The observer could still see the goal, because the guarantee was a sentence

[gunbai-bot]

std.goal_assessment said "the observer cannot see the goal" while observe took (Subject, Scope) — and a subject is exactly where a goal travels. The sentence was true when written and false one binding later: fabric_switch matched on subject.intent, so the desired mode selected which lanes were read. Two of the three bindings broke the law the module advertised.

inspect_goal now takes subject, goal and request as three arguments and hands the observer (Subject, ObservationRequest). It is goal-blind because it has no goal-typed parameter, not because a note asks it to be. It is not subject-blind — handing it only the request would make subject a label on the result, free to name A while the read went to B. Both result arms carry the request, so a refusal says which read was attempted.

Three defects this fixes were shipped by #10814, and its witnesses ratified them

Member-level unknowns were promoted to whole-observation refusal. The first unread lane short-circuited the observation and discarded every deviation proved on lanes that were read — an unknown fact suppressing a known one, which is the ordering harm #10814 removed from repo_ruleset, reintroduced one module over.

The denominator came from the observation. Unknowns were built from LaneNeverRead rows a caller authored, so a lane omitted from the readings entirely vanished from the population it was supposed to be measured against. The switch now joins SwitchIntent.lanes — the declared roster — against what was read. An intent naming lanes none of which were read is fully unknown, not empty; only an intent naming no lanes is the malformed question. cable_plant cannot do this join (no declared leg roster) and now states that ceiling with its next-rung trigger rather than implying the guarantee.

The collapse survived one module downstream. fabric_switch_desired mapped divergence, indeterminacy and assessment refusal onto one PlantDivergedFromRequirement { legs: Nat } — discarding every unknown, reporting a malformed assessment as legs: 0. It carries the rows now.

Renames

The inspect-only modules stop advertising an actuator they never had: *_converge → *_assessment, Crs812ConvergenceSubject → Crs812SwitchSubject, *_convergence → *_inspection. No alias, no compatibility shim.

Evidence

41 witnesses green, including four new controls: unknown is not a failed read; a proved deviation and an unread member are reported together; an unread roster is not an empty one; and a lane the readings omit entirely is still an unknown.

The last two are proved discriminating by mutation — reverting the join to the reading-derived shape gives:

FAIL a_lane_the_readings_omit_entirely_is_still_an_unknown
FAIL one_unread_lane_is_an_unknown_and_not_a_failed_read
PASS a_correctly_configured_switch_converges     <- control on the control

A new generic control fixes the module's central claim: two goals over one request produce one observation.

One deliberate divergence from review guidance

The recommendation was to eliminate GoalObservationRefused for cable (whose ObserveRefusal is Never) "through the Never fold already used by the corpus". That fold does not exist, and .dag refuses match f { } ("match expression has no arms"). The alternative that compiles is fabricating a CablePlantAssessRefusal for the arm to carry, which asserts a reason that isn't the real one. I kept a payload-free arm that fails closed to undecided, never a speed, wrote into the module that this is a language limit rather than a modelling choice, and named the trigger: empty-match support or a Never elimination fold.

Not verified by execution

repo_ruleset. Its closure reaches gunbc.roadmap.roadmap_belt_actuate via extdeps.transports.rest, and that module fails to resolve (if branches resolve to incompatible types) byte-identically to main — a pre-existing break I did not introduce and am not fixing here. Its changes typecheck with no errors attributed to them, which is not the same as green by execution. Flagging rather than letting 41 green witnesses imply coverage they don't have. That main defect wants its own change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PUtSkZTNvpWQv58Lk9cGzg

[gunbai-bot]

Both findings from review 62850 confirmed against the code and fixed in b8f33c08b6d. The first was worse than reported.

observe_repo_ruleset_attempt arity — confirmed, plus a second defect underneath. You were right that the observer takes one parameter while inspect_goal calls observe(subject, request), and that nothing else repaired it. But re-typing the parameter would have compiled and still left the guarantee false here: the request at the call site was a verbatim duplicate of the subject — the same RepositoryRulesetConvergenceSubject constructed twice — so this binding's request carried nothing about the read. Your §5 reading is exactly right, and it applies to the duplicate as much as to the arity.

So the repair is the split, not the arity: subject is now Repository (who), request is RulesetReadRequest { ruleset_id } (what to read). The fused RepositoryRulesetConvergenceSubject is deleted — it existed only to carry both facts at once, which is the fusion this PR is about.

two_goals_over_one_request_produce_one_observation permanently green — confirmed, deleted rather than repaired. Both calls passed the same fixture_observe, which has no goal parameter, so the equality could not go red. §4b's question about authorable RED applies, and it would have been cited as coverage for the module's central claim.

The replacement has an authorable RED, and finding it changed the claim. inspect_goal closes the parameter route; it does not close lexical capture — a lambda can close over the goal and shape the read by it. That is expressible today (the compiler accepted such a lambda and objected only to my argument syntax). So the honest rung is structural against the parameter, mitigated by review against capture, and both the module and the witness now say so. Next-rung trigger named: a lens refusing an observe argument whose free variables include the goal bound at the same call site.

I also removed fixture_assess_echoing_goal, which the deletion left unconsumed (§3c).

Evidence: 41 witnesses green across four entries, post-merge with current main.

Still not verified by execution — repo_ruleset, cause now located. Its closure reaches gunbc.roadmap.roadmap_belt_actuate, where two coproducts declare an arm named Observed — BeltObserve's and a nullary one in gunbc.self_host_compile_phase_frontier. Resolution picks the nullary, so a branch building Observed { live: ... } types as Primitive(Observed) rather than Coproduct(BeltObserve). That is a §3 collision on main — one name, two declarations — unrelated to this subject, and it silently breaks resolution for every closure reaching that module while CI stays green because CI does not compile it. Not fixed here; it wants its own change, and folding it in would make this a two-subject PR.

Which means your finding caught a defect in the one module my evidence cannot reach. That is worth stating plainly rather than leaving implied by a green tally.

— sent from sleek-newt-698

[gunbai-bot]

All three findings from review 62866 confirmed and fixed in ff3499be2ed. The first is the sharpest thing said about this work so far.

The fleet-entry annotation — confirmed, and it is this PR's own thesis failing. It claimed the entry point "refuses at the observe stage today, and it refuses with the ONE fact that is missing — the interface nobody read." The observer's refusal type is Never and it always establishes; the refusal comes from the assessment and carries the cable cause — which the module's own witness asserts while returning false on GoalObservationRefused, exactly as you noted. The sentence was true of the shape before this cut and false of the one in the same diff.

I've corrected it and recorded what it said and why it was wrong, rather than quietly swapping the text. A guarantee carried only by prose, surviving one edit past the code it described, is precisely what this change removes from the type — and it reappeared in the module while that removal was being written. That is worth leaving legible.

A sibling sweep found a second site you did not cite. The module header said the "observe stage inherits that refusal rather than re-deciding it" — same class, same edit, one paragraph away. The assessment inherits it; the observe stage cannot refuse at all. Also fixed, with the reason now stated.

Worth naming: annotations are the one part of this change no witness can guard. No Accepted program reads one, so 41 green tests say nothing about whether the prose beside them is true. Review and a targeted sweep are the only mechanisms available, and the sweep only worked because I knew the specific false claim to grep for. There is no general check here and I would rather say so than imply otherwise.

Line 292 merged paragraph — confirmed. My splice landed in the tail of an unrelated block and lost its heading. Restored.

interface_absent_from — confirmed as a failed decomposition, and the compounding cost is real. any(xs, pred) is the canonical surface (extdeps.boards.types, extdeps.bmc.capability) and I minted list_length(flat_map(...)) == 0 beside it. Worse, observed_lane_interfaces was called inside the fold: n intent lanes × m read lanes did n·m work and allocated n copies of the same list to answer one membership question each, with lane_intent_interface computing twice per lane. The projection is now hoisted once and the fold uses any. §6's standing rule applies regardless of the realized n, since n is not a time-stable fact.

Evidence: 17 witnesses green across the switch and cable entries after the fixes.

repo_ruleset remains not-execution-verified for the reason given in my previous comment — the Observed arm collision on main between BeltObserve and gunbc.self_host_compile_phase_frontier. Unchanged by this round, still not fixed here.

— sent from sleek-newt-698

[gunbai-bot]

Merge conflict with main resolved in 62087145b15 (merge commit, not a rebase — squash-merge flattens history anyway and this avoids a force-push). Head is now 3be7c35ae.

Both conflicts were more than mechanical, and one of them carried a correction I had gotten wrong.

The modify/delete conflict on the renamed witness. #10869 renamed that test from "refuses because its cables do" to "refuses while its plant cannot answer", on the grounds that six of the eight legs have never been dumped — so the plant's answer is dominated by legs nobody read, not by the coding of the legs that were read. My rename in this branch had asserted the coding story (…because_its_cables_are_uncoded), which is exactly the claim #10869 established is false of the fleet's actual state.

Taking my deletion wholesale would have silently reverted that. I ported it, and the recut sharpens it: under this change the plant answers indeterminate rather than refusing, because unread legs are member-level unknowns now — so it reports them alongside any proved coding divergence instead of refusing the whole observation on the first one. The propagation the witness asserts is unchanged; the fidelity beneath it went up. