Skip to content

Record the ANALYST form of stale_base_branch_reads_as_pending_work: a label authored separately from its measurement - #10286

Merged
gunbai-bot[bot] merged 6 commits into
mainfrom
session/tidy-koi-619-analystform
Sep 3, 2026
Merged

gunbai-bot[bot] merged 6 commits into
mainfrom
session/tidy-koi-619-analystform

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

The row already describes the artifact misleading someone who reads it. This adds the person who measures correctly and labels the measurement wrong.

The invalid state, at the grain that makes it repairable

A label authored separately from the measurement it names — a claim with no mechanical relationship to the number beside it.

My first framing was "unlabelled composition of two measurements". That's narrower and wrong: composition is where it usually shows up, not what it is. warm-seal-35 supplied the sharper statement.

It is worse than the reader form rather than milder: the reader form yields a missed fact; this yields a specific false claim, and a specific false claim gets acted on.

The git instance

diff(merge-base, head) is what the PR does — the only direction describing a merge. diff(head, main) and two-dot main..branch are what the branch lacks. Both readings are true; only the label is wrong.

Four specimens, one evening, two authors

  1. Reported that merging two survivor branches would delete eight and then four named files, including a witness test that had landed twenty minutes earlier — posted on a closed PR as a correction. The branches' own diffs are 3A/26M/2R/0D and 2M/0D. The "deletion set" was main's forward movement. The tell that was present and missed: across four branches of one session the counts were 22, 14, 7, 4 — monotone in branch age. A deletion set does not correlate with staleness; a forward-movement set does so by definition.
  2. The mirror direction (Ground call reachability once in v2.std.fn_index: one authority, compile-door consumption, and deletion of BOTH duplicate call_reachable_decls implementations in one completed cut #10265): rule held correctly, a merge-base hunk quoted, labelled an answer about main.
  3. Two greps in one shell command over two job logs, output read as belonging to the first — the first matched nothing, the second matched two lines. There is no branch in this specimen at all, which forecloses the objection that the class is about git.
  4. The sharpest (fabric work #10284): git diff origin/main..$BR --stat under an echo reading "what the branch would ADD to main" → 4,680 deletions, which read for ten seconds as a mass revert. The label was written before the command ran, so the output could only confirm it. A pre-written label is not a label, it is a hypothesis wearing one.

The repair, and why "be careful" is not it

Make the producer emit its own identity — the grep prints the filename it searched, the diff prints the ref expression it evaluated — so a mislabel becomes unwritable rather than merely unlikely. Every specimen had a hand-authored label, in a heredoc or an echo, beside a number it had no mechanical link to.

Why this amends rather than mints

The first two specimens occurred while analysing an instance of this very class — both branches were stale-base survivors whose content had already landed. Neither analyst stumbled into a neighbouring failure; each failed at the class while examining it, having stated the distinction correctly to the other beforehand.

That is also the strongest available support for the row's existing trigger. The row argues the trigger must name a producer rather than reviewer diligence, citing an approval of superseded content. This is stronger: the approval shows someone misled by the artifact; these show two analysts who knew the rule, had just written it down, and still mislabelled a direction within hours. If holding the rule is not sufficient, diligence is definitively not the repair.

I initially proposed this as its own row and was wrong — the boundary test the roster uses is whether the repairs are disjoint, and they are not: the producer already named covers both.

The trigger is deliberately not extended. Its output leaves nothing to compose or label by hand, which is where all four specimens failed. A trigger that grows to name a second capability is how a row stops being retirable.

Also recorded

  • The direction-free fallback, because it is what held while every directional claim beside it was retracted: zero branch-only files, plus content verified present on main by content rather than ancestry — a squash destroys ancestry.
  • Two neighbours cited, not restated (restating a neighbour's fact inside this row is the failure the ledger exists to prevent): absence_read_as_a_negative_result for the empty-result half, and the mention-vs-record grain distinction — "92 versus 76" mentions understated what record grain shows, 48 TransitionAdmission records against 18, a clean apply restoring thirty.

Projection regenerated via main_wet; only the authority and its projection moved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn

Brian Searls and others added 2 commits September 3, 2026 21:18
… label authored separately from its measurement

The row already describes the ARTIFACT misleading someone who reads it. This adds the person who
measures correctly and labels the measurement wrong.

The invalid state is stated at the grain that makes it repairable: a label authored separately
from the measurement it names -- a claim with no mechanical relationship to the number beside it.
An earlier framing said "unlabelled composition of two measurements", which is where it usually
shows up rather than what it is.

It is worse than the reader form rather than milder: the reader form yields a MISSED fact, this
yields a SPECIFIC FALSE CLAIM, and a specific false claim gets acted on.

Four specimens from one evening, two authors, and the last two are what fix the row's scope:

1. Reported that merging two survivor branches would DELETE eight and then four named files,
   including a witness test that had landed twenty minutes earlier, and posted it on a closed PR
   AS A CORRECTION. The branches' own diffs are 0D. The "deletion set" was main's forward movement
   read out of the wrong direction. The missed tell: 22/14/7/4 across four branches of one
   session, monotone in branch age -- a deletion set does not correlate with staleness.
2. The mirror direction: the rule held correctly, a merge-base hunk quoted, labelled as an answer
   about main.
3. Two greps in ONE shell command over two job logs, output read as belonging to the first. The
   first matched nothing, the second matched two lines. THERE IS NO BRANCH IN THIS SPECIMEN, which
   forecloses the objection that the class is about git.
4. `git diff origin/main..$BR --stat` run under an echo string reading "what the branch would ADD
   to main": 4,680 deletions, which read as a mass revert. Two-dot shows what the branch LACKS.
   The label was written BEFORE the command ran, so the output could only confirm it. A pre-written
   label is not a label, it is a hypothesis wearing one.

The repair is why "be careful" is not it: make the producer emit its own identity -- the grep
prints the filename it searched, the diff prints the ref expression it evaluated -- so a mislabel
becomes unwritable rather than unlikely.

What decides that this belongs here rather than in a row of its own is also the strongest available
argument for the row's existing trigger: the first two specimens occurred WHILE ANALYSING AN
INSTANCE OF THIS VERY CLASS. The row argues the trigger must name a producer rather than reviewer
diligence, citing an approval of superseded content. This is stronger -- the approval shows someone
misled by the artifact; these show two analysts who knew the rule, had just written it down, and
still mislabelled a direction within hours. If holding the rule is not sufficient, diligence is
definitively not the repair.

The trigger is deliberately NOT extended. The producer already named covers this form, because its
output leaves nothing to compose or label by hand. A trigger that grows to name a second capability
is how a row stops being retirable.

Two neighbours are CITED rather than restated, since restating a neighbour's fact inside this row
is the failure the ledger exists to prevent: absence_read_as_a_negative_result for the empty-result
half, and the mention-versus-record grain distinction for the count half.

Found jointly with warm-seal-35, who supplied two of the four specimens and the sharper statement
of the invalid state.

Projection regenerated via generated_artifact_gate main_wet; only the authority and its projection
moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
…s not exist

The amendment cited `absence_read_as_a_negative_result` for the empty-result half. That name
resolves to nothing -- zero occurrences anywhere on main. It was a note in a private memory,
offered as a ledger identity. A dangling citation in a row about labels with no mechanical
relationship to what they name is the row demonstrating its own subject.

The correct authority already existed: `empty_capture_read_as_clean_result`, filed 2026-09-02.

Citing it rather than restating it is load-bearing, and the reason is now in the row. BOTH authors
of this amendment independently reported as a fresh method note a specimen that row already names
-- `gh api .../actions/jobs/<id>/logs` writing ZERO BYTES without --allow-escape-sequences,
refusing on stderr, so a grep over the capture reports no findings for a job that failed. One of us
was one message from filing a second authority for a rostered fact, in the ledger whose purpose is
preventing exactly that.

That row also states the rule better than either draft did: a zero-byte capture is NOT A VERDICT IN
EITHER DIRECTION. Inferring failure from size alone fabricates a refusal for a query that
legitimately returned nothing; consult the typed status -- exit code, and which stream the refusal
travels on -- before consuming the emptiness. Its recorded asymmetry is why the class recurs: an
empty capture never manufactures a false alarm, only a false all-clear, so nothing trains a reader
to check it.

Three of this amendment's own near-misses were that class rather than this one, and are now
recorded as the boundary between the two rows: a `git show` against an unfetched sha writing an
empty file, read as zero declarations in an 83-row module; a `gh run list --commit` on a fabricated
sha returning an empty run set that a fallback absorbed; and a log sweep returning zero hits across
seven jobs from a zero-byte endpoint. THERE the emptiness is misread as an answer; HERE a real
measurement is given the wrong name.

The dangling name was caught by its author, whose grep carried its own control -- the same command
returned five neighbouring row names, so the zero was readable as absence rather than as a failed
search. That is the cited row's own rule applied correctly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
@gunbai-bot

gunbai-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Pushed a correction after review 59495, which was bound to the prior head and does not carry to 1dab9dec4d.

The row cited a name that resolves to nothing. absence_read_as_a_negative_result has zero occurrences anywhere on main — it was a note in a private memory, offered to me as a ledger identity and cited in good faith. A dangling citation, in a row whose subject is labels with no mechanical relationship to what they name, is the row demonstrating its own defect.

Nothing a reviewer could have caught: it is prose, and no compiler resolves it.

The correct authority already existed — empty_capture_read_as_clean_result, filed 2026-09-02 — and it is not adjacent to what I was citing, it is the same fact filed better. It already names the exact specimen that was offered to me as a fresh method note:

gh api .../actions/jobs/<id>/logs writes zero bytes without --allow-escape-sequences, again refusing on stderr

So both authors of this amendment independently reported as a new discovery something rostered a day earlier, and one of us was a message away from filing a second authority for it — the §2 re-invention failure, inside the ledger built to prevent it. That is now recorded in the row, because it is better evidence for citing-not-restating than any argument.

It also states the rule more precisely than either of our drafts: a zero-byte capture is not a verdict in either direction. Inferring failure from size alone fabricates a refusal for a query that legitimately returned nothing. And its recorded asymmetry is why the class recurs — an empty capture never manufactures a false alarm, only a false all-clear, so nothing trains a reader to check it.

Three of this amendment's own near-misses turn out to be that class rather than this one, and the boundary is now written into the row: a git show against an unfetched sha writing an empty file, read as zero declarations in an 83-row module; a gh run list --commit on a fabricated sha returning an empty run set that a fallback absorbed; and a log sweep returning zero hits across seven jobs from a zero-byte endpoint. There the emptiness is misread as an answer; here a real measurement is given the wrong name.

The dangling name was caught because the grep that found it carried its own control — the same command returned five neighbouring row names, so the zero was readable as absence rather than as a failed search. That is the cited row's rule applied correctly, which is a better demonstration than the citation would have been.

— sent from tidy-koi-619

Brian Searls and others added 3 commits September 3, 2026 21:34
…sult

Testing the remedy rather than repeating it splits the three near-misses this amendment had
lumped together, and the split lands on the CITED row's ceiling rather than on this one.

Two were LOUD refusals whose signal was discarded or unread:
  git show <unfetched-sha>:path   exits 128, prints 108 bytes of `fatal:` to stderr, writes an
                                  empty file -- read as zero declarations in an 83-row module
  gh api .../jobs/<id>/logs       exits 1 and NAMES ITS OWN FIX on stderr, under a sweep whose
                                  `2>/dev/null | grep -c ... || true` deleted both the exit code
                                  and the sentence in the same command that produced the answer
For these, empty_capture_read_as_clean_result's remedy works exactly as written: consult the typed
status.

The third has NO TYPED STATUS TO CONSULT:
  gh run list --commit <sha-that-does-not-exist>   rc=0, stderr EMPTY, stdout `[]`
A nonexistent ref and a real commit with no runs are byte-identical in every channel the caller can
read. There is no discarded signal, no suppressed stream, no arm to keep -- the emptiness is the
entire response. That is residue the cited row's remedy does not reach.

It is named here as a pointer and deliberately NOT repaired here, because the repair belongs to that
row. Widening this row to hold it would be the re-invention failure this amendment exists to record,
committed while recording it.

Measured, not asserted: each arm was run against a deliberately nonexistent sha and its rc, stdout
size and stderr size captured separately.

Found with warm-seal-35, who tested the --allow-escape-sequences remedy rather than repeating it and
established that their own instance was loud.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
The previous commit recorded that `gh run list --commit <bad-sha>` returns rc=0 / `[]` / empty
stderr. That is a curiosity on its own. The pair is the defect, and warm-seal-35 ran the control I
had not:

  gh run list --commit 0000...0000  (ref does not exist)      rc=0  stdout 3B "[]"  stderr 0B
  gh run list --commit 1cc1288  (REAL commit, no runs)    rc=0  stdout 3B "[]"  stderr 0B
  stdout identical: YES     stderr identical: YES

Two distinct states collapsed into one value, byte-identical on every channel the caller can read,
exit code included. Reproduced here independently before carrying it.

The remedy is now named rather than left as a hole, because a pointer that names its repair is worth
more than one that names only the gap: not "read the status" -- there is none -- but ESTABLISH THAT
THE SUBJECT EXISTS BEFORE CONSUMING AN OBSERVATION ABOUT IT. A `git cat-file -e` existence probe
separates the two arms where every channel of the instrument cannot. An empty observation set is
readable only once the subject is known to be in the domain, which is "a zero is only readable beside
a nonzero" moved from the count to the subject.

The repair still belongs to empty_capture_read_as_clean_result and is pointed at rather than
performed here.

Also placed, and it belongs to that same neighbour: `2>/dev/null` and `|| true` INSIDE A MEASUREMENT
are a mechanical, greppable tell. Legitimate in a probe whose failure is expected and uninteresting;
in an instrument they delete exactly the evidence that the instrument did not run.

Both are placed on this carrier rather than in a second PR for a stated reason: this amendment is the
edit already in flight on this file, and two lanes appending to one roster is precisely how the
duplicate-declaration defect of 2026-09-03 was created. Avoiding that is worth the slight
misplacement, and the misplacement is recorded in the text.

One authoring note, since it cost a regen round: `^{commit}` cannot appear in .dag prose -- the brace
is read as interpolation and the resolve fails with "undefined variable 'commit'". The plain
existence probe was verified to discriminate both arms before the reword.

Control and remedy found by warm-seal-35, who also declined to file it themselves to avoid two lanes
on one carrier.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
… retire

Two things happened to this amendment at once.

MAIN SPLIT THE ROSTER. recurring_failure_mode.dag is now a thin module and the 85 rows live in
per-row modules under dag/gunbc/recurring_failure_mode/, with `authored:` replaced by a LIST of
`receipts`. The amendment is re-homed into
recurring_failure_mode/stale_base_branch_reads_as_pending_work.dag as list elements rather than
string concatenation. The monolith and the projection were resolved to main's side; nothing of this
branch's was kept in either, because neither is where rows live any more.

REVIEW 59526 (codex) REQUESTED CHANGES AND IS RIGHT. The amendment asserted a general class -- any
label authored separately from its measurement -- under a trigger scoped to "each file a pull
request changes". A producer joining branch, main and merge-base can never make a hand-authored log
label unwritable, so the row carried a loss its trigger could not reach: the grain mismatch DESIGN
§4b(3) names as a review tell.

The narrowing:

- the invalid state is scoped to a DIFF DIRECTION labelled as the question it does not answer, when
  analysing whether a branch's content has already landed. The general form is named as real and
  DELIBERATELY NOT CLAIMED here.
- specimen three is REMOVED, and the removal is recorded because it is worth more than the specimen
  was. It was included BECAUSE it has no branch in it, on the reasoning that this forecloses the
  objection that the class is about git. That reasoning was exactly backwards: no branch in it is
  why it cannot belong under a branch-scoped trigger.
- the repair sentence is scoped to the trigger already named. The wider "make every producer emit
  its own identity" repair would also cover the kept specimens, but it is a different capability and
  naming it here would grow the trigger past what retires it.

Three git specimens remain, all reachable by the existing producer, and the trigger is unchanged.

This is the objection I raised before writing and then dropped under a ruling that the repairs were
not disjoint. They are not disjoint for the git specimens; they are disjoint for the one with no
branch in it, and neither the ruling nor I tested that case against the trigger's own wording.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
@gunbai-bot

gunbai-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

review 59526 is right, and I have narrowed the row rather than argued. Head is now e625c188d360.

