Local instruments green a parse error: a specimen, not a new failure class

[gunbai-bot]

What

One receipt appended to gunbc.recurring_failure_mode.green_reported_over_a_population_the_instrument_does_not_own, plus its deterministic projection. No new failure class, and the reason is measured rather than asserted.

The incident

An edit to gunbc.v1_maintenance_standing broke a data expression onto the line after = — a parse error in .dag. Two local instruments were run on the broken form and both returned green:

• claim_executor --required-floor → verdict=FloorClean, claims_failed=0
• the docs projection regen → wrote its outputs, exit 0

The required lane then refused on the pushed head: adjudication BLOCKING phase=parse (497 error(s)), naming the file and expected expression, found Newline.

Which branch it is — measured before filing

Two different faults produce the same green, and only one is this class:

the file was planned, parsed and tolerated	right denominator, insufficient predicate — a different class
the file was never in the population	this class

It is the second. No import statement anywhere in the corpus names gunbc.v1_maintenance_standing. The one witness that appears to reach it (test.claim.documentary_refs_witness) imports gunbc.documentary_refs and consumes a DeclarationRef carrying the module path as a string — a reference, not an import — so the module enters no parse closure. The parser was never tolerant; it was never asked.

Three neighbours disposed of explicitly

All three concern a denominator, so a reader has to be able to tell which owns this.

• required_lane_green_over_a_population_it_never_offered — closest, and still not it. Its population is declared claims preparation did not offer this run; the floor prints them under outside this run's universe. Its subject belongs to the gate's declared population and its repair is to offer the claim. This subject carries no claim, appears in no exclusion list, and there is nothing to offer.
• instrument_answers_outside_its_domain — requires the instrument to answer about the subject and answer wrongly, its direction set by the domain gap. Neither instrument answered about this subject at all; both greens were true statements about other populations.
• check_subject_shape_cannot_represent_the_state_the_check_detects — the state was representable, was represented, and the required lane refused it by name. Nothing about subject shape hid it.

The transferable part — stated in the sound direction

The condition is two conjuncts, not one: the subject is not a root of that instrument, and no root reaches it through imports. Only then can the instrument refuse nothing in it.

Zero importers alone is not sufficient, and the counterexample is live in this tree — and is the very module this receipt already cites. test.claim.documentary_refs_witness has zero importers (nothing in dag or src/v2 imports it), yet the floor parses it every run, because a witness module is a root of the floor closure rather than a leaf reached from one. The row contained its own refutation of the one-conjunct form, which is what makes this narrowing measured rather than a logical caveat.

Both conjuncts are established for the specimen, so the incident stands unweakened: gunbc.v1_maintenance_standing is not a root of the floor (whose roots are planned witness claims), not a root of the docs projection regen (whose roots are the ledger authorities it renders), and no root reaches it by import since nothing imports it at all.

The module's §3c consumption answer is a correlate, not a cause. An earlier draft of this receipt asserted the converse as a law — "any carrier whose declared consumption route is human review is, for exactly that reason, invisible to every instrument whose population is derived from the import graph" — and that is false: consumption route and import count are independent, and a review-consumed carrier may perfectly well be imported — which buys visibility-as-possibility and nothing stronger, since a given instrument still needs a root that reaches one of those importers. The ten imported siblings measured above are exactly that population, and this row never measured their consumption answers. The review answer made the blindness unsurprising here; the import census is what made it predictable at authoring time.

The habit underneath is symmetric, and that is the transferable form. The row over-claimed invisibility (zero importers, therefore invisible to every instrument) and then, in the paragraph repairing that, over-claimed visibility (many importers, therefore parsed by every instrument). "Remember the root conjunct" predicts neither. The habit is asserting a universal over instruments where the fact is per-instrument: visibility is a relation between a module and one instrument, decided by that instrument's own root set, so no property of the module alone — import count included — settles it for all of them. The check that follows is mechanical: any sentence quantifying over "every instrument" or "no instrument" is suspect by construction, in either direction, and I grepped for it rather than waiting for a fourth report.

That correction is recorded in the row rather than quietly applied, because it is the same move the row refuses one paragraph up — a shared property promoted to an identity law, doing the work the measured predicate should do, which is exactly what the fold argument on absence_classifier_default_bucket deletes a universal to avoid.

The sibling census

Over every module in dag/gunbc/v1/, counted by their real module paths: v1_maintenance_standing is the only one with zero importers; every sibling is imported, with non-zero counts throughout — the discriminating control, since a census finding zero everywhere would be measuring its own key. The counts are not transcribed; re-derive them with the census (§6). So the specimen is not "an authority module happens to be unimported" — it is that the one module governing every v1 admission is the one nothing imports, against a sibling control showing the pattern is not directory-wide.

A trap worth recording: these modules are gunbc.<name> with no v1 path segment, so a census keyed on the directory spelling matches nothing and manufactures ten false positives. The positive control that makes the census trustworthy is that the control modules come back non-zero.

Rung and trigger

Mitigatable: the required lane did refuse, loudly and located. What failed is the local pre-push instrument; the cost was a paid runner cycle plus a green that had to be withdrawn. Ceiling is mechanically preventable — whether an instrument's population contains a path is decidable from data the run already holds.

Next-rung trigger, at capability grain and deliberately not "authors should run the right command": a local instrument refuses to return a verdict about any path outside the population it adjudicated — rather than returning a verdict the reader must join by hand. An instrument that merely prints its population is insufficient; it leaves the join to the reader, which is the step that failed here.

The population is the instrument's own, not the changed-file set. That distinction is stated because the nearest wrong spelling is one this row already retracted twice: what an instrument adjudicates stays whatever it adjudicates — the floor's witness closure, the sweep's roots — and the changed set is only the question a reader puts to it.

What it deliberately does not promise: it does not stop the defect reaching a push. It makes the green unspendable. The harm here was never that a parse error reached CI — the required lane refused it, loudly and located. It is that two local instruments returned green and the author read them as coverage of a file neither had opened. It is decidable (population membership is data the run already holds), needs no hook or new surface, and retires by its own trigger: once it lands the specimen is unwritable, because neither instrument would have answered about that file at all.

The trigger has now been wrong three times, in three different ways — unbuilt, already-built, and naming a surface the corpus forbids. The previous head demanded the sweep be bound to a default-run gate, "sufficient that a parse error cannot reach a push locally." That sufficiency clause is unsatisfiable by any local surface that exists. Every .githooks surface is opt-in per clone, bypassable with --no-verify, and absent in container worktrees, and the 2026-07-25 fmt-only operator ruling forbids re-heavying that hook at all. The one non-hook local surface that passes all three tests, src/v1/stage0/build.rs, cannot host it either: a build script runs before the crate whose binary it would need — a cycle, not a policy objection. A trigger whose consequence no surface can produce is retired by nothing, which is §4b(3)'s failure from the opposite side: promising more than any capability can deliver rather than less.

The instrument already exists, which two earlier drafts of this row got wrong and which is recorded rather than quietly corrected. Those drafts demanded "a locally runnable instrument whose population is the changed-file set of the working tree." Both halves were false. The v1_src_dag_parse cargo bin already is such an instrument: it and the required run's parse phase both call run_dag_parse_sweep over the shared DAG_PARSE_SWEEP_ROOTS roster, so they are one walk over one subject. Measured in both directions rather than read off its header — a clean sweep in seconds rather than minutes, and against this row's own specimen (defect reintroduced) it refuses with file and line, better location than the required lane produced. The figures are deliberately not transcribed: they move with the sweep roots and the machine, so the citation is the bin, not a number (§6). A trigger naming an already-built capability can never be retired by its trigger, so the row would have sat on main claiming a climb was blocked when it was not — an unearned blocked status, rung inflation's mirror with the same effect.

And the population was mischaracterised too: the operative distinction is all sources under the sweep roots vs. the witness closure, not changed-versus-unchanged. The floor misses this module because the closure excludes it. The absent binding is recorded as a fact, not an obligation: the generated pre-push hook carries exactly one gate, cargo fmt --all --check, and no reference to the sweep — and under the 2026-07-25 fmt-only operator ruling that is where it stays. An earlier revision of this PR made that binding the trigger; it is retracted, because no local surface can produce the consequence it promised.

This is a record, not a repair: the class stands unremedied at mitigatable and may not be cited as coverage.

Verification on this head

• docs_projection_gate --function regen — clean.
• claim_executor --required-ci --required-lane witnesses — exit 0, no adjudication BLOCKING (the 16 lines matching "blocking" are witness names).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MuB8wHjijaFwNoyzm78stF

[briansrls]

Exact-head review of ccbdb28: REQUEST_CHANGES.

The review-62440 rung correction is right. The class now reports the minimum across its in-scope paths: generated-artifact adjudication is mechanically preventable; the local pre-push path remains mitigatable because no local join establishes that the changed path is in the instrument's population. That fixes the prior rung inflation rather than scoping the weak arm away. The corrected module-name census is also valuable: dag/gunbc/v1/ is a filesystem locator, while the modules declare gunbc.<name>, so a census keyed on gunbc.v1.* would manufacture a zero-import population. Keeping that failed census in the row is appropriate.

One blocker remains in the new specimen. The row generalizes from this module's TWO coincident facts into an implication that is not true: Any carrier whose declared consumption route is human review is, for exactly that reason, invisible to every instrument whose population is derived from the import graph. Human-review consumption and import-graph reachability are orthogonal. A standing can be semantically consumed only by reviewers and still be imported by a witness or another module, in which case an import-closure instrument can parse it. What proves blindness in THIS specimen is the separately measured fact that gunbc.v1_maintenance_standing has zero importers; the human-review route does not prove that fact.

The sentence immediately before it needs the same grain discipline. A module nothing imports is a module no closure-driven instrument reads is the valid implication. No fold consumes it and no local gate can refuse it are not generally the same statement: a changed-file gate can refuse a source it does not semantically consume — the required lane in this very specimen demonstrates that. Keep closure-driven load-bearing and do not promote the §3c consumption answer into a reachability theorem.

Suggested repair: state that in THIS specimen human-review-only semantic consumption co-occurs with the independently established zero-importer fact; make the transferable rule the one the row already has elsewhere — enumerate the instrument population / ask whether it would read the changed bytes. Human-review consumption may be a reason to CHECK reachability, never evidence of its answer.

CI on this SHA is still pending, but this is a content blocker independent of CI. Any corrected head is a new subject.

[briansrls]

Exact-head review of 9d2f19b: REQUEST_CHANGES.

The prior implication-direction finding is substantially repaired. The row now correctly demotes the §3c human-review consumption answer to a correlate, explicitly retracts the false converse, and grounds the actual incident on the independently measured import population. The rung correction and real-module-path census remain sound. I do not want the old human-review => invisibility objection reopened.

One narrower blocker remains, and this is a correction to MY OWN prior suggested wording. The replacement now states ZERO IMPORTERS IMPLIES INVISIBLE TO EVERY CLOSURE-DRIVEN INSTRUMENT. That is still too strong. A module can enter an import closure by being one of the instrument's ROOTS; it does not need an incoming importer. gunbc run --entry <that module> is the trivial shape. Zero importers proves only that no OTHER root reaches it through an incoming import chain.

The incident itself is still established: for the two local instruments named here, gunbc.v1_maintenance_standing was neither in their root/seed population nor reachable through imports, while the required changed-file lane did include it. So the repair is small but load-bearing: state the relation as subject not in the instrument's roots AND no root reaches it through imports => invisible to that closure-driven instrument, or equivalently make the transferable check is the changed path itself a root, or reachable from one? The existing ASK WHETHER THE INSTRUMENT WOULD EVEN READ THE BYTES YOU CHANGED sentence is already the right higher-level rule.

This matters because the row is explicitly trying to make the blindness predictable at authoring time. zero importers alone predicts the wrong answer for a direct-root instrument, so leaving the universal would encode another population shortcut in the row whose subject is population shortcuts.

The ten imported siblings remain useful controls for the directory-spelling census, and the §3c correlation paragraph may stay; neither answers root membership, which is a separate axis.

CI on this exact SHA is currently in progress; this content blocker is independent of CI. Any corrected head is a new subject.

[briansrls]

Exact-head re-review of 0ca2b82: REQUEST_CHANGES.

The prior implication-direction finding is substantially fixed. The row now correctly establishes the two required conditions for THIS specimen: gunbc.v1_maintenance_standing is not a root of either local instrument, and no root reaches it through imports. The live counterexample test.claim.documentary_refs_witness also makes the root conjunct measured rather than hypothetical: zero importers, yet parsed by the floor because it is itself a witness root. The §3c human-review consumption answer is correctly demoted to a correlate, not a cause, and the ten imported siblings are appropriately named as a population whose consumption answers were never measured.

One blocker remains, already identified by the requesting lane: the replacement paragraph still begins with the refuted one-conjunct theorem, A module nothing imports is a module no closure-driven instrument reads, and only retracts/narrows it later in the same paragraph. That topic sentence is independently citable and false in the same tree by the documentary_refs_witness counterexample. Delete or rewrite it so the paragraph starts directly at the two-conjunct condition.

The mechanical-test sentence one paragraph earlier IS repaired correctly: it asks root membership first, then import reachability, and says only when both answers are no can the instrument refuse nothing in the module. Keep that.

This is exactly the propagation lesson the lane surfaced: correcting the flagged sentence is not enough when the earlier claim already has copied formulations. The authority must carry no surviving one-conjunct version after the correction.

Exact-head workflow run 34216892316 is still in progress at review time, but this content blocker is independent of CI. Any correction moves the head and requires a fresh exact-head verdict. No merge action taken.

[briansrls]

Exact-head review of 11ba50a: REQUEST_CHANGES.

The previous one-conjunct finding is substantially repaired. The recognition rule now asks the correct two questions at instrument grain: is the subject a root, and if not, is it reachable by imports from a root. The live test.claim.documentary_refs_witness counterexample is excellent evidence that zero importers alone is insufficient, and the topic sentence now leads with the two-conjunct condition rather than asserting then retracting the bad form. The rung correction, real-module-path census, and human-review-consumption-as-correlate framing remain sound.

One root-set quantifier survives in the 3c-correlation paragraph: it says a review-consumed carrier may be imported by ten other modules, in which case every closure-driven instrument parses it. Importability by those ten modules does not make the module visible to EVERY closure-driven instrument. A particular instrument still needs a root that reaches at least one of those importers. The point needed here is only that review consumption does not imply invisibility: imported modules CAN be visible to closure-driven instruments whose root sets reach them.

Please narrow that clause to the same per-instrument root/reachability grain now used everywhere else. For example: ...may perfectly well be imported, making it reachable to any closure-driven instrument whose roots reach one of those importers. The ten siblings remain useful candidate counterexamples; the row simply has no basis to quantify over all instruments.

This is the only content blocker I found on the current two-file diff. Current main remains 5e24cc9, matching the PR base. Exact-head CI is still pending and remains a separate gate.

[briansrls]

Exact-head review of 7faad22: APPROVE on content.

The prior inverse-universal finding is closed. The row now treats visibility as a relation between one module and one instrument, with both root membership and import reachability explicit. The documentary_refs_witness zero-importer/root counterexample makes that narrowing measured, not merely logical.

The additional sweep materially improved the row: the former no instrument's population contains it contradiction is repaired by separating the two local instruments from the required changed-file lane; the witness-closure claim is derived on both conjuncts rather than asserted; and the imported-siblings paragraph now states only visibility-as-possibility, correctly requiring a root path before any particular instrument sees the module.

I also agree with demoting the universal-word grep to a smell test. Its miss on the possessive form demonstrates that no finite spelling list establishes cleanliness. The real check is the expensive one now named in the row: re-derive every visibility claim against the named instrument's root set.

I am not blocking on the module enters no parse closure in the apparent-reacher paragraph. In context it is the conclusion about that witness/import route, and the preceding paragraph independently establishes that no witness closure reaches the standing by either root or import. I do not read it as a new all-instrument theorem.

CI is separate: this exact head did not yet have an exact-head green when reviewed. No merge action taken.

[briansrls]

Exact-head review of ff60fc5: REQUEST_CHANGES.

The previously approved visibility/root-set material remains sound. I am reviewing the two head moves after 7faad22 as new subject matter: the heal commit plus the two generated-artifact verification receipts.

BLOCKER: the new reviewer-side receipt collapses two independent verification obligations into one. It says THE SOUND INSTRUMENT IS THE ONE THAT COMPARES THE ARTIFACT TO ITS PRODUCER OVER ITS WHOLE CONTENT: re-run the generator on the head under test and REQUIRE NO DIFF. That establishes a FIXED POINT: the committed artifact equals what this deterministic generator emits from this committed tree. It does NOT establish CONTENT ARRIVAL from the authored authority. A deterministic generator that silently drops one newly authored sentence reproduces itself exactly and passes the no-diff check forever.

The stronger measurement already performed on this head is the missing second arm: derive the AUTHORITY DELTA, enumerate the content it gained, and join that population against the projection, with a fabricated/non-member sentence as a negative control so an extractor that matches everything or nothing cannot look clean. On this projection the two checks answer different questions and neither subsumes the other:

1. producer fixed point — regenerate exact HEAD and require no diff;
2. authored-delta arrival — derive what the authority gained and require every member to reach the projection, with a discriminating control.

The first catches a stale rendering of an older tree. The second catches a current, deterministic generator that omits authored content. The incident being filed here is unusually strong evidence for keeping both, because the lane itself first used a chosen phrase as a fake completeness check and then explicitly measured twelve gained authority sentences against twelve projected sentences with zero missing.

Please record that dual obligation in the row instead of calling fixed-point comparison THE SOUND INSTRUMENT. The class fold itself is fine: in the author-side incident the regeneration's subject was an earlier tree; in the reviewer-side incident the grep's subject was one preselected phrase. In both, a green was spent as evidence about a wider population it never adjudicated.

Freshness note, separate from this content blocker: current main is bd1603f while this PR still reports base 5e24cc9. No landing authority can attach until integration produces a final head, and that head is a new review subject.

Exact-head CI is still in progress and remains a separate gate. No merge action taken.

[briansrls]

Exact-head review of 3063307: APPROVE on content.

The previous verification-method blocker is closed. The row now records TWO independent checks instead of elevating one to THE sound instrument:

1. fixed point — regenerate the exact committed head and require no diff; proves this generator produces this artifact from this tree, while explicitly missing deterministic generator omissions;
2. authored-delta arrival — derive the authority delta and require every gained sentence in the projection; proves the authored delta arrived, while explicitly missing stale/omitted content outside that delta.

The added MISSES on the second arm is correct and important: the pair is complementary but still not jointly sufficient for whole-artifact correctness, so the row does not turn a useful two-arm procedure into another universal assurance claim.

Main integration is also resolved on this head: the PR base is current main bd1603f, and the inherited main changes do not alter the reviewed subject beyond the integrated projection context. The prior visibility/root-set, rung, census and propagation repairs remain coherent in the current whole diff.

CI is separate: exact-head workflow 34227203984 is pending at review time. No merge action taken.

[briansrls]

Exact-head re-review of d573ea5: REQUEST_CHANGES, review-surface only.

The AUTHORITY'S third trigger repair is now directionally right. It no longer promises pre-push enforcement, correctly distinguishes sweep-root population from witness closure, and asks for the reachable capability: when a caller asks whether a particular path was covered, the local instrument must refuse rather than return a spendable green if that path is outside its adjudicated population. I have no remaining content objection to that trigger in the row itself.

One propagated copy of the superseded second trigger still survives in the PR BODY. After the body says the new capability needs no hook or new surface and does not stop a defect reaching push, it later says What is actually absent is THE BINDING: the generated pre-push hook ... has no reference to the sweep. That is no longer the missing capability; the authority now records that pre-push absence only as a FACT under the standing fmt-only ruling, explicitly not as the obligation/trigger.

Please update the body to the same grain as the authority: the absent pre-push binding is historical/current-state evidence, not what the class is waiting for. This is exactly the propagation rule this PR records — correcting the authority site while leaving the old claim on another asserting surface has not completed the correction.

This body edit need not move the SHA, but I will refresh the verdict after it changes. Separately, current main advanced after this exact head, so eventual integration will move the subject and require another exact-head pass regardless. No merge action taken.

[gunbai-bot]

Addressed — the body edit landed at ~17:29, after review 5144891091 was submitted at 17:19:46, so it is already on the current body at d573ea5d8d. No SHA move.

The superseded sentence is gone. Its replacement is at the authority's grain:

The absent binding is recorded as a fact, not an obligation: the generated pre-push hook carries exactly one gate, cargo fmt --all --check, and no reference to the sweep — and under the 2026-07-25 fmt-only operator ruling that is where it stays. An earlier revision of this PR made that binding the trigger; it is retracted, because no local surface can produce the consequence it promised.

The finding is right about more than the sentence, and worth stating plainly: this PR records that a corrected claim propagates slower than the claim itself, and I left the dead claim standing on a second asserting surface while fixing the authority. That is the third time in this lane that the PR body was the surviving asserting site after a .dag correction — which is why the body is now swept on the same pass as the row, not after it.

On the integration point: agreed that eventual integration moves the subject and needs another exact-head pass. Holding that until there is a merge to catch rather than re-integrating against a base that keeps advancing while nothing can land.

— sent from smart-ant-528