From 1ac6b000a01595e8d2c71e5ee9207ba3fd94e3eb Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Wed, 2 Sep 2026 14:31:39 +0000 Subject: [PATCH 1/4] merge main + relocate the safety vocabulary onto the widened ledger --- src/v2/workflow/floor_terminal_ledger.dag | 53 ++++++++++++++++++--- src/v2/workflow/required_floor.dag | 56 +++++++++-------------- 2 files changed, 69 insertions(+), 40 deletions(-) diff --git a/src/v2/workflow/floor_terminal_ledger.dag b/src/v2/workflow/floor_terminal_ledger.dag index cea59466c64..d440b9c085e 100644 --- a/src/v2/workflow/floor_terminal_ledger.dag +++ b/src/v2/workflow/floor_terminal_ledger.dag @@ -9,12 +9,6 @@ import v2.workflow.floor2_prepared_subject { WitnessIdentity, witness_identity_q import v2.workflow.floor_route_gap { FloorRouteGapGround, UnpublishedMockCase, NoMockResponse, FilesystemRemoval } -import v2.workflow.required_floor { - ClaimSafetyOutcome, - CompletedPastSafetyLimit, - CompletedWithinSafetyLimits, - SafetyInterrupted -} // THE FLOOR'S TERMINAL EVIDENCE, OWNED BY v2, TO BE SERIALIZED BY THE SEED. // @@ -142,6 +136,53 @@ import v2.workflow.required_floor { // WHAT THIS DOES NOT TOUCH: `floor_route_gap` keeps its expectation type and its whole population. // What an identity is EXPECTED to gap on is a different fact from what an attempt REACHED, and // neither derives from the other, so nothing there is redundant with this arm. +// THE SAFETY VOCABULARY LIVES HERE, BESIDE THE TERMINAL THAT CARRIES IT. +// +// These two types were declared in `v2.workflow.required_floor` and imported back. That put a +// VOCABULARY inside one of its CONSUMERS: outside required_floor the family is referenced 12 times +// in this module, 12 in the wire, and 12 more across the two test modules, so the declaring module +// was not where it was used. It survived while only the floor and the ledger were involved, and +// became impossible the moment a third module needed both -- `local_repo_wet_terminal` consuming the +// shared terminal vocabulary closed `ledger -> required_floor -> local_repo_wet_terminal -> ledger`. +// DESIGN section 4 makes acyclicity the import graph's only structural law, so the relocation is the +// FORCED answer rather than a tidier one. +// +// PURE RELOCATION. No arm is added, renamed, reordered or re-payloaded; `required_floor` imports +// them back and remains a consumer, and the opaque-host-operation population stays there as policy +// over this vocabulary. + +// WHICH REACHABILITY ONE CLAIM HAS, closed and named rather than left implicit per-occurrence. +// A claim either stays inside `eval_expr`'s own poll loop for its whole duration +// (`CooperativelyPollable` -- the case the two safety limits above genuinely protect), or it +// crosses into a synchronous native `free_call.*` arm that never re-enters `eval_expr` while it +// runs (`OpaqueHostCallUnbounded`, naming the operation). These are exactly the two mechanisms +// `std.evaluation_budget` `evaluation_budget_opaque_host_call_note` and this module's own prior +// comment already described in prose; this type is what the ruling asked that prose become. +type ClaimPreemptionReachability = + CooperativelyPollable + | OpaqueHostCallUnbounded { operation: String } + +// THE THREE-WAY OUTCOME THE RULING NAMED, replacing the binary `ClaimTerminality` this module's +// prose used to describe as though a third state did not need its own arm. `SafetyInterrupted` +// is reserved for a claim the poll genuinely stopped before a verdict -- it must never be the +// label for a claim that ran to completion, however far over its limit, because "terminal" and +// "interrupted" are different facts and conflating them is exactly the relabeling this ruling +// forbids. `CompletedPastSafetyLimit` names the other terminal-but-over-limit case and carries +// its `ClaimPreemptionReachability`, so a reader can tell WHY the poll never had a chance to fire +// without re-deriving it from a comment. +type ClaimSafetyOutcome = + CompletedWithinSafetyLimits + | SafetyInterrupted { + raised_by: String + elapsed_cpu_at_least: Int + elapsed_wall_at_least: Int + } + | CompletedPastSafetyLimit { + observed_cpu: Int + observed_wall: Int + preemption: ClaimPreemptionReachability + } + type ClaimAttemptTerminal = Returned { observation: ClaimObservation } | RuntimeErrored { message: String } diff --git a/src/v2/workflow/required_floor.dag b/src/v2/workflow/required_floor.dag index 81852226de2..b5c9491375d 100644 --- a/src/v2/workflow/required_floor.dag +++ b/src/v2/workflow/required_floor.dag @@ -6,6 +6,21 @@ import v2.std.logic { Bool, True, False } import v2.std.integer { Int, int_gt } import v2.workflow.floor_expected_red { floor_expected_red_roster } import v2.workflow.floor_non_verdict { floor_non_verdict_roster } +// THE SAFETY VOCABULARY IS IMPORTED, NOT DECLARED HERE. `ClaimSafetyOutcome` and +// `ClaimPreemptionReachability` moved to `v2.workflow.floor_terminal_ledger`, beside the +// `ClaimAttemptTerminal` arm that carries them. They are TERMINAL VOCABULARY -- what a claim attempt +// reached -- and this module is a CONSUMER that classifies safety outcomes rather than the authority +// that defines them. Declaring them here made a vocabulary depend on one of its readers, which +// closed a cycle the moment a third module needed both; DESIGN section 4 makes acyclicity the import +// graph's only structural law, so this direction is forced rather than preferred. +// +// WHAT STAYED: the opaque-host-operation POPULATION below. That is policy declared OVER this +// vocabulary, not the vocabulary, and it is the same split `floor_route_gap` already draws between +// its ground type and its expectation roster. +import v2.workflow.floor_terminal_ledger { + ClaimSafetyOutcome, CompletedWithinSafetyLimits, SafetyInterrupted, CompletedPastSafetyLimit, + ClaimPreemptionReachability, CooperativelyPollable, OpaqueHostCallUnbounded +} import v2.workflow.floor_route_gap { floor_route_gap_roster } import v2.workflow.floor_cost_debt { floor_cost_debt_roster, floor_cost_debt_holds } import v2.workflow.local_repo_wet_terminal { local_repo_wet_schedule } @@ -779,12 +794,15 @@ fn required_floor_site_disposition( // -- they are NOT hard bounds across an opaque host operation unless that operation separately // carries a deadline-aware contract or a killable process boundary. Whichever deadline a poll // DOES observe crossing raises a genuinely terminal-before-verdict occurrence -// (`ClaimSafetyOutcome.SafetyInterrupted`, below); a claim whose cost accrues where no poll can +// (`ClaimSafetyOutcome.SafetyInterrupted`, declared in `v2.workflow.floor_terminal_ledger`); a claim +// whose cost accrues where no poll can // land instead completes and is classified `CompletedPastSafetyLimit`, which blocks identically // (`claim_safety_outcome_blocks`) but is never mislabeled as an interrupt it did not receive. The -// typed model -- `ClaimPreemptionReachability`, `ClaimSafetyOutcome`, `claim_safety_outcome`, -// `claim_safety_outcome_blocks`, the migration wall, and the §4b rung drop -- is declared further -// down this file rather than described here in prose a second time; the measured receipt behind +// typed model is declared rather than described here in prose a second time, and it now spans TWO +// modules: the VOCABULARY -- `ClaimPreemptionReachability` and `ClaimSafetyOutcome` -- lives in +// `v2.workflow.floor_terminal_ledger` beside the terminal that carries it, while the CLASSIFICATION +// over it -- `claim_safety_outcome`, `claim_safety_outcome_blocks`, the migration wall and the §4b +// rung drop -- stays in this module, which is the consumer. The measured receipt behind // it (floor run 32301212975, `root_d_checkpoint_scalar_declared_arity_witness_holds` reaching a // verdict at 60317ms CPU against this module's 5000ms `required_floor_claim_cpu_safety_limit_ms`, // twelve times over and uninterrupted, not a first occurrence -- 2792-2855ms isolated per @@ -994,16 +1012,6 @@ fn required_floor_claim_wall_safety_limit_ms() -> Int { // a deadline-aware contract or a killable process boundary -- neither of which // `compile_dag_rust_emit_check` has today. -// WHICH REACHABILITY ONE CLAIM HAS, closed and named rather than left implicit per-occurrence. -// A claim either stays inside `eval_expr`'s own poll loop for its whole duration -// (`CooperativelyPollable` -- the case the two safety limits above genuinely protect), or it -// crosses into a synchronous native `free_call.*` arm that never re-enters `eval_expr` while it -// runs (`OpaqueHostCallUnbounded`, naming the operation). These are exactly the two mechanisms -// `std.evaluation_budget` `evaluation_budget_opaque_host_call_note` and this module's own prior -// comment already described in prose; this type is what the ruling asked that prose become. -type ClaimPreemptionReachability = - CooperativelyPollable - | OpaqueHostCallUnbounded { operation: String } // THE POPULATION OF OPAQUE HOST OPERATIONS THE PREEMPTION-1 RUNG DROP IS DECLARED OVER, AND IT // IS EIGHT MEMBERS RATHER THAN ONE. CORRECTED 2026-09-02; the correction is a rung-honesty repair, @@ -1132,26 +1140,6 @@ fn claim_preemption_admission(preemption: ClaimPreemptionReachability) -> Bool { } } -// THE THREE-WAY OUTCOME THE RULING NAMED, replacing the binary `ClaimTerminality` this module's -// prose used to describe as though a third state did not need its own arm. `SafetyInterrupted` -// is reserved for a claim the poll genuinely stopped before a verdict -- it must never be the -// label for a claim that ran to completion, however far over its limit, because "terminal" and -// "interrupted" are different facts and conflating them is exactly the relabeling this ruling -// forbids. `CompletedPastSafetyLimit` names the other terminal-but-over-limit case and carries -// its `ClaimPreemptionReachability`, so a reader can tell WHY the poll never had a chance to fire -// without re-deriving it from a comment. -type ClaimSafetyOutcome = - CompletedWithinSafetyLimits - | SafetyInterrupted { - raised_by: String - elapsed_cpu_at_least: Int - elapsed_wall_at_least: Int - } - | CompletedPastSafetyLimit { - observed_cpu: Int - observed_wall: Int - preemption: ClaimPreemptionReachability - } // FLAT-SCALAR MILLISECOND FIELDS, DECLARED AS A BOUNDED GAP RATHER THAN SILENTLY LEFT (review // 53860 on gunbc#8584, BLOCKING on `observed_cpu_ms`/`observed_wall_ms`/`cpu_limit_ms`/ From 74719e46ddb8ca7a6da7b36d353668caba502162 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Wed, 2 Sep 2026 14:32:20 +0000 Subject: [PATCH 2/4] re-anchor two annotations the move falsifies, including the widening's own cycle argument --- src/v2/workflow/floor_terminal_ledger.dag | 49 +++++++++++++++++------ 1 file changed, 36 insertions(+), 13 deletions(-) diff --git a/src/v2/workflow/floor_terminal_ledger.dag b/src/v2/workflow/floor_terminal_ledger.dag index d440b9c085e..90b06d3717f 100644 --- a/src/v2/workflow/floor_terminal_ledger.dag +++ b/src/v2/workflow/floor_terminal_ledger.dag @@ -126,12 +126,18 @@ import v2.workflow.floor_route_gap { // between observation and artifact where the two facts were fused back together. // // THE VOCABULARY IS IMPORTED, NOT MINTED. `FloorRouteGapGround` stays where it is and this module -// takes a dependency on it. Relocating it here was tried first and REFUSED BY ACYCLICITY: this -// module imports `required_floor`, which imports `floor_route_gap`, so moving the type would have -// closed a cycle -- and DESIGN section 4 makes acyclicity the import graph's only structural law. -// The edge already exists transitively; naming it directly adds no new dependency, only an honest -// one. A third spelling beside that authority and the seed's `v1_interpreter.HermeticEffectGround` -// mirror would be exactly the fork this widening exists to close. +// takes a dependency on it. Relocating it here was tried first and REFUSED BY ACYCLICITY, because at +// that time this module imported `required_floor`, which imports `floor_route_gap`, so moving the +// type would have closed a cycle -- and DESIGN section 4 makes acyclicity the import graph's only +// structural law. +// +// THAT PREMISE NO LONGER HOLDS AND THE CONCLUSION STILL DOES. This module no longer imports +// `required_floor` at all: the safety vocabulary moved HERE for the same acyclicity reason, which +// removed the edge. So the cycle argument above is now HISTORY rather than a live constraint, and it +// is kept because it records WHY the ground type was not relocated when that question was live. The +// ground stays in `floor_route_gap` on the independent merit that a spelling beside that authority +// and the seed's `v1_interpreter.HermeticEffectGround` mirror would be exactly the fork this +// widening exists to close -- which was always the stronger half of the reason. // // WHAT THIS DOES NOT TOUCH: `floor_route_gap` keeps its expectation type and its whole population. // What an identity is EXPECTED to gap on is a different fact from what an attempt REACHED, and @@ -341,13 +347,30 @@ type TerminalLedger { // gap. The class sits at MITIGATABLE: the state is REPRESENTABLE and is caught by a check // (`ledger_green_admission` refuses a ledger carrying it), not made unwritable. Making it // unwritable by narrowing `BudgetRefused`'s carrier to the two coherent arms is REJECTED, and not -// for cost: `ClaimSafetyOutcome` is owned by `v2.workflow.required_floor` and reused here -// deliberately, so a narrowed two-arm twin declared beside it would be one concept forked by -// rigor -- §3 nicknaming -- and a fork gets consolidated later at someone else's cost. -// NEXT-RUNG TRIGGER: the safety axis declared as a family in its OWNING module, with the -// budget-bearing sub-family derived there rather than