The third state of 0 -> 1: a derived module's binding to its generator's declared input

[gunbai-bot]

The wave-admission wall has refused every change that ADDS a failure-mode row file
since gunbc#10822, and admitted every change that edits one. Measured across five
lanes and seven changes with no exceptions: #10710, #10842 and #10837 refuse;
#10832, #10841, #10811 and #10835 pass. #10835 is the one that names the predicate
correctly -- it is additions-only by diffstat and PASSES, so "additive" is not the
discriminator and no diffstat can be. The predicate is a row MODULE THAT IS NEW AT
THE BASE, which is a question about state.

WHY IT REFUSED. binding_disposition reads 0 -> 1 through authorship: the target grew
a name this module was reaching for (a coincidence in the pool, cause elsewhere) versus
this module's own author writing what resolves a name it already spelled (the repair
the wall wants). THAT DISCRIMINATOR PRESUMES A MODULE THAT HAS AN AUTHOR. Since
gunbc#10822 the roster is generated from the row directory, so it has none:
authored_here is false for every binding it will ever acquire, and each new row read
as a coincidence. The membership arm already reached the opposite answer on the same
files -- an added row edge auto-admits as ExplicitlyEvaluatedZeroDelta, "reached by a
name this module authors" -- so the two arms disagreed about one file, which is the
tell that the disposition and not the population was wrong.

This is the SAME SHAPE as the 2026-08-27 split that created AuthoredReferenceResolution
after the wall refused gunbc#9485, and it lands the same way: one symbol carrying two
states with opposite owners and opposite repairs, separated rather than weakened.

WHAT IS ADMISSIBLE IS NOT "THE MODULE IS GENERATED", and that distinction is the whole
arm. Exempting the category would auto-admit every binding any generated module ever
acquires, on the one surface where a wrong binding has no human reader -- the same
state-space conflation committed in the fail-open direction. What is admissible is a
binding that is THE MECHANICAL IMAGE OF THE GENERATOR'S DECLARED INPUT RELATION:
derived_row_roster declares the roster is produced by reading ROW_MODULE's directory,
so a roster binding whose every candidate is a module of that directory is the
deterministic consequence of a file the change adds, decidable from the generator's own
constants rather than from a reader's judgement.

EVIDENCE, BOTH ARMS IN THIS COMMIT
a_derived_roster_binding_to_a_new_row_module_is_the_generators_declared_input
classifies DerivedGeneratorInputResolution AND adjudicates. Disabling the new arm
turns it RED, so the green is the fix's and not the fixture's.
a_derived_roster_binding_outside_its_generators_inputs_still_refuses
same derived module, same 0 -> 1, same absence of an author, target outside the
generator's inputs: stays NewPoolCoincidenceResolution and stays unadjudicated.
It is GREEN IN BOTH STATES -- with the arm and without it -- which is what makes it
a positive control rather than a mirror of the first test. If it ever greens as
admitted, the wall was widened rather than sharpened.
Full wall suite 52/52, including the vocabulary check that refuses when the host enum
and the .dag authority disagree about the coproduct.

THE FIXTURE ITSELF CARRIES A FINDING. A first version had the roster spell the row name
bare, and produced ZERO deltas -- because a row module is a SIBLING of the roster, so
the bare name resolved to nothing on both sides and the sets were equal. Both arms were
then asserting over an empty list: a test that cannot fail, for a reason unrelated to
what it claims to test. The generated roster imports each row explicitly, which is what
makes the candidate set move {} -> {module}, and the fixture now reproduces that
transition rather than resembling it -- verified against the subject and detail string
the production report emits.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

Acceptance

Unblocks every change adding a failure-mode row module, not just the asker's. All five new-at-base modules across the three refusing PRs are direct children of ROW_MODULE with no nested directory, which is exactly the condition the predicate tests:

PR	new module
#10710	…authored_quotation_terminates_the_string_it_is_authored_in
#10710	…unresolved_callee_conflated_with_dispatched_elsewhere
#10842	…declared_frontier_outlives_the_firing_of_its_own_trigger
#10842	…unresolved_name_is_reported_as_a_decidability_verdict
#10837	…handwritten_population_wrong_by_gain_and_by_loss

#10837 belongs to a lane unconnected to this one and is cleared by the same arm, not by a special case. That table is a structural argument; the executed proof for all three is CI on their own heads once this lands.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GwvzQ3SQoWWDgHkAeffMeF

[gunbai-bot]

Both findings in review 62773 verified against the tree and fixed in e5802ed89a.

The interlock one is the defect I have spent the day filing, committed by me. The partition paragraph enumerated four auto-admitted dispositions; my arm made it five, and I recorded the fifth only beside the arm. One authority then answered the same question two ways — §3 — and it is a stale_claim_survives_its_own_correct_edit instance in miniature: the edit was correct, and it falsified a sentence elsewhere that nothing joins to it. The partition sentence now carries the fifth member, with a note saying why it belongs there rather than only at the declaration that introduced it.

The seed-growth one. derived_generator_input_binding is now enumerated in hand_authored_declarations, in the CLASS A prose list, and in the trigger's pure-fold list — the three places that roster claims exact name-bijection.

Verified by identity join rather than count, filtered on module_path: 43 rostered for v1_compiler.namespace_wave_admission against 43 declared, empty in both directions. Worth stating because the unfiltered join reports a false positive — dotted_chain, a legitimate row for v1_compiler.declaration_index — so the filter is part of the check, not a detail. A count comparison would have read 44 vs 43 and sent me looking for a defect that is not there.

The hand-Rust receipt says plainly that nothing was deleted. No scaffold removed, no fork consolidated; 42 → 43. What it buys is the wall's ability to admit an append the generator itself produces, which before this refused across five lanes and seven changes. The alternative that would have added no declaration — widening authored_here so every generated module counts as authored — is the fail-open direction of the conflation this split repairs, so the declaration is the price of not weakening the wall rather than a convenience. CLASS A, dissolving with its neighbours unchanged.

Wall suite 52/52 after both edits, including the vocabulary check that refuses when the host enum and the .dag coproduct disagree.

— sent from quick-heron-85

[gunbai-bot]

Verified and fixed in 724ccc15d3.

The finding is right and it is a defect rather than a style note: inserting the new predicate directly above binding_disposition attached that function's entire doc block to the new symbol, leaving binding_disposition — whose signature this PR changed — with no documentation at all, and putting two summary lines on one item. Re-split so each block sits on the symbol it describes.

Worth naming rather than fixing quietly: this is the third instance of one class in this change. The interlock partition sentence, the seed-growth roster's bijection, and now this doc block — each a correct edit that silently re-homed or falsified a claim about a different symbol, with nothing joining the claim to the thing it describes. All three were caught by a reader; none by a mechanism. That is stale_claim_survives_its_own_correct_edit behaving exactly as its row predicts, in a change whose own subject is a wall that adjudicates deltas — which I think makes the row's next-rung trigger more interesting, not less.

One the review did not raise, which the re-split exposed. That paragraph said "the discriminator below" — a positional reference. Moving the block happened to make it accurate again, and that is precisely why the form is wrong: a position silently re-points under any edit above it and cannot be checked. §3's cite-the-symbol rule covers exactly this, so it now names authored_here instead.

Wall suite 52/52 after the re-split, and the classifier itself is unchanged by this commit — no arm, predicate, or test was touched, only where the prose attaches.

— sent from quick-heron-85

[gunbai-bot]

Fixed in 3c1f517f7f and 2a9be56dba — the finding is worth acting on, and acting on it exposed a second one.

The fabricated default is gone, and the fix is at the authority rather than the consumer — which is the sharper half of your point. The wall was re-deriving a name its generator owns. derived_row_roster now declares ROSTER_MODULE directly, with the reason recorded there: any consumer recovering the name has to decide what to do when the suffix is absent, and every such choice is a guess about a name that module owns. The wall consumes the constant, so there is no default left to guess — the state is unwritable rather than defaulted. On an auto-admission path the consequence of the guess would have been a comparison that silently succeeds against a name nobody declares, instead of a refusal.

The consequence I caught before CI did: derived_row_roster carries its own seed-growth roster, so declaring the constant there put that module's name-bijection out by one — the same decay review 62773 flagged on the wall's roster, one module over. Enumerated, with a receipt stating what the addition is: one constant added, one strip-and-default recovery deleted, no new host capability.

And a note on the instrument, because it nearly produced a large wrong repair. My first join over that file reported rostered: 0, declared: 14 — a module with nothing enumerated at all. The roster was fine; my extractor assumed multi-line DeclarationRef blocks while that file writes them on one line. Trusting it would have meant "repairing" fourteen rows that were already correct. An extractor that silently matches nothing reports the same shape as a genuinely empty roster, which is the failure mode of every join whose extractor is unverified.

Wall suite 52/52 throughout, clippy --all-targets clean, and both bijections empty in both directions.

— sent from quick-heron-85