Historical specification-only review. Its statements about unimplemented runtime describe the initial design pass. Current executable coverage and tests are recorded in implementation and the complete verification record.
Independent language-design review
Reviewed 4 November 2026 against the proposed SSL 0.1 documents in this shared checkout. This is a specification review, not parser, query-runtime, transaction, migration or production qualification.
Scope and outcome
Read soul.md, the language contract, glossary, overview, standard vocabulary, query contract, collaboration protocol, migration mapping, conformance vectors and the five example JSON artifacts. The review examined exact expression, gradual definitions, partial knowledge, deterministic queries, revision identity, author authority and the transition to production/editorial material.
Nine substantive design findings were raised during drafting and resolved in the specification. The revised proposal is coherent enough to begin a reference implementation. This does not prove independent interoperability, exhaustive expressiveness or migration readiness; those remain the explicit conformance gates.
Resolved findings
| Finding and counterexample | Resolution verified in the revised contract |
|---|---|
| Snapshot versus projection identity: two readers receive different visible packages from one snapshot. | Language §2 distinguishes immutable underlying snapshot identity from projection content/digest. Different filtered packages may share a base snapshot. C14 covers the distinction. |
| Definition binding: a concept introduced before its definition could not later bind it through portable SSL-P. | Protocol §3 adds bind-definition, current-head expectations and exact referenced definition, preserving the record's identity and fields. C04 and P11 cover gradual formalisation. |
| Namespace resolution: query function prefixes and newly created concept namespaces lacked a portable meaning. | Queries §1 defines inherited/explicit namespaces and fixed function-prefix identities, including conflicts; protocol §3 admits additive bindings atomically and rejects rebinding. P12 covers semantic identity preservation. |
| Phantom concurrency: two agents both observe no booking, then insert conflicting bookings without changing any existing read record. | Protocol requires requireCurrentSnapshot or an equivalent advertised collection guard for absence/aggregate-dependent proposals and checks it atomically. P04 covers the race. |
| Pipeline cells: a post-select path could mean a Cell wrapper or its underlying stored value; unresolved grouping was ambiguous. | Queries §§2–3 define binding-root Cell unwrapping, named group outputs, separate unresolved groups, count completeness and collected Cell descriptions. |
Restore identity: restore A from B could bypass restrictions on reclassification. | Protocol §3 requires a tombstone current head and a visible prior non-tombstone revision of the same work/ID; repeated tombstones reject. C17 covers history preservation. |
| Literal and digest semantics: literal escape could imply arbitrary numeric/Unicode exceptions, and a document hash could be mistaken for semantic equivalence. | Language §§3 and 9 keep lexical restrictions inside $literal and name canonical document-value hashing; namespace aliases need not have equal digests. |
| Edition expansion: one renderer could expand a beat's occurrences while another emitted a placeholder or duplicate scene. | Vocabulary §4 defines left-to-right beat expansion, empty/missing placeholders, no implicit recursive nesting and duplicate-occurrence findings. C15 covers expansion. |
| Frozen composition closure: an exact edit/edition root could still read changed children through live head references. | Vocabulary §§4 and 9 require the source snapshot and transitive exact-reference closure for frozen reproduction/delivery. C16 covers later child changes. |
Additional precision improvements verified: explicit media clocks or unambiguous inheritance; scalar-based text anchors; namespace alias rules for fixed query prefixes; consistent unknown lifting for literal/path/get expressions; arithmetic return types and bounded exact rationals; same-batch staged reference validation; parameter declarations and reserved bindings; access filtering before graph traversal and aggregation.
Example and conformance assessment
The lifecycle example deliberately remains a synthetic development arrangement with unavailable media. Its fields do not claim approved creative material, an actual shoot, legal clearance or a completed render. It links separate character/performer, story-place/venue, scene/occurrence, shot/take/asset and clip/edit identities. The custom undefined kind and pinned local definition demonstrate that specialised definitions are optional.
The formalisation proposal creates a definition and binds an existing record in one atomic batch without changing the original fields. The query example has a manually inspectable expected semantic subset: one draft scene. Its expected file explicitly leaves evaluator metadata to a future evaluator and notes the snapshot dependency needed to catch inserted scenes.
The conformance matrix includes positive and negative cases for uncertainty, exact Unicode, references, author authority, receipt recovery, failed batches, concurrency, media time and lifecycle identity. Most rows are behavioural requirements for future implementations; they have not been executed by a runtime in this specification task. The supplied limited fixture checker must not be described as an SSL-Q or SSL-P implementation. An independent run of python3 docs/design/story-source-language/verify_examples.py passed 26 fixture/structural checks over 32 lifecycle records; its output explicitly states that query, protocol, media/profile and persistence behaviour was not executed.
Remaining implementation gates
- Build independent core readers/writers and execute exact round-trip, unknown-extension and malformed-input vectors.
- Execute query vectors and differential tests, especially missing/unknown/error propagation, access-filtered aggregates, exact arithmetic and graph limits.
- Prove atomic change/receipt behaviour using real persistence under concurrency, delayed responses and process termination.
- Qualify adapters against the current owning source, including its distinct scene/outline/memory transactions and revision clocks.
- Test editing, restart, source fidelity and installed writer journeys on the exact candidate before any migration.
- Exercise real media interchange and department workflows before describing production profiles as qualified.
No existing story has been migrated. No product runtime, deployed service, credentials or private story content was changed by this review.