re-spelled here. At that point this arm has -// no constructor and this disposition, its refusal arm and their evidence dissolve together -// (operator ruling, 2026-08-24). +// for cost: `ClaimSafetyOutcome` is declared ABOVE IN THIS MODULE and a narrowed two-arm twin beside +// it would be one concept forked by rigor -- §3 nicknaming -- and a fork gets consolidated later at +// someone else's cost. +// +// THE OWNERSHIP SENTENCE HERE USED TO SAY `v2.workflow.required_floor` OWNS THIS TYPE. That was true +// when written and became false when the declaration moved here to open an import cycle. It is +// corrected rather than deleted because the sentence is load-bearing: it is the reason the narrowed +// twin is refused, and a reader who found it naming the wrong authority would conclude the refusal +// no longer applies. +// +// NEXT-RUNG TRIGGER, RE-ANCHORED AND NOT RETIRED. It read "the safety axis declared as a family in +// its OWNING module, with the budget-bearing sub-family derived there rather than re-spelled here". +// Every locating word in that sentence was DEICTIC -- its owning module, there, here -- so moving the +// declaration silently re-pointed it at a different module while the prose stayed readable. It did +// not become false, it became AMBIGUOUS, which is why nothing would ever have flagged it: this is the +// positional-citation failure one level up, a relative reference decaying rather than a line number. +// +// So the trigger is restated with its location EXPLICIT: the safety axis declared as a family in +// `v2.workflow.floor_terminal_ledger`, with the budget-bearing sub-family DERIVED from that family +// rather than re-spelled as a sibling coproduct. RELOCATING THE DECLARATION DOES NOT SATISFY IT -- +// the sub-family derivation is the capability, and this change performed a move, not a derivation. +// The drop stays open at MITIGATABLE. At the point the trigger is met, this arm has no constructor +// and this disposition, its refusal arm and their evidence dissolve together (operator ruling, +// 2026-08-24). type ClaimDisposition = Passed | Failed From bc748acb8a18eb01ec692cea5bf7d736940b3a88 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Wed, 2 Sep 2026 17:43:25 +0000 Subject: [PATCH 3/4] Adjudicate the 57 namespace deltas this relocation creates, enumerated by identity The wave-admission phase refused both attempts with 57 unadjudicated deltas -- every one a TargetChanged binding reading base {v2.workflow.required_floor} -> head {v2.workflow.floor_terminal_ledger}, verified as the only shape in the report. That is this PR's own move, and the roster's documented closure is to author a row per delta. Enumerated, not patterned: 57 deltas, 57 rows, each naming its module, declaration and spelling. The rows go stale the moment this merges and MUST be deleted in the first PR after it lands -- a stale row refuses every unrelated PR in the repository. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GvVoivi7L449wbh6rjeJY4 --- src/v1/stage0/src/namespace_wave_admission.rs | 593 ++++++++++++++++++ 1 file changed, 593 insertions(+) diff --git a/src/v1/stage0/src/namespace_wave_admission.rs b/src/v1/stage0/src/namespace_wave_admission.rs index a7fd1632235..02ea6897d56 100644 --- a/src/v1/stage0/src/namespace_wave_admission.rs +++ b/src/v1/stage0/src/namespace_wave_admission.rs @@ -608,7 +608,600 @@ pub struct TransitionAdmission { /// the dissolution recorded above and this branch by its own reading of the same fired trigger. /// A union of the two rosters would have re-added a deletion both sides intended; the resolution /// took the deletion. +/// FOURTH TRANSITION, SAME RULE (2026-09-02). The `ClaimSafetyOutcome` / +/// `ClaimPreemptionReachability` relocation of gunbc#10077: both types move from +/// `v2.workflow.required_floor` to `v2.workflow.floor_terminal_ledger`, beside the +/// `ClaimAttemptTerminal` arm that carries them, so the ledger stops importing the floor and the +/// cycle that blocked the wet-route migration opens. Every one of the 57 rows below is a +/// `TargetChanged` binding whose base is `v2.workflow.required_floor` and whose head is +/// `v2.workflow.floor_terminal_ledger` — verified as the ONLY shape in the report, so no row here +/// adjudicates a delta this transition did not cause. +/// +/// THEY ARE ENUMERATED BY IDENTITY, NOT MATCHED BY PATTERN. Fifty-seven deltas, fifty-seven rows, +/// each naming its module, its declaration and the exact spelling whose target moved. A wildcard +/// covering this relocation would also admit the next one nobody reviewed. +/// +/// TRIGGER, AND