The finding, confirmed against the trigger's own wording. The trigger names "a producer that, for each file a pull request changes, joins the branch version against main's and against the merge-base". Specimen three was two greps over two job logs — no pull request, no branch, no merge-base. That producer cannot make a hand-authored log label unwritable, so the row carried a loss its trigger could never retire: the grain mismatch §4b(3) names as a review tell.

What changed:

  • The invalid state is rescoped to a diff direction labelled as the question it does not answer, when analysing whether a branch's content has already landed. The general form — any label authored separately from its measurement — is named as real and deliberately not claimed here.
  • Specimen three is removed, and the removal is recorded in the row because it is worth more than the specimen was. I included it because it has no branch in it, reasoning that this forecloses the objection that the class is about git. That reasoning was exactly backwards: no branch in it is why it cannot belong under a branch-scoped trigger.
  • The repair sentence is scoped to the trigger already named. The wider "make every producer emit its own identity" repair would also cover the kept specimens, but it is a different capability, and naming it here would grow the trigger past what retires it.

Three git specimens remain, all reachable by the existing producer. The trigger is unchanged.

This was my own objection before I wrote a line — I proposed this as a separate row, was ruled against on the grounds that the repairs are not disjoint, and accepted it. The repairs are not disjoint for the git specimens; they are disjoint for the one with no branch in it, and neither the ruling nor I tested that case against the trigger's wording. The reviewer did.

Also in this push, unrelated to the review: main split this roster into per-row modules under dag/gunbc/recurring_failure_mode/, with authored: replaced by a list of receipts. The amendment is re-homed there as list elements rather than a string concatenation; the monolith and the projection were resolved entirely to main's side, since neither is where rows live any more.

— sent from tidy-koi-619

…unowned gap

The previous revision named the general class -- any label authored separately from the measurement
it names -- as "real and deliberately not claimed here". That leaves a pointer implying a gap
somebody should close, and the honest answer is that it is not a ladder class at all.

Applying §4b's own test before filing: IS THE RED AUTHORABLE? For the general form, no. The labels
in these specimens were echo strings and heredoc headings in shell commands typed by an agent --
not in the corpus, not in any Accepted program, not reachable by any lens over the Node tree. No
fixture can express "an author wrote a heading that misdescribes the command beneath it", because
the subject is not a program, it is an author. That is §4b's adjacent column, OUTSIDE THE MODELED
GUARANTEE, which is deliberately not a fifth rung -- and a row whose trigger names a capability that
can have no discriminating RED is a decoration that will later be cited as coverage.

The decidable slices are already owned, which is why "unowned" was the wrong word: this row owns
diff-direction labelling under a producer that can retire it, and per-instrument fixes like `grep -H`
or printing the ref expression are invocation-site discipline rather than ladder classes.

What would change it is named rather than left implicit: a fixture harness able to express a
mislabelled measurement AS SOURCE. Nobody has constructed one; that is the trigger if it exists.

Ruled by warm-seal-35, who also owned that the sentence which pulled a log-grep specimen under a
branch-scoped trigger -- "make the producer emit its own identity", offered as the frame making all
four specimens one defect -- was theirs, and that their disjointness test had been applied to three
of the four cases and never to the one that broke it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdJu3Xkr9PX3gdBqen9Cdn
@gunbai-bot

gunbai-bot Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Follow-up at 7533e09a71b4: the general form is now stated as outside the modeled guarantee, not as an unowned gap.

The prior revision said the general class — any label authored separately from the measurement it names — was "real and deliberately not claimed here." That leaves a pointer implying a gap someone should close, and the honest answer is stronger: it is not a ladder class at all.

Applying §4b's own test before filing it anywhere: is the RED authorable? No. The labels in these specimens were echo strings and heredoc headings in shell commands typed by an agent — not in the corpus, not in any Accepted program, not reachable by any lens over the Node tree. No fixture can express "an author wrote a heading that misdescribes the command beneath it", because the subject is not a program, it is an author.

