proposals: unrepresentable covenants DSL + durable scrivener plan

[goldenwitch]

Summary

Two linked proposals from the post-#64 abstraction audit, shaped for the next build phase (a journal-first machine with heavy fan-out and durability requirements).

1. proposals/unrepresentable-covenants.md — typed covenant tree + DSL

Applies a strict prevention ladder (type system → source generator/analyzer → runtime remainder) to the ten bad states that are representable today (multi-provider journal collisions, overlapping-predicate fan-out, dead routes, DI shape traps, tools/streaming gating, manifest lies, dispose-without-start).

Key mechanisms:

• Connected<TManifest> evidence tokens — routes to unconnected journals or never-produced types stop compiling
• Fused route+transmuter registration at Done() — deletes validation Rule 4 instead of tightening it
• Registration typestate + ToolCapability<T> tokens — streaming/tools misconfigurations become inexpressible
• On/Tee dispatch: one dispatcher per source journal; On = ordered first-match alternatives, Tee = declared always-fire fan-out. Multi-match stays first-class — the fix targets undeclared overlap, not fan-out itself
• Generated manifests from IProduce<>/IConsume<> markers; Coven.Analyzers (COVEN001–006) for what generics can't express

2. proposals/durable-scrivener.vine — journal contract → durable → distributed (VINE plan)

Contract-first DAG, 10 nodes. The IScrivener guarantees everything currently relies on are implicit and only true of InMemoryScrivener; this formalizes them, ships a cross-implementation contract test suite, then a single-node segmented durable log (hydration, torn-write recovery, durable per-consumer cursors, idempotent pumps), then distributed semantics (single position authority w/ lease+fencing; replication with an explicit adopt-vs-build gate refereed by the contract suite).

Retires FileScrivener/FlusherDaemon (in-memory delegator, silent shutdown drop) per delete-unused-code guidelines.

Review focus — the opinionated calls

1. On/Tee arbitration split (§2 of the DSL proposal) — first-match alternatives vs declared fan-out replacing today's all-filtered-routes-fire
2. Dense monotonic positions retained in the durable plan — forces a single sequencer per journal; CRDT/vector positions explicitly rejected
3. At-least-once + idempotent effects rather than exactly-once transport; dedup at pump level, scriveners stay dumb logs
4. Adopt-vs-build gate for replication: JetStream/Kafka/Redis Streams adopted only if the contract suite passes unmodified

Note: the .vine plan carries two @guidance links to local design docs outside this repo (file:///D:/git/geasarcana/...) — decide during review whether to inline those specs, keep the local-only links, or drop them.

Testing

Docs/plan only — no code changes. .vine validates against VINE 1.2.0 (magic line, root-first, DAG dependencies all resolve).