policy: Explicit-Escape Principle (LANGUAGE-POLICY v1.2.2)

rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc

@@ -3,19 +3,20 @@
 
 = RSR Language Policy
 :author: Jonathan D.A. Jewell (hyperpolymath)
-:revnumber: 1.2.1
+:revnumber: 1.2.2
 :revdate: 2026-05-16
 :toc: left
 :icons: font
 :source-repo: https://github.com/hyperpolymath/cccp
 
 [NOTE]
 ====
-*Version Status*: v1.2.1 — adds the Naming Convention (separator semantics,
-RFC 8552-grounded, with scoped override for foreign/inverted conventions).
-v1.2.0 codified the Interface & Architecture Law (ABI=Idris2, API+FFI=Zig;
-strict typed boundaries; no gatekeeperless gateways). v1.1.0 amended the
-allowed/banned lists 2026-04-10. See §Amendments for the full change list.
+*Version Status*: v1.2.2 — adds the Explicit-Escape Principle (every estate
+default must offer a tool-honoured escape). v1.2.1 added the Naming Convention
+(separator semantics, RFC 8552-grounded, scoped override for foreign/inverted
+conventions). v1.2.0 codified the Interface & Architecture Law (ABI=Idris2,
+API+FFI=Zig; strict typed boundaries; no gatekeeperless gateways). v1.1.0
+amended the allowed/banned lists 2026-04-10. See §Amendments for the full list.
 ====
 
 == Terminology: "Rust" means "Rust/SPARK"
@@ -357,14 +358,46 @@ programs) is a **misnamed duplicate** introduced by tooling that did not know
 this convention — it is to be collapsed into the hyphen form, not treated as a
 valid parallel structure. Underscore is reserved for genuine data/content dirs.
 
+== Explicit-Escape Principle (NORMATIVE, general)
+
+The scoped convention override above is one instance of a general estate law.
+
+*Every estate default, alias, or convention MUST provide an explicit,
+machine-readable escape; and any tool or agent MUST honour a declared escape
+and MUST NOT re-impose the default across it, in either direction.*
+
+Rationale: a default with no escape becomes a trap, and "helpful" tooling that
+silently re-applies a default over a deliberate, declared opt-out is the single
+most common way hard-won corrections get undone (the estate's recurring
+re-emergence failure). Think of a shell alias (`apt` → `nala`) with `\apt` as
+the escape: the escape is sacrosanct — nothing may "correct" it back. The
+estate version is *scoped*: declare the escape once at a boundary
+(`.machine_readable/`), and everything inside is escaped, with tools required
+to detect and respect the marker rather than re-inferring the default.
+
+Applies to: the separator convention, language/architecture layer rules,
+formatting/lint defaults, generated-vs-authored markers, vendored subtrees, and
+any future convention. No estate convention is exempt; an escape that tooling
+does not honour is a defect in the tooling, not in the escape.
+
 == Machine-Readable Policy
 
 See link:../spec.scm/language-policy.scm[spec.scm/language-policy.scm] for tooling integration.
-The separator convention above MUST be mirrored there so agents/tools enforce
-it from the machine-readable policy, not prose alone.
+The separator convention and the Explicit-Escape Principle above MUST be
+mirrored there so agents/tools enforce them from the machine-readable policy,
+not prose alone.
 
 == Amendments
 
+=== v1.2.2 — 2026-05-16 (Jonathan D.A. Jewell)
+
+Generalised the scoped convention override into the *Explicit-Escape
+Principle* (NORMATIVE): every estate default/alias/convention must offer an
+explicit machine-readable escape; tools must honour a declared escape and must
+never re-impose the default across it, in either direction. Recurring
+re-emergence failures are tooling defects when an escape exists. Must be
+mirrored into the machine-readable policy.
+
 === v1.2.1 — 2026-05-16 (Jonathan D.A. Jewell)
 
 Added the *Naming Convention: separator semantics* normative section: