Report what the diff touched once, and let each consumer apply its own scope — the consumed-row deletion arm was false on every run

[gunbai-bot]

P2 of three. Lands after #10007 (P1, the rung-drop declaration). P1 declares the drop; this repairs it.

The defect, in the required log's own words

From required-witnesses-floor on run 33596391300 — nine consecutive lines, one per admission row, each ending the same way:

namespace-wave-admission CONSUMED ADMISSION DCH-1 messages wire shape hoisted to its
specification module 2026-09-02 (gunbc#9985) (TargetChanged binding
extdeps.llm.anthropic_rest::llm.Anthropic `AnthropicChatMessage` ->
extdeps.llm.anthropic_messages_api) already satisfied at the base — consumed by its own
merge; deletion is owed on the roster's next touch

deletion is owed on the roster's next touch, announced nine times by a run that was structurally incapable of ever collecting it. That is the whole bug: the obligation gunbc#9824 declared is printed on every required run, and the arm that would enforce it could not fire.

Why it could not fire

namespace_wave_admission::diff_sides applied the parser's .dag scope to its own answer, so the only available statement of what did this change touch was already narrowed to one consumer's question. A second consumer downstream asks a different one: roster_touched is about ADMISSION_ROSTER_REL_PATH, a .rs file. A .rs path cannot survive a .dag filter, so roster_touched was false on every production run, consumed_due in the executor could never be true, and the consumed-row deletion obligation gunbc#9824 declared could never come due. Its stated window — "roster-use bounded" — had no bound in execution.

That is gunbc.recurring_failure_mode incidental_denominator_as_wall: an upstream filter written to answer a different question silently deciding an unrelated operation, with nothing joining them. P1 files the receipt at this polarity, where the accident kills a wall rather than accidentally holding one up.

The repair, and why not the narrower one

The narrow fix is to give roster_touched its own source of truth. Rejected on §3: that leaves "what this diff touched, parser-filtered" and "what this diff touched, unfiltered" as two live representations of one fact, and the next reader must know which is which — the same class one step later, planted by the repair for it.

So: diff_sides reports the diff once, unfiltered, and each consumer applies the scope its own question needs at its point of use. in_sweep_scope is now pub and applied per side for the two baseline-reconstruction reads that genuinely ask the parser's question; roster_touched reads the unfiltered list. Measured before choosing: diff_sides has exactly one production caller and both retains lived inside the callee, so this is also the smaller change.

wave_admission_refusal moves the verdict from the executor into the wall. It was interleaved with printing inside a private function of a binary, so nothing outside that binary could construct the refusal and no test could discriminate the roster-touched arm on the path CI runs — §4b's decoration case, where the missing harness is the trigger rather than a ceiling. The executor keeps the receipts (it owns a stderr) and asks the wall for the verdict, so "does this run refuse" has one authority instead of an authority and a printer.

The nine deleted rows are this change's own first positive control

The nine DCH-1 rows are removed by their own dissolve-on trigger — #9985 merging, which has fired; extdeps.llm.anthropic_rest already imports the four hoisted spellings from extdeps.llm.anthropic_messages_api at the base of every run, so admission_consumed_at_base proves the relocation. They were born consumed: authored in the same commit that merged their subject, so no run after that commit could ever match them. That is the second born-consumed cohort in two days.

The deletion is not housekeeping riding along. This commit makes roster_touched reachable and touches the roster file, so under the arm it enables those nine rows would come due and refuse it. A change that turns a wall on while leaving standing exactly the population that wall refuses would be reporting a green it did not earn.

The nine were verified consumed before deletion, by the last instrument able to answer it. That same run reported deltas=0, nine CONSUMED ADMISSION lines, zero STALE, and ADMITTED — including the five rows that bind through whole-pool resolution, which could not be settled by reading imports. None of the nine was refusing anyone. After this PR the rows are gone and the question is unobservable, which is why it was read first.

What clears: the nine consumed rows, and the class of run that could never observe them. What survives: every other refusal — an unmatched row still refuses every run, an unadjudicated delta still refuses, NotEvaluated still refuses, and a bystander run carrying a consumed row is still admitted. What newly appears: a roster-touching change carrying consumed rows now refuses, which is the obligation coming due for the first time.

Prose correction, folded in per §3

Three paragraphs of the roster's ledger referred to RLM-2b deictically — rows "above", deltas "below", a cohort that "stays". Those referents are deleted, so sentences true when authored had become present-tense claims that are false, inside the very ledger whose subject is rows outliving their truth. Tense and position words corrected, no claim altered, and the correction itself recorded — §3's cite-the-symbol-not-the-position reaching prose, because a ledger's positions are exactly what its own dissolution rule destroys.

Evidence

cargo test -p v1-compiler --test namespace_wave_admission: 50/50 green. cargo clippy --all-targets -- -D warnings: green.

Three mutations, each redding exactly the intended test and nothing else:

mutation	reds
restore the two retains inside diff_sides (the pre-change behaviour)	the_roster_path_reaches_the_side_the_roster_touched_predicate_reads (+ the rename test)
consumed_due drops roster_touched — refuses bystanders	a_consumed_row_comes_due_on_the_roster_touching_run_and_on_no_other
consumed_due forced dead — the defect at the decider	same test, the other assertion

The decider test's report is produced by adjudicate over authored base and head trees, so what is judged is a real consumed admission; only roster_touched is supplied, and the producer test is what establishes that value is now reachable. Positive control: touching_the_roster_with_no_consumed_row_is_admitted — an empty roster is not permissive, but touching the file with nothing due must pass.

a_rename_contributes_its_source_to_the_base_side_and_its_destination_to_the_head_side redded on the scope move, which is the evidence the change reached the acceptance path rather than a problem to engineer around. Its assertion moved to the parser's question, where it is still true, and it now asserts both halves: the diff carries the paths, and in_sweep_scope still refuses them.

Rung: this restores the class to 2, mechanically preventable — the rung P1 declares as previous. It is not the climb to 4; that waits on admissions bound to the delta content they admit and never resident on main, which is P3's subject.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Et86vcNb8YdMQSSPc3pbhR

[gunbai-bot]

CI: all four jobs failed at the step Install Rust toolchain, before anything in this diff was compiled. Infrastructure, not code — srv1-01/srv1-06 currently have broken or incomplete toolchains, which is also producing failures on unrelated runs. I re-ran the failed jobs rather than pushing; a push would only cancel lanes.

The evidence this PR was waiting on has arrived, and it closes the open question in the body. #10007's run (33596391300, required-witnesses-floor, 06:06:13Z) adjudicated base=4059156e491 head=390b859f8de — a merge ref I confirmed carries the nine rows before trusting it — and reported:

modules_compared=4506 modules_added=0 modules_removed=0 membership_edges_head=25038
binding_rows_compared=678564 closure_rows_moved=0 deltas=0
… nine CONSUMED ADMISSION lines, one per row …
namespace-wave-admission ADMITTED

9/9 consumed, 0 stale. The five rows that bind through whole-pool resolution — Assistant and Standard in test.claim.extdeps_llm_type_grounding_witness, and the three v2.test.lens_disposition_redundancy rows — all prove consumed, so admission_consumed_at_base does see a singleton equal to the target through pool resolution. None of the nine was refusing anyone; deleting them here is owed, not a repair of a live break.

Every one of those nine lines ends deletion is owed on the roster's next touch. That is the obligation this PR makes enforceable, printed nine times by a run that could not act on it — the defect narrating itself.

That run was also the last instrument able to answer this: after this PR the rows are gone and the question is unobservable. Hence it was read before merge rather than after.

— sent from sleek-deer-53