Delete world_converge at the root: replace it with std.goal_assessment

[gunbai-bot]

What this is

The first cut of the convergence replacement migration: gunbc.world_converge is deleted at the root and replaced by std.goal_assessment, a pure, subject-agnostic goal-assessment algebra. Its one binding, gunbc.repo_ruleset, cuts over to inspect_goal in the same motion.

The corpus search surface for the replaced authority was exactly four files — the module, repo_ruleset, and two witnesses — so this is a §3 atomic root cut, not a staged one. No shadow structure, no compatibility arm, no consumer that understands both representations.

Why the shape it replaces could not be fixed in place

WorldConvergenceHandler fused four separable facts into one record with an apply stage. Three consequences, all measured rather than argued:

1. The successful actuation path had never executed anywhere in the corpus. The generic's own fixture bound apply to FixtureApplyShouldNotRun, and the sole production binding is read-only. There was no green to preserve.
2. Read-only policy was modelled as an actuator that always refuses. Three of repo_ruleset's seven refusal causes described a write that does not exist. One of them — RepositoryRulesetUnexpectedLiveRule — was a second representation of a fact the divergence list already carried as RulesetRuleUnexpected, free to disagree, with only the second reachable once a hold fired.
3. That cost a real finding. Because the holds were ordered above the divergence step, an unreadable bypass roster returned the hold and discarded the drift list. Under this repository's credential the roster is unreadable on every live read — so verify reported "the roster could not be read" unconditionally and never reported that the enforcement, required contexts or ruleset name had also drifted.

What lands

dag/std/goal_assessment.dag — two layers kept as two layers:

• ObservationAttempt — did a usable snapshot exist at all. An established absence is a fact inside Observed, not a refusal.
• GoalAssessment — GoalSatisfied | GoalDiverged | GoalIndeterminate | GoalAssessmentRefused. GoalDiverged and GoalIndeterminate carry FreeSemigroup, so a divergence naming nothing has no constructor (§4b rung four).
• inspect_goal — guards observation first; the observer never receives the goal, so it cannot narrow what it looks at to what the desire mentions.
• assess_by_deviations / assess_by_deviations_and_unknowns — the mints. The list is destructured, so agreement and divergence are decided by the same match that supplies the payload; unknowns outrank deviations and the deviations survive into GoalIndeterminate.

No std.nonempty_list was minted. std.algebra already owns the free semigroup over T, and its grounding note explicitly withholds the NonEmptyList alias so one name never resolves to two declarations. Using anything else here would have been the §3 nickname this module exists to argue against.

gunbc.repo_ruleset cuts to inspect_goal. The five held standings redistribute onto the three facts they always were, and two causes are deleted rather than moved (RepositoryRulesetActuationRealizationUnbound, RepositoryRulesetUnexpectedLiveRule). RulesetBypassRosterUnobserved leaves the divergence coproduct and becomes RulesetUnknown — an unread fact was being filed as a proved mismatch. Two helpers that already recorded having no production consumer (bypass_roster_projection_refusal, merge_queue_projection_refusal) are deleted with the last thing that could be mistaken for one; the DELETE-hazard they carried is restated as an obligation on the writer that does not exist yet.

Every refusal is preserved. Unreadable read, proved drift, an undeclared bypass actor, an undeclared live rule, an unreadable roster, an unprojectable signed policy — all still exit non-zero. What changed is that the drift list is no longer discarded when a hold fires.

Evidence, by execution

• dag/test/claim/goal_assessment_witness_test.dag — 6 witnesses, all PASS: the observation guard (with a distinct refusal type per layer, so a root reaching the assessor could not return the observer's refusal), its positive control, both directions of the nonempty mint, unknowns-outrank-and-still-carry, and the fixed-point predicate answering false for indeterminate and for refused.
• dag/test/claim/repo_ruleset_goal_assessment_witness_test.dag — the binding's own witnesses, including the discriminating RED for the regression above: an unreadable roster must be GoalIndeterminate and must still carry the proved name drift. A model answering GoalDiverged has lost the first distinction; one answering GoalIndeterminate with empty known_deviations has reproduced the original defect exactly.
• dag/test/claim/repo_ruleset_witness_test.dag — retargeted; the unobserved-roster claim now asserts both halves (the unknown is produced and the divergence fold does not also carry it).

Deliberately not in this PR

reconcile_once — the effectful half (planner, admission boundary, ActuationCompletionUnknown, independent post-apply re-observation). Its only honest first consumer is the fleet admission spine (gunbc.fleet_converge_plan: generation, held lease, observed baseline, compare-and-set), and shipping an effectful protocol around one convenient adapter is precisely how the shape being deleted acquired an apply stage nothing ever ran. Trigger: that spine binding it.

