std.pareto: a candidate that declares a gap is not eligible to be shown dominating

[gunbai-bot]

The defect

compare_pair answered the dominance question from readings alone and never read missing_inputs, while challenger_applies — twenty lines away in the same file — excluded exactly those challengers from the field fold. Two answers to one question, and the exported one was the permissive arm.

Found while migrating a private consumer onto #9959's interval evidence, and measured there rather than reasoned about: a board declaring unproven supply depth was reported by compare_pair as dominating a peer at the low memory price, while entry_standing reported that same candidate NotComputable. Any caller reaching the pair API directly — which is exported — got a dominance verdict from a candidate whose own standing says its inputs are incomplete.

This is the same class as the pair_dominates deletion this file already carries, one layer out: a pair-level answer that outruns its evidence. That tombstone says "the standing path is the only path, and a caller that wants a Boolean must first say what it intends to do about a refusal" — but compare_pair itself still let a caller skip the gap question entirely.

The shape

PairEvidenceIncomplete is its own arm, deliberately neither of the two it sits between. A candidate that declares a gap has not been shown not to dominate — nothing was shown about it at all — and it is not malformed either, since declaring your missing inputs is the honest behaviour this spine asks for. The cause names the entry and its obligations, so a caller learns what would make the question answerable. Both operands are gated: an entry that cannot be evaluated cannot be shown dominated either.

challenger_applies is now the self-comparison guard alone. The eligibility rule lives in compare_pair, and the field fold derives its behaviour from the arm rather than restating it — one authority, and entry_standing's observable behaviour is unchanged.

Evidence

entry_gap_but_best is a new fixture that beats every other entry on both funded axes and declares an outstanding quote, so readings and declaration point in opposite directions — the only case on which a silent gate can be caught.

mutation	result
gate disabled entirely	both new controls red
gate off here, rule restored in challenger_applies (the old shape)	pair control red, standing control green

That second row is exactly the pre-cut world, and it is the point: the standing path was always right; the pair API was the liar.

The existing fixture entry_quote_pending could not have caught this — it declares a gap but is the worst entry on power (that axis is HigherIsBetter), so it could never dominate anything whatever the gate did. Reaching for it would have produced a control that passes in both worlds.

Checks

• 12/12 controls green in pareto_selection_witness_test.
• Stage0 mirror regenerated, first_generation_equal=true (verified before merging main; the two files drifting locally afterwards are Nat/i64 churn from Preserve authored identity on resolved type-reference leaves #10046 against a stale local binary, in files this PR does not touch — CI regenerates with a current compiler).
• cargo clippy --all-targets -- -D warnings green; cargo test --release -p v1-compiler --lib green. Both remote, with the must-fail control run to prove the compiler was actually reached.

Sequencing

Independent of private #33 and of the queued axis-scoped-gap cut. It does not change ParetoEntry.missing_inputs' shape — it reads it — and no private consumer calls compare_pair any more, so there is no cross-repo churn. #33 remains the priority.

🤖 Generated with Claude Code

https://claude.ai/code/session_019LhF5WCbZqrZHPqsnjpkYu

[gunbai-bot]

Fixed in 090f1315. review 58743 was right, and the precedence argument is stronger than "add a check": this file had already settled it and I broke it one layer down.

entry_contradicts_its_declaration exempts an absent reading when the entry declares its gaps, and pointedly does not exempt a duplicate — its own comment says two readings on one axis identity is malformed evidence whatever else the entry declares, because the spine would have to pick one. My gate returned before any reading was examined, so that ordering held at the standing layer and inverted at the pair layer. compare_pair now mirrors it: duplicates refuse first, then the gap gate, then the fold.

The two facts differ in kind, which is the ordering argument rather than a convention: a declared gap is an honest statement about the world and this spine asks for it; a duplicate reading is a bug in the projector, and no declaration excuses a bug.

On the combined witness — it already existed. entry_gap_and_duplicate and a_declared_gap_does_not_excuse_a_duplicate_reading have been in this file, at the standing layer. What was missing was any control at the pair layer, which is exactly why the regression landed unseen. So the new control reuses that same fixture rather than minting a second: the two are one claim asked at two layers, and separate fixtures could drift apart.

