The parser never stamped a type declaration, so every type reference in the corpus was unbindable

[briansrls]

READ THIS BEFORE THE NUMBERS. "Type declarations 0 → 1243" is NOT a completeness claim and
must not be read as one. Condition 2 (exact declaration completeness) DOES NOT HOLD. The
census reports CensusUnavailable { DeclarationDomainDisagrees { missing, extra } } and REFUSES
to print a partition. This PR lands as a declared census-enabling scaffold: the instrument
that can see the problem, landing before the problem is solved, because withholding it keeps the
incompleteness invisible in everyone else's tree.

The parser never stamped a type declaration, so every type reference in the corpus was unbindable

This is the PREREQUISITE for the XL-0T cut, not the cut. It is on its own PR because it is a
change to v1.compiler.parse, which DESIGN names as load-bearing.

v1.compiler.parse stamped type REFERENCES as TypeOccurrence and never stamped a type
DECLARATION as one: ParsedOccurrenceDeclaration was produced with FieldOccurrence,
LexicalValueOccurrence, CallableOccurrence and NamespaceSegmentOccurrence only.
std.occurrence_binding_resolve admits a TypeOccurrence reference against a TypeOccurrence
declaration only, so the join had no right-hand side at all.

Measured by type_occurrence_binding_census --denominator dag/std (142 files):

reference_occurrences_by_category   = Callable 6971, Field 2830, LexicalValue 10226, Method 382, Type 9672
declaration_occurrences_by_category = Callable 1742, Field 2280, LexicalValue 6748, NamespaceSegment 142, Type 0   <- before
                                                                                                        Type 1243  <- after

Y therefore bound 0 of 9672 references before this change. That is the headline the earlier
census understated: the largest single class, OldKernel_NewUnresolved = 3136 (32.4% of the
denominator), was not evidence about Y's resolver at all — it was the empty declaration side
showing through.

Why the whole existing suite stayed green through it

Every fixture hand-builds its declarations with category: TypeOccurrence — exactly the shape
production never emitted — so the suite supplied the missing half of the join itself. Those
fixtures are correct about the authority's LOGIC; nothing here weakens them. They were never
SUFFICIENT, and nothing in the tree said so. DESIGN §5: a green suite that cannot see the
production population is not weak evidence, it is zero evidence, and it gets cited as coverage.

The declaration rule is three negatives, and the answer is (b)

(b): the parse tree genuinely carries no positive type-declaration marker. The parser
dispatches on the type / fn / data / service keyword and then DISCARDS which one it saw —
Node has no item-kind field, so by the time the occurrence walk runs the kind survives only as
which optional fields happen to be ABSENT. Every downstream reader (is_type_def_item,
is_function_item, is_data_def_item, is_service_def_item in
v1.compiler.emit_core_support) re-derives it from shape for the same reason.

So the rule is provisional and is written accordingly: not a bare predicate but an exhaustive
ParsedModuleItemKind match whose ModuleItemUnrecognized arm REFUSES with a located
diagnostic rather than defaulting into the type bucket. A bare predicate over three absent fields
fails open by construction, at the parser, where a wrong answer propagates into every consumer of
the occurrence transport and nothing fails when it starts being wrong (DESIGN §5: a failure arm
refuses, never widens).

What refusal does NOT fix, stated so it is not read as closed: it covers the residual that can be
EXPRESSED today. It cannot cover an item kind nobody has invented yet, because the discriminator
is absence and a new kind's absence looks identical to a type's. Terminal fix, a construction
rather than a check: the parse constructors carry the kind they already know onto the item, at
which point this match reads a field and the emit-side shape predicates dissolve into it.

Evidence

• src/v1/tests/claim/type_declaration_occurrence_control_test.dag — a PRODUCTION-FED control, not
  another hand-built transport. Its third conjunct is the state that was RED before this change: a
  subject with type REFERENCES and an empty declaration side. Executed: PASS.
• It executes on NO required run — the required floor's source roots are dag and src/v2, and
  this subject is only reachable through v1.compiler.parse. Rung: mitigatable; the next-rung
  trigger (a witness home whose source roots reach src/v1) is stated in the file. Direct
  execution is evidence the assertions hold; it is never evidence that CI runs them.
• --required-regen --source-root dag --source-root src/v2: first_generation_equal=true,
  planned=151 executed=151 adjudicated=151. Mirrors installed.
• cargo clippy --all-targets -- -D warnings: clean. cargo fmt --all --check: clean.

