Declare the two bare type references in gunbc.spark.serving_execution_schedule, and enroll the closure pair that can see them

[briansrls]

gunbc.spark.serving_execution_schedule named SparkServingObservationProvenance (declared in gunbc.spark.serving_observation_transaction) and HostIdentity (declared in product.placement_supply) at field and parameter positions while naming neither in any import. A bare type position resolves against the whole module pool by global uniqueness rather than by import binding, so the full-corpus compile was green; under any narrower source closure the compiler answers unresolved type, pointing at the using module — which reads like a corpus bug and is not one.

What lands

• Two declared imports in gunbc.spark.serving_execution_schedule. No resolution rule is widened or weakened.
• test.claim.spark.spark_serving_schedule_closure_resolution_witness_test — the pair that can actually see the defect, because the import line alone is invisible to every check here (green before, green after):
  • subject: a synthetic single-import module over gunbc.fleet_converge_plan, whose closure contains the repaired module, through compile_dag_rust_emit_check.
  • positive control: the same shape over gunbc.spark.serving_realization, which compiled before the repair as well as after.
  • The RED is authorable: deleting either import line turns the subject red and leaves the control green.

The witness executes in CI's floor run; I have no local gunbc binary and did not run it in this session — the floor result on this PR is the execution receipt, not a claim made here.

The class is corpus-grain, and this PR does NOT remedy it

Census of bare type references that are neither declared locally nor named in any import, over the denominator of 4,459 .dag modules under dag/** and src/v2/**:

• 789 modules carry at least one
• 2,190 (module, name) pairs

By tree: v2 1,732 · test 1,231 · gunbc 414 · extdeps 137 · std 32 · product 4 · tools 1 (pair counts, pre-refinement pass). The largest single name is LiveTreeDisposition (427 modules writing data live_tree_disposition: LiveTreeDisposition = … with no import of v2.std.live_tree).

The compiler already models this class: src/v1/04_resolve.dag emits UnlistedImportUse as an advisory, non-erroring diagnostic against source_visible_names, and its own annotation names the burndown of genuine unlisted uses to zero as the trigger that promotes it to a hard UnresolvedType — i.e. the corpus-grain remedy already has a declared home and a declared dissolution trigger. Scoping that burndown is not this PR.

Second commit: the sizing is recorded where the flip happens

Parent's ruling: stop at this PR, no burndown lane tonight (CI capacity — 789 modules of import edits at a ~40min median witnesses run with no merge queue starves every other lane). But the sizing had to be recorded against the existing dissolution rather than left in an inbox, and this PR is the only one on the board whose subject is this class.

gunbc.compile_clean_diagnostic_policy now carries unlisted_import_use_burndown_sizing, a typed observation beside compile_clean_unlisted_import_use_enforcement_dissolve_on:

• the numbers travel bound to their producer (SizedByStandInExtractor, this session's one-pass static extractor), to how far it was checked (10 hand-drawn rows, 1 false positive found and corrected), and to how they may be read (LowerBoundOnOrder, not a count) — DESIGN §6, name the instrument rather than transcribe its output.
• it names the authority that supersedes it: cli_run::compile_clean::compile_clean_unlisted_import_census computes the same census tree-wide with the UnlistedImportBindingSource attribution the extractor cannot produce — and has never been invoked. Its entry point was deleted, as one member of the 25-file unrostered-seed-probe sweep in Delete unrostered seed probes and orphan tests #9160, recorded as a Delete in gunbc.live_deploy.srv1_residue_rehearsal. So the burndown has never once been measured by its own authority.
• the annotation states what the next reader should do: restore reachability from an entry point that already earns its keep, not author a new bin — a new bin recreates exactly the unrostered property that got the old one swept, and unlisted_import_use_census_hand_rust_dissolve_trigger is already a standing retirement obligation on that transport.

Roughly one module in six resolves a type name it never imports, so this burndown is a prerequisite for any closure-computing tooling, not hygiene.

Third commit: the class witness, and the sizing arm sharpened

The narrowed module-grain subject went GREEN on the floor (both claims standing=planned-and-passed). The floor job is still red, for one BUDGET-REFUSED claim going undecided — test.claim.compiler_frontend_program_status_witness.a_live_milestone_row_agrees_with_its_own_folds, INTERRUPTED-BEFORE-VERDICT, unexpected_failures=0 failed=0 passed=3403. Not this diff; required-witnesses-floor is red on main's last four runs, and rust-unit-tests is red on main at this merge base with the identical single test (compiler_tests::shell_service_unmodeled_output_key_refuses, 644 passed / 1 failed both sides).

Added test.claim.undeclared_bare_type_reference_class_witness, which witnesses the class rather than one module's repair, and which no corpus closure can hold hostage. tools.multi_module_compile_fixture compiles a caller-authored manifest with no module index and no corpus roots:

• RED: a definer module and a user module naming the definer's type at a field position with no import edge → asserts UnresolvedType with a blocking row.
• Control: the same bytes plus one import line → must complete with zero diagnostics.
• The definer is present in both manifests deliberately: without it the red is satisfied by a misspelled name, which is a different and already-walled class.

read_as on the sizing observation is now OrderOnlyBothDirections, not LowerBoundOnOrder. The extractor over-reports (measured: an isolated closure containing extdeps.uri, which it flags, compiled clean) and under-reports (positions its filter does not scan; no binding-source attribution). Neither direction is bounded.

Not paid: no regen first_generation_equal receipt — there is no local gunbc binary here and the doc/mirror regen is a local-only whole-tree job. The diff touches five .dag files and no generated-artifact path; that is an argument, not a receipt, and is labelled as one.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BjBjo69owLCe6RWESLtQQf