system-operations-never-crash
OUT derived (depth 4)
Every system operation is crash-free: atomic mutations prevent partial state corruption, deterministic reversible reasoning prevents oscillation and ambiguity, and uniform evaluation prevents dispatch errors — provided no dangling dependent references exist in the graph.
Summary
The system guarantees that no operation can crash or leave things in a broken state — mutations are all-or-nothing, reasoning never gets stuck in loops, and every node is handled the same way. This guarantee holds as long as the dependency graph has no orphaned references pointing to nodes that no longer exist.
Justifications
SL — Operational integrity holds structurally, but propagation's unchecked dependent-ID lookup is a crash vector if the dependents index is inconsistent
Antecedents (all must be IN):
- mutations-are-atomic-and-safely-propagated — Every network mutation follows an end-to-end safety pipeline: API context management ensures atomic load/save with write-flag gating, truth propagation terminates deterministically with lifecycle-aware BFS traversal, and snapshot persistence captures the final consistent state — no mutation can produce an inconsistent or divergent network.
- reasoning-engine-is-deterministic-and-reversible — The TMS engine achieves deterministic reversible non-monotonic reasoning: truth maintenance produces predictable terminating results through uniform evaluation and conservative asymmetry, while every non-monotonic operation (challenge, kill-switch, supersession, dialectics) is inherently undoable through the single outlist primitive.
Unless (any of these IN defeats this justification):
- propagate-assumes-dependents-exist — Every ID in `node.dependents` is accessed via `self.nodes[dep_id]` without a membership check; a dangling dependent reference will raise `KeyError` — this is intentional (broken invariant = bug)