A goal revision in the result. The law is real — a receipt should say which revision it assessed — but both consumers today declare their goal as corpus data, so the parameter would be a placeholder at every call site. Trigger: the plan basis, where a revision is what the compare-and-set is fenced against.

The §3b conformance row and the corpus fork gate. Deferred, and now for a measured reason rather than a cautious one: live_deploy is ~14,700 lines across 22 files and fleet_converge_plan.dag is 2,607. There is not yet one effectful authority to conform to, and adding the row before those land would canonize the missing post-observation boundary.

Finding, not fixed here

Four modules carry annotations claiming std has no generic nonempty carrier, which is false since FreeSemigroup landed: extdeps.external_authority, gunbc.scm.commit_closure, gunbc.machine_intake.subject, gunbc.host_assimilation_program. commit_closure's is the sharpest — its stated next-rung trigger was "a NonEmptyList authority earning its place from more than one consumer", and that trigger has fired without retiring anything. They are not repaired here because std.algebra's own convergence-debt note rules that the corpus-wide de-fork is not carried by the lane that landed the authority; the same reasoning applies to the lane that merely became its fifth consumer. Worth a follow-up work item.

Failure-mode row

read_only_policy_bound_as_an_actuator_that_only_refuses — the class this migration discovered, with its recognition rule (if every arm a binding supplies for a stage is a refusal, the binding does not inhabit that stage), the ordering harm, and its separation from three near neighbours.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PUtSkZTNvpWQv58Lk9cGzg

[gunbai-bot]

Fixed in 5ec3876 — review 62257 was right, and I verified it before acting rather than taking it on faith.

git grep -n goal_is_satisfied -- dag src returned exactly two sites: the definition and the witness asserting it. gunbc.repo_ruleset verify matches GoalSatisfied directly, which is the correct route precisely because the other three arms carry payloads it has to report. So the only consumer was a test — §3c and §5, and the function’s own annotation named a caller that did not exist.

The sharper part: this branch had already applied that exact test two files over, deleting bypass_roster_projection_refusal and merge_queue_projection_refusal because they recorded the same standing. I ran the reviewer’s question outward from the declarations I was deleting and never turned it back on the one I had just written. That asymmetry is the argument for §3c reading from consumers inward.

Deleted: goal_is_satisfied, its witness only_a_satisfied_goal_reads_as_a_fixed_point, the three fixture builders and the FixtureAssessment alias that existed only to feed it, and the now-unused GoalAssessmentRefused import.

On the law that witness carried — that indeterminate must not read as agreement. It is not weakened by the deletion, it is strengthened. With no one-bit summary in the module the conflation has no spelling to be written in: construction where there was validation, which is the direction §5 asks for. An annotation now stands where the predicate did, stating why the convenience is refused, so the next author does not restore it as a kindness.

Re-ran the generic-law witnesses after the deletion: 5/5 PASS (the sixth was the deleted one). The binding witnesses and the 29 pre-existing repo_ruleset witnesses are untouched by this commit.

— sent from sleek-newt-698

[gunbai-bot]

CI failure fixed in eb5dd6c9729, plus review 62263 addressed in the same commit. Both were real, and one caused the other.

Review 62263 — the witnesses were not enrolled. Verified against the modelled rule rather than by eye: v2.workflow.floor_naming_hygiene enrolls a decl only when its line starts with test fn or test data , and floor_discovery_barren_test_sidecar_reason_prefix refuses a *_test.dag entry that declares none. Both new files had grep -c "test fn" = 0, so floor discovery enrolled nothing from either. The whole evidence set for the new root — layer guard, nonempty-divergence law, unknowns-outrank-deviations — was inert. That is §4b(4) inverted: a climb deletes the lower-rung production machinery while its discriminating RED stays enrolled, and this migration deleted the enrolled world_converge witnesses and put unenrolled functions in their place. All ten are now test fn.

The CI failure was my previous fix. The annotation I put where goal_is_satisfied had been was a trailing // block at end of file. §4c admits only leading blocks attached to a module-scope declaration, so it named no subject — ten located parse errors, and they are what refused the floor phase (adjudication BLOCKING phase=parse ... (10 error(s))). The rationale now sits above type GoalAssessment, the carrier it is actually about. gunbc compile --source-root dag --source-root src/v2 reports 0 errors where CI reported ten.

Why my own verification missed both, since that is the transferable part. claim_batch --functions <names> runs whatever it is handed — it proves the assertions hold and says nothing about whether any lane would ever ask them. Naming functions to a runner is not evidence of enrollment. And it resolves an entry closure rather than running the parse phase over the corpus, so the annotation refusal could not reach it. I was using a runner as though it were the floor.

Also merged current main (the branch was 2 commits behind). On the regenerated ledger I ran the driver’s prescribed set-difference check rather than a count: no row from the base projection is missing, and admission_roster_read_as_the_whole_membership_rule — which briefly looked dark — is simply a row main added after my earlier merge, now present.

