0.5.218: adopt edge v33.0.0 / persist v51.0.0 / verify v18.0.0 (pre-staged on #710's graph)

[emooreatx]

DRAFT until the tags land. Pinned today to edge #710's head (68bba8bb) and the persist commit it pins (789be5b3, v51), with verify at its v18.0.0 tag. At the tags: move the pins from rev to tag, re-pin the envelope-vocabulary hash once (after checking it equals persist's published constant), apply v51's differences from 789be5b3 (below), rerun the sweep and the ladders.

Source changes

• open_mls_state(engine, path) → (store, custody). A TPM-less host now opens the MLS store on disk under its software master; Posture::Durable { custody }.
• persist v50: withdrawn_by re-derives stored withdraws through the WRITE-form check (now a 5-hop default) — use check_withdraws_admission_as_admitted (recorded depth) #690: withdrawn_by re-derives at each row's admitted depth (check_withdraws_admission_as_admitted).
• CIRISEdge#698, sealed descriptors: every drive path that shows, keeps or tests a name or type goes through drive::describe (listing, metadata, read, raw headers, replace, move, the notes filter). Listings say description: clear|opened|sealed. Its body opens the bytes until edge ships a descriptor-only door (asked on CIRISEdge#702).
• CIRISEdge#675, the person authors files: the author check accepts the person's key, and a withdraws is signed by the row's own attester.
• Strict registry (persist v50): the self-declared age row is age_self_declared:band:{band}:v1, and the old spelling still reads. New gate emitted_dimensions_are_registered.
• The fixed CIRISEdge#687 inline band is un-marked in the corpus.

Test sweep (one binary at a time): 141/149 green on the first pass, and every red has been read. Now red only:

• Clear at the tag switch: substrate::gate_substrate_pins_at_target, gate_no_substrate_rev_pin_at_release, readme_substrate_pins_match_cargo_toml, blocked_upstream_gate.
• Re-pinned at the v51 tag: persist_envelope_vocabulary_hash_pinned, gate_envelope_vocabulary_is_the_one_we_adopted.
• Rename (2 drive_crud tests): needs edge's re-seal door (CIRISEdge#702). A renamed row carries a clear name beside the old sealed descriptor, and edge refuses it (D4).

At the v51 tag (from persist/edge's notes):

• open_descriptor_for_blob gains caller_aad; that's edge-internal plus the descriptor-only door.
• Chunk-key grants: the server seals only through the Engine door, so persist sends them itself.
• A stalled trust root now resolves with live=false. Re-check mesh_genesis / mesh_config_surface trusted_roots_of consumers and GET /v1/trust-root.
• #941 refuses A→B→A ownership chains.

Ladders: not yet run on this graph. selffiles' negative rungs should go green here (CIRISPersist#919 fixed in v50; names sealed by #698).

🤖 Generated with Claude Code

https://claude.ai/code/session_01QdM21U8xUmHk2TwrMTKJPf

[emooreatx]

Edge side of the native-fixture findings:

• CIRISEdge#716 (a multi-fragment frame on the reverse-path link stalls at fragment 0) and CIRISEdge#717 (the puller stores a chunk-DAG blob's manifest as the file): both are being fixed now, each with a failing-on-main witness. I'll post here when they're tagged.
• Finding 5 (one-hop scoped content) is CIRISEdge#718, and it's an edge gap, not an open design question. CC 5.4.6 forbids announcing a group-scoped destination and dialling a derived address through a relay. It sanctions relay-blinded, announce-free reach, where the relay carries ciphertext on the identity plane and holds no group address. The A/V mesh already measures that for blobs (conformance.relay_holds_no_cohort_address). So two phones behind the canonical should chat. #718 names the candidate gates and asks for an edge-side repro first. harness.native chat without --direct is the server-side witness.

[emooreatx]

Correction to my earlier comment on finding 5: your Rule 4 reading is right, and I was wrong to call it an edge gap. A scoped address can't be announced, so it has no multi-hop path by construction, and edge's serve gate admits scoped bodies only over a direct link. CC 5.4.6 itself calls multi-hop reach for group-scoped destinations "an amendment-plane design question". The A/V relay I cited carries identity-plane traffic, not scoped content.

One refinement: this doesn't need an N-clique. CC's model is that members relay for members, so for community rooms a connected graph of member nodes should suffice (a member that pulled a body re-serves it). That's not measured yet; CIRISEdge#718 is narrowed to that witness. Self and family rooms fetch from the author, so there a device needs a direct link to the author's node. Any member node can be the relay, a person's own home node included. The case that has no answer today is two people's phones behind the non-member public canonical in a pair room. That waits on a CC amendment, and whether to file it is the maintainer's call.

[emooreatx]

edge v34.1.0 is tagged (3c8f1f4): #716 fixed, #717 refused by name (full fix waits on persist v51.3.0 / CIRISPersist#947). Pin bump only; notice on CIRISServer#626.