spec-page, spec:consumers.binding-language-views.pack-member-table, spec:consumers.derived-readiness-banner, spec:consumers.derived-readiness-banner.dishonest-divergence, spec:consumers.derived-readiness-banner.honest-headroom, spec:consumers.design-review, spec:consumers.design-review.pure-projection, spec:consumers.wholesale-view-rewrite, spec:consumers.wholesale-view-rewrite.build-invalidates-view, spec:consumers.wholesale-view-rewrite.failed-run-view-removed, spec:consumers.wholesale-view-rewrite.late-stale-page, spec:consumers.wholesale-view-rewrite.stale-page-removed, spec:validation.diagnostic-rendering, spec:validation.diagnostic-rendering.composed-location, spec:validation.diagnostic-rendering.table-cell-location.

  Run 1: external run evidence from vitest 4.1.10

  Build: CI 433 · Branch: fix/second-review-pass · Commit: 6375b6e431a7cf885a49befec76d7876cd3e538c · Start: 2026-11-04T07:12:23.076Z · Stop: 2026-11-04T07:15:49.695Z

  Name	Suite	Result	Duration
  executes the bound example against a fresh world	The view is the graph read twice, and the corpus is untouched by reading it (spec:consumers.design-review.pure-projection)	passed	141.87 ms
  executes the bound example against a fresh world	An overstated rung raises the banner and names the clause that refused (spec:consumers.derived-readiness-banner.dishonest-divergence)	passed	3.19 ms
  executes the bound example against a fresh world	A rung the structure overshoots renders as information, not as a banner (spec:consumers.derived-readiness-banner.honest-headroom)	passed	1.81 ms
  renders a Spec whose idea floor is unmet with no rung and a below-idea banner	not recorded	passed	1.26 ms
  executes the bound example against a fresh world	A fully bound Spec renders binding language on the page and in the index (spec:consumers.binding-language-views.bound-spec-page)	passed	2.81 ms
  executes the bound example against a fresh world	The Pack member table speaks the page's binding language, not a shorthand (spec:consumers.binding-language-views.pack-member-table)	passed	2.98 ms
  executes the bound example against a fresh world	A page from an earlier run does not survive the next one (spec:consumers.wholesale-view-rewrite.stale-page-removed)	passed	17.79 ms
  executes the bound example against a fresh world	A page the build's invalidation never saw still does not survive the swap (spec:consumers.wholesale-view-rewrite.late-stale-page)	passed	10.96 ms
  executes the bound example against a fresh world	A run that cannot produce a current view leaves no view at all (spec:consumers.wholesale-view-rewrite.failed-run-view-removed)	passed	6.92 ms
  executes the bound example against a fresh world	A build that never renders still takes the old view down (spec:consumers.wholesale-view-rewrite.build-invalidates-view)	passed	9.25 ms
  executes the bound example against a fresh world	One finding, three location shapes, one composition rule (spec:validation.diagnostic-rendering.composed-location)	passed	1.13 ms
  executes the bound example against a fresh world	The same three location shapes, rendered as table cells (spec:validation.diagnostic-rendering.table-cell-location)	passed	0.73 ms

• spec:consumers.wholesale-view-rewrite.failed-run-view-removed · A run that cannot produce a current view leaves no view at all · declared · example enabled · specs/consumers/wholesale-view-rewrite.failed-run-view-removed.sdp.md
• spec:consumers.wholesale-view-rewrite.late-stale-page · A page the build's invalidation never saw still does not survive the swap · declared · example enabled · specs/consumers/wholesale-view-rewrite.late-stale-page.sdp.md
• spec:consumers.wholesale-view-rewrite.stale-page-removed · A page from an earlier run does not survive the next one · declared · example enabled · specs/consumers/wholesale-view-rewrite.stale-page-removed.sdp.md
• test:protocol.cli-write-boundaries · anchored · test anchor binding present · test/cli-write-boundaries.test.ts:292

  External run evidence from test/cli-write-boundaries.test.ts

  Test anchors: test:protocol.cli-write-boundaries. Specs verified by those bindings: spec:consumers.design-review, spec:consumers.gherkin-view, spec:consumers.mermaid-view, spec:consumers.projections-model, spec:consumers.wholesale-view-rewrite, spec:extraction.build-pipeline.

  Run 1: external run evidence from vitest 4.1.10

  Build: CI 433 · Branch: fix/second-review-pass · Commit: 6375b6e431a7cf885a49befec76d7876cd3e538c · Start: 2026-11-04T07:12:23.076Z · Stop: 2026-11-04T07:15:49.695Z

