Skip to content

Two rows the contended surface had been holding: the diagnostic absorber, and a frontier that outlived its own trigger - #10842

Merged
briansrls merged 3 commits into
mainfrom
ledger/frontier-and-fabricated-type-rows
Sep 9, 2026
Merged

briansrls merged 3 commits into
mainfrom
ledger/frontier-and-fabricated-type-rows

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Both were derived and written days ago and deliberately not filed: the roster was a
hand-authored membership tail, so every append collided in one merge region and filing
would have added to the population being cited as evidence that the surface had to
change. gunbc#10822 removed that surface -- membership is now read from the row
directory -- so an append is a new file and never an edit to a shared tail. Filed in
the order the lane recommended: the compiler defect first, so the new mechanism proves
itself on real content rather than on a smoke row.

CONSUMPTION, checked by execution rather than asserted: both identities appear in
expected_design_failure_modes_md with NO registration edit anywhere -- no import
line, no list entry, no roster. That is the derived membership working, and it is the
executed evidence that gunbc#10822's capability is live rather than merely landed.

unresolved_name_is_reported_as_a_decidability_verdict
A reference that failed to resolve is reported in a category that presupposes it
resolved. Two ends, one mechanism: the advisory end WIDENS to a true-sounding
"undecidable position"; the blocking end FABRICATES, putting an unresolved callee's
authored name into a type-equality verdict as though it were a type. The second is a
false statement about the program -- section 5's fabricated plausible output -- and
sits below the section 4b floor.
The measurement is the argument: a controlled A/B over one corpus moved the
generic-formal reason from 59 to 6,231 while three neighbouring diagnostic classes
stayed INVARIANT. The honest arm for an unresolved formal exists and fired ZERO times
in both arms, because the name it tests is read from authored source and so survives
a failed lookup. Pre-existing; a supply change made it loud rather than causing it.

declared_frontier_outlives_the_firing_of_its_own_trigger
A declaration admitted under section 3c as consumed-by-a-named-later-consumer,
whose trigger is then satisfied BY OTHER MEANS, becomes dangling without any edit to
itself. The specimen is this lane: gunbc#10836 declared a frontier whose trigger was
roster membership becoming derived, and gunbc#10822 landed exactly that while the
declaration was in review. It is not the stale-claim class -- the frontier's sentence
stayed accurate, so re-reading the claim against its premise finds nothing wrong --
and not the unsatisfiable-trigger class, which is its opposite: satisfaction is what
stranded it.
The row records that a reviewer's requirement to move the trigger OUT of a pull
request body and into the tree beside the declaration is the only reason the firing
was discoverable at all, and names the next rung: a typed frontier carrier a fold can
read, so a frontier whose capability has landed refuses instead of waiting to be
noticed.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

🤖 Generated with Claude Code

https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

…ding is a new file

Both were derived and written days ago and deliberately not filed: the roster was a
hand-authored membership tail, so every append collided in one merge region and filing
would have added to the population being cited as evidence that the surface had to
change. gunbc#10822 removed that surface -- membership is now read from the row
directory -- so an append is a new file and never an edit to a shared tail. Filed in
the order the lane recommended: the compiler defect first, so the new mechanism proves
itself on real content rather than on a smoke row.

CONSUMPTION, checked by execution rather than asserted: both identities appear in
`expected_design_failure_modes_md` with NO registration edit anywhere -- no import
line, no list entry, no roster. That is the derived membership working, and it is the
executed evidence that gunbc#10822's capability is live rather than merely landed.

unresolved_name_is_reported_as_a_decidability_verdict
  A reference that failed to resolve is reported in a category that presupposes it
  resolved. Two ends, one mechanism: the advisory end WIDENS to a true-sounding
  "undecidable position"; the blocking end FABRICATES, putting an unresolved callee's
  authored name into a type-equality verdict as though it were a type. The second is a
  false statement about the program -- section 5's fabricated plausible output -- and
  sits below the section 4b floor.
  The measurement is the argument: a controlled A/B over one corpus moved the
  generic-formal reason from 59 to 6,231 while three neighbouring diagnostic classes
  stayed INVARIANT. The honest arm for an unresolved formal exists and fired ZERO times
  in both arms, because the name it tests is read from authored source and so survives
  a failed lookup. Pre-existing; a supply change made it loud rather than causing it.

declared_frontier_outlives_the_firing_of_its_own_trigger
  A declaration admitted under section 3c as consumed-by-a-named-later-consumer,
  whose trigger is then satisfied BY OTHER MEANS, becomes dangling without any edit to
  itself. The specimen is this lane: gunbc#10836 declared a frontier whose trigger was
  roster membership becoming derived, and gunbc#10822 landed exactly that while the
  declaration was in review. It is not the stale-claim class -- the frontier's sentence
  stayed accurate, so re-reading the claim against its premise finds nothing wrong --
  and not the unsatisfiable-trigger class, which is its opposite: satisfaction is what
  stranded it.
  The row records that a reviewer's requirement to move the trigger OUT of a pull
  request body and into the tree beside the declaration is the only reason the firing
  was discoverable at all, and names the next rung: a typed frontier carrier a fold can
  read, so a frontier whose capability has landed refuses instead of waiting to be
  noticed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF
@gunbai-bot

gunbai-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

#10842's RED IS MINE, IT IS NOT THE STALE-ADMISSION CLASS, AND IT IS A GAP IN #10822 THAT ONLY
A ROW-ADDING CHANGE CAN HIT. I am the first append since the restructure, so I am the first to
find it.

WHAT FAILED, exactly: the floor itself is CLEAN (verdict=FloorClean, unexpected_failures=0,
3549 executed). The lane failed at phase namespace-wave-admission:
adjudication BLOCKING phase=namespace-wave-admission
cause=2 unadjudicated delta(s), 0 stale admission(s), 0 consumed admission(s)
The two deltas ARE my two row files, and their disposition is the discriminating part:
ExplicitlyEvaluatedZeroDelta membership roster -> AUTO-ADMITTED
"reached by a name this module authors"
NewPoolCoincidenceResolution binding roster::recurring_failure_mode_roster
<my row> -- base {} -> head {} REFUSED
So the MEMBERSHIP edge auto-admits and the BINDING refuses, on the same two files.

BASELINE CHECKED FIRST, because a correlated red is a hypothesis and not a finding: sibling
open PRs at the same base are SUCCESS on required-witnesses-floor (10843, 10841, 10840, 10849).
Mine is the only FAILURE. So this is my diff, and I am not going to call it someone else's.

THE ANALYSIS, AND IT IS WHY I THINK THE CLASSIFICATION IS WRONG RATHER THAN MY ROWS BEING BAD.
The interlock records that AuthoredReferenceResolution was SPLIT OUT of
NewPoolCoincidenceResolution on 2026-08-27 precisely to separate "the target grew a name this
module was already reaching for" (coincidence, cause elsewhere) from "this module's own author
wrote what resolves a name it was already spelling" (the repair the wall exists to want). THE
STATED DISCRIMINATOR IS THE MODULE'S OWN SOURCE.
gunbc.recurring_failure_mode.roster NO LONGER HAS AN AUTHOR. Since #10822 it is GENERATED --
ensure_derived_recurring_failure_mode_roster reads the row directory -- so its source is
DERIVED FROM THE VERY FILES BEING ADDED. Its binding to my row is not a coincidence in the
pool; it is the mechanical consequence of the file existing, which is exactly what #10822
built. The membership arm already reaches that conclusion and auto-admits with "reached by a
name this module authors". The binding arm applies a discriminator that assumes a human author
and gets the opposite answer on the same fact.
Consequence, stated plainly: after #10822 an append is a new file and nothing else -- EXCEPT
that it now requires an operator-authored namespace admission. The merge-region collision was
removed and a gate refusal took its place. That is cheaper and far better, but it is not free,
and nobody has hit it until now.

WHAT I AM NOT DOING: authoring the admission. The interlock says operator-authored, and I will
not hand-admit a wall refusal about my own diff -- that is the escape-hatch shape whatever the
merits.