Not claiming green: the floor lane is the instrument for enrollment, and I want its run on this head to say so rather than assert it from the source.

— sent from sleek-newt-698

[gunbai-bot]

Correction to my previous comment: I said gunbc compile --source-root dag --source-root src/v2 reports 0 errors. That was read off an incomplete log. The finished run reports 21 blocking error(s), 26010 advisory diagnostic(s) under gunbc.compile_clean_diagnostic_policy, exit 1.

What I actually verified, stated at the grain it holds:

• The class CI refused on — source annotation names no subject — is 0 occurrences in the completed compile, down from 10. That is the fix, and it is measured.
• None of the 21 blocking errors is in a file this branch changes. Checked by joining the error locations against git diff --name-only origin/main: zero intersection. No error file imports std.goal_assessment or gunbc.repo_ruleset either, so there is no coupling by which this branch could have caused one. They are inherited from main, which this branch merged.
• I am not claiming the corpus is compile-clean, and gunbc compile is evidently not the gate the floor lane runs — main carries these 21 while its floor lane is green.

The overstatement mattered because "0 errors" is the kind of sentence a reviewer relies on instead of re-running, so it is corrected here rather than left to be discovered. The narrow claim it should have been: the annotation refusal that failed the floor phase is gone, and nothing else in this branch’s files is red.

— sent from sleek-newt-698

[gunbai-bot]

Fixed in 18dfb429b6f. All four findings in review 62280 verified against the tree first — all four real.

• fixture_subject() in the binding witness: no caller anywhere (git grep over the tree returns only the definition). Deleted.
• Bool in dag/std/goal_assessment.dag: residue of the deleted goal_is_satisfied; the only other occurrence is the word inside the annotation explaining why the predicate was refused. Removed.
• RepositoryRulesetConvergenceSubject, ObservationRefused, ObservationEstablished, RulesetBypassRosterUnobservable: imported, never referenced. Removed.

I did not fix only the four that were named. Four instances of one class is evidence about the class, not a list of four repairs, so I ran the same question over every import and declaration in all four files this branch adds. That found three more the review did not reach — List and GoalInspection in the generic witness, NoRequiredStatusChecksRule in the binding witness — plus gunbc_repository, which became unused only after the dead fixture was deleted and would have survived a finding-by-finding fix entirely.

Worth naming plainly: this is the third unconsumed declaration this branch has landed — goal_is_satisfied, then this fixture — both mine, both after the branch had already deleted two such helpers for that exact reason. §3c is easy to apply to code being removed and easy to forget on code being written. It now runs as a sweep over the diff rather than a judgement at each site, which is what caught the extra three.

Also confirmed while I was in there, since they read as unused by an in-file check and are not: inspect_goal and assess_by_deviations_and_unknowns have no second reference inside std.goal_assessment because their consumer is gunbc.repo_ruleset (repo_ruleset.dag:1190,1253).

Ten witnesses re-run after the deletions: 10 PASS, 0 FAIL.

Thanks for the non-findings you recorded as cleared — the FreeSemigroup-is-one-declaration check and the refusal-preservation check are the two I would most want a second reader on, and knowing they were examined is worth more than the findings.

— sent from sleek-newt-698

[gunbai-bot]

Fixed in 8255cea132f. Review 62287 is correct on every point, and it found the sharpest defect on this branch so far.

Verified before acting. ruleset_assess did answer signed_desire_projection_refusal() first and return a whole-assessment refusal, never reaching observation_divergences. So a merge-queue projection gap suppressed live enforcement, target, name and required-context drift that have nothing to do with it. That is the same ordering harm this branch deleted the actuation holds to fix, reproduced one layer down on the arm that was left — and an instance of the class this same branch rosters. The helper’s own prose still reads “Refusing rather than actuating”, which is exactly what it was: a refusal on behalf of a writer this module does not bind.

I did not take the minimum the review offered, because a stronger disposition is available and honest. The gap is not merely "don’t let it suppress the rest". The goal states the merge-queue desire twice — as the signed policy, and as the rules wire the projection carries — and when those two disagree, which one is the goal is undetermined. merge_queue_divergences can still compare the live queue against the signed policy, so the dimension is not unassessable for want of a comparison; it is unassessable for want of an unambiguous goal. That is an unknown on one dimension (RulesetMergeQueueDesireSelfInconsistent), carried beside every other dimension’s proved drift — the same shape the bypass roster got.

The type now states the consequence. With that arm gone, no state of this subject leaves its inputs incomparable, so AssessRefusal is v2.std.cardinality Never, which has no constructor. That is the checked claim, not a placeholder. The arm survives in verify’s match because the coproduct is closed — the property that makes a fifth assessment arm a compile error rather than a silent fall-through — and it is unreachable by construction rather than by convention.

Two witnesses added, both enrolled as test fn: the desire is self-consistent today and contributes no unknown, and a name drift is still reported with the desire self-consistent — which a short-circuit reinstated anywhere above the comparison fails. 36 witnesses across both repo_ruleset entries: 36 PASS, 0 FAIL.

Worth stating plainly, since it is the pattern rather than the instance: I deleted three refusals that spoke for an absent writer and left a fourth standing, in the same function, having just written a failure-mode row whose recognition rule names it. Finding four of a class and repairing three is how a class survives its own repair.

— sent from sleek-newt-698

[gunbai-bot]

Fixed in a14a66d032e. Review 62304 is correct on both findings, and the cause is worth more than the fix.

When this branch deleted gunbc.world_converge, the census was clean — four referents, all handled. Main then landed #10712 (std.decision, "selection precedes convergence"), which added a new world_converge consumer while this branch was deleting it. Merging main was textually clean, so the break arrived silently: no conflict, no marker, an unresolved import on a claim-witness path. A textual merge cannot see a symbol deleted on one side and newly referenced on the other.

DESIGN §3 says the deletion is the census and what breaks is exactly what was load-bearing. That holds — but only against the tree at deletion time. Against a moving main the census has to be re-run after every merge, and this branch had merged four times without doing so. That is the generalizable lesson here, not the two files.

Fixed forward rather than restored, per the same section:

• dag/test/claim/realization_selection_witness_test.dag migrates to std.goal_assessment. Two stages disappear rather than being rewritten: it supplied WorldApplied over a context it threaded straight through, which asserted nothing about actuation and existed only because the interface demanded a stage. There is now nothing to supply and nothing to mistake for a proven write. The §3d claim it exists for is unchanged — a SelectedWithin candidate feeds the convergence root as its subject, and the root reaches a satisfied assessment — and the old handler returned that receipt unchanged too, so nothing asserted was dropped. Its two test fn names named the deleted symbol and are renamed with it.
• gunbc.design_document, gunbc.design_argument, std.decision cited world_converge in prose and in the §3d reviewer question. That is precisely the stale-name defect §3’s standing rule names, sitting in the document that governs the criterion — so the rename lands with the deletion rather than after it. DESIGN.md regenerated: zero occurrences.

git grep world_converge across dag/ and src/ now returns only prose about the deletion (the failure-mode row, the new module’s note, repo_ruleset’s migration note). 18 witnesses on the migrated entry: 18 PASS, 0 FAIL.

— sent from sleek-newt-698

[gunbai-bot]

Both findings in review 62345 verified against the tree. One fixed, one is in-flight by the driver's own prescribed route.

Annotation loss in repo_ruleset_witness_test.dag — real, fixed in b2a2e1e01f1.
Confirmed exactly as described: w_RED_an_incomplete_merge_queue_rule_refuses_and_names_the_missing_fields and w_RED_verify_reports_an_undeclared_bypass_actor both survived with their leading blocks taken by the neighbouring deletions. An off-by-one, not a decision — agreed.

I restored the rationale rather than reverting the text, because the original prose described a shape this branch removed. One block called itself "the second half of the type-tag guard," and that guard's test no longer exists; the other contrasted verify against a converge actuation path that is gone. Reverting would have reinstated two stale citations. What is restored is the part §4c actually asks for — the irreducible why: absent and zero are different observations and only the optional carries that difference; and a refusal that names nothing tells the operator something is wrong without telling them what.

Missing read_only_policy_bound_as_an_actuator_that_only_refuses row in docs/design-failure-modes.md — real observation, but regenerating it here is the wrong move.
The row was in the projection on an earlier head. It went dark in the origin/main merge at 4978326, where that path hit GeneratedArtifactConcurrentDivergence: both sides had changed the projection since the merge base, so the driver refused, left the ours-side bytes unmerged, and printed its repair route. Step 1 of that route is to take the base side verbatim; step 4 is "do not regenerate this projection locally"; step 5 is that heal-generated-artifacts derives it from the merged authorities and pushes the healed head.

I followed that, and verified the resolution by set difference in both directions rather than by count, per step 2: zero rows from main went dark, and the single row missing from the artifact is mine — whose authority is merged and intact (dag/gunbc/recurring_failure_mode/read_only_policy_bound_as_an_actuator_that_only_refuses.dag exists, and roster.dag carries both its import and its enumeration entry; I identity-joined that file in both directions, 178 = 178, no orphans).

So the roster and its rendering do disagree right now, and that disagreement is what heal-generated-artifacts exists to close on this head. Hand-regenerating would put me back on the exact path the driver refused. If heal runs and the row is still absent, that is a real defect in the heal route and I will say so rather than paper over it.

— sent from sleek-newt-698

[gunbai-bot]

Review 62379 verified and fixed in f54790be214. The finding was correct and it was the sharpest one on this PR: the migration kept the arm and dropped the seam that made it reachable.

What was wrong. merge_queue_desire_unknowns read the declared rows through a nullary signed_desire_projection_refusal(). This repository's merge queue is unsigned, so that fold answers Absent on every input the corpus can produce — the Present arm and the whole RulesetMergeQueueDesireSelfInconsistent branch of render_unknown were unreachable, and the only claim over them was a positive control. §4b's test is whether the check's RED is authorable before the check is written, and its stated boundary is whether the forbidden state is authorable as a fixture, not whether it exists in the accepted corpus. It is.

The fix is the one the module already knew, as the review said. merge_queue_desire_unknowns now takes policy / rules and calls the already-parameterized signed_desire_projection_refusal_for; the nullary wrapper is deleted rather than left standing beside it. That is the same seam the deleted repo_ruleset_observed_actuation_admission carried, for the reason its own removed note gave — it was unreachability that let the inversion sit.

The RED is discriminating by execution, not by inspection. I did not want to assert that from the source, having been wrong that way before, so I falsified it: with the operand set back to what the nullary wrapper supplied, claim_batch reports

FAIL RED_a_signed_policy_the_projection_does_not_carry_is_an_unknown_on_that_dimension

Restored, all 7 witnesses in the file pass. The mutation was reverted before the commit.

One thing the review did not name, found while fixing it. The refusal string still read "converge would send a ruleset that cannot converge. Refusing rather than actuating" — actuation prose surviving the actuation deletion, sitting inside a value that is now an unknown and not a refusal. Rewritten, along with an annotation that cited that sentence in the present tense.

— sent from sleek-newt-698

[gunbai-bot]

Blocked, and deliberately not worked around. required-witnesses-floor fails on 1020adf with

required-ci: adjudication BLOCKING phase=namespace-wave-admission
  cause=namespace-wave-admission (1 unadjudicated delta(s), 0 stale, 0 consumed)

witnesses is the aggregator reading that lane, so this is one cause and not two. required-witnesses-build and heal-generated-artifacts both pass on this head.

The delta. Eight were reported; seven auto-classified. The one that did not:

NewPoolCoincidenceResolution binding
  gunbc.recurring_failure_mode.roster::recurring_failure_mode_roster
  `read_only_policy_bound_as_an_actuator_that_only_refuses`
  base {} -> head {gunbc.recurring_failure_mode.read_only_policy_bound_as_an_actuator_that_only_refuses}

Cause, and it is not this PR. Merging main brought in #10822, which took roster.dag out of version control and derives it instead. Before that, adding a failure-mode row edited roster.dag in the same commit, so the reference was authored — AuthoredReferenceResolution, auto-admitted. Now the roster is generated and gitignored, so the reference exists only in generated bytes, and disposition_auto_admitted does not admit NewPoolCoincidenceResolution.

This PR carries the first failure-mode row to land after #10822, which is the only reason it surfaced here. It will recur for every future row.

Why I have not unblocked myself. A row in NAMESPACE_TRANSITION_ADMISSIONS clears this in minutes. That array is currently empty — every prior admission has been dissolved — and adding one would be a standing permission papering over a substrate deficit, paid again by every later author. DESIGN §5: "noticing you are implementing a workaround IS the line-stop signal." The root fix is in namespace_wave_admission.rs, load-bearing seed code, under a brief that predates #10822.

Escalated to the operator with three options: fix the classifier (my recommendation, and it belongs in #10822's lane rather than this one), add the seed admission row, or drop the failure-mode row from this PR — the last of which I do not favour, since it would drop a §4b obligation for a class that was genuinely discovered.

Holding here rather than pushing.

— sent from sleek-newt-698

[gunbai-bot]

Substrate deficit fixed at the root, not admitted around. d8f366ce7e0. Operator authorized the fix; the side-chat ruling shaped it.

What was wrong. The wave-admission baseline is the head index with the diff applied in reverse at file grain, which assumes one thing about every file the diff did not name: that its base text equals its head text. True for a tracked file. False for a source generated before compile and gitignored, because that file never appears in git diff no matter how far its content moved — so its head record was carried into the base index and the wall compared the head against itself. The binding delta was right (base {} is real); the authorship evidence under it was poisoned.

#10822 made the roster derived and gitignored. This branch carries the first row to land after it. It would have blocked every later row too.

The fix. The ordinary carry now requires the base tree to contain the path — unchangedness is only proof of byte identity for a file git actually tracks. A derived path is re-rendered from the base revision's row files through the same renderer the writer uses and parsed by base_records. Any other untouched head-index record absent from the base tree is NotEvaluated.

Three things I did not do, each deliberately:

• No NAMESPACE_TRANSITION_ADMISSIONS row. That array is still empty. Nothing is admitted by permission.
• No widening of disposition_auto_admitted. That would say "whenever authorship evidence is missing, treat the coincidence as though authorship had been established" — turning poisoned evidence into permission, and destroying the negative control that justified splitting the two 0 -> 1 variants.
• No hand-built record. My first attempt cloned the head ModuleDeclarationRecord and filtered selected collections. That produces facts no source ever produced, and the next field added to that struct would silently keep its head value on the base side. Rendering source and re-parsing it keeps one derivation authority and one parser.

Measured, not asserted. The wall's own run on this base/head:

namespace-wave-admission ... deltas=7   (was 8)
namespace-wave-admission ADMITTED — every delta is auto-admitted or named by a transition admission

binding_rows_compared 759867 -> 759866: exactly the one row that should never have been compared, because with a correct base that name does not exist there. Note this differs from the predicted outcome — the delta does not reclassify to AuthoredReferenceResolution, it disappears, since binding_rows keys on the base record's own occurrences and a correct base roster has none. Same result by a stricter route.

Two unit tests cover the derivation, both enrolled in gunbc.derived_row_roster_seed_growth (that receipt is exhaustive — it lists even write_atomically). The one encoding the defect is discriminating: it fails under a mutation that renders the base as the head, while its three siblings stay green. Honest caveat: these sit under the declared drop rust_unit_tests_off_the_merge_path, so they are local diligence, not enrolled evidence.

cargo clippy --all-targets -- -D warnings clean. One local wet-lane witness pair (self_host_logic_*) fails in my session; both passed in CI on the identical head 1020adf, and they compile and run binaries, so I read that as my environment and am letting CI adjudicate rather than asserting it.

— sent from sleek-newt-698

[gunbai-bot]

Two things in fd0098e5887, on top of the merge at 3af78c573a4.

Review 62579 — the promise is now a check. Correct finding: I wrote the hazard into a comment and left nothing enforcing it, which is validation standing exactly where §5 asks for construction — and the hazard is the same class this PR repairs one revision earlier, re-admitted as an author obligation.

I did not take the proposed construction (compare the base blob of DERIVATION_CARRIER_REL_PATH against head bytes), because I measured it first and it refuses this very PR: this diff edits that file. It would also refuse every later change to it, including one adding a doc comment — a line stopped where nothing is wrong, which teaches authors to route around the wall rather than through it.

So the guard's subject is the renderer, not its file: it compares the text of render_roster, the declaration whose bytes decide the output and which exists on both revisions so the comparison actually spans the boundary. Verified both directions against the real base blob — identical today (so it passes rather than blocking), and refusing under a mutation that changes the rendered import syntax. One residual is stated in the code rather than papered over: the membership predicate is not covered, because this change moves it into a declaration the base does not have, so no text comparison spans both sides.

The substrate fix is confirmed on the real instrument. CI on d8f366ce reported deltas=7, 0 unadjudicated delta(s) — the false NewPoolCoincidenceResolution is gone on the runner, not just locally, and NAMESPACE_TRANSITION_ADMISSIONS was still empty when it said so.

What blocked instead was a rule I triggered, and it is now paid. That same run said 2 consumed admission(s) due for deletion on this roster-touching change. Main had added the two gunbc#10688 rows admitting the call_semantics_target re-home; my change touches namespace_wave_admission.rs, which is the roster path, so they came due. Those rows demand their own adjudication in as many words — "not by trusting this sentence" — so I ran the join rather than trusting either the sentence or CI: on main v1.std.core declares call_semantics_target, while v1.compiler.emit_rust references it four times and declares it none. Both sides resolve the spelling to v1.std.core, the TargetChanged delta is no longer producible, both rows are consumed.

Rows and label deleted together, as the two label deletions before them were, recorded as the Thirty-Fifth Dissolution. gunbc.namespace_wave_admission drops the label from its enumerated declarations and re-tenses the prose that claimed it was listed. The roster is empty again — still nothing admitted by permission.

cargo clippy --all-targets -- -D warnings clean; cargo fmt clean via the hooks.

— sent from sleek-newt-698

[gunbai-bot]

43b78562bf5 — two fixes.

Mine to own: the four-lane failure on fd0098e5887 was my error. Deleting CALL_SEMANTICS_TARGET_REHOME_LABEL from the enumerated declarations dropped only the decl_name line and left the enclosing DeclarationRef { … } standing, so the module carried a record with no name. Every required lane parses the corpus, so one malformed literal failed all four — this was one cause, not four. The compiler named it precisely (missing required field 'decl_name' in literal of type 'DeclarationRef'), which is the fail-closed behaviour doing its job. The generated-artifact gate resolves again locally.

Review 62605 — correct, and it was one instance of a class. The sign-off standing did still assert the world this branch deleted: a WHOLE-RULESET PUT, a converge run that would delete an out-of-band rule, "a divergence converge repairs" two sentences before SIGNING THIS ROW ACTUATES NOTHING, and "the actuation refusal below" — a positional pointer to deleted code, which is the §3 citation defect the review also named.

Sweeping the module found seven such sites. I fixed them as a class rather than the one line, because §3 is explicit that a dead assumption is an attractor: while it stands, nearby questions keep being answered in its vocabulary.

The UI-flip warning got the sharpest correction, because the hazard did not soften — it inverted. It read: a rule enabled in the web form is deleted by the next run, a scheduled silent self-reversal. With no writer, a flip is not reversed at all. It persists, unmodeled, reported as a divergence on every assessment forever, with nothing in this repository able to clear it. The operator sees a configured queue; the assessment sees drift it can never repair. So signing the row is now the only route rather than merely the best one, and the note says that.

On the review's parenthetical — "drop 'converge repairs' unless a writer actually exists" — I dropped the claim of repair, but kept the hazards that survive as obligations on a future writer (the whole-ruleset replace, the unexpected-rule refusal, the signed desire the projection cannot build), stated as obligations rather than as current facts. The reason those checks exist does not disappear with the writer that used to consume them, and deleting the rationale would lose a correctness distinction rather than update it.

All 7 witnesses in repo_ruleset_goal_assessment_witness pass, including the discriminating RED.

— sent from sleek-newt-698

[gunbai-bot]

Review 62621 verified and fixed in 26f123aab26. The finding was real, and the cause is mine rather than the merge.

What happened. My scripted replacement of the SIXTH TRANSITION block computed the block's END offset with an index search from position 0, which matched an earlier occurrence of the same trigger sentence in a preceding entry. With end < start, concatenating the two slices duplicated everything between them. The review's reading of it as a merge-resolution artifact was the natural one, but the merges are innocent here.

Deleting the span turned up more than the review reported. The original SIXTH TRANSITION block was still standing too, at :1692. So the file simultaneously documented the two gunbc#10688 rows as live and recorded their dissolution — two sources free to disagree about exactly the rows this roster adjudicates. That is the §3 violation the review named, in a sharper form than it found: not just a duplicated record, but a duplicated record contradicting itself.

Verified by counting against origin/main, not by reading the diff, because this is the second time a scripted text edit of mine has damaged this file (the headless DeclarationRef was the first). Per-pattern occurrence counts, head vs main:

THE gunbc#10671 ROWS DISSOLVED HERE     head=1  main=1
THE gunbc#10602 ROW DISSOLVED HERE      head=1  main=1
SIXTH TRANSITION (2026-09-07            head=0  main=1   (replaced by the dissolution)
THIRTY-FIFTH DISSOLUTION                head=1  main=0   (the only addition)
CALL_SEMANTICS_TARGET_REHOME_LABEL      head=1  main=3   (const + 2 rows gone; 1 mention in the record)

I also ran a delta scan across every changed file — repeated long lines in head vs the same file on main — to catch any other block my edits duplicated. One hit, in derived_row_roster.rs, and it is legitimate: the same fixture path appears in both of my new tests. No other file carries duplication relative to main.

cargo clippy --all-targets -- -D warnings clean.

— sent from sleek-newt-698

[gunbai-bot]

Merge conflict resolved in d24dc450338, with the reasoning recorded separately in 99a213ae38d so it is reviewable on its own. This one is worth reading rather than skimming, because main and this branch collided on the same defect.

Main's #10813 hit exactly the defect this PR repairs. Adding one recurring-failure-mode class made the roster's existing declaration resolve a new name; the wall reported NewPoolCoincidenceResolution; that disposition does not auto-admit; so the class could not land without a permission row. #10813 added one, plus a label constant and a transition entry describing it as "the honest cost of the pool being adjudicated rather than assumed".

It was not the pool's cost. It was a wrong baseline's. The roster is derived before compile and gitignored, so it never appears in git diff, and the reconstruction carried its head record into the BASE index — the wall compared the head roster against itself, so a reference authored by the change looked authored by nobody. Every future class would have paid the same row. That is the same finding I escalated on this branch, arrived at independently from the other side.

So the row is deleted, and that is main's own rule firing rather than a preference of mine. With the base re-derived from the base revision's row files, the class is absent from the base roster, the binding row exists on one side only, and the comparison skips it under the rule the wall already states — only rows present on both sides, because a newly authored name has no prior denotation to change. No delta is produced, so the row matches nothing, and a row matching no delta is stale, which refuses. Keeping it would have blocked CI on a stale admission.

Adjudicated by measurement, not by that paragraph: the class file is absent at this change's merge base and present at its head — precisely the shape that produced the delta before and produces none after. The required run on this head is the check.

I also dropped my own THIRTY-FIFTH DISSOLUTION entry. Main independently recorded the same #10688 row deletion while this branch did. Keeping both would be two sources free to disagree about which rows were adjudicated and why — the duplicated-record fork review 62621 caught here one head ago, so I took main's entry as the single authority and deleted mine.

Verified the file by occurrence counts against origin/main rather than by reading the diff (the method I switched to after damaging this file twice): every pre-existing record appears exactly once, SEVENTH TRANSITION is replaced by its dissolution, and the two extra repeated long lines relative to main are NotEvaluated arms in the renderer guard, not duplication. NAMESPACE_TRANSITION_ADMISSIONS is empty again.

cargo clippy --all-targets -- -D warnings clean.

— sent from sleek-newt-698

[gunbai-bot]

Conflict resolved in fe50f1d181a; reasoning recorded separately in 6f90b0d37f0. The resolution is a yield, and it shrinks this PR back to its original subject.

Main's #10856 landed the same fix this branch was carrying. Same diagnosis, same cut, arrived at independently from the other side: a derived roster has no base side in a diff, so a baseline that drops only the paths the diff touched inherits the head's roster as the base's, the module's own source reads as unchanged, the authorship discriminator answers false, and an ordinary append classifies NewPoolCoincidenceResolution. Main's comment describes the mechanism in nearly the same words mine did.

Two implementations of one fact is the §3 fork, so this branch takes main's and deletes its own. All four files now diff to zero against main.

Main's is also better in a place mine was wrong. roster_from_path_listing returns None when the base tree carries no row files, keeping "the roster module was genuinely absent at this revision" distinct from "present and empty". Mine rendered an empty roster for both — which fabricates a module the base never had, the empty-observation narrow, inside the code written to remove one. Main also generalizes over sweep roots instead of hardcoding the dag/ prefix, and it retired the #10813 admission row on the same reasoning I reached here.

What is lost, and where it should land: the renderer-sameness guard from review 62579. Main's version renders base inputs with the HEAD renderer, so a change to render_roster would have the wall compare a head-rendered base against a head-rendered head and report that renderer's own change as zero. The finding is moot against the code it was written about — that code no longer exists — but the hazard is not, and it now lives in main's implementation rather than in this PR. It deserves its own change against main's shape rather than a rushed transplant at the end of this one. Flagging it rather than silently dropping it.

This PR is now the convergence consolidation alone: 14 files, no Rust, no seed-growth roster, no wall changes. That also resolves the two-subject scope concern I raised earlier — main landing the wall fix independently removed the coupling that justified carrying it here.

— sent from sleek-newt-698

[gunbai-bot]

Review 62717 verified and fixed in c5ea5027df2. The finding was correct: the root cut was unfinished, and your diagnosis of the cause matches mine — those consumers arrived via the fe50f1d181a merge of #10683, the textual merge was clean, and the break was silent. The census is the only thing that finds this, which is exactly why the deletion is the census.

Migrated, not restored — and you were right that restore is the wrong arm. All five files you named are done: cable_plant_converge, fabric_switch_converge, fabric_switch_desired, and both witnesses. git grep world_converge now returns four files, all annotations naming it as deleted.

Your observation about the refuse-only apply arms was the useful part. Both bindings carried one, and in each case that refusal had to inhabit the same coproduct as the causes meaning the subject could not be observed — so an unread leg and a miscoded leg, an uncaptured lane and a misconfigured one, arrived as a single verdict answering two different questions. PlantCodingCannotBeActuatedHere and SwitchCannotBeActuatedHere are therefore deleted rather than ported: each restated as a refusal what the difference list already carried as a value, and the weaker copy was the arm a reader reached first.

fabric_switch_desired had the same conflation one layer out, which the review did not reach. Its DesiredSpeedUndecidedCause held a single PlantDidNotConverge arm carrying a plant refusal, so a caller could not distinguish the plant was never read from the plant was read and diverges — two different remedies (go read the plant, versus go change the copper) behind one name. Now PlantNotObservable and PlantDivergedFromRequirement.

Every defect in my first migration pass was caught by execution, not by reading, which is worth stating plainly given how much of this PR has been scripted text edits. The corpus compile found a stale import rename and two matches where switch-refusal causes were left standing as arms of an assessment. The witness run then found two more, where I had carried the old List shape's list-and-unwrap ceremony into a FreeSemigroup that answers with .head directly. All 13 witnesses across both files now pass, and the compile reports zero errors in any file this branch touches (the 34 corpus-wide blocking errors are inherited from main and unrelated).

— sent from sleek-newt-698