The partition, all thirteen classes plus both unclassifiable arms

Instrument: type_occurrence_binding_census dag/std. Denominator 9672. Every grounding closes
exactly. Zeros are reported because a dropped zero row is indistinguishable from "not measured" —
OldKernel_NewAmbiguous = 0, OldSynthetic_NewAmbiguous = 0, OldUnresolved_NewAmbiguous = 0
together say Y introduces no new ambiguity anywhere, which is a load-bearing positive finding.

class	NamespaceStructuralRoot	ModuleLocalMember	CrossFileProviderExported
OldAndNewAgree	2786	2786	4856
OldKernel_NewUnresolved	3136	3136	1204
OldBinds_NewUnresolved	2203	2203	20
OldSynthetic_NewUnresolved	909	909	9
OldUnresolved_NewUnresolved	367	367	367
OldSynthetic_NewBinds	250	250	1150
OldKernel_NewBinds	0	0	1932
OldAndNewDisagree	21	21	54
OldBinds_NewAmbiguous	0	0	80
OldKernel_NewAmbiguous	0	0	0
OldSynthetic_NewAmbiguous	0	0	0
OldUnresolved_NewAmbiguous	0	0	0
OldUnresolved_NewBinds	0	0	0
Unclassifiable_NoIndexEntry	0	0	0
Unclassifiable_NoModuleEnv	0	0	0
total	9672	9672	9672

OldSynthetic_NewBinds = 250 (1150 cross-file): X manufactured a synthetic identity where Y now
names an authored declaration. A synthetic id is not a declaration id and must never be netted
against one, so those are counted as their own class rather than folded into agreement.

The two module-scoped groundings are byte-identical to each other and only
CrossFileProviderExportedExposure discriminates — which is exactly what the earlier all-zero run
could not have told anyone, and retroactively confirms that the earlier byte-identical partitions
located the failure UPSTREAM of visibility rather than in the groundings.

Read the numbers with these three disclosures — they are printed by the instrument itself

1. The X column is the POST-REWIRE persisted env, the one EMISSION reads. Pre-rewire inference
   answers are not measured; the two once disagreed on this exact subject.
2. This is a TWO-READER COMPARISON, not correctness evidence
   (gunbc.recurring_failure_mode disagreement_census_blind_to_agreed_wrong). OldAndNewAgree
   means the cut does not MOVE this occurrence, never that it binds correctly. Both readers wrong
   together scores as agreement and is invisible here by construction.
3. Undecided is a finding, not noise. Every New*Unresolved arm is inside the denominator.

Scope, declared so the next increment is driven by measurement

MODULE-LEVEL type declarations only. Coproduct variants and type parameters in type position stay
unstamped, so references to them stay Unbound and the census says so by name. MethodOccurrence
stands at 382 references against 0 declarations — the same gap in the same collector, not
addressed here. The cut is NOT attempted in this PR.

---

The seven-condition T1 bar, with the evidence for each

#	condition	evidence	verdict
1	production source only, through tokenize → parse, no hand-built transport	both new controls call parse_authored_occurrence_binding_source; the census join parses each file with parse_with_table and reads parsed.occurrence_transport	HOLDS
2	exact declaration COMPLETENESS — every grammar-owned type declaration contributes exactly one occurrence	exact-set join at occurrence-id grain vs. the emit-side reader. Residue 2 items in 1 module, attributed by the join to the OTHER reader (emit_core_support is_bare_leaf_item)	DECLARED NOT HOLDING
3	exact SOUNDNESS — nothing else contributes one accidentally	same join, extra = 0 on the merged corpus. This is the direction that caught the three resource items	HOLDS
4	identity preservation — the occurrence is the declaration head's, already in the index	stamp_parsed_node reads the node's existing OccurrenceMinted identity and mints nothing; the join checks every declaration id against that parse's own index (not_in_index = 0)	HOLDS
5	non-vacuous binding — a production-parsed reference binds a production-parsed declaration through Y	production_fed_exposure_discrimination_holds binds under CrossFileProviderExportedExposure; executed, PASS	HOLDS
6	EXPOSURE DISCRIMINATION — different exposure fact, different outcome	same control: same occurrences, same resolver, ModuleLocalMemberExposure → Unbound, CrossFileProviderExportedExposure → Bound; executed, PASS	HOLDS
7	MUTATION CONTROL — removing the stamping reddens the production-fed witness while the hand-built suite stays green	with the stamping reverted to ParsedOccurrenceUnclassified: both production-fed controls FAIL; control_one / control_two / control_three / control_api all PASS. Both halves executed	HOLDS

Condition 2: declared NOT HOLDING, residue two items in one module, attributed to the other reader

The first version of this measurement said 202 grammar-owned type declarations were absent across
100 modules. That was a defect in this diff, not a corpus fact, and it was found before merge:
the ModuleItemResource arm added to fix the first fail-open keyed on properties being non-empty,
and type X sole_constructor { .. } carries a property too — so every sole-constructor type in the
corpus classified as a RESOURCE and vanished from the declaration population.

The repair excludes the modifier by an enumeration of minting sites, not by grep.
v1.compiler.parse has exactly two module-item property sources:
parsed_sole_constructor_properties (one field-init named sole_constructor, the only source every
type-item constructor passes along, four call sites) and parse_resource_entries. nominal_opaque
is dropped lexically by drop_leading_type_modifier and mints nothing;
mint_parsed_optional_int_property is confined to nested where-predicate nodes. The set of
modifiers mintable as a property on a type declaration is a closed set of one. What breaks that
later is stated in the annotation: a second modifier that MINTS a property reintroduces this
silently and in the same direction, which no longer list can prevent.

Measured corpus-wide (type_occurrence_binding_census --establish over dag src/v2 src/v1):
modules_diverging 100 → 1, absent declarations 202 → 2, zero extras, zero duplicates,
zero index absences, zero parse failures. Both remaining absences are in that one module.

The residue is not this classifier's defect. resource Network and resource AuthContext
declare no capabilities, so with no children, body, params or connective they satisfy
v1.compiler.emit_core_support is_bare_leaf_item and the independent reader calls them type
declarations. Same class, different authority — filed, not repaired, as
gunbc.recurring_failure_mode absence_classifier_default_bucket.

The countermeasure, which is the transferable part

Those two were invisible while one classifier answered, because both readers agreed they were
types — the agreed-wrong pair a disagreement census cannot see by construction
(disagreement_census_blind_to_agreed_wrong), and no amount of running it harder finds them.
Splitting the question across two independently derived readers — absence-of-body/transport/
annotation in the parser vs. connective/params/children in the emitter — converted their agreement
into a disagreement, which is the only form the census can report.

WHERE A CENSUS COMPARES TWO READERS, A THIRD INDEPENDENTLY-DERIVED READER IS THE ONLY THING THAT
CAN FALSIFY THEIR AGREEMENT.

That split arrived here as a side effect of building the population join rather than as a design
goal, which is exactly why it is filed: reach for it on purpose when an agreed-wrong population is
suspected.

Generated artifacts are never resolved by picking a side

The four build errors on the previous head were not a partial regen from adding a module. They were
this branch resolving generated-artifact merge conflicts to --ours, which dropped main's
authority-derived bytes and left the crate root referencing modules that were still emitted but no
longer present. A generated artifact is regenerated from the merged authority, never resolved by
picking a side — the merge driver refuses precisely to prevent this, and the loss came from
resolving past the refusal. The fourth error (Some(InferredNode::Divergent) non-exhaustive) was
stale mirror content, not an uncovered arm in the .dag.

Also worth recording: --required-regen does not project the ledger docs. It reported
first_generation_equal=true with docs/design-failure-modes.md still stale. The projection
actuator is gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet.

What the census now refuses to conflate

CensusUnavailable { DeclarationDomainAbsent | DeclarationDomainDisagrees { missing, extra } }
CensusObservedOnCurrentTree { joined_declarations }
CensusAdmissibleForCut { parser_carried_item_kind, joined_declarations }

"The join agrees on today's tree" and "the classifier is a durable authority" are different facts.
CensusAdmissibleForCut is unconstructible on this tree — the accepted bucket is still defined by
absence — and is modeled anyway, with a refusing arm, because leaving it unmodeled is what would
let the first be read as the second.

The resource fail-open, and the rule that generalises it

The join's first run found three items — Filesystem, Clock, Entropy in std.resources —
silently stamped as TYPE DECLARATIONS. A resource carries no body, no transport and no type
annotation, so the exhaustive match's refusing residual could not fire: a resource is not
unrecognised, it is indistinguishable from a type under a three-negatives rule. The parser's own
item error names TEN keywords, so the four-kind premise was wrong and its falsifier was in the same
file.

A RESIDUAL REFUSAL DOES NOT PROTECT A CLASSIFIER WHOSE ACCEPTED BUCKET IS DEFINED BY ABSENCE; A
NEW KIND CAN SILENTLY RESEMBLE THE DEFAULT.

ModuleItemResource repairs the known collision; it does not turn absence into a positive
authority. The terminal construction — parse constructors carrying the kind they already know — is
required before anything is cut over on this classifier.

Two instrument defects were caught before being reported as production ones: the join first read
the post-typecheck item list, whose rebuilt copies carry OccurrenceSynthetic (1077 phantom rows),
and it compared per-file parse ids against the whole-program index — two different id spaces (40
phantom absences).

Receipts

• --required-regen: first_generation_equal=true, 155/155/155, main.rs declared divergent
• --required-regen-fixed-point: fixed_point_equal=true (separate invocation, source roots on each)
• cargo clippy --all-targets -- -D warnings: clean · cargo fmt --all --check: clean

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLXA6u6f3UK8PR5VEJoUwm

---

What is verified, and what is not

Local receipts: generated_artifact_gate main_wet exit 0; --required-regen
first_generation_equal=true 155/155/155 (main.rs declared divergent);
--required-regen-fixed-point fixed_point_equal=true; clippy --all-targets -- -D warnings
clean; fmt clean; corpus-wide join 202 → 2.

CI on this head (ad9381b117): all required lanes green — required-witnesses-build,
required-witnesses-floor, rust-unit-tests, witnesses, heal-generated-artifacts and
fabric-evidence all pass; emit-copy-qualification-battery skipping. GitHub reports the head
CLEAN. (An earlier revision of this section said no required lane had executed against this head;
that was true when written and is now stale, so it is corrected rather than left standing.)

The ledger merge, and how it was resolved

The two sides of gunbc.recurring_failure_mode add disjoint rows, so main's file was taken
whole and this branch's row re-applied by insertion — no conflicted line was ever opened. That
matters on this carrier specifically: one row is one line, the longest is 16,792 characters, and
hand-composing a markered line that size loses content no diff view would show. Verified by
identity, not by rc or line count: authority 69 → 70 rows with an empty main-missing-from-mine
difference, and the projection grepped by identity string (heading count is silently null on this
file — it carries no ### markers). docs/design-failure-modes.md was regenerated from the merged
authority rather than hand-resolved, which is the only correct move on a driver-bound path.
.gitattributes is byte-identical to main, so the driver bound as intended.

A second row, and it carries an instance of itself

green_reported_over_a_population_the_instrument_does_not_own: --required-regen reports
first_generation_equal=true 155/155/155 while docs/design-failure-modes.md is stale, because
the ledger projections belong to a different actuator. A lane can file a row, run the regen, see
green, and stop — having shipped a row that exists in the authority and nowhere a reader can see it.

It is filed with both neighbours cited and the distinction stated as polarity: the same
denominator shape as incidental_denominator_as_wall with the sign reversed — theirs a filter that
accidentally creates safety (nothing wrong today, the protection uncredited), this one a filter
that accidentally destroys coverage while reporting green (something wrong today, the assurance
credited but absent).

The row records its own author committing the same shape within the hour: a claim that CI would
never run on a merge-conflicted head, drawn from six minutes of polling one branch, while three
other DIRTY pull requests were carrying six and seven check-runs each. Recency separated the
population; dirtiness did not. An instrument's silence read as a fact about a population it
never enumerated — the same shape with the sign flipped, and §5 names the tell in advance, since
"never" is the word that lets a ratchet pass as a wall.