Widen the second-generation drop to every regenerating phase, and kill the stale enrolment claim that hid it

dag/gunbc/commit_workflow.dag

@@ -1361,7 +1361,7 @@ data githooks_pre_push_slimmed_to_fmt_disposition: Disposition = Terminal {
 }
 
 data commit_gate_rust_suite_removed_disposition: Disposition = Terminal {
-  reason: "The v1 Rust test suite (cargo fmt --all --check plus cargo nextest run -p v1-compiler-tests) was REMOVED from CI 2026-07-11 (operator ruling) — its RustMonolithGate enrollment, the rust_tests job, and rust_gates_ci.dag's CI consumers are all gone. This records the removal as intentional, not silent (the review-flagged concern). Rationale: rust_tests was NON-required (only the ci job is protection-required on the gunbc main ruleset; rust_tests and ci_regen were not) AND red on main (it exercises the v1 seed, which is being deleted under the §7 burn-down), so it delivered a permanent non-required red — the §5 tolerated-red anti-pattern — at ~37 GiB, the fleet's single largest CI memory job. AMENDED 2026-07-15 (operator ruling, the falsifier lane): the fmt HALF of this removal is REVERSED — cargo fmt --all --check is re-enrolled as a standalone build-job step (gunbc.ci_spec ci_fmt_gate_note / ci_fmt_gate_line). Every rationale above is a fact about NEXTEST (37 GiB, red, seed-runtime); fmt is 4.3s measured, parse-only, needs no build, and is green — it was collateral damage of a §3 fusion, since tools.rust_gates_ci.run_gates welds both into one ProcessExit, so killing the bundle killed the cheap green half. This amendment does NOT re-enroll RustMonolithGate (still REJECTED below) and does not return nextest to CI. AMENDED 2026-07-31 (operator ruling, PR #7490 repair): the COMPILE half for the separate v1-compiler-tests workspace crate is RE-ENROLLED as cargo check -p v1-compiler-tests --tests (gunbc.ci_spec ci_v1_compiler_tests_compile_gate_note / ci_v1_compiler_tests_compile_gate_line) — compile-only, no test execution, ~41s measured cold; NOT nextest and NOT RustMonolithGate. #7490 updated typecheck_module and fixed stage0 call sites but left four direct integration-test callers stale because neither DagCompileCleanGate nor the release build compiles that crate. The former claim 'cargo fmt stays enforced by the pre-push hook (CommitCargoFmtCheck on GitPrePushHook)' is RETRACTED as the enforcement authority: a hook is an escape hatch (§5) — opt-in per clone via a manual core.hooksPath config, bypassable with --no-verify, and absent in container worktrees — and it is PROVEN ineffective, not merely theoretically weak: #6658 landed an unformatted .rs on main 2026-07-15 and no gate caught it. The hook remains as fast local feedback, never as the wall. Coverage now: cargo fmt = the required CI path (ci needs:[build], so a red fmt step blocks the required job by construction); cargo check -p v1-compiler-tests --tests = the required CI compile path for direct Rust integration-test call sites; cargo nextest run -p v1-compiler-tests still runs LOCALLY, not in CI. Return trigger for NEXTEST — NONE by design: that suite does not re-enroll. It is retired WITH the v1 seed and deleted at §7 terminal collapse. Re-enrolling RustMonolithGate onto the required ci floor is explicitly REJECTED — it would move the ~37 GiB red job into the required merge gate. DagCompileCleanGate still catches .dag compile drift; this gate closes the v1-compiler-tests direct-caller hole it cannot see. CORRECTED 2026-08-20: this sentence also named RegenVerifyGate as live cover. It is not — RegenVerifyGate was RETIRED AT THE ROOT by the regen cut, recorded in enrollment_surface_asymmetry_retired_note in this same module. The false half was load-bearing precisely because this is the sentence explaining why a hole is considered covered, so it made an unguarded class read as guarded, and mirror drift did accumulate on main unobserved: sixteen generated stage0 mirrors had diverged from their .dag authorities by 2026-08-20, verified as real content divergence rather than a formatter artifact by a whitespace-stripped differential that shares no code with the regen comparator. RE-CORRECTED THE SAME DAY, hours later, because the first correction's own factual half died before the ink dried: it stated that no workflow computes the regen fixed point and that witnesses.yml does not invoke --required-regen. #8618 falsified both. witnesses.yml on main now enrols TWO required steps between the parse step and the floor fold — --required-regen (first generation matches the committed candidate) and --required-regen-fixed-point (G0 emit reproduces itself on a second pass) — each gated on its predecessor's outcome, and the same PR regenerated all sixteen mirrors, so the drift population is closed rather than merely observed. The hole this sentence describes is therefore GUARDED again, by a different mechanism than the retired gate it once wrongly credited. Recorded as two dated corrections rather than one rewritten sentence because the failure mode is identical in both directions and the second instance is the more instructive: a correction that asserts a live enrollment fact acquires an expiry the moment enrollment changes, so what a carrier may safely assert about CI is which authority owns a fact, not which jobs happen to be running today."
+  reason: "The v1 Rust test suite (cargo fmt --all --check plus cargo nextest run -p v1-compiler-tests) was REMOVED from CI 2026-07-11 (operator ruling) — its RustMonolithGate enrollment, the rust_tests job, and rust_gates_ci.dag's CI consumers are all gone. This records the removal as intentional, not silent (the review-flagged concern). Rationale: rust_tests was NON-required (only the ci job is protection-required on the gunbc main ruleset; rust_tests and ci_regen were not) AND red on main (it exercises the v1 seed, which is being deleted under the §7 burn-down), so it delivered a permanent non-required red — the §5 tolerated-red anti-pattern — at ~37 GiB, the fleet's single largest CI memory job. AMENDED 2026-07-15 (operator ruling, the falsifier lane): the fmt HALF of this removal is REVERSED — cargo fmt --all --check is re-enrolled as a standalone build-job step (gunbc.ci_spec ci_fmt_gate_note / ci_fmt_gate_line). Every rationale above is a fact about NEXTEST (37 GiB, red, seed-runtime); fmt is 4.3s measured, parse-only, needs no build, and is green — it was collateral damage of a §3 fusion, since tools.rust_gates_ci.run_gates welds both into one ProcessExit, so killing the bundle killed the cheap green half. This amendment does NOT re-enroll RustMonolithGate (still REJECTED below) and does not return nextest to CI. AMENDED 2026-07-31 (operator ruling, PR #7490 repair): the COMPILE half for the separate v1-compiler-tests workspace crate is RE-ENROLLED as cargo check -p v1-compiler-tests --tests (gunbc.ci_spec ci_v1_compiler_tests_compile_gate_note / ci_v1_compiler_tests_compile_gate_line) — compile-only, no test execution, ~41s measured cold; NOT nextest and NOT RustMonolithGate. #7490 updated typecheck_module and fixed stage0 call sites but left four direct integration-test callers stale because neither DagCompileCleanGate nor the release build compiles that crate. The former claim 'cargo fmt stays enforced by the pre-push hook (CommitCargoFmtCheck on GitPrePushHook)' is RETRACTED as the enforcement authority: a hook is an escape hatch (§5) — opt-in per clone via a manual core.hooksPath config, bypassable with --no-verify, and absent in container worktrees — and it is PROVEN ineffective, not merely theoretically weak: #6658 landed an unformatted .rs on main 2026-07-15 and no gate caught it. The hook remains as fast local feedback, never as the wall. Coverage now: cargo fmt = the required CI path (ci needs:[build], so a red fmt step blocks the required job by construction); cargo check -p v1-compiler-tests --tests = the required CI compile path for direct Rust integration-test call sites; cargo nextest run -p v1-compiler-tests still runs LOCALLY, not in CI. Return trigger for NEXTEST — NONE by design: that suite does not re-enroll. It is retired WITH the v1 seed and deleted at §7 terminal collapse. Re-enrolling RustMonolithGate onto the required ci floor is explicitly REJECTED — it would move the ~37 GiB red job into the required merge gate. DagCompileCleanGate still catches .dag compile drift; this gate closes the v1-compiler-tests direct-caller hole it cannot see. CORRECTED 2026-08-20: this sentence also named RegenVerifyGate as live cover. It is not — RegenVerifyGate was RETIRED AT THE ROOT by the regen cut, recorded in enrollment_surface_asymmetry_retired_note in this same module. The false half was load-bearing precisely because this is the sentence explaining why a hole is considered covered, so it made an unguarded class read as guarded, and mirror drift did accumulate on main unobserved: sixteen generated stage0 mirrors had diverged from their .dag authorities by 2026-08-20, verified as real content divergence rather than a formatter artifact by a whitespace-stripped differential that shares no code with the regen comparator. RE-CORRECTED THE SAME DAY, hours later, because the first correction's own factual half died before the ink dried: it stated that no workflow computes the regen fixed point and that witnesses.yml does not invoke --required-regen. #8618 falsified both. #8618 enrolled two required steps invoking --required-regen and --required-regen-fixed-point directly, and regenerated all sixteen mirrors, so that drift population was closed rather than merely observed. THAT ENROLMENT CLAIM IS DEAD AND THIS SENTENCE NO LONGER MAKES ONE (corrected 2026-09-04, third correction to this paragraph). The lane consolidation replaced per-flag steps with two invocations of claim_executor --required-ci --required-lane build|witnesses, and the binary owns the partition, so `--required-regen-fixed-point` appears ZERO times in .github/workflows/witnesses.yml today and no required phase computes a fixed point: gunbc.required_ci_phase_roster declares exactly five phases -- parse, namespace-wave-admission, regen, generated-artifact, floor -- and none of them is a fixed-point arm. The standing loss is rostered in gunbc.rung_drop floor_cut_regen_second_generation_agreement, which is the authority for it; this paragraph deliberately does not restate that row's population, because restating it here is how this sentence went stale in the first place. WHAT THE THIRD CORRECTION COSTS, RECORDED BECAUSE THE PARAGRAPH'S OWN CLOSING WARNING PREDICTED IT AND WAS IGNORED: on 2026-09-04 this sentence was read as current by a lane auditing fixed-point coverage, which reported to its manager that the regen phase performs a fixed point over its population. It does not. That report was approved, and an hour of work was authorised on it twice before the lane read the workflow instead of this prose and refused its own premise. So the rule below is not a style preference and has now a named victim: what a carrier may safely assert about CI is WHICH AUTHORITY OWNS A FACT, never which steps are running today -- and the correct repair for a stale enrolment sentence is to delete the claim and name the authority, which is what this revision does rather than substituting today's shape for yesterday's. Recorded as two dated corrections rather than one rewritten sentence because the failure mode is identical in both directions and the second instance is the more instructive: a correction that asserts a live enrollment fact acquires an expiry the moment enrollment changes, so what a carrier may safely assert about CI is which authority owns a fact, not which jobs happen to be running today."
 }
 
 data commit_gate_roster: List<CommitCheckEnrollment> = [