Stop merging the failure-mode ledger on every append

[gunbai-bot]

Summary

• Independent failure-mode filings no longer share a committed merge region: docs/design-failure-modes.md is not committed, and gunbc.recurring_failure_mode.roster is derived from the row directory instead of hand-appended.
• No committed combined file. No identity index. No hand-appended roster.
• DESIGN.md points authors at dag/gunbc/recurring_failure_mode/. Heal still regenerates the rung-drop ledger only.

Absent is loud (the four writers are convenience)

Three modules import gunbc.recurring_failure_mode.roster: gunbc.design_ledgers, gunbc.ledger_row_coherence, and test.claim.generated_artifact_merge_driver_real_execution_witness. A reader that never hits the four collect writers still fails at resolve: missing module, not an empty fold. The four ensure_ sites exist so a clone compiles without a committed roster; they are not load-bearing for the absent case.

Short roster is refused (not silent)

(a) A non-UTF-8 .dag stem is a typed refusal in the writer, not continue. read_dir / dirent errors already propagate.

(b) ledger_row_coherence is roster-to-projection, so a short roster still projects a short document and stays green. The required-CI parse join now identity-joins sibling .dag files (except roster.dag) to roster members, independent of the writer: RowFileNotRostered and RosterMemberNotARowFile. That is the 175/175 stem measurement as an executing check.

length(rows) == 0 => NotALedgerArtifact still classifies an empty roster as "not a ledger" rather than an empty ledger (predicate vacuously true on an empty domain). It does not bite while absent-is-loud holds; it is not a second line of defence.

File-join wall vs discriminating evidence (§4b(1))

run_rostered_row_join runs in the required-CI parse phase (claim_executor). The declared-versus-rostered arm has an on-path control: test.fixture.rostered_row_join.omitted_control.

The two new arms (RowFileNotRostered, RosterMemberNotARowFile) do not have an equivalent on-path fixture. Their discriminating REDs are #[test] functions in rostered_row_join.rs (file_roster_join_tests), which run only under cargo test -p v1-compiler --lib — the declared drop gunbc.rung_drop.rust_unit_tests_off_the_merge_path. Compile-and-CI enforce the production join on every required run; the evidence one would point at to show those two arms discriminate is off the merge path. "The join executes" is not "the join is proven to discriminate" for those two arms.

Q2 — write during read (DESIGN §7)

Stated §3b divergence: those four collects write a gitignored file into the source tree.

• Two compiles racing: both derive the same identity-sorted bytes; write is *.dag.deriving then rename; last rename wins with identical content.
• Write fails (read-only checkout, sandbox): collect refuses. It does not proceed with a missing file. If on-disk already byte-matches, the write is skipped and a read-only checkout can compile.
• Torn live file: no. The destination is replaced by rename.

A compile that cannot write source is a new failure mode for those four collect consumers (local sessions, remote CI, BuildBuddy).

Seed growth and filename-as-name

The substrate cannot enumerate a directory into typed value bindings. Directory-as-membership is a §4b wall-after-grounding realized in the host. Retired by declaration-value binding over the declared population (gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall).

Filename stem = declaration name is a spelling join, not typed inhabitance. Same retirement trigger.

Gate 3 is not a §4b(3) drop

A committed-bytes wall over a file that no longer exists had its subject removed. Content is still checked by required_lane_claim_agreement_witness against expected_design_failure_modes_md() as generated text.

Drop population (rust_unit_tests_off_the_merge_path)

This change enrols v1_compiler.cli_run.rostered_row_join file_roster_join_tests into that declared drop's --lib population. The restoration trigger is unchanged and covers them: they are --lib tests.

Test plan

• Required CI parse join still reports a complete RecurringFailureMode population after adding only a new row file (no roster edit).
• Two concurrent branches each adding a distinct row file merge without touching a shared ledger path.

[gunbai-bot]

Verified against current head from review 62305 (dashboard-only, reviewed 4163d30).

1. Hand-Rust .dag strings / generated_artifact registry — not registering. roster.dag is a gitignored compile input, not a docs projection. Putting it on gunbc.generated_artifact would put a derived membership list on the regen/heal/drift surface this PR exists to take the ledger off of. Footprint is already modeled at gunbc.repo_workspace. Dissolution trigger is named in the writer and the PR body: declaration-value binding (gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall). Seed growth is a §4b wall-after-grounding, not an unreceipted scaffold.

2. Four copied call sites — fixed in 51aa920. One ensure_if_row_dir / ensure_if_row_dir_or_panic. A fifth walker that never writes still refuses at resolve: three modules import gunbc.recurring_failure_mode.roster. Write-during-read remains a stated §7 divergence (temp+rename; write fail refuses).

3. Hardcoded "recurring_failure_mode" / "gunbc" pair — fixed in the same commit. The match is now the modeled directory gunbc/recurring_failure_mode.

[gunbai-bot]

Verified against current head from review 62325.

1. Fixed temp path — real. Concurrent writers could rename a truncated roster.dag.deriving into place. write_atomically now uses roster.dag.{pid}.{nanos}.deriving and deletes the tmp if rename fails. Landed in fda7942.

2. Converge actuator instead of read-path write — not doing that in this PR. Absent roster is already a missing-module refusal for any reader that is not one of the four seed walks (including emitted collect_dag_files in 05_emit_rust.dag). The four writes are convenience so a clone compiles; parent accepted the §7 write-during-read as a stated divergence (temp+rename, skip when bytes match, refuse on write fail). An explicit converge actuator is a follow-up, not a silent empty fold we would ship.

3. Three spellings of the row home — the join now walks dag + ROW_DIR_REL, and ROW_DIR_REL is asserted equal to ROW_MODULE with / for .. ensure_if_row_dir returning Ok on a non-matching path is the other directories in the walk, not a silent skip of the modeled home. If the directory is moved, imports of gunbc.recurring_failure_mode.roster still refuse at resolve.

[gunbai-bot]

Verified against current head from review 62332.

nfr_reason_concurrent_divergence_repair_policy still said both design-ledger artifacts answer HealRegeneratesAfterProvisionalMerge. The match is DesignRungDropsArtifact only. Updated that reason, and the // note at gunbc.ledger_row_coherence that named the same false pair.

[gunbai-bot]

Verified against current head from review 62348.

1. Required CI parse sweep never derived roster.dag — real. run_dag_parse_sweep is the first required-CI phase and it was not one of the four collect sites, so a clean checkout had no gunbc.recurring_failure_mode.roster in the index and the join reported RosterModuleAbsent on the intended state. The sweep now calls ensure_if_row_dir before listing each directory. 56ca471.

2. Sprinkling at call sites — the gate is this sweep, not the four convenience collectors. Those still write so other compilers compile; the merge path writer is now the parse walk. Unifying every future walker onto one corpus-acquisition type is a follow-up; leaving the file committed would put the membership list back on the shared merge surface this PR deletes.

3. Seed-growth as a //! rather than a seed-retained row — not adding a second tracking census here. Dissolution is already the named capability gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall (declaration-value binding), recorded on the writer and in the PR body. A v1-zero-hand-maintained-rust lane row would be a second name for that same trigger.

[gunbai-bot]

Verified against current head from review 62367.

1. Stall row stale for RecurringFailureMode — real. roster_re_enumerates_its_own_rows_stall still said every author writes the roster entry and named gunbc.recurring_failure_mode.roster as heading the measured population. That member is a directory fold as of this PR. The row now records that it left the hand-append set, that the host writer is a second path beside the declared value-binding climb (not a climb of this stall), and that the stall still holds for every carrier that hand-appends, including this one. 2885484.

2. Register the producer in generated_artifact — not doing that. Putting roster.dag on that registry would put a derived membership list on heal/drift, which is the shared rewrite this PR deletes. The footprint is already in gunbc.repo_workspace. Dissolution remains declaration-value binding on this stall row, now stated there rather than only in a Rust //!.

[gunbai-bot]

review 62378 (Opus REQUEST_CHANGES on 2885484):

1. Fixed on dbf5222. agree_if_committed is gone. tools.docs_projection_gate main now agrees only DesignRungDropsArtifact (committed bytes). Regen still writes a local failure-mode copy. Regen-correctness for that projection stays on expected_design_failure_modes_md / required_lane_claim_agreement_witness and on docs_projection_bytes_agree fixtures that can still go red — not a skip-success committed-bytes compare.

2. Not reverted. Parent/operator already admitted the seed writer as the wall-after-grounding host fold (directory → .dag bytes) until declaration-value binding retires gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall. The stall row already says this is a second path beside that climb, not the climb. Registering roster.dag on gunbc.generated_artifact would restore heal/drift rewrite of a gitignored file. Completing the surviving construction is that stall's trigger, not deleting the host that makes a clean checkout parse.

3. Fixed on the same commit. collect_dag_files_tolerant calls ensure_if_row_dir and ignores write errors; run_dag_parse_sweep remains the loud required-CI writer.

[gunbai-bot]

review 62400 (cursor/auto REQUEST_CHANGES): landed. gunbc.derived_row_roster_seed_growth derived_row_roster_seed_growth_justification enumerates the added hand items (derived_row_roster.rs plus the new join arms and file_roster_join_tests members) and is on seed_growth_justification_roster(). Dissolution stays gunbc.guarantee_stall.roster_re_enumerates_its_own_rows_stall (declaration-value binding), not a sentence in the Rust module. cli_run.rs / claim_executor.rs / JoinFindingKind variant adds are ExistingSeedItemModified, not netted as additions.