Record the means and the dependency rule (#11, #103)

[iderex]

The issues this belongs to

Closes #103

It also carries the record #11 asks for. #11 is named rather than closed here,
because the second half of its done-condition is that every M2 issue naming it as
a blocker has been updated, and that happens on those issues after this lands
rather than in this diff.

Two issues in one pull request, deliberately. Both land only decision records, and
a separate landing for each moves the mainline under the other while it is open.
The two records are also the pair that has to be read together: #11 measures five
facilities the standard library does not supply, and #103 is the rule that decides
what may fill them.

What changed

Two decision records and their two index lines. Nothing else in the tree.

0011 records the language, the toolchain and the binding layer. The choice came
from entry 2 of #1, answered on 2026-08-24. The record carries what an answer to a
question cannot: the cost in build legs, runtimes and a generated binding, what
the choice forecloses, what would reverse it, and one section that is not a
transcription of anything - each condition the eleven landed records wrote against
a language nobody had chosen, answered from a program compiled against the
toolchain.

0103 records what admits a dependency and what is refused. It answers the five
questions the issue asks, names the licence set as an explicit list rather than as
a principle, and adds a sixth clause the issue does not ask for: a dependency that
a record already standing requires, which is the case 0041 and 0105 create and the
one a rule written without it would refuse under a clause nobody wrote for it.

The means, and why it fits

Markdown under docs/decisions/, which is the means 0001 already fixed for a
decision on this board. The rule it has to carry is that a claim carries the
command that produced it, and an indented block holding a command and its output
carries that in a form a reader re-runs; nothing here is a guard, so no refusable
property or ledger row is owed. Choosing anything else would put two record
formats in one directory.

What failure it prevents

For 0011: the language being chosen by the first file. Without the record the
choice is made by whoever first needs to compile something, is then defended by
the work already resting on it, and the eleven conditions are met or missed by
accident rather than checked. This has not happened here - there is no code yet -
so it is a failure expected rather than one already met.

For 0103: a rule with ten exceptions in it. There is no code and therefore no
graph, which is the only moment the rule can be written without each clause being
argued against work already resting on it. The narrower half is already visible:
0011 measures five absences, and a hole met at a call site is filled with
whatever the person at that call site reached for.

Evidence

Every measurement in 0011 was produced by compiling or running a program against
this toolchain, and each block in the record carries the program and the command
above its output.

rustc -vV
rustc 1.97.0 (2d8144b78 2026-07-07)
binary: rustc
commit-hash: 2d8144b7880597b6e6d3dfd63a9a9efae3f533d3
commit-date: 2026-07-07
host: x86_64-pc-windows-msvc
release: 1.97.0
LLVM version: 22.1.6

The four conditions the means meets, the three it does not, and the two toolchain
bounds on the detector in #117 are each in the record with their own block. The
one that decides the most is the detector, because 0009 does not accept an
unproven calling-thread guarantee: the flag is a nightly one, and the sanitizer is
supported on the Linux and Apple targets and absent on the Android and Windows
ones. Both readings are in the record with the commands that produced them.

The licence the set in 0103 is derived from:

gh api repos/Flowfin/core --jq '.license.spdx_id'
AGPL-3.0

The size of the change, because it is over the 400-line figure this organisation
inherits as a readable cap:

git diff --stat origin/main HEAD
 ...language-the-toolchain-and-the-binding-layer.md | 471 +++++++++++++++++++++
 ...what-admits-a-dependency-and-what-is-refused.md | 266 ++++++++++++
 docs/decisions/README.md                           |   2 +
 3 files changed, 739 insertions(+)

What holds across every one of those bytes is one property: each is a decision
record in the shape 0001 fixes, or the index line that record requires beside
it. There is no second topic inside the count.

Every changed path is inside the directory the two issues are about:

git diff --name-only origin/main HEAD
docs/decisions/0011-the-language-the-toolchain-and-the-binding-layer.md
docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md
docs/decisions/README.md

The document check that judges named paths was run over the two new records and
the index before this was pushed. The whole-tree verb did not finish inside nine
minutes on this machine, so the rules were applied to the three changed documents
instead, through the script's own functions rather than a second copy of them:

== docs/decisions/0011-the-language-the-toolchain-and-the-binding-layer.md
COUNT   0       0       0
== docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md
COUNT   0       0       0
== docs/decisions/README.md
COUNT   52      0       0

That is fifty-two named paths resolved in the index, none excused, and no refusal
anywhere. The run in this pull request is the one over the whole tree.

What this does not cover

The whole-tree document check was not run to completion here, for the reason
above. What ran covered the three documents this change touches and nothing else,
so a path broken elsewhere in the tree by something else would not have been seen
by it.

0011 does not pin a version, name a directory layout, choose target triples or
pick a binding generator. Those are #14, #13, #113 and a later record under
#103's rule, and the record says so rather than deciding them in passing.

0103 is not enforced by anything. No check in this repository reads the clause
line beside a manifest entry, and there is no manifest yet. The record states that
about itself.

Three of the conditions 0011 answers are answered "not met": no source of
unpredictable bytes on a stable build, no cryptographic digest, and no promise
that a credential's bytes are cleared. None of them is softened, and none of the
records that raised them is superseded here - each already wrote the outcome as a
case rather than as a failure.

The claim about a credential's bytes is a claim and not a measurement, and the
record says which it is: the reading that would prove it is a read of freed
memory.

Nothing here was built, compiled into this repository, or tested by a suite,
because this repository has no code. The programs the record quotes were compiled
outside the tree and are reproduced in it in full so that a reader can run them.

Who has read it

Nobody but me. There is no second reader on this board tonight, and the evidence
above stands in place of one.