Give docs/*.md ledger projections a ProcessExit actuator that can finish

dag/gunbc/generated_artifact_boundary_seed_growth.dag

@@ -76,13 +76,13 @@ import gunbc.seed_growth { SeedGrowthJustification }
 // line to the emitted lib.rs and its SeedRetainedIntrinsicRegistration carries has_pub_mod: false.
 // What grows is the SeedRetained roster, enumerated below.
 //
-// HAND-ITEM DELTA: +20, all enumerated below rather than counted, and ZERO of them uncitable --
+// HAND-ITEM DELTA: every host declaration is enumerated below rather than counted, and ZERO of them uncitable --
 // there is not one impl block in the file, which is deliberate and cost something. The first cut
 // carried four inherent methods, and every impl method is uncitable as a DeclarationRef because
 // std.decl_ref offers WholeDeclaration or NamedField and neither names a method on an impl block,
 // so they would have grown the class gunbc.seed_growth_admission reports as
 // seed_growth_uncitable_item_keys. They are free functions instead. THE DELTA IS A NET FIGURE AND
-// THE NET IS NOT +20 ACROSS THE CHANGE: bin/claim_executor.rs LOSES three declarations
+// THE NET IS NOT A COUNT ACROSS THE CHANGE: bin/claim_executor.rs LOSES three declarations
 // (GeneratedArtifactPathBody, generated_artifact_ctx, generated_artifact_body_for_path) which are
 // hoisted rather than added, so the corpus-wide hand-item delta for those three is ZERO and only
 // their new home changed. They are listed below because the roster names where an obligation LIVES,
@@ -185,6 +185,21 @@ data generated_artifact_boundary_seed_growth_justification: SeedGrowthJustificat
       decl_name: "run_generated_artifact_boundary",
       field: WholeDeclaration
     },
+    DeclarationRef {
+      module_path: "v1_compiler.generated_artifact_boundary_host",
+      decl_name: "DOCS_PROJECTION_GATE_ENTRY",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.generated_artifact_boundary_host",
+      decl_name: "DocsProjectionAgreement",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.generated_artifact_boundary_host",
+      decl_name: "run_docs_projection_agreement",
+      field: WholeDeclaration
+    },
     DeclarationRef {
       module_path: "v1_compiler.generated_artifact_boundary_host",
       decl_name: "disposition_separates_absent_from_drifted",
@@ -218,6 +233,6 @@ data generated_artifact_boundary_seed_growth_justification: SeedGrowthJustificat
   ],
   reason: "The phase compares a modeled projection against BYTES ON DISK, and reading the committed file is a host effect the required floor's hermetic envelope refuses by construction -- so the leaf is Rust for the same reason ingestion is. The rejected alternative was running the existing tools.generated_artifact_gate main through the interpreter in Wet mode, refused because it makes the interpreter load-bearing for a NEW required phase while two lanes delete it, and because that gate body also reaches artifact_extra_valid's ci_yml_parses, so the required phase would acquire a second subject nobody asked it to check. What the growth buys is that a committed projection diverging from its authority stops the line at all: for the whole interval since the 2026-08-15 floor cut, DESIGN.md and ROADMAP.md were compared by nothing, and the first execution of this phase found four divergences, one of them wrong since #9394.",
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
-  trigger: "Delete the 20 generated_artifact_boundary_host declarations when the required run can execute a .dag adjudicator over this population -- that is, when a modeled operation can read a committed file's bytes inside the required envelope, at which point the whole comparison is gunbc.generated_artifact_emit plus one modeled read and this host has nothing left to do. Delete the separately rostered v1_compiler.bin.claim_executor run modification when required-run dispatch consumes gunbc.required_ci_phase_roster RequiredCiPhase directly under ROADMAP node v1-hand-queue-drain. A PARTIAL migration is admissible and is the expected shape: the four pure declarations here (AdjudicatedArtifact, ArtifactDisposition, artifact_disposition, artifact_disposition_name) are a fold over two strings and dissolve the moment anything models them, independently of the read. What does NOT dissolve them is moving them to another host file, and what does NOT dissolve them is a witness asserting this host agrees with the model -- that would raise the rung without removing the duplicate.",
+  trigger: "Delete every v1_compiler.generated_artifact_boundary_host row in hand_authored_declarations when the required run can execute a .dag adjudicator over this population -- that is, when a modeled operation can read a committed file's bytes inside the required envelope, at which point the whole comparison is gunbc.generated_artifact_emit plus one modeled read and this host has nothing left to do. Delete the separately rostered v1_compiler.bin.claim_executor run modification when required-run dispatch consumes gunbc.required_ci_phase_roster RequiredCiPhase directly under ROADMAP node v1-hand-queue-drain. A PARTIAL migration is admissible and is the expected shape: the four pure declarations here (AdjudicatedArtifact, ArtifactDisposition, artifact_disposition, artifact_disposition_name) are a fold over two strings and dissolve the moment anything models them, independently of the read. What does NOT dissolve them is moving them to another host file, and what does NOT dissolve them is a witness asserting this host agrees with the model -- that would raise the rung without removing the duplicate.",
   current_boundary: "src/v1/stage0/src/generated_artifact_boundary_host.rs; src/v1/stage0/src/cli_run.rs (one #[path] mod line and one pub use, adding no declaration); src/v1/stage0/src/bin/claim_executor.rs run (ExistingSeedItemModified: the required generated-artifact phase body consumes gunbc.required_ci_phase_roster RequiredCiPhase; no new Rust declaration); dag/gunbc/generated_artifact_boundary_seed_growth.dag"
 }

dag/gunbc/instruments/ci_gates.dag

@@ -1,6 +1,6 @@
 module tools.ci_gates
 
-import std.process { ProcessExit, ExitSuccess, exit_failure }
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import gunbc.ci_gate { EmitHostGate, Gate, CheapClaimPoolGate }
 import gunbc.ci_spec {
   gunbc_ci_gates, CiSpec,
@@ -18,10 +18,6 @@ import tools.prose_row_introduction_gate { run_prose_row_introduction_gate }
 import gunbc.rung_drop { rung_drop_declaration_message }
 import gunbc.rung_drop.source_root_ingest_gate_rung_drop { source_root_ingest_gate_rung_drop }
 
-fn exit_ok(e: ProcessExit) -> Bool {
-  match e { ExitSuccess => true  _ => false }
-}
-
 fn run_spec_gate(g: Gate) -> ProcessExit {
   match g {
     EmitHostGate => run_emit_host_ci_gate()
@@ -39,7 +35,10 @@ fn run_spec_gate(g: Gate) -> ProcessExit {
 
 fn run_gate_list(gates: List<Gate>) -> ProcessExit {
   fold(gates, init: ExitSuccess, f: fn(acc, g) {
-    if exit_ok(e: acc) { run_spec_gate(g: g) } else { acc }
+    match acc {
+      ExitSuccess => run_spec_gate(g: g)
+      ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+    }
   })
 }
 

dag/gunbc/instruments/dag_compile_clean_gate.dag

@@ -5,7 +5,7 @@ import gunbc.ci_gate { gate_receipt_exit, gate_receipt_failure_detail }
 import tools.dag_compile_clean_transport { run_clean_tree_compile }
 
 // The loudness half: the floor witness collapses this gate's ProcessExit to Bool via
-// tools.ci_gates.exit_ok, so compile-clean reds reported only returned Bool(false). The gate
+// std.process.exit_ok, so compile-clean reds reported only returned Bool(false). The gate
 // consumes the executor's one in-run compile receipt; the failure-receipt companion projects the
 // same receipt's located diagnostic without a second compile. BOTH HALVES NOW READ ONE RECEIPT.
 // Before this retype the body branched on a Bool and, on the false side, INVENTED its reason --

dag/gunbc/instruments/docs_projection_agreement.dag

@@ -0,0 +1,21 @@
+module tools.docs_projection_agreement
+
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+
+data docs_projection_regen_command: String = "gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/docs_projection_gate.dag --function regen"
+
+// ONE PURE VERDICT OVER ONE PATH'S EXPECTED AND COMMITTED BYTES. Production regen and the
+// required generated-artifact phase both reach a ProcessExit through this function, so a fixture
+// can present drifted ledger bytes without resolving gunbc.generated_artifact_emit or writing
+// the live tree. The path is an argument because the diagnostic must name the file; production
+// callers pass artifact_path from gunbc.generated_artifact, the single location authority.
+fn docs_projection_bytes_agree(path: String, expected: String, committed: String) -> ProcessExit {
+  if expected == committed {
+    ExitSuccess
+  } else {
+    exit_failure(reason: concat(
+      "generated-artifact drift: ",
+      concat(path, concat(" is not derived from its .dag authority; regenerate with ", docs_projection_regen_command))
+    ))
+  }
+}

dag/gunbc/instruments/docs_projection_gate.dag

@@ -0,0 +1,67 @@
+module tools.docs_projection_gate
+
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
+import extdeps.filesystem.filesystem_io { Filesystem, filesystem_read_outcome, FilesystemReadSucceeded, FilesystemReadRefused }
+import gunbc.design_ledgers { expected_design_failure_modes_md, expected_design_rung_drops_md }
+import gunbc.generated_artifact {
+  artifact_path,
+  DesignFailureModesArtifact,
+  DesignRungDropsArtifact
+}
+import tools.docs_projection_agreement { docs_projection_bytes_agree }
+
+fn write_docs_projection(path: String, content: String) -> ProcessExit {
+  let w = Filesystem.Write(path: path, content: content)
+  if w.success {
+    ExitSuccess
+  } else {
+    exit_failure(reason: concat(concat("write failed for ", path), concat(": ", w.error)))
+  }
+}
+
+// THE CLEANLY-EXITING ACTUATOR FOR docs/*.md LEDGER PROJECTIONS.
+//
+// gunbc.generated_artifact_gate main_wet folds the WHOLE committed registry, and resolving
+// gunbc.generated_artifact_emit pulls every generator (plans, workflows, CAD, stage0 mirrors).
+// This entry still imports gunbc.generated_artifact for artifact_path only — the location
+// authority — not generated_artifact_emit. claim_executor --required-regen never owns these
+// files: is_compared_generated_basename is ends_with .rs. That ownership gap is the motive;
+// this entry returns ProcessExit over the two ledger paths.
+func regen() -> ProcessExit {
+  let first = write_docs_projection(
+    path: artifact_path(a: DesignFailureModesArtifact),
+    content: expected_design_failure_modes_md()
+  )
+  match first {
+    ExitSuccess => write_docs_projection(
+      path: artifact_path(a: DesignRungDropsArtifact),
+      content: expected_design_rung_drops_md()
+    )
+    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+  }
+}
+
+fn agree_one(path: String, expected: String) -> ProcessExit {
+  let r = Filesystem.Read(path: path)
+  match filesystem_read_outcome(content: r.content, success: r.success, error: r.error) {
+    FilesystemReadRefused { error } => exit_failure(
+      reason: concat(concat("docs projection unreadable: ", path), concat(": ", error))
+    )
+    FilesystemReadSucceeded { content } =>
+      docs_projection_bytes_agree(path: path, expected: expected, committed: content)
+  }
+}
+
+func main() -> ProcessExit {
+  let first = agree_one(
+    path: artifact_path(a: DesignFailureModesArtifact),
+    expected: expected_design_failure_modes_md()
+  )
+  match first {
+    ExitSuccess => agree_one(
+      path: artifact_path(a: DesignRungDropsArtifact),
+      expected: expected_design_rung_drops_md()
+    )
+    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+  }
+}

dag/gunbc/instruments/extdeps_scope_placement_gate.dag

@@ -251,7 +251,7 @@ func run_extdeps_scope_placement_gate_body() -> ProcessExit {
 }
 
 // The loudness half (gunbc#7644 diagnosis): the floor witness collapses this gate's ProcessExit to
-// Bool via tools.ci_gates.exit_ok, so ten consecutive main runs reported the bare string 'returned
+// Bool via std.process.exit_ok, so ten consecutive main runs reported the bare string 'returned
 // Bool(false)' and named neither the refusing arm nor the offending path — the located diagnostic
 // scope_placement_gate_verdict already builds was discarded one frame above it. This projects the
 // SAME verdict (one authority, never a second decision path) into the claim_executor

dag/gunbc/instruments/floor_effect_gate_witness.dag

@@ -5,7 +5,8 @@ import gunbc.ci_spec {
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate, ExtdepsScopePlacementGate,
   ProseRowIntroductionGate
 }
-import tools.ci_gates { exit_ok, run_spec_gate }
+import std.process { exit_ok }
+import tools.ci_gates { run_spec_gate }
 import tools.extdeps_scope_placement_gate { scope_placement_failure_receipt }
 import tools.prose_row_introduction_gate { prose_row_gate_failure_receipt }
 import tools.dag_compile_clean_gate { dag_compile_clean_failure_receipt }
@@ -37,35 +38,35 @@ import tools.generated_artifact_gate { generated_artifact_drift_failure_receipt
 // projection from this entry's declarations (see loudness_witness_note sequencing note).
 
 func emit_host_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: EmitHostGate))
+  exit_ok(e: run_spec_gate(g: EmitHostGate))
 }
 
 func cheap_claim_pool_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: CheapClaimPoolGate))
+  exit_ok(e: run_spec_gate(g: CheapClaimPoolGate))
 }
 
 func extdeps_external_authority_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: ExtdepsExternalAuthorityGate))
+  exit_ok(e: run_spec_gate(g: ExtdepsExternalAuthorityGate))
 }
 
 func dag_compile_clean_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: DagCompileCleanGate))
+  exit_ok(e: run_spec_gate(g: DagCompileCleanGate))
 }
 
 func generated_artifact_drift_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: GeneratedArtifactDriftGate))
+  exit_ok(e: run_spec_gate(g: GeneratedArtifactDriftGate))
 }
 
 func extdeps_scope_placement_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: ExtdepsScopePlacementGate))
+  exit_ok(e: run_spec_gate(g: ExtdepsScopePlacementGate))
 }
 
 func extdeps_scope_placement_gate_failure_receipt() -> String {
   tools.extdeps_scope_placement_gate.scope_placement_failure_receipt()
 }
 
 func prose_row_introduction_gate_passes() -> Bool {
-  tools.ci_gates.exit_ok(e: run_spec_gate(g: ProseRowIntroductionGate))
+  exit_ok(e: run_spec_gate(g: ProseRowIntroductionGate))
 }
 
 func prose_row_introduction_gate_failure_receipt() -> String {

dag/gunbc/instruments/generated_artifact_gate.dag

@@ -1,7 +1,7 @@
 
 module tools.generated_artifact_gate
 
-import std.process { ProcessExit, ExitSuccess, exit_failure }
+import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import extdeps.filesystem.filesystem_io { Filesystem }
 import gunbc.ci_gate { gate_receipt_failure_detail }
 import gunbc.generated_artifact {
@@ -46,10 +46,6 @@ fn generated_artifact_agreement_verdict(findings: GeneratedArtifactPopulationFin
   }
 }
 
-fn exit_ok(e: ProcessExit) -> Bool {
-  match e { ExitSuccess => true  _ => false }
-}
-
 // THE REMEDY IS PER FINDING, NOT PER RUN, AND REMOVING THE GLOBAL SENTENCE IS THE POINT. This body
 // used to append one closing instruction to every nonempty population -- do not hand-edit,
 // regenerate via main_wet -- which is correct for a content difference and WRONG for every other
@@ -99,7 +95,7 @@ func run_generated_artifact_drift_gate() -> ProcessExit {
 }
 
 // The loudness half: the floor witness collapses this gate's ProcessExit to Bool via
-// tools.ci_gates.exit_ok, so a generated-artifact drift red reported only returned Bool(false)
+// std.process.exit_ok, so a generated-artifact drift red reported only returned Bool(false)
 // without the located path. The gate body records the reason from its single
 // observe_generated_artifact_population pass; the failure-receipt companion consumes that retained
 // detail instead of re-observing. THE BODY NOW RECORDS THE CLEAN SIDE TOO, and that is the whole
@@ -244,16 +240,16 @@ func main_wet_one(path: String) -> ProcessExit {
 
 func main_wet() -> ProcessExit {
   fold(committed_generated_artifacts(), init: ExitSuccess, f: fn(acc, a) {
-    if exit_ok(e: acc) {
-      match artifact_generate(a: a) {
-        ArtifactGenerationRefused { reason } => exit_failure(reason: concat(concat("generation refused for ", artifact_path(a: a)), concat(": ", reason)))
-        ArtifactGenerated { content } => {
-          let w = Filesystem.Write(path: artifact_path(a: a), content: content)
-          if w.success { ExitSuccess } else { exit_failure(reason: concat(concat("write failed for ", artifact_path(a: a)), concat(": ", w.error))) }
+    match acc {
+      ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
+      ExitSuccess =>
+        match artifact_generate(a: a) {
+          ArtifactGenerationRefused { reason } => exit_failure(reason: concat(concat("generation refused for ", artifact_path(a: a)), concat(": ", reason)))
+          ArtifactGenerated { content } => {
+            let w = Filesystem.Write(path: artifact_path(a: a), content: content)
+            if w.success { ExitSuccess } else { exit_failure(reason: concat(concat("write failed for ", artifact_path(a: a)), concat(": ", w.error))) }
+          }
         }
-      }
-    } else {
-      acc
     }
   })
 }
@@ -359,9 +355,8 @@ func heal_repair_declaration() -> ProcessExit {
 
 func main_wet_verified() -> ProcessExit {
   let first = main_wet()
-  if exit_ok(e: first) {
-    run_generated_artifact_drift_gate_body()
-  } else {
-    first
+  match first {
+    ExitSuccess => run_generated_artifact_drift_gate_body()
+    ExitFailure { code, reason } => ExitFailure { code: code, reason: reason }
   }
 }

dag/gunbc/non_fold_residue.dag

@@ -597,16 +597,6 @@ data non_fold_residue_frontier: List<FrontierRow> = [
     reason: nfr_reason_mint_era,
     dissolution: nfr_dissolve_wildcard_total,
   },
-  FrontierRow {
-    subject: PathSubject { path: "dag/gunbc/instruments/ci_gates.dag::exit_ok" },
-    reason: nfr_reason_mint_era,
-    dissolution: nfr_dissolve_wildcard_total,
-  },
-  FrontierRow {
-    subject: PathSubject { path: "dag/gunbc/instruments/generated_artifact_gate.dag::exit_ok" },
-    reason: nfr_reason_mint_era,
-    dissolution: nfr_dissolve_wildcard_total,
-  },
   FrontierRow {
     subject: PathSubject { path: "src/v2/compiler/01_tokenize.dag::lex_try_rules_prefer_longer" },
     reason: nfr_reason_mint_era,