diff --git a/src/v1/stage0/src/namespace_wave_admission.rs b/src/v1/stage0/src/namespace_wave_admission.rs index 2714c62c8d2..a7c76e30c2a 100644 --- a/src/v1/stage0/src/namespace_wave_admission.rs +++ b/src/v1/stage0/src/namespace_wave_admission.rs @@ -651,7 +651,615 @@ pub struct TransitionAdmission { /// /// THE RESTING STATE IS RESTORED: empty, and empty is not permissive -- a run with a real delta /// still refuses it as UNADJUDICATED. -pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[]; +/// FOURTH TRANSITION, SAME RULE (2026-09-02). The `ClaimSafetyOutcome` / +/// `ClaimPreemptionReachability` relocation of gunbc#10077: both types move from +/// `v2.workflow.required_floor` to `v2.workflow.floor_terminal_ledger`, beside the +/// `ClaimAttemptTerminal` arm that carries them, so the ledger stops importing the floor and the +/// cycle that blocked the wet-route migration opens. Every one of the 57 rows below is a +/// `TargetChanged` binding whose base is `v2.workflow.required_floor` and whose head is +/// `v2.workflow.floor_terminal_ledger` — verified as the ONLY shape in the report, so no row here +/// adjudicates a delta this transition did not cause. +/// +/// THEY ARE ENUMERATED BY IDENTITY, NOT MATCHED BY PATTERN. Fifty-seven deltas, fifty-seven rows, +/// each naming its module, its declaration and the exact spelling whose target moved. A wildcard +/// covering this relocation would also admit the next one nobody reviewed. +/// +/// TRIGGER: #10077 MERGING. After that, main carries the relocation, so a later run's base and head +/// both have it and no run can produce these deltas. +/// +/// THEY WILL REPORT CONSUMED, NOT STALE, AND THE ENTRY ABOVE IS WHY I AM SAYING SO. The seventeenth +/// dissolution records that its predecessor predicted "stale" and got CONSUMED, and left the wrong +/// prediction standing because the disposition is what decides WHO PAYS: a stale row matches no +/// delta, a CONSUMED row is one whose delta is already satisfied at the BASE, and only the second +/// charges its deletion to the next unrelated roster-toucher. These 57 are authored in the same PR +/// that performs the move, so once that PR is in main they are satisfied at the base of every +/// subsequent run — born consumed, exactly as the SJT-1 and DCH-1 cohorts were. +/// +/// SO THE DELETION IS OWED AND IT SHOULD NOT WAIT FOR ME. They must be removed in the first PR +/// after #10077 lands, by whoever next touches this roster, which is the convention the sweep above +/// establishes rather than a favour asked of them. Removing them early is safe and loud — an +/// unadjudicated delta refuses by name and is closed by re-authoring a row, never by a silent +/// admission — so the only dangerous direction is leaving them standing. +const LEDGER_SAFETY_VOCABULARY_LABEL: &str = + "ledger safety vocabulary relocation gunbc#10077 2026-09-02"; + +pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_both_within_their_own_limits_does_not_block", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_over_limit_claim_blocks_though_preparation_was_inside_its_envelope", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_over_limit_claim_blocks_though_preparation_was_inside_its_envelope", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_refused_preparation_blocks_though_every_claim_is_healthy", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_a_live_non_nested_compile_operation_is_still_refused", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_a_second_nested_compile_operation_is_admitted", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_completed_past_safety_limit_blocks", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_completed_past_safety_limit_blocks", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_cooperatively_pollable_is_always_admitted", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_blocks_too", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_grandfather_population_matches_the_grounded_surface", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_grandfathered_operation_is_admitted", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_new_opaque_operation_is_refused", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "ClaimAttemptTerminal", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_budget_refusal_is_a_pre_verdict_disposition_not_a_failure", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_row_carrying_a_contradictory_budget_terminal_refuses_the_ledger", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_row_carrying_a_contradictory_budget_terminal_refuses_the_ledger", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "ClaimPreemptionReachability", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "ClaimPreemptionReachability", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "floor_run_blocks", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, +]; /// The denominators a green must name (DESIGN §5): a run that cannot say what it covered is an /// instrument failure wearing coverage's clothes. diff --git a/src/v2/workflow/floor_terminal_ledger.dag b/src/v2/workflow/floor_terminal_ledger.dag index cea59466c64..90b06d3717f 100644 --- a/src/v2/workflow/floor_terminal_ledger.dag +++ b/src/v2/workflow/floor_terminal_ledger.dag @@ -9,12 +9,6 @@ import v2.workflow.floor2_prepared_subject { WitnessIdentity, witness_identity_q import v2.workflow.floor_route_gap { FloorRouteGapGround, UnpublishedMockCase, NoMockResponse, FilesystemRemoval } -import v2.workflow.required_floor { - ClaimSafetyOutcome, - CompletedPastSafetyLimit, - CompletedWithinSafetyLimits, - SafetyInterrupted -} // THE FLOOR'S TERMINAL EVIDENCE, OWNED BY v2, TO BE SERIALIZED BY THE SEED. // @@ -132,16 +126,69 @@ import v2.workflow.required_floor { // between observation and artifact where the two facts were fused back together. // // THE VOCABULARY IS IMPORTED, NOT MINTED. `FloorRouteGapGround` stays where it is and this module -// takes a dependency on it. Relocating it here was tried first and REFUSED BY ACYCLICITY: this -// module imports `required_floor`, which imports `floor_route_gap`, so moving the type would have -// closed a cycle -- and DESIGN section 4 makes acyclicity the import graph's only structural law. -// The edge already exists transitively; naming it directly adds no new dependency, only an honest -// one. A third spelling beside that authority and the seed's `v1_interpreter.HermeticEffectGround` -// mirror would be exactly the fork this widening exists to close. +// takes a dependency on it. Relocating it here was tried first and REFUSED BY ACYCLICITY, because at +// that time this module imported `required_floor`, which imports `floor_route_gap`, so moving the +// type would have closed a cycle -- and DESIGN section 4 makes acyclicity the import graph's only +// structural law. +// +// THAT PREMISE NO LONGER HOLDS AND THE CONCLUSION STILL DOES. This module no longer imports +// `required_floor` at all: the safety vocabulary moved HERE for the same acyclicity reason, which +// removed the edge. So the cycle argument above is now HISTORY rather than a live constraint, and it +// is kept because it records WHY the ground type was not relocated when that question was live. The +// ground stays in `floor_route_gap` on the independent merit that a spelling beside that authority +// and the seed's `v1_interpreter.HermeticEffectGround` mirror would be exactly the fork this +// widening exists to close -- which was always the stronger half of the reason. // // WHAT THIS DOES NOT TOUCH: `floor_route_gap` keeps its expectation type and its whole population. // What an identity is EXPECTED to gap on is a different fact from what an attempt REACHED, and // neither derives from the other, so nothing there is redundant with this arm. +// THE SAFETY VOCABULARY LIVES HERE, BESIDE THE TERMINAL THAT CARRIES IT. +// +// These two types were declared in `v2.workflow.required_floor` and imported back. That put a +// VOCABULARY inside one of its CONSUMERS: outside required_floor the family is referenced 12 times +// in this module, 12 in the wire, and 12 more across the two test modules, so the declaring module +// was not where it was used. It survived while only the floor and the ledger were involved, and +// became impossible the moment a third module needed both -- `local_repo_wet_terminal` consuming the +// shared terminal vocabulary closed `ledger -> required_floor -> local_repo_wet_terminal -> ledger`. +// DESIGN section 4 makes acyclicity the import graph's only structural law, so the relocation is the +// FORCED answer rather than a tidier one. +// +// PURE RELOCATION. No arm is added, renamed, reordered or re-payloaded; `required_floor` imports +// them back and remains a consumer, and the opaque-host-operation population stays there as policy +// over this vocabulary. + +// WHICH REACHABILITY ONE CLAIM HAS, closed and named rather than left implicit per-occurrence. +// A claim either stays inside `eval_expr`'s own poll loop for its whole duration +// (`CooperativelyPollable` -- the case the two safety limits above genuinely protect), or it +// crosses into a synchronous native `free_call.*` arm that never re-enters `eval_expr` while it +// runs (`OpaqueHostCallUnbounded`, naming the operation). These are exactly the two mechanisms +// `std.evaluation_budget` `evaluation_budget_opaque_host_call_note` and this module's own prior +// comment already described in prose; this type is what the ruling asked that prose become. +type ClaimPreemptionReachability = + CooperativelyPollable + | OpaqueHostCallUnbounded { operation: String } + +// THE THREE-WAY OUTCOME THE RULING NAMED, replacing the binary `ClaimTerminality` this module's +// prose used to describe as though a third state did not need its own arm. `SafetyInterrupted` +// is reserved for a claim the poll genuinely stopped before a verdict -- it must never be the +// label for a claim that ran to completion, however far over its limit, because "terminal" and +// "interrupted" are different facts and conflating them is exactly the relabeling this ruling +// forbids. `CompletedPastSafetyLimit` names the other terminal-but-over-limit case and carries +// its `ClaimPreemptionReachability`, so a reader can tell WHY the poll never had a chance to fire +// without re-deriving it from a comment. +type ClaimSafetyOutcome = + CompletedWithinSafetyLimits + | SafetyInterrupted { + raised_by: String + elapsed_cpu_at_least: Int + elapsed_wall_at_least: Int + } + | CompletedPastSafetyLimit { + observed_cpu: Int + observed_wall: Int + preemption: ClaimPreemptionReachability + } + type ClaimAttemptTerminal = Returned { observation: ClaimObservation } | RuntimeErrored { message: String } @@ -300,13 +347,30 @@ type TerminalLedger { // gap. The class sits at MITIGATABLE: the state is REPRESENTABLE and is caught by a check // (`ledger_green_admission` refuses a ledger carrying it), not made unwritable. Making it // unwritable by narrowing `BudgetRefused`'s carrier to the two coherent arms is REJECTED, and not -// for cost: `ClaimSafetyOutcome` is owned by `v2.workflow.required_floor` and reused here -// deliberately, so a narrowed two-arm twin declared beside it would be one concept forked by -// rigor -- §3 nicknaming -- and a fork gets consolidated later at someone else's cost. -// NEXT-RUNG TRIGGER: the safety axis declared as a family in its OWNING module, with the -// budget-bearing sub-family derived there rather than re-spelled here. At that point this arm has -// no constructor and this disposition, its refusal arm and their evidence dissolve together -// (operator ruling, 2026-08-24). +// for cost: `ClaimSafetyOutcome` is declared ABOVE IN THIS MODULE and a narrowed two-arm twin beside +// it would be one concept forked by rigor -- §3 nicknaming -- and a fork gets consolidated later at +// someone else's cost. +// +// THE OWNERSHIP SENTENCE HERE USED TO SAY `v2.workflow.required_floor` OWNS THIS TYPE. That was true +// when written and became false when the declaration moved here to open an import cycle. It is +// corrected rather than deleted because the sentence is load-bearing: it is the reason the narrowed +// twin is refused, and a reader who found it naming the wrong authority would conclude the refusal +// no longer applies. +// +// NEXT-RUNG TRIGGER, RE-ANCHORED AND NOT RETIRED. It read "the safety axis declared as a family in +// its OWNING module, with the budget-bearing sub-family derived there rather than re-spelled here". +// Every locating word in that sentence was DEICTIC -- its owning module, there, here -- so moving the +// declaration silently re-pointed it at a different module while the prose stayed readable. It did +// not become false, it became AMBIGUOUS, which is why nothing would ever have flagged it: this is the +// positional-citation failure one level up, a relative reference decaying rather than a line number. +// +// So the trigger is restated with its location EXPLICIT: the safety axis declared as a family in +// `v2.workflow.floor_terminal_ledger`, with the budget-bearing sub-family DERIVED from that family +// rather than re-spelled as a sibling coproduct. RELOCATING THE DECLARATION DOES NOT SATISFY IT -- +// the sub-family derivation is the capability, and this change performed a move, not a derivation. +// The drop stays open at MITIGATABLE. At the point the trigger is met, this arm has no constructor +// and this disposition, its refusal arm and their evidence dissolve together (operator ruling, +// 2026-08-24). type ClaimDisposition = Passed | Failed diff --git a/src/v2/workflow/required_floor.dag b/src/v2/workflow/required_floor.dag index 81852226de2..b5c9491375d 100644 --- a/src/v2/workflow/required_floor.dag +++ b/src/v2/workflow/required_floor.dag @@ -6,6 +6,21 @@ import v2.std.logic { Bool, True, False } import v2.std.integer { Int, int_gt } import v2.workflow.floor_expected_red { floor_expected_red_roster } import v2.workflow.floor_non_verdict { floor_non_verdict_roster } +// THE SAFETY VOCABULARY IS IMPORTED, NOT DECLARED HERE. `ClaimSafetyOutcome` and +// `ClaimPreemptionReachability` moved to `v2.workflow.floor_terminal_ledger`, beside the +// `ClaimAttemptTerminal` arm that carries them. They are TERMINAL VOCABULARY -- what a claim attempt +// reached -- and this module is a CONSUMER that classifies safety outcomes rather than the authority +// that defines them. Declaring them here made a vocabulary depend on one of its readers, which +// closed a cycle the moment a third module needed both; DESIGN section 4 makes acyclicity the import +// graph's only structural law, so this direction is forced rather than preferred. +// +// WHAT STAYED: the opaque-host-operation POPULATION below. That is policy declared OVER this +// vocabulary, not the vocabulary, and it is the same split `floor_route_gap` already draws between +// its ground type and its expectation roster. +import v2.workflow.floor_terminal_ledger { + ClaimSafetyOutcome, CompletedWithinSafetyLimits, SafetyInterrupted, CompletedPastSafetyLimit, + ClaimPreemptionReachability, CooperativelyPollable, OpaqueHostCallUnbounded +} import v2.workflow.floor_route_gap { floor_route_gap_roster } import v2.workflow.floor_cost_debt { floor_cost_debt_roster, floor_cost_debt_holds } import v2.workflow.local_repo_wet_terminal { local_repo_wet_schedule } @@ -779,12 +794,15 @@ fn required_floor_site_disposition( // -- they are NOT hard bounds across an opaque host operation unless that operation separately // carries a deadline-aware contract or a killable process boundary. Whichever deadline a poll // DOES observe crossing raises a genuinely terminal-before-verdict occurrence -// (`ClaimSafetyOutcome.SafetyInterrupted`, below); a claim whose cost accrues where no poll can +// (`ClaimSafetyOutcome.SafetyInterrupted`, declared in `v2.workflow.floor_terminal_ledger`); a claim +// whose cost accrues where no poll can // land instead completes and is classified `CompletedPastSafetyLimit`, which blocks identically // (`claim_safety_outcome_blocks`) but is never mislabeled as an interrupt it did not receive. The -// typed model -- `ClaimPreemptionReachability`, `ClaimSafetyOutcome`, `claim_safety_outcome`, -// `claim_safety_outcome_blocks`, the migration wall, and the §4b rung drop -- is declared further -// down this file rather than described here in prose a second time; the measured receipt behind +// typed model is declared rather than described here in prose a second time, and it now spans TWO +// modules: the VOCABULARY -- `ClaimPreemptionReachability` and `ClaimSafetyOutcome` -- lives in +// `v2.workflow.floor_terminal_ledger` beside the terminal that carries it, while the CLASSIFICATION +// over it -- `claim_safety_outcome`, `claim_safety_outcome_blocks`, the migration wall and the §4b +// rung drop -- stays in this module, which is the consumer. The measured receipt behind // it (floor run 32301212975, `root_d_checkpoint_scalar_declared_arity_witness_holds` reaching a // verdict at 60317ms CPU against this module's 5000ms `required_floor_claim_cpu_safety_limit_ms`, // twelve times over and uninterrupted, not a first occurrence -- 2792-2855ms isolated per @@ -994,16 +1012,6 @@ fn required_floor_claim_wall_safety_limit_ms() -> Int { // a deadline-aware contract or a killable process boundary -- neither of which // `compile_dag_rust_emit_check` has today. -// WHICH REACHABILITY ONE CLAIM HAS, closed and named rather than left implicit per-occurrence. -// A claim either stays inside `eval_expr`'s own poll loop for its whole duration -// (`CooperativelyPollable` -- the case the two safety limits above genuinely protect), or it -// crosses into a synchronous native `free_call.*` arm that never re-enters `eval_expr` while it -// runs (`OpaqueHostCallUnbounded`, naming the operation). These are exactly the two mechanisms -// `std.evaluation_budget` `evaluation_budget_opaque_host_call_note` and this module's own prior -// comment already described in prose; this type is what the ruling asked that prose become. -type ClaimPreemptionReachability = - CooperativelyPollable - | OpaqueHostCallUnbounded { operation: String } // THE POPULATION OF OPAQUE HOST OPERATIONS THE PREEMPTION-1 RUNG DROP IS DECLARED OVER, AND IT // IS EIGHT MEMBERS RATHER THAN ONE. CORRECTED 2026-09-02; the correction is a rung-honesty repair, @@ -1132,26 +1140,6 @@ fn claim_preemption_admission(preemption: ClaimPreemptionReachability) -> Bool { } } -// THE THREE-WAY OUTCOME THE RULING NAMED, replacing the binary `ClaimTerminality` this module's -// prose used to describe as though a third state did not need its own arm. `SafetyInterrupted` -// is reserved for a claim the poll genuinely stopped before a verdict -- it must never be the -// label for a claim that ran to completion, however far over its limit, because "terminal" and -// "interrupted" are different facts and conflating them is exactly the relabeling this ruling -// forbids. `CompletedPastSafetyLimit` names the other terminal-but-over-limit case and carries -// its `ClaimPreemptionReachability`, so a reader can tell WHY the poll never had a chance to fire -// without re-deriving it from a comment. -type ClaimSafetyOutcome = - CompletedWithinSafetyLimits - | SafetyInterrupted { - raised_by: String - elapsed_cpu_at_least: Int - elapsed_wall_at_least: Int - } - | CompletedPastSafetyLimit { - observed_cpu: Int - observed_wall: Int - preemption: ClaimPreemptionReachability - } // FLAT-SCALAR MILLISECOND FIELDS, DECLARED AS A BOUNDED GAP RATHER THAN SILENTLY LEFT (review // 53860 on gunbc#8584, BLOCKING on `observed_cpu_ms`/`observed_wall_ms`/`cpu_limit_ms`/