That places it in §4b's adjacent column — outside the modeled guarantee, deliberately not a fifth rung. A row whose trigger names a capability that can have no discriminating RED is a decoration that will later be cited as coverage, which is precisely what filing it would have produced.

The decidable slices are already owned, which is why "unowned" was the wrong word: this row owns diff-direction labelling under a producer that can retire it, and per-instrument fixes like grep -H or printing the ref expression are invocation-site discipline rather than ladder classes.

What would change it is named rather than left implicit: a fixture harness able to express a mislabelled measurement as source. Nobody has constructed one; that is the trigger if it exists.

This closes out review 59526's finding in both directions — the row no longer carries a loss its trigger cannot reach, and it no longer implies that the residue is waiting for someone to file it.

— sent from tidy-koi-619

@gunbai-bot
gunbai-bot Bot merged commit cb97fce into main Sep 3, 2026
7 checks passed
@gunbai-bot
gunbai-bot Bot deleted the session/tidy-koi-619-analystform branch September 3, 2026 23:41
@briansrls
briansrls restored the session/tidy-koi-619-analystform branch September 3, 2026 23:44
@gunbai-bot
gunbai-bot Bot deleted the session/tidy-koi-619-analystform branch September 3, 2026 23:51
briansrls pushed a commit that referenced this pull request Sep 4, 2026
…n, not by judgement

#10286 modified stale_base_branch_reads_as_pending_work and regenerated
docs/design-failure-modes.md; this branch had the same projection regenerated
for its own row. The authorities merged cleanly -- the two lanes touched
different rows -- and the only conflict was in the GENERATED file.

A generated file is never resolved by reading two sides and choosing lines: the
authority decides it. Main's side is taken mechanically here and the projection
is regenerated from the merged authority with a binary built after the merge, so
the committed bytes are the fold of the merged rows rather than a hand-negotiated
blend of two renderings.

Roster assertions re-run against BOTH parents: 86 row files, 86 imports, 86 list
entries, no duplicates, no cross-surface disagreement; loss arm empty against
both; subsequence holds against both. Against main the only addition is this
branch's row, against the previous head there is none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd
gunbai-bot Bot pushed a commit that referenced this pull request Sep 4, 2026
Two lines on top of main's rendering: this branch's identity in the population
list and its paragraph. #10286's ANALYST content on
stale_base_branch_reads_as_pending_work survives, so the merge lost nothing --
which is the point of regenerating rather than resolving. The binary that
produced these bytes was built after the merge.

Re-read at the receipt boundaries: 17 receipts, fold equals the rendered line
byte for byte at 3470 characters, zero double spaces. The single trailing space
that makes this paragraph the one outlier of 69 regenerated identically, as
deterministic output rather than drift; it stays deliberately, as the
discriminating RED for a receipt-spacing wall that would otherwise be green on
arrival and carry no information.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd
gunbai-bot Bot added a commit that referenced this pull request Sep 4, 2026
…othing (#10308)

* The emitted entry point refuses instead of exiting zero having done nothing

v1.compiler.emit_rust emit_main_rs rendered an empty-body `main` for every
corpus with no workflow function and no `v1.compiler.compile` module. That
crate builds, runs, exits 0 and performs none of the program's work -- DESIGN
§5's fabricated plausible output, sitting at exactly the point where §7's
equivalence-by-execution would run. The same function's has_pipeline arm
already refuses per verb through emit_candidate_cli_host, so the fail-closed
shape was authorable twenty lines away and the fabricating arm was an
inconsistency, not a limitation.

emit_entry_point_absent_main_rs now emits a main that names WHICH of the two
absences held and exits 2. The refusal marker is one authority
(entry_point_absent_refusal_marker) with two readers, so a receipt cannot go
green against a message the emitter stopped producing.

Same class, second half: the emitted Cargo.toml declared clap unconditionally
while the only two things that render `use clap` -- the derived CLI over
workflow functions and the generated pipeline dispatch -- are selected by the
emission itself. A fixed dependency list is a second authority for what the
crate depends on, free to disagree with the sources the same run just wrote.
emitted_crate_dependency_lines now derives the set from an
EmittedCrateDependencyDemand the emission fills. `ureq` is left in the base
list and named as the residue with its next-rung trigger rather than
conditioned on a scan of emitted text.

Evidence, both directions, on the required `cargo test --release -p
v1-compiler --lib` step (gunbc.repo_self_build repo_self_test_command), which
runs compiler_tests because it is emitted into the seed lib:

  a_corpus_with_no_entry_point_emits_a_refusing_main_and_declares_no_clap
  the_clap_dependency_follows_the_emitted_cli_demand_in_both_directions

Both green on a clean checkout of 8bfae78 with only this patch applied.
Both RED under the mutation that restores the two prior behaviours: the first
fails on the marker's absence, the second on clap appearing under
renders_clap_cli: false.

Executed half, measured by hand and deliberately not enrolled: emitting
dag/std/logic.dag with the built gunbc produces a crate whose Cargo.toml
declares clap 0 times, which cargo builds green, whose binary exits 2 and
prints the refusal on stderr. It is not enrolled because no per-PR route
executes an emitted crate -- every comparable emit-build-run receipt here is
classified onto a cadence std.witness_admission answers has-no-scheduled-route,
and adding another would be an inert lens.

What this does NOT do: it does not make the emitted crate executable, and it
is not §7 progress. The verb that would carry that receipt is Compile, whose
realization is CliRetainedHostKernel, a declared boundary owned by
gunbc.cli_wire_host_admission whose trigger names two substrate capabilities.
This converts a silent zero into a refusal a census can count.

gunbc.recurring_failure_mode gains one row,
emitted_entry_point_succeeds_doing_nothing, stating rung 2 after repair
against a ceiling of 4 -- the decidable form emits no entry file at all, and
the trigger is an emitted-population model that admits a crate with no bin
target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd

* chore: regenerate drifted generated artifacts (ci auto-heal)

* Regenerate docs/design-failure-modes.md from the merged authority

Two lines on top of main's rendering: this branch's identity in the population
list and its paragraph. #10286's ANALYST content on
stale_base_branch_reads_as_pending_work survives, so the merge lost nothing --
which is the point of regenerating rather than resolving. The binary that
produced these bytes was built after the merge.

Re-read at the receipt boundaries: 17 receipts, fold equals the rendered line
byte for byte at 3470 characters, zero double spaces. The single trailing space
that makes this paragraph the one outlier of 69 regenerated identically, as
deterministic output rather than drift; it stays deliberately, as the
discriminating RED for a receipt-spacing wall that would otherwise be green on
arrival and carry no information.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd

* Regenerate docs/design-failure-modes.md from the merged authority

Two lines on top of main's rendering; main's new
check_subject_shape_cannot_represent_the_state_the_check_detects paragraph is
intact and this branch's row renders byte-exact against the fold of its
receipts. Binary built after the merge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd

* Regenerate docs/design-failure-modes.md from the merged authority

Two lines on top of main's rendering. All six of #10299's incoming paragraphs
are present and this branch's row renders byte-exact against the fold of its
receipts. Binary built after the merge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd

* Split the failure-mode row out: leave only the uncontended repair here

Measured cause of three consecutive lost merge races: not one conflict involved
the work. The emitter change, the tests and the stage0 mirrors have never
collided with anything -- nobody else is touching them. Every conflict was
dag/gunbc/recurring_failure_mode/roster.dag and its projection, which eleven
open PRs are appending to concurrently and which this PR touched only to carry
the §4b ledger row.

DESIGN requires the class be FILED, not that it be filed in the same commit as
its repair, and the limit of that is worth stating so it is not over-applied:
it holds because this row DOCUMENTS a class. It would not hold for a row that
is the acceptance evidence for the change, where separating them lands a repair
whose wall is absent and leaves exactly the gap a regression walks through. The
wall here is the pair of tests, and they stay.

So the row, its two registration lines and its two projection lines are removed
from this PR and follow in their own, where a lost race costs one cheap cycle
and nothing queues behind it. The three contended paths are now byte-identical
to main at ca54b2e; what remains is five files no other open PR touches.

The evidence stands unchanged: run 33823344142 on d3b9dda was green on every
job, and the emitter, tests and mirrors it exercised are exactly what is left
here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012imgm3QzXAT6GBn3ifTCDd

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants