DEVIATION — Architecture Cleanup (reality ledger)

Status: REFERENCE (reality ledger) — complete. Companion to RFC-L2-architecture-cleanup. All rows are closed (M8 ritual: DEVIATION register complete, all 13 rows closed) — the code caught up to the specs and every [::state] marker flipped. Kept intact as the reality ledger; not edited back into specs.

This register carries reality: for every drained RFC decision, one row describing how the code currently diverges from the spec's end-state. Specs carry intent; this file carries the delta; reality is never edited back into a spec.

Row lifecycle: open (spec updated, code lags) → landing (migration step in flight) → closed (code matches spec; [::state] marker removed; reviewed bumped).

Rows

Row	RFC ref	Spec section	Current state (reality)	End state (intent)	Status
V1	D1, D3, D4, D17, D18	replication/authority-server-link L1–L3; authority-server L1–L3; architecture/L2-crate-topology §1.3	Crate posthaste-link-contract with DownFrame (lib.rs:130), RuntimeId (lib.rs:181); crate doc overclaims "the contract both links speak"; crate posthaste-authority-runtime with BackendApi/BackendLink/BackendNode/LocalBackend; RemoteBackend/RuntimeBackendOutbox in posthaste-runtime; bins posthaste_backend, posthaste_daemon, posthaste_runtime_daemon	Crate posthaste-authority-server-link with AuthorityServerFrame, AuthorityServerLinkId, AuthorityServerApi, AuthorityServerLink; crate posthaste-authority-server with AuthorityServerNode, LocalAuthorityServer; RemoteAuthorityServer/RuntimeAuthorityServerOutbox in posthaste-runtime; bins posthaste-authority-server, posthaste-authority-runtime-server (bundled), posthaste-runtime, posthaste-client (D18); doc scoped to the authority-server-link surface	closed — M4 landed 2026-07-02 (incl. D31/D32/D35 riders: http-api-adapter, AuthorityServerLink trait taxonomy, RuntimeLink, forward_mutation)
V2	D5, D6, D8, D11, D12, D16	architecture/L2-crate-topology §1.1; runtime/adapter; replication/*	No posthaste-contract-core. Wire types fused with RuntimeCore in runtime-contract (lib.rs:68-1354); stringly MutationRequest{name,args} (lib.rs:730); typed MessageMutation stranded in link-contract/message_mutation.rs:27; WireMutationId mirror alive (link-contract/lib.rs:147); dead settlement arms (Conflict/Queued/LocalApplied)	posthaste-contract-core crate: typed MailOperation (one vocabulary incl. the revCursor control arm, parsed once per wire at the §6.6 crossings), MutationRequest/Receipt, ids, view models, RuntimeAdapterError; WireMutationId deleted (link_core::MutationId is the one wire id); settlement vocabulary trimmed to live states; the 5 per-command RPCs collapsed into one apply_mail_operation(MailOperation) -> CommandAck (D21 — one typed entry per semantics)	closed — M5 landed 2026-07-02: MailOperation typed (14 variants incl. revCursor), fold_effect shared, apply() collapse, WireMutationId deleted, settlement verified trim, crossings exhaustive
V3	D7	runtime/internals L1–L3; architecture/L2-crate-topology §1.3	RuntimeCore god-trait, ~60 methods (runtime-contract/lib.rs:1011-1354), implemented by posthaste-runtime; near node already moved to crates/posthaste-runtime while old specs said authority-runtime	Split: posthaste-runtime-api (typed wire-free domain RPC) + posthaste-client-link (link ops: mutation forward, frame stream, session/view ops)	closed — M3 landed (uvlxntnt, 2026-07-02): 4 traits + umbrella (41 methods) + RuntimeLinkOps (10); RuntimeCaller → contract-core; replay_events dropped; sessionless pair kept (production consumer POST /v1/views); runtime-contract deleted
V4	D10, D13	backend/L2; architecture/L2-crate-topology §1.1–1.2	posthaste-domain god-crate: 13 modules, model+ports+MailService+provider+imap+cache+search, mail-parser+tokio deps; ConfigError in config.rs, ValidationError in validation.rs; every wire consumer drags all of it	posthaste-domain-model (pure types incl. relocated ConfigError/ValidationError, per RFC §6.1 file assignment as amended by D30) + posthaste-domain-service (hexagonal core); no glob re-export shim in end-state	closed — M1 landed the split (zuyxovxr); M8 landed the shim sunset (touqxsxr, 2026-07-02): glob deleted, 221 files compiler-verified re-pointed
V5	D14	architecture/L2-crate-topology §4 no-parallel-namespaces	posthaste-store re-exports ~80 domain symbols wholesale	store exports only what it owns (DatabaseStore, RepairReport, …); consumers import domain types from the domain crates	closed — D14 landed (kppnrskp, 2026-07-02); reality note: only 4 public re-exports remained post-M1 (RevLog set), zero external consumers
V6	D15	architecture/L2-crate-topology §3	M0 landed (pkrvlwqm, 2026-07-02): wasm-frontier CI job checks link-core + link-replica. Remaining: frontier still breached via link-wasm → runtime-contract → domain → {mail-parser, tokio}; domain-model/contract-core don't exist yet	link-core, link-replica, domain-model, contract-core build for wasm32-unknown-unknown in CI	closed — M0 landed the job (pkrvlwqm); M8 extended it to the full five-crate frontier (touqxsxr, 2026-07-02); frontier breach healed by M2/M3/M5 (link-wasm closure = replica crates + contract-core + domain-model)
V8	D19	architecture/L2-crate-topology §4 no-parallel-namespaces	posthaste-authority-runtime/lib.rs:39-43 re-exports 10 near-node symbols (4 with zero shim consumers; RuntimeHandle/BackendTransportConfig under two namespaces; SystemSecretStore under three); posthaste-server/lib.rs:11-16,23-29 glob-facades the whole api surface + dead pub mod oauth + tests-only pub mod supervisor	No cross-crate facade re-exports anywhere; consumers declare the owning crate (server/testkit/bench add a posthaste-runtime dep; server tests import deps directly)	closed — D19 landed 2026-07-02; reality notes: pub mod oauth had 2 real consumers (re-pointed), desktop consumed ServerConfig via the facade (now direct from posthaste-api)
V9	D20	authority-server/L3 intro; runtime/internals/L3 intro	MigrationRuntime, 2 dead from_api_bridge_* constructors, zero-consumer provider traits (account_reads.rs/live_accounts.rs), AuthorityRuntimeApiMigrationBridge, server/src/migration.rs (57 LOC) live in prod surfaces; code @spec comments point at the retired wrapper-migration plan	Dead symbols deleted; test bridge in testkit/cfg(test) only; no dangling @spec pointers	closed — M3b landed (momvtsxu, 2026-07-02)
V10	D24	architecture/L2-crate-topology §1.3–1.4; replication/authority-server-link L2	link_router/start_backend live in posthaste-server/link.rs and borrow ApiError + 3 auth helpers from posthaste-api (link.rs:40-41); the standalone far-node binary drags the /v1 client platform	The far-node link wire lives in posthaste-authority-server with its own minimal error/auth vocabulary; posthaste-server only mounts it	closed — M3b landed (momvtsxu, 2026-07-02): link_wire.rs in authority-runtime (crate renamed at M4); startup_backend sheds posthaste-api entirely
V11	D25, D26, D27	authority-server/L2 §1.1; api/L2 §1	DaemonSettings resolution in posthaste-api/src/config.rs:115-207 field-reads the voldemort AppToml from read_app_toml(); DaemonRuntimeTuning + 5 sub-structs exported with zero consumers; node assembly + fail-closed LinkAuth triplicated (startup.rs ≡ startup_backend.rs ≡ runtimed/main.rs)	posthaste-config owns settings resolution; no voldemort types cross the boundary; dead tuning surface deleted; one shared assembly helper + one LinkAuth::from_daemon_settings	closed — D26 (ospkxvwk), D25 (mtstxsrn), D27 (in M3b momvtsxu: assemble_daemon_preamble + LinkAuth::from_daemon_settings, 3 call sites) all landed 2026-07-02
V12	D28	state/mail/L2 (query evaluator)	Two tokenizers for one grammar: authority-server mail_queries/rules/tokenize.rs (190 LOC) pre-splits in: then re-feeds domain search::parse_query (rules.rs:36)	One tokenizer in domain-service with an in:-resolver hook	closed — D28 landed (rmoloolq, 2026-07-02): parse_query_with_scopes + ScopeToken; second tokenizer deleted; 5 boundary tests
V13	D33	architecture/L2-crate-topology §1.3; replication/authority-server-link L1-L2	One 49-method far-node trait fuses the typed request surface with the link mechanics (post-M4 name: AuthorityServerLink); runtime's ReadCache mirrors the read half 1:1 without a named seam	AuthorityServerApi (typed request surface) + AuthorityServerLink (coherent-link mechanics), mirroring RuntimeApi+RuntimeLinkOps; both implemented by LocalAuthorityServer/RemoteAuthorityServer	closed — M5b landed (pxwyyqrm, 2026-07-02): Api 39 / Link 6 per §6.9, apply() at the far seam, ReadCache narrowed to Api, wire byte-identical
V7	D9	replication/authority-server-link L2; replication/client-link L2	Replica/Link/Outbox layering ~80% realized in structure (MessageReplica, RuntimeBackendOutbox, EntityStore::settle) but not legible in trait seams; race-free retire invariant lives only in EntityStore::settle, not the engine (stale issue L2-engine-absorption-footguns)	Explicit Replica (and if warranted Link/Outbox) trait views over the single owner; the second convergence consumer (runtime near node) uses the same seam	closed — M6 landed (nmwstyru, 2026-07-02): OptimisticReplica trait, retire gate lifted in-engine, entity_store mechanism/projection split, project_optimistic shared, far_end/ module

Conventions

• One row per divergence, not per file: a single crate split that touches 40 call sites is one row.
• Current state must name the crates/types as they exist today (old names), End state uses the spec's names — the row is the old↔new bridge while both exist.
• A row may not close while any [::state partial …] marker it owns remains in a durable spec.

M9 rows (next wave — opened at D40–D47 drain, 2026-07-02)

Row	RFC ref	Spec section	Current state (reality)	End state (intent)	Status
V14	D40, D45, D46, D47	architecture/L2-crate-topology §2.1b; replication L1 §10	Two hand-rolled far-ends: runtime sessions (seq replay, per-subscriber struct) + AS registry (NO replay, silent lag swallow, sink leak, no expiry); dedup ledgers duplicated with divergent failed-retry semantics	posthaste-link-far-end crate: composable sub-stores (dedup w/ D47 terminal-class semantics, settlement sinks, seq-backlog replay w/ collapse fallback + expiry); both far-ends assemble it; AS frames carry seq (wire change)	closed — M9a (ruwnwror) + D49/D50 fixes (2026-07-02): all 10 review findings fixed with pinning tests; D48 retention live; one replay mechanism both seams (collapse-always = capacity-0)
V15	D40, D41, D44, D45	architecture/L2-crate-topology §2.1b; replication client-link L1–L2	Three near-end forks: reqwest transport (no deadline/reconnect), TS sessionClient (flat 1s retry, cursor dropped on reconnect, unchecked parse), in-process; outbox replay triggered by view-open; sent-but-unsettled TODO	posthaste-link-near-end crate (wasm-pure, frontier CI): Transport trait + engine (deadlines, jittered backoff, seq cursor, typed parse) + level-triggered reconciler on every connect (owns never-dispatched + sent-but-unsettled; view-open trigger deleted); browser IO shim zero-policy; closes lifecycle-debt rows 1/2/8/9	closed — M9b-core (qqypqsqv) + M9b2 (xxzvnykm, 2026-07-02): engine live at both seams (Wire seam), TS policy forks deleted, mutation_settlement, reconciler complete; lifecycle-debt rows 1/2/8/9 closed IN PRODUCTION
V16	D42, D43	architecture/L2-crate-topology §1.1, §1.3; runtime specs (session vocabulary)	RuntimeSessionId (49 uses/10 files) + session protocol vocabulary; crates named posthaste-link-core/posthaste-link-replica	RuntimeLinkId + link-connection vocabulary; posthaste-replica-core/posthaste-replica-projector; link-wasm name decided; CI frontier list updated	closed — M9c landed 2026-07-02: D42 link vocabulary (route literals kept, residuals justified), D43 replica-core/replica-projector/client-node-wasm, D38 resolved-by-verdict (native-mount-specific), docs swept