Verified by mutation: restoring the gap-gate-first order turns duplicate_outranks_gap red and leaves the other twelve green.

On the CI red at 7b0b9da: the floor reports failed=0, with 14 claims INTERRUPTED-BEFORE-VERDICT raised_by=cpu_deadline in self_host_compile_phase_live_gate_witness — unrelated to this diff, and both changed pareto witnesses report planned-and-passed. The lane's own aggregate step says a lane failure alone does not establish that its subject was evaluated. I have not treated it as a defect in this change; the fresh run on 090f1315 will say whether it recurs.

— sent from fierce-ant-136

[briansrls]

Exact-head review at 090f13158b36192d39fb1c1d7ccf4ccd1954826d: REQUEST_CHANGES.

The central correction is right: PairEvidenceIncomplete is distinct from PairNoDominance and PairRefused; both operands are gated; and the field fold now derives challenger eligibility from the typed pair result instead of restating the missing-input rule in challenger_applies. The duplicate-reading-before-gap repair from review 58743 is also necessary.

One precedence hole remains. duplicate_reading_causes pre-scans only duplicated readings. A complete entry that lacks a funded-axis reading is also malformed projector evidence, and the standing path already gives that contradiction precedence over an honest gap elsewhere in the field. The pair path still does not.

Concrete counterexample using existing fixtures: compare entry_gap_but_best (or entry_quote_pending) with entry_reading_hole. One operand honestly declares a gap; the other declares complete inputs but lacks the power reading. Current compare_pair sees no duplicate, sees the honest gap, and returns PairEvidenceIncomplete before the axis fold can discover the unexplained absence. entry_standing over the same entries instead reaches SelectionRefused, because field_contradictions catches the complete-but-absent reading before subject incompleteness. The PR therefore still leaves two answers to the same pair question, and malformed evidence is again wearing the report of honest incompleteness.

Factor one projector-contradiction helper and use it in both paths. For each entry and funded axis: ReadingDuplicated is always a contradiction; ReadingAbsent is a contradiction exactly when that entry declares no missing inputs; ReadingFound is clean. compare_pair must collect those contradictions from both operands before declared_gap_cause, then apply the gap gate, then run the comparison fold. field_contradictions should consume the same helper rather than preserve a second spelling of the rule.

Add a pair-layer control using the existing gap and reading-hole fixtures in both operand directions. It must require PairRefused; restoring the current duplicate-only pre-scan must make it fail.

The completed run 33643094074 is accepted as green on its checked merge candidate, but it is not a current landing receipt: that candidate's first parent was a425a822, and public main has since moved through compiler, emitted-seed, and required-floor changes. After the source repair, regenerate std_pareto.rs from the composed authority and obtain fresh exact-head CI against then-current main.

Do not merge 090f1315.

[briansrls]

Exact-current-head follow-up at 93653d20e3950d943622b08c13e3f4e3a8291ee3.

The source finding from review 5091604216 is closed.

Deleting duplicate_reading_causes is better than adding another shared projector function. compare_pair and field_contradictions now consume the same entry_contradicts_its_declaration authority, so duplicate readings and complete-but-absent funded readings are classified once. compare_pair performs that contradiction scan over both operands before the honest-gap gate; the required precedence therefore follows from one reader instead of being restated.

an_honest_gap_does_not_mask_a_contradiction_on_the_other_side is the correct permanent discriminator. It uses the complete-but-absent fixture rather than another duplicate fixture, checks both operand positions, is enrolled in the executed witness entrypoint, and fails under the old duplicate-only pre-scan while the duplicate controls remain green. That is exactly the missing observation from the prior head.

The branch has moved beyond the reported 2cd253ee109: current head 93653d20e395 is a merge of current public main into the feature. The intervening main-only commits do not modify this PR's three files, so the accepted repair is unchanged in the current composition.

This is source acceptance, not landing approval yet. Workflow run 33655924913 for exact head 93653d20e395 is still pending, with no terminal jobs or verdict. The prior green receipt belongs to a superseded composition. Keep the PR open and do not merge until the exact-current-head run is terminal SUCCESS; if the branch moves again, the receipt must bind that newer head.

No additional source change is presently requested on #10066.

[briansrls]

Exact-head review at 93653d20e3950d943622b08c13e3f4e3a8291ee3: REQUEST_CHANGES.

The repair reported at 2cd253ee109 is accepted in substance. Deleting duplicate_reading_causes was stronger than adding another projector check: compare_pair and field_contradictions now consume the same entry_contradicts_its_declaration authority, so complete-but-absent evidence and duplicated evidence have one definition. The resulting precedence is correct: projector contradiction before honest declared incompleteness before ordinary comparison. The new two-order entry_reading_hole × entry_gap_but_best control is permanent and discriminating; restoring the weaker duplicate-only pre-scan makes that control fail while the duplicate-only controls can remain green, which is exactly the blind spot it claims to own.

One instance of the same pair/field authority split remains: duplicate axis identities.

entry_standing calls axes_have_duplicate_identity and returns SelectionRefused before deriving any standing. Exported compare_pair does not validate the axis roster. With the existing fixtures,

compare_pair(
  a: entry_cheap_strong,
  b: entry_dear_weak,
  axes: duplicated_axes,
)

returns ordinary PairNoDominance: the first cost row says Better, the same cost identity repeated under the opposite goal says Worse, and the power row says Better; no refusal is recorded. entry_standing over that same axis roster returns SelectionRefused. Thus the direct pair path and field path still answer differently about the same malformed selection input.

The existing witness_duplicate_axis_identity_refuses does not close this. It exercises only entry_standing, so removing—or never adding—the pair-layer guard leaves it green.

Use one axis-roster contradiction authority in both paths. compare_pair must return PairRefused for a duplicated axis identity before entry contradictions, declared gaps, or the axis fold; entry_standing should consume that same authority rather than retain a separate Boolean spelling. Add a direct pair-layer control using duplicated_axes and require PairRefused. Removing the pair guard must make that new control red while the existing standing-path control remains green.

The exact-head witnesses run 33655924913 is still nonterminal. Its eventual success cannot close this source split; after the repair, regenerate std_pareto.rs and obtain fresh exact-head CI on the then-current composition.

Do not merge 93653d20e3950d943622b08c13e3f4e3a8291ee3.

[gunbai-bot]

The failing lane on 93653d20e is inherited from main, not introduced here, and I am deliberately not pushing a fix for it. Measured rather than inferred:

	main@b74191516	this PR @93653d20e
failed=	0	0
passed=	3406	3419
interrupted_before_verdict=	6	2
interrupted_cpu_deadline=	6	2
interrupted module	self_host_compile_phase_live_gate_witness	same
verdict	FloorRefused unexpected_failures=0	same

main fails the identical two jobs (required-witnesses-floor, witnesses) with none of this branch in it, and this branch's own pre-merge head 2cd253ee1 passed the lane — the failure appeared only when I merged main in. On both sides failed=0 and unexpected_failures=0: no semantic claim failed. The FloorRefused verdict comes entirely from rows preempted at cpu_at_least=501ms/500ms, one millisecond over a CPU ceiling, before reaching a verdict.

Two ways to clear the check that I am refusing:

Re-running until green. This is a boundary flake — ab4e3a4a passed repeatedly, b74191516 failed twice, and this head drew 2 interruptions where main drew 6. A re-run would probably pass. That converts "a witness never reached a verdict" into a green mark asserting it did. A non-verdict must stay blocking while being distinguished from a judged failure; rolling the dice erases exactly that distinction.

Tuning self_host_compile_phase_live_gate_witness under its budget. Not this PR's lane and not its defect. Editing another module's CPU budget to unblock my merge is a widen where a refusal belongs.

The remedy the diagnostic itself names is upstream: reduce the row's cost, or move it to a lane declaring its own ceiling. Until then this check is red for a real reason and should block.

Source state is unaffected: one approval on this exact head (review 58808), no outstanding request-changes, and the review finding that opened this round — an honest declared gap masking a complete-but-absent reading on the other operand — is closed by deleting the second authority rather than patching it, with a both-directions control whose killing mutation reds it and only it.

— sent from fierce-ant-136

[briansrls]

Exact-head source review at live PR head 96babf4997da5c225df6066d736f0b351189c0e7 (the SHA in the handoff, 96babf4997dcc..., is not the live PR head): REQUEST_CHANGES.

The axis-roster split is closed in the important structural sense. Deleting axes_have_duplicate_identity, replacing it with the cause-carrying axis_roster_contradiction, and making both compare_pair and entry_standing consume that one authority is the right construction. compare_pair consults it before entry contradictions, declared incompleteness, and the ordinary axis fold, so the intended malformed > incomplete > comparison precedence now holds. The generated mirror reflects the same shape.

One narrower defect remains in the new authority itself: axis_roster_contradiction emits a cause once per axis occurrence, not once per duplicated identity. With the existing duplicated_axes roster, both rows sharing axis_cost_id satisfy count_axis_identity(...) > 1, so the exact same diagnostic is appended twice. A triple duplicate produces the same cause three times. Both public entry points now agree, but they agree on a diagnostic that overstates one structural defect as several. This is the same diagnostic-cardinality class already repaired in #9959 when one contradiction was named twice.

The new control only requires a nonempty PairRefused and agreement with entry_standing, so it cannot distinguish one accurately named duplicate identity from the current repeated sentence. Make the authority emit one cause per unique duplicated identity. Permanently discriminate at least:

• one duplicated identity appearing twice => exactly one located cause;
• two different duplicated identities => exactly two causes, one per identity;
• restoring per-occurrence emission makes the control fail.

Then regenerate std_pareto.rs and obtain fresh exact-head CI.

On the requested sweep: I do not find a fourth pair/standing authority split in field_has_duplicate_identity or sensitivities. Field identity is a property of a population, and compare_pair has only two operands; it cannot census duplicate membership in a field. Treating equal operand identities as malformed would also conflate an intentional self-comparison with two duplicate field members unless a separate distinct-operands contract is introduced. sensitivities are attached only to a successful ProvisionallyNonDominated standing and do not participate in pair comparison, eligibility, or refusal, so their absence from compare_pair is not a second answer.

The required-floor non-verdict remains an instrument result, not a source finding against this PR. No reroll is requested while this source correction is owed.

[gunbai-bot]

Floor lane red again on 96babf4 — measured, and it is again not this diff. But my earlier framing of this failure was too narrow and I want to correct it rather than repeat it.

failed=0   unexpected_failures=0   passed=3431
interrupted_before_verdict=2   interrupted_cpu_deadline=2

v2.test.emit.produced_decl_two_target.produced_decl_module_folds_declarations_in_order  526ms/500ms
v2.test.emit.produced_decl_two_target.produced_decl_two_targets_render_own_order        508ms/500ms

Nothing in this branch reaches v2.test.emit, no semantic claim failed, and this PR's own new controls passed as changed witnesses — including a_duplicated_axis_roster_refuses_the_pair_too.

The correction: I previously called this "inherited from main@b74191516", which fitted the evidence then — main failed the identical two jobs with none of this branch in it. That comparison no longer holds: main's most recent witnesses run (33673806092 at 630645246) passed. So "main is red, therefore not mine" was never the right test, and I am withdrawing it as a standing argument.

What the evidence actually supports is stronger and less convenient: the victims move. The first occurrence was six rows in self_host_compile_phase_live_gate_witness; this one is two rows in a different module entirely. Both times failed=0. This is not one broken module — it is a population of rows sitting close enough to the 500ms CPU ceiling that runner load decides which ones get preempted. main passing one run and a branch failing the next is the same coin landing differently, not a difference between the trees.

Two things follow that matter beyond this PR.

The preempted rows are not neutral. In the first occurrence the two rows killed by the deadline were that module's discriminating REDs — a_live_tree_that_gained_an_identity_refuses_and_names_it and a_live_tree_that_swapped_an_identity_at_equal_cardinality_refuses. The deadline was not slowing a witness down, it was silencing the two controls that witness exists for, and the floor was right to refuse. So this class does not merely produce undecided rows; it can suppress refusals, which is why re-running until it goes green would be worse than leaving it red.

This particular instance cannot be fixed by the mechanism that fixed the first one. A shared-derivation roster row removed the live-gate cluster entirely (measured: run CPU 110998ms -> 93110ms, cpu_deadline 2 -> 0, those two REDs restored to executing). produced_decl_two_target is in the emit family, which that roster's header excludes on a measured serve-above-recompute result with a capability trigger. It is gated on that capability, not on another roster row.

I am still not re-running this to green, for the same reason as before, now better supported: a green mark would assert those rows reached a verdict when they did not.

— sent from fierce-ant-136

[briansrls]

Exact-live-head review at c12cf966ce359df8511ce03a715f00868994ece5 (the SHA in the handoff has the right prefix but a non-live tail): REQUEST_CHANGES.

The cause-cardinality repair is accepted. AxisScan carries structural identities already named, so one duplicated identity contributes one cause regardless of two or three occurrences, and the strengthened [A,A] / [A,A,A] / [A,A,B,B] / [A,B] control is the right discriminator. Reverting the identity-equality PairRefused arm is also correct: duplicate candidate identity is a property of a field population, and an intentional self-comparison must not be refused.

One narrower defect remains: the current source only deletes the wrong self-comparison answer; it does not construct the right answer its new comment and commit message claim. compare_pair now has no identity-equality arm. For two point-identical payloads the axis fold happens to reach PairNoDominance, but that result is not stable under the evidence carrier:

• a candidate with a clean wide reading such as [10,20], compared with itself, reaches UndecidedOnEvidence because identical wide intervals correctly do not establish equality between two independently-valued subjects; current compare_pair(x, x) therefore returns PairPendingEvidence, not PairNoDominance;
• two complete payloads carrying one candidate identity but different exact readings can return PairDominates, so the exported pair API can still say one structural candidate dominates itself.

Identity equality is not evidence of a duplicated field, but it is proof that the relation is a self-comparison. Preserve malformed-query precedence: admit the axis roster and reject any entry projector contradiction first. Then, before the declared-gap and ordinary axis-evidence folds, short-circuit equal candidate identities to PairNoDominance. Do not restore the refusal, and keep field_has_duplicate_identity field-only.

Add one permanent control with three cases:

1. one candidate with a wide interval compared with itself => PairNoDominance;
2. two complete payloads sharing one identity but carrying different readings => PairNoDominance;
3. those two rows placed together in one field => SelectionRefused.

Both the intermediate refusal implementation and the current fall-through implementation must fail that control. Regenerate std_pareto.rs and obtain fresh exact-head CI.

Run 33683379804 is still in progress and will be superseded by the source edit. Do not merge the current head.

[briansrls]

Follow-up on exact head c12cf966ce359df8511ce03a715f00868994ece5: one correction to my permanent-control prescription in review 5095265887.

The three self-relation cases there are necessary but not sufficient to pin the required precedence. A mutant that moves the equal-identity short-circuit to the top of compare_pair would satisfy all three while laundering malformed evidence into PairNoDominance.

The control must therefore also exercise the self relation under malformed input:

• equal candidate identity + duplicated axis roster => PairRefused;
• equal candidate identity + projector contradiction (duplicate reading, or complete-but-absent funded reading) => PairRefused.

Those cases pin the intended order:

axis-roster contradiction > entry/projector contradiction > self relation > honestly declared gap > ordinary pair evidence.

Killing mutations the permanent control must reject are now four distinct shapes: (1) restore the fail-shut equal-identity PairRefused; (2) leave the current fall-through, which yields pending/dominance on wide/divergent same-identity payloads; (3) short-circuit equal identity before axis-roster admission; (4) short-circuit equal identity before projector admission.

No extra semantic surface is being added: field_has_duplicate_identity remains field-only. This only makes the exported pair relation structurally irreflexive without letting that relation mask malformed query evidence.

[briansrls]

Exact-head review at 2ed233a54da980792d831d012bc069db4e56e130: REQUEST_CHANGES, narrowly on the permanent discriminator.

The source repair itself is correct. compare_pair now admits malformed query structure first (axis-roster contradiction, then either operand's projector contradiction), constructs equal candidate identity as PairNoDominance, then consults declared gaps, then folds axis evidence. This closes both concrete self-comparison failures from the prior head without reintroducing the field-population refusal. field_has_duplicate_identity correctly remains field-only.

The new control is not yet strong enough for the invariant the source now states. a_subject_does_not_dominate_itself carries only three cases: wide self-comparison, same-identity/different-readings, and duplicate identity placed in a field. Those kill the two prior implementations, but they do not kill precedence regressions.

Two mutations currently survive all three cases:

1. move the identity-equality PairNoDominance arm ahead of axis_roster_contradiction / entry_contradicts_its_declaration; malformed self-comparisons are then laundered into PairNoDominance while the control stays green;
2. move identity equality below declared_gap_cause; a clean gapped entry compared with itself then becomes PairEvidenceIncomplete, contradicting the new source claim that a gap cannot make a subject fail to tie with itself, while all three current cases stay green.

Extend the same permanent control to pin the whole ordering it claims:

• clean wide x vs x => PairNoDominance;
• same identity, differing complete readings => PairNoDominance;
• same identity in two field positions => SelectionRefused;
• clean self-comparison under duplicated_axes => PairRefused;
• a projector-malformed row compared with itself (existing entry_reading_hole or entry_double_reading) => PairRefused;
• a clean honestly-gapped row compared with itself (existing entry_gap_but_best) => PairNoDominance.

The first three prove the relation answer; the next two prove malformed-query > self; the last proves self > honest incompleteness. Each boundary in the source precedence is then executable rather than prose.

No std.pareto semantic change is requested on this head; this is a witness-strengthening change. The in-flight exact-head run 33687465230 belongs to the current weaker-control head and will be superseded by that witness edit.

Do not merge 2ed233a54da980792d831d012bc069db4e56e130.

[gunbai-bot]

Floor red on 2ed233a. Measured, not inferred: failed=0, passed=3432, interrupted_before_verdict=3, zero pareto rows affected.

self_host_compile_phase_frontier_witness.current_persisted_compile_phase_frontier_holds    504ms/500ms
self_host_compile_phase_live_gate_witness.a_live_tree_that_removed_an_identity_holds       505ms/500ms
self_host_compile_phase_live_gate_witness.a_measurement_that_never_reached_cargo_...       501ms/500ms

This branch now has five heads, none of which touch the affected modules:

head	floor
2cd253ee1	pass
93653d20e	fail
96babf499	fail
c12cf966c	pass (fully green, every lane)
2ed233a54	fail

Same tree, same modules, alternating outcomes — and across three different module sets now (live_gate, then v2.test.emit.produced_decl_two_target, now frontier_witness + live_gate). That holds the tree constant, which makes it a better instrument than the comparison against main I withdrew earlier in this PR.

So the class is a population of rows sitting close enough to the 500ms CPU ceiling that runner load decides which ones get preempted, not a defect in any one module and not this diff.

Two of the three rows above are in the module that #10114 fixes — that PR measured cpu_deadline 2 -> 0 on a controlled pair by removing a shared fold those rows were each re-running. It is verified ready and unlanded.

I am not re-running this to green. c12cf966 went fully green with no relevant source difference, so a re-run is a coin flip — and in the first occurrence of this class the preempted rows were a module's discriminating REDs (a_live_tree_that_gained_an_identity_refuses_and_names_it, a_live_tree_that_swapped_an_identity_at_equal_cardinality_refuses). A green mark obtained by re-rolling would assert those rows reached a verdict when they did not, and would hide a class capable of silencing refusals.

Separately, review 58947 is being addressed by a source edit (the quadratic fold in axis_roster_contradiction), which supersedes this run regardless.

— sent from fierce-ant-136

[briansrls]

Exact-head source/witness review at live PR head f2d5d4dff0d1ecf589af18f2d06475a3be6b5ad4: SOURCE APPROVED; LANDING HOLD pending terminal exact-head CI.

The precedence-control finding from review 5095502958 is closed. This commit is test-only: only dag/test/claim/pareto_selection_witness_test.dag moves; std.pareto and the generated mirror are unchanged.

a_subject_does_not_dominate_itself now owns the full order it describes, not just the self-relation answer. The six observations discriminate: wide self -> PairNoDominance; same identity/different readings -> PairNoDominance; duplicate identity in a field -> SelectionRefused; self under duplicated axes -> PairRefused; projector-malformed self -> PairRefused; honestly-gapped self -> PairNoDominance. Those pin malformed axis roster > malformed projector > self relation > honest gap > evidence fold.

The five named killing mutations are the right set: restore the equal-identity refusal, remove the identity arm, hoist self above axis admission, hoist self above projector admission, and move self below the declared-gap gate. The last three each cross one stated precedence boundary; none is now prose-only.

I also accept the process correction: a mutation that failed to apply and produced no red is no evidence. Recasting the axis mutation as a minimal condition edit with the same observable semantic fault is the right falsifier shape.

No further source or witness change is requested on this head.

This APPROVE clears my superseded CHANGES_REQUESTED state; it is not merge authorization yet. Workflow run 33691767100 for this exact head is still in progress. Do not merge until I issue an explicit landing approval after terminal CI and the normal forward-delta adjudication if public main moves materially.

[gunbai-bot]

Materiality adjudication of public main's forward movement

Under the composition rule banked on gunbc-private#33 — pin the public revision actually TESTED, then adjudicate the net forward delta for materiality, rather than demanding a fresh 42-minute run for byte-currency at merge.

Tested base: ab4e3a4ac4da8a939e5448bb90d03754c066b5fc. Forward delta: 31 commits.

Path overlap: none. This PR touches dag/std/pareto.dag, dag/test/claim/pareto_selection_witness_test.dag, src/v1/stage0/src/std_pareto.rs. No commit in the delta touches any of the three, and none touches a pareto- or selection-named file.

Path disjointness is not the argument, though, so I looked for semantic reach. Two candidates:

1. behavioral_receipt_host.rs (#10086 region) names std.pareto five times. This is the one that could have bitten: it parses std.pareto and reports per-declaration shape, so my edits change what it sees. Every one of those sites is an eprintln! in the receipt census — CHILDSHAPE and SHAPE diagnostic lines using std.pareto as a convenient specimen. No assertion, no count comparison, no oracle. It prints differently after this PR and passes identically. It does not reference pair_dominates or on_pareto_front, the two symbols this PR deletes.

2. The floor harness moved — required_floor.dag, required_floor_runner, claim_executor, witness_floor_workflow — which is the harness my new controls execute under, so a new refusal arm there would be material regardless of path. Reading the delta: it is additive measurement (eval_steps netted against shared-artifact fills, #10030) plus a clippy roster replacing a crate-root blanket allow (#10073). No new refusal condition, no changed verdict composition.

And #10133 moves the floor in the safe direction for this PR specifically: it cuts the compile-phase frontier standing so three required-floor witness modules stop crossing the 500 ms CPU ceiling. That reduces the preemption exposure I have been reporting on this PR; it does not create any.

Verdict: non-material. I am not requesting another full run to re-establish byte-currency.

Exact-head status on f2d5d4dff0d1ecf589af18f2d06475a3be6b5ad4: required-witnesses-build pass, required-witnesses-floor pass, rust-unit-tests pass. The floor lane's summary carries unexpected_failures=0 with two rows interrupted at the CPU ceiling before reaching a verdict — the class documented on this PR. As stated earlier, I am not re-rolling to clear that mark: a green obtained by re-rolling would assert those rows reached a verdict when they did not, and would hide a class capable of silencing refusals.

— sent from fierce-ant-136

[briansrls]

LANDING APPROVED on exact head f2d5d4dff0d1ecf589af18f2d06475a3be6b5ad4.

The final hold is discharged.

• Workflow run 33691767100 is terminal SUCCESS on this exact head. Its six jobs are all terminal: required-witnesses-build, required-witnesses-floor, rust-unit-tests, fabric-evidence, and aggregate witnesses succeeded; emit-copy-qualification-battery was skipped by its own condition.
• The forward-composition census is complete through current public main@7c7bfb49c0c3fdc806f6f0ddb48492a31bd40008. GitHub reports exactly 31 commits from tested base ab4e3a4ac4da8a939e5448bb90d03754c066b5fc to that current tip, matching the PR's materiality adjudication. There is no unadjudicated tail.
• I accept that adjudication as non-material to #10066's semantic/import/generated-output/acceptance closure. The std.pareto receipt-census reader is observational only; the floor-harness changes are additive measurement / clippy-roster work with no new refusal or verdict-composition rule, and #10133 reduces rather than increases this PR's preemption exposure.
• The stale Codex review is not a landing prerequisite: it is against a superseded head and is not an adverse current-head finding.

The earlier source/witness approval remains valid. No rerun for byte-currency is owed under the banked composition rule. Later neutral public movement does not revoke this approval; later material movement would.

You may merge #10066 at this exact head.