[SAFETY BLOCKER] Do not connect ForthWall exact-placement repair to CI

[hyperpolymath]

⛔ Safety blocker: do not wire ForthWall repair into CI

Do not connect the proposed ForthWall rule engine to an automatic DocMatrix
or Empty-linter repair path. ForthWall is distinct from recon-silly-ation:
the latter is a broader cross-document consistency reconciler, while ForthWall
is only a proposed capability-bounded Forth execution layer. Do not treat the
current documentation, conversion FFI, interface scaffolding, or placeholder
tests as evidence that exact-placement repair or a complete editor works.

The intended design is valuable: a small Forth transformation VM could make an
approved edit replayable, fixed-point/integer based, and easy to audit at the
operation level. That gives deterministic execution. It does not prove that
the detector selected the correct semantic location. Perfect execution at the
wrong span is still corruption, and can provide stronger false assurance than a
visible failure.

Evidence observed on 2026-08-28

The observation horizon was the current Docmatrix checkout plus every reachable
Git ref in that checkout, and the current recon-silly-ation checkout and its
self-reported test/readiness files.

• DocMatrix documentation describes a Forth-like lexer, VM, built-ins, format
  support, and examples under the former name ReconForth; one roadmap marks the
  VM operational/complete.
• No such implementation exists in the current DocMatrix tree or the
  reachable Docmatrix Git history inspected.
• DocMatrix's evidenced core is document conversion. Its Rust C FFI exposes
  parse/render operations; it does not expose a ForthWall VM, rule engine,
  trace, proof, or exact patch operation.
• Interface and Ada TUI source exists, but no end-to-end evidence establishes a
  complete editor. It has no intensive/critical repair profile, ForthWall
  settings, rule configuration,
  proof/trace viewer, ambiguity handling, or patch-approval control.
• The separate recon-silly-ation repository records both its actual
  reconciliation engine and proposed ForthWall VM as 0% complete; its
  end-to-end test does not exercise a real reconciliation round trip.
• Its Zig FFI still contains example/no-op processing, returns Example result,
  and its integration test is a template placeholder that only asserts true.

The documentation therefore materially outruns the executable evidence.

Required safety model

CI may automatically audit and fail closed. It must not silently rewrite a
branch. Exact-placement repair must default to a proposed patch requiring review.

Every critical operation must bind all of the following into one replayable
record:

1. input file identity and cryptographic hash;
2. parser/format identity and version;
3. exact byte span and, where applicable, AST node and fixed-point page/glyph
   coordinates;
4. expected bytes/content before the operation;
5. replacement bytes/content;
6. explicit rule/profile identifier and severity;
7. deterministic VM instruction trace;
8. expected output hash;
9. an independent post-operation parser/renderer and invariant result;
10. approval identity for ambiguous or safety/quality-critical edits.

Refuse the operation if the input hash is stale, the expected-before value does
not match, the span is ambiguous, parsers disagree, the format round-trip drifts,
the operation is non-idempotent, the independent verifier is unavailable, or
any unrecognised VM word/configuration is present.

Acceptance criteria before any automatic integration

• Replace the template/no-op engine with a real, bounded ForthWall VM.
• Specify the word set, stack effects, integer/fixed-point coordinate model,
  resource limits, error semantics, and deterministic serialisation.
• Implement exact-span compare-before-write and transactional output.
• Implement signed/hashed execution traces and independent verification.
• Add positive, negative, ambiguity, stale-hash, parser-disagreement,
  round-trip-drift, idempotence, and fault-injection tests.
• Replace placeholder FFI and tests with a real DocMatrix ↔ ForthWall
  round-trip exercised in CI.
• Add TUI settings for audit/propose/critical modes, rule profiles, severity,
  include/exclude scope, verifier selection, and patch review.
• Make audit the only non-interactive CI default.
• Keep automatic mutation disabled for ambiguous and critical findings.
• Correct roadmap/readiness claims so documentation reports implemented and
  tested capability, not intended architecture.
• Obtain an explicit maintainer safety ruling before removing
  status:do-not-automate or enabling any CI write path.

Non-goal

Forth does not provide physical/atomic printer precision or semantic omniscience.
It can deterministically emit exact digital operations; device tolerances and the
correctness of the detector remain separate concerns that need separate evidence.

Suite boundaries

DocMatrix is conversion and precision infrastructure in a suite with two
separate user-facing responsibilities:

• Formatrix Docs owns tabbed views of one logical document across TXT,
  user-selected-delimiter tabular text, Markdown, AsciiDoc, Djot, and A2ML,
  with synchronised editing as its intended progression.
• Blocky Writer owns fitting and placement into fixed-layout PDF and
  application-form boxes, baselines, and per-character cells designed for hand
  spacing.

Proof does not transfer automatically between components. Conversion
round-trip evidence does not prove editor-state synchronisation; editor tests do
not prove PDF geometry; exact geometry does not prove semantic correctness.
Every cross-component operation must satisfy each participating component's
contract and an end-to-end independent verification.