  Name	Suite	Result	Duration
  replaces a stale 'symbolic' link at 'graph.json' without touching its target	build write boundaries	passed	67.45 ms
  replaces a stale 'hard' link at 'graph.json' without touching its target	build write boundaries	passed	13.17 ms
  replaces a stale 'symbolic' link at 'imports.json' without touching its target	build write boundaries	passed	18.95 ms
  replaces a stale 'hard' link at 'imports.json' without touching its target	build write boundaries	passed	10.38 ms
  replaces a stale 'symbolic' link at 'registrars.json' without touching its target	build write boundaries	passed	19.24 ms
  replaces a stale 'hard' link at 'registrars.json' without touching its target	build write boundaries	passed	12.84 ms
  routes a successful build's ordinary removals and writes through the filesystem hooks	build write boundaries	passed	19.14 ms
  names an unresolvable output parent when generated is a dangling link	build write boundaries	passed	1.24 ms
  refuses a staging link planted after stale removal	build write boundaries	passed	4.94 ms
  build refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	5.03 ms
  view refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	4.29 ms
  census refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	4.86 ms
  mermaid refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	4.19 ms
  gherkin refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	6.19 ms
  studio refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	4.04 ms
  generate refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	3.87 ms
  vault refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	5.04 ms
  stamp refuses an escaping generated parent before writing or cleanup	build write boundaries	passed	11.13 ms
  keeps the named root in ordinary command output	explicit symlinked watch root	passed	5.6 ms
  validate starts and reruns through the named root	explicit symlinked watch root	passed	17.86 ms
  studio starts and reruns through the named root	explicit symlinked watch root	passed	88.19 ms
  vault starts and reruns through the named root	explicit symlinked watch root	passed	35.65 ms
  view refuses case-colliding pages and removes stale output	portable projection publication	passed	10.23 ms
  mermaid refuses case-colliding pages and removes stale output	portable projection publication	passed	7.15 ms
  gherkin refuses case-colliding pages and removes stale output	portable projection publication	passed	10.32 ms
  stamp replaces a symbolic link without modifying its target	publication boundary regressions	passed	4.1 ms
  stamp replaces a hard link without modifying its target	publication boundary regressions	passed	3.74 ms
  a stamp that fails after staging leaves no staging file in the page set	publication boundary regressions	passed	1.83 ms
  view recovery preserves outside output after a parent swap	publication boundary regressions	passed	6.23 ms
  census recovery preserves outside output after a parent swap	publication boundary regressions	passed	6.21 ms
  mermaid recovery preserves outside output after a parent swap	publication boundary regressions	passed	5.59 ms
  gherkin recovery preserves outside output after a parent swap	publication boundary regressions	passed	5.64 ms
  studio recovery preserves outside output after a parent swap	publication boundary regressions	passed	5.11 ms
  vault recovery preserves outside output after a parent swap	publication boundary regressions	passed	5 ms
  generate recovery preserves outside output after a parent swap	publication boundary regressions	passed	6.75 ms
  build refuses inside-link generated identity	publication boundary regressions	passed	2.93 ms
  build refuses replaced-directory generated identity	publication boundary regressions	passed	2.58 ms
  vault refuses a default vault linked outside the root but allows an explicit outside vault	publication boundary regressions	passed	9.03 ms
  generate refuses a default vault linked outside the root but allows an explicit outside vault	publication boundary regressions	passed	23.26 ms
  vault holds a default vault linked inside the root to the placement rules where it resolves	publication boundary regressions	passed	11.29 ms
  generate holds a default vault linked inside the root to the placement rules where it resolves	publication boundary regressions	passed	28.31 ms
  projection suite refuses a linked generated parent (check-clean: false)	publication boundary regressions	passed	65.78 ms
  projection suite refuses a linked generated parent (check-clean: true)	publication boundary regressions	passed	47.87 ms
  package artifacts unlink stale staging links and refuse linked recipe directories	publication boundary regressions	passed	1.5 ms
  package artifacts refuse a linked recipe directory before stale cleanup	not recorded	passed	0.78 ms
  watch leaves outside bytes unchanged after direct-empty parent swap	not recorded	passed	12.49 ms
  watch leaves outside bytes unchanged after direct-managed parent swap	not recorded	passed	15.69 ms
  watch leaves outside bytes unchanged after checkout-empty parent swap	not recorded	passed	77.25 ms
  watch leaves outside bytes unchanged after checkout-managed parent swap	not recorded	passed	117.05 ms
  watch leaves outside bytes unchanged after studio-direct parent swap	not recorded	passed	12.8 ms

Requirement drawing

Decisions

No decision record named.

• component:protocol.cli · entry points, shared build and publication · src/cli/build-command.ts:31 · layer edge · context protocol

  Uses

  • component:protocol.adapters · external runtime and source adapters · src/adapters/vitest.ts:23 · layer adapter · context protocol
  • component:protocol.codegen · contracts and registrar output · src/codegen/contracts.ts:671 · layer application · context protocol
  • component:protocol.extract · the carrier and source pipeline · src/extract/index.ts:197 · layer application · context protocol
  • component:protocol.graph · the one graph and its semantic decisions · src/graph/schema.ts:34 · layer domain · context protocol
  • component:protocol.import · canonical conversion with a fidelity boundary · src/import/import.ts:45 · layer application · context protocol
  • component:protocol.model · the authored contracts and stable ids · src/model/anchors.ts:100 · layer domain · context protocol
  • component:protocol.projections · read-only output, layout and owned publication · src/projections/design-review.ts:29 · layer edge · context protocol
  • component:protocol.reader · the typed graph contract and body evaluator · src/reader/reader.ts:697 · layer application · context protocol
  • component:protocol.validate · one finding currency and ordered checks · src/validate/validators.ts:76 · layer domain · context protocol
• impl:protocol.build-pipeline-emit · stages build outputs, checks determinism and invalidates projections · src/cli/build-command.ts:285

  Component: component:protocol.cli · entry points, shared build and publication · src/cli/build-command.ts:31 · layer edge · context protocol

  Uses

  None.

• impl:protocol.wholesale-view-rewrite · publishes each Design Review as one wholesale temporary-directory replacement · src/cli/validate-view-command.ts:127

  Component: component:protocol.cli · entry points, shared build and publication · src/cli/build-command.ts:31 · layer edge · context protocol

  Uses

  None.

Runtime observation: not tracked.

Runtime observation: not tracked.

Build attestations: not tracked.

Deployments: not tracked.

Bills of materials: not tracked.