IT IS THE SAME ONE EVERY SHRINK ABOVE USED: they go STALE the moment #10077 merges, +/// because merge commit and base then both carry the relocation and no run can produce these +/// deltas. `stale_admissions` is per RUN, so from that moment these 57 rows refuse EVERY UNRELATED +/// PR in the repository until they are removed. They MUST be deleted in the first PR after #10077 +/// lands. Removing them early is safe and loud — an unshrunk delta refuses as UNADJUDICATED and is +/// closed by re-authoring a row, never by a silent admission — so the only dangerous direction is +/// leaving them. +const LEDGER_SAFETY_VOCABULARY_LABEL: &str = + "ledger safety vocabulary relocation gunbc#10077 2026-09-02"; + pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_both_within_their_own_limits_does_not_block", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_over_limit_claim_blocks_though_preparation_was_inside_its_envelope", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_over_limit_claim_blocks_though_preparation_was_inside_its_envelope", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.floor_preparation_shared_build", + in_declaration: "w_refused_preparation_blocks_though_every_claim_is_healthy", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_a_live_non_nested_compile_operation_is_still_refused", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_a_second_nested_compile_operation_is_admitted", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_completed_past_safety_limit_blocks", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_completed_past_safety_limit_blocks", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_cooperatively_pollable_is_always_admitted", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_blocks_too", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_genuine_interrupt_is_not_relabelled_completed", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_grandfather_population_matches_the_grounded_surface", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_grandfathered_operation_is_admitted", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_new_opaque_operation_is_refused", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "test.claim.preemption_reachability", + in_declaration: "w_within_limits_does_not_block", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "ClaimAttemptTerminal", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger", + in_declaration: "claim_disposition", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_budget_refusal_is_a_pre_verdict_disposition_not_a_failure", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_row_carrying_a_contradictory_budget_terminal_refuses_the_ledger", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_test", + in_declaration: "a_row_carrying_a_contradictory_budget_terminal_refuses_the_ledger", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_safety_detail", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire", + in_declaration: "render_terminal_tag", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.floor_terminal_ledger_wire_test", + in_declaration: "every_shape", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "ClaimPreemptionReachability", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "CooperativelyPollable", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_preemption_admission", + spelling: "OpaqueHostCallUnbounded", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "ClaimPreemptionReachability", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "CompletedPastSafetyLimit", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "CompletedWithinSafetyLimits", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "claim_safety_outcome_blocks", + spelling: "SafetyInterrupted", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, + TransitionAdmission { + label: LEDGER_SAFETY_VOCABULARY_LABEL, + subject: AdmissionSubject::Binding { + module: "v2.workflow.required_floor", + in_declaration: "floor_run_blocks", + spelling: "ClaimSafetyOutcome", + target: "v2.workflow.floor_terminal_ledger", + }, + disposition: NamespaceDeltaDisposition::TargetChanged, + }, TransitionAdmission { label: "SJT-1 Redfish boot-override constants join the module that authors their subject 2026-09-02", subject: AdmissionSubject::Binding { From d580fa4773610184533d7f12e79c15675d218fd1 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Wed, 2 Sep 2026 18:19:26 +0000 Subject: [PATCH 4/4] Drop the four SJT-1 rows my merge resolution silently restored Main's seventeenth dissolution swept this roster to empty. My conflict resolution kept main's receipt prose but re-opened the const with the whole of my side's row list, which still carried the four dissolved rows -- so it reinstated a permission nobody re-authored and the wave phase reported them CONSUMED and refused. That is precisely the failure a conflict invites: a resolution in my favour restoring what the other side deliberately removed. The 57 rows themselves adjudicated correctly in that same run: 0 unadjudicated deltas. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GvVoivi7L449wbh6rjeJY4 --- src/v1/stage0/src/namespace_wave_admission.rs | 55 ++++--------------- 1 file changed, 10 insertions(+), 45 deletions(-) diff --git a/src/v1/stage0/src/namespace_wave_admission.rs b/src/v1/stage0/src/namespace_wave_admission.rs index 7f867ab7de1..a7c76e30c2a 100644 --- a/src/v1/stage0/src/namespace_wave_admission.rs +++ b/src/v1/stage0/src/namespace_wave_admission.rs @@ -858,7 +858,8 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ label: LEDGER_SAFETY_VOCABULARY_LABEL, subject: AdmissionSubject::Binding { module: "test.claim.preemption_reachability", - in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", spelling: "CompletedPastSafetyLimit", target: "v2.workflow.floor_terminal_ledger", }, @@ -868,7 +869,8 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ label: LEDGER_SAFETY_VOCABULARY_LABEL, subject: AdmissionSubject::Binding { module: "test.claim.preemption_reachability", - in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", spelling: "CompletedWithinSafetyLimits", target: "v2.workflow.floor_terminal_ledger", }, @@ -878,7 +880,8 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ label: LEDGER_SAFETY_VOCABULARY_LABEL, subject: AdmissionSubject::Binding { module: "test.claim.preemption_reachability", - in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", spelling: "CooperativelyPollable", target: "v2.workflow.floor_terminal_ledger", }, @@ -888,7 +891,8 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ label: LEDGER_SAFETY_VOCABULARY_LABEL, subject: AdmissionSubject::Binding { module: "test.claim.preemption_reachability", - in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", spelling: "OpaqueHostCallUnbounded", target: "v2.workflow.floor_terminal_ledger", }, @@ -898,7 +902,8 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ label: LEDGER_SAFETY_VOCABULARY_LABEL, subject: AdmissionSubject::Binding { module: "test.claim.preemption_reachability", - in_declaration: "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", + in_declaration: + "w_root_d_shape_derives_completed_past_safety_limit_with_opaque_host_preemption", spelling: "SafetyInterrupted", target: "v2.workflow.floor_terminal_ledger", }, @@ -1254,46 +1259,6 @@ pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[ }, disposition: NamespaceDeltaDisposition::TargetChanged, }, - TransitionAdmission { - label: "SJT-1 Redfish boot-override constants join the module that authors their subject 2026-09-02", - subject: AdmissionSubject::Binding { - module: "gunbc.srv3_boot_once_cd", - in_declaration: "srv3_boot_once_cd_resolved", - spelling: "srv3_boot_cd_enabled", - target: "gunbc.srv3_os_install_actuate_workflow", - }, - disposition: NamespaceDeltaDisposition::TargetChanged, - }, - TransitionAdmission { - label: "SJT-1 Redfish boot-override constants join the module that authors their subject 2026-09-02", - subject: AdmissionSubject::Binding { - module: "gunbc.srv3_boot_once_cd", - in_declaration: "srv3_boot_once_cd_resolved", - spelling: "srv3_boot_cd_mode", - target: "gunbc.srv3_os_install_actuate_workflow", - }, - disposition: NamespaceDeltaDisposition::TargetChanged, - }, - TransitionAdmission { - label: "SJT-1 Redfish boot-override constants join the module that authors their subject 2026-09-02", - subject: AdmissionSubject::Binding { - module: "gunbc.srv3_boot_once_cd", - in_declaration: "srv3_boot_once_cd_resolved", - spelling: "srv3_boot_cd_reset_type", - target: "gunbc.srv3_os_install_actuate_workflow", - }, - disposition: NamespaceDeltaDisposition::TargetChanged, - }, - TransitionAdmission { - label: "SJT-1 Redfish boot-override constants join the module that authors their subject 2026-09-02", - subject: AdmissionSubject::Binding { - module: "gunbc.srv3_boot_once_cd", - in_declaration: "srv3_boot_once_cd_resolved", - spelling: "srv3_boot_cd_target", - target: "gunbc.srv3_os_install_actuate_workflow", - }, - disposition: NamespaceDeltaDisposition::TargetChanged, - }, ]; /// The denominators a green must name (DESIGN §5): a run that cannot say what it covered is an