fix(varve): pin the layer by digest — the rolling channel republished 2026.08.4

[avrabe]

The symptom

Every varve-shimmed tool invocation in this repo currently fails:

$ varve which synth
error: layer 2026.08.4 is installed more than once under different digests
(2 entries) and the pin carries no digest to disambiguate — add
`digest = "sha256:…"` to the pin

Exit 1, nothing on stdout. Any script doing S=$(varve which synth) gets an
empty string and then either fails obscurely or silently falls back to an
ambient binary.

The cause

The rolling channel republished layer 2026.08.4 under a second manifest
digest. Both are in the local store:

manifest digest	installed
sha256:7e48ccc3…	2026-08-27 00:35
sha256:c1e6a418…	2026-08-27 23:45

It is a re-publication, not a content change

varve inspect under each pin returns the same 47-line inventory,
byte-identical apart from the layer's own digest line. Every dispatched tool
hashes the same under both:

tool	version	sha256 (first 16)
synth	0.58.0	033d7c61118e7093
loom	1.4.0	9583f530baa0d6f0
meld	0.52.0	88fb38bd1e796632
witness	0.43.0	3c54bf7bde25f284
rivet	0.34.0	72b1b81dab0b8a78

So nothing built against either copy is suspect. No committed artifact needs
rebuilding.

The fix, and what it costs a claim

Pin the later digest — what the channel serves now — and document it.

This falsifies something docs/toolchain-pin.md rested on. On the rolling
channel a layer name is not a stable identifier: layer = "2026.08.4"
resolved to one manifest on 27 Aug and to two by 28 Aug. Any reproducibility
claim anchored to the name alone is falsifiable, and was. Only the digest
pins the artifact. The doc now says so.

Kill-criterion

Strip the digest line from varve.toml and run varve which synth. It must
exit 1 with the ambiguity error. Verified:

exit=1 msg=error: layer 2026.08.4 is installed more than once under different digests (2 entries) and

With the digest present, all five tools resolve (versions above).

Note on varve itself

Its refusal is the feature working — it exited non-zero and named the fix
instead of guessing. A shim that fell back to an ambient binary would have
produced a build attributable to no layer at all. Reporting the duplicate
publication upstream separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!