ESCALATING, because the fix is one of two and neither is mine: (a) author the two admissions
for #10842 and let the class recur on every future row, or (b) treat a DERIVED module's binding
to a newly-present source file as AuthoredReferenceResolution rather than
NewPoolCoincidenceResolution, which closes it for every future append. I recommend (b) and I
would take (a) only as an interim with (b) as its trigger.
#10842 stays red until that is answered. Nothing else of mine is affected.

briansrls pushed a commit that referenced this pull request Sep 9, 2026
…tor's declared input (#10871)

* The third state of `0 -> 1`: a derived module's binding to its generator's declared input

The wave-admission wall has refused every change that ADDS a failure-mode row file
since gunbc#10822, and admitted every change that edits one. Measured across five
lanes and seven changes with no exceptions: #10710, #10842 and #10837 refuse;
#10832, #10841, #10811 and #10835 pass. #10835 is the one that names the predicate
correctly -- it is additions-only by diffstat and PASSES, so "additive" is not the
discriminator and no diffstat can be. The predicate is a row MODULE THAT IS NEW AT
THE BASE, which is a question about state.

WHY IT REFUSED. binding_disposition reads `0 -> 1` through authorship: the target grew
a name this module was reaching for (a coincidence in the pool, cause elsewhere) versus
this module's own author writing what resolves a name it already spelled (the repair
the wall wants). THAT DISCRIMINATOR PRESUMES A MODULE THAT HAS AN AUTHOR. Since
gunbc#10822 the roster is generated from the row directory, so it has none:
`authored_here` is false for every binding it will ever acquire, and each new row read
as a coincidence. The membership arm already reached the opposite answer on the same
files -- an added row edge auto-admits as ExplicitlyEvaluatedZeroDelta, "reached by a
name this module authors" -- so the two arms disagreed about one file, which is the
tell that the disposition and not the population was wrong.

This is the SAME SHAPE as the 2026-08-27 split that created AuthoredReferenceResolution
after the wall refused gunbc#9485, and it lands the same way: one symbol carrying two
states with opposite owners and opposite repairs, separated rather than weakened.

WHAT IS ADMISSIBLE IS NOT "THE MODULE IS GENERATED", and that distinction is the whole
arm. Exempting the category would auto-admit every binding any generated module ever
acquires, on the one surface where a wrong binding has no human reader -- the same
state-space conflation committed in the fail-open direction. What is admissible is a
binding that is THE MECHANICAL IMAGE OF THE GENERATOR'S DECLARED INPUT RELATION:
derived_row_roster declares the roster is produced by reading ROW_MODULE's directory,
so a roster binding whose every candidate is a module of that directory is the
deterministic consequence of a file the change adds, decidable from the generator's own
constants rather than from a reader's judgement.

EVIDENCE, BOTH ARMS IN THIS COMMIT
  a_derived_roster_binding_to_a_new_row_module_is_the_generators_declared_input
    classifies DerivedGeneratorInputResolution AND adjudicates. Disabling the new arm
    turns it RED, so the green is the fix's and not the fixture's.
  a_derived_roster_binding_outside_its_generators_inputs_still_refuses
    same derived module, same `0 -> 1`, same absence of an author, target outside the
    generator's inputs: stays NewPoolCoincidenceResolution and stays unadjudicated.
    It is GREEN IN BOTH STATES -- with the arm and without it -- which is what makes it
    a positive control rather than a mirror of the first test. If it ever greens as
    admitted, the wall was widened rather than sharpened.
Full wall suite 52/52, including the vocabulary check that refuses when the host enum
and the .dag authority disagree about the coproduct.

THE FIXTURE ITSELF CARRIES A FINDING. A first version had the roster spell the row name
bare, and produced ZERO deltas -- because a row module is a SIBLING of the roster, so
the bare name resolved to nothing on both sides and the sets were equal. Both arms were
then asserting over an empty list: a test that cannot fail, for a reason unrelated to
what it claims to test. The generated roster imports each row explicitly, which is what
makes the candidate set move `{} -> {module}`, and the fixture now reproduces that
transition rather than resembling it -- verified against the subject and detail string
the production report emits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* Enumerate the new declaration, and state the partition where the partition is stated

review 62773, both findings verified against the tree and both real.

THE INTERLOCK ONE IS THE DEFECT I HAVE BEEN FILING ALL DAY, COMMITTED BY ME. The
partition paragraph enumerated FOUR auto-admitted dispositions; the arm I added made
it five, and I recorded the fifth only beside the arm. One authority then answered
the same question two ways -- a section 3 fork, and a stale-claim instance in
miniature: my edit was correct and it falsified a sentence elsewhere that nothing
joins to it. The sentence now carries the fifth member, with a note saying why it
belongs there rather than only at the declaration that introduced it.

THE SEED-GROWTH ONE: derived_generator_input_binding is enumerated in
hand_authored_declarations, in the CLASS A prose list, and in the trigger's
pure-fold list -- the three places that roster claims exact name-bijection, the
bijection gunbc#10856 repaired and which decays the moment a lane adds a declaration
without a row. Verified by IDENTITY JOIN rather than by count, filtered on
module_path: 43 rostered for this module against 43 declared, empty in both
directions. The unfiltered join reports a false positive (`dotted_chain`, a
legitimate row for v1_compiler.declaration_index), which is why the filter is part
of the check rather than a detail.

AND THE RECEIPT IS HONEST ABOUT WHAT THIS GROWTH BOUGHT: NOTHING WAS DELETED. No
scaffold removed, no fork consolidated; the count goes 42 to 43. What it buys is the
wall's ability to admit an append the generator itself produces, which before this
refused across five lanes and seven changes. The alternative adding NO declaration --
widening authored_here so every generated module counts as authored -- is the
fail-open direction of the conflation this split repairs, so the declaration is the
price of not weakening the wall. CLASS A, dissolving with its neighbours unchanged.

Wall suite 52/52 after both edits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* Re-home the doc block: the set-disposition paragraphs describe binding_disposition

review 62782, verified. Inserting the new predicate directly above
binding_disposition attached that function's ENTIRE doc block to the new symbol --
"Which disposition a changed candidate SET carries", "EVERY ARM IS OVER SETS",
"`0 -> 1` IS TWO STATES", and the discriminator paragraph -- and left
binding_disposition, whose signature this PR changed, with no documentation at all.
The block also carried two summary lines for one item.

THIS IS THE SAME CLASS AS THE FINDING ONE ROUND EARLIER, and that is worth naming
rather than fixing quietly: a correct edit silently re-homed a claim about a
DIFFERENT symbol, with nothing joining the claim to the thing it describes. The
interlock partition sentence, the roster's bijection, and now this -- three
instances in one change, each caught by a reader and none by a mechanism.

Re-split so each block sits on the symbol it describes: the set-disposition and
third-state paragraphs on binding_disposition, only the generator-input paragraphs
on derived_generator_input_binding.

AND ONE THE REVIEW DID NOT RAISE, WHICH THE RE-SPLIT EXPOSED. That paragraph said
"the discriminator BELOW" -- a positional reference. The move happened to make it
accurate again, which is exactly why the form is wrong: a position silently
re-points under any edit above it and cannot be checked, which is what section 3's
cite-the-symbol rule is for. It now names `authored_here`.

Wall suite 52/52.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* Remove a fabricated default from an auto-admission path; the generator owns its module name

review 62792 (APPROVE, non-blocking) and it is worth fixing rather than deferring.
The wall recovered the roster's module name with
`ROSTER_BASENAME.strip_suffix(".dag").unwrap_or("roster")` -- a GUESS substituted
when the suffix is absent. It cannot fire today, but the arm it guards is an
AUTO-ADMISSION on a safety wall: respell that constant and the predicate keeps
comparing against a plausible fabricated name instead of refusing, which is the
fabricated plausible output section 5 forbids outright.

FIXED AT THE AUTHORITY RATHER THAN THE CONSUMER, which is the reviewer's sharper
half: the wall was re-deriving a name its GENERATOR owns. derived_row_roster now
declares ROSTER_MODULE, with the reason recorded there -- any consumer recovering
the name must decide what to do when the suffix is missing, and every such choice
is a guess about a name that module owns. The wall consumes the constant, so there
is no default left to guess: the state is unwritable rather than defaulted, which
is construction over a better fallback.

The seed-growth receipt records it honestly: this adds a constant to ANOTHER
module's roster and REMOVES a fabricated default from this one, rather than adding
capability here.

Wall suite 52/52, clippy --all-targets clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* Enumerate ROSTER_MODULE in the generator's own roster, with the removal receipt

A consequence of the previous commit, caught before CI: derived_row_roster carries
its OWN seed-growth roster, so declaring ROSTER_MODULE there put THAT module's
name-bijection out by one -- the same decay review 62773 flagged on the wall's
roster, one module over. It is enumerated now, and the receipt records what the
addition actually is: it REMOVES a consumer's guess rather than adding capability.
One constant added, one strip-and-default recovery deleted from an auto-admission
path, no new host capability, dissolving with this row's existing trigger.

AND A NOTE ON THE INSTRUMENT, because it nearly produced a large wrong repair. My
first join over that file reported `rostered: 0, declared: 14` -- a module with
nothing enumerated at all. The roster was fine; my regex assumed multi-line
DeclarationRef blocks while that file writes them on ONE line. Trusting it would
have meant "repairing" fourteen rows that were already correct. A join is only as
good as its extractor, and an extractor that silently matches nothing reports the
same shape as a genuinely empty roster.

Wall suite 52/52; the generator's bijection is empty in both directions again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* State the arm's residual risk in the tree, not in a review thread

The arm trusts the generator's DECLARED inputs, and what it checks is the
declaration rather than the generator's behaviour. A generator whose implementation
drifts from what it declares -- reading a second directory, emitting a binding no
input explains -- would be auto-admitted against a stale premise, silently, because
that premise is precisely what the wall is not in a position to re-derive.

Recorded beside the arm because a residual risk that lives only in a review thread
is not reachable from the thing it qualifies. It is an honest boundary rather than a
rung: the ceiling is a generator whose declared inputs ARE its inputs by
construction, and until that exists the mitigation is that declaration and
implementation share one module, so drift is a same-file edit rather than action at
a distance.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

* Disclose that the arm answers for ONE generator, and name what a second would need

The prose explained the arm well enough that a reader would reasonably conclude it
generalizes over generators with declared inputs. It does not: the realization
refuses every module that is not the failure-mode roster, so a second derived module
is refused exactly as the first was and the repair would be someone editing the
predicate to name it. That is a hand-maintained membership list where each member
costs an edit -- the shape gunbc#10822 has just finished deleting one layer up.

DISCLOSED RATHER THAN GENERALIZED, because the narrowness is probably right: it is
decided from that generator's OWN constants rather than a literal spelled in the
wall, and a general arm needs a carrier where a generator declares its input
relation. That carrier does not exist -- gunbc.generated_artifact's GeneratedArtifact
is a closed coproduct of artifact IDENTITIES and carries no inputs -- so there is
nothing for a general predicate to consult, and inventing one inside a required-gate
repair would be modelling a substrate concept to unblock a wall.

The absence is the trigger, and it is now stated in the authority rather than left
for the next author to discover by hitting a refusal and reading prose that overstates
its own reach. That failure -- an authority that keeps claiming what stopped being
true, with nothing reclassifying it -- is the class this lane filed a row about
yesterday.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

---------

Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Brian Searls <briansearls1@gmail.com>
Brian Searls and others added 2 commits September 9, 2026 03:25
Review 62862 found the load-bearing receipt carrying its argument as
transcribed literals -- "fired 59 times", "6,231", "three neighbouring classes
were INVARIANT" -- with no producer named. That is DESIGN section 6 exactly:
name the instrument, never transcribe its output, because a transcribed number
is unreachable from the thing that owns it and rots without anyone touching
either end. The sibling rows on this carrier already show the compliant form.

The finding is upheld with a receipt of its own. Attempting to re-derive the two
figures from the run artifacts that produced them returned 38 and 6148, not 59
and 6231. The numbers had ALREADY decayed, on an unlanded row, inside one
session -- so this row is a specimen of the class it was written to file, and
that is now stated in the receipt rather than quietly repaired.

The producer replaces them: the whole-corpus compile, the reason spelling that
identifies the counted class, the neighbouring reasons as invariant controls,
and the A/B design that makes it decidable. The claim is kept qualitatively and
made falsifiable in the honest direction: a re-derivation that moved the
neighbouring reasons too would refute this row rather than confirm it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF
@briansrls
briansrls merged commit 39387c0 into main Sep 9, 2026
4 checks passed
@briansrls
briansrls deleted the ledger/frontier-and-fabricated-type-rows branch September 9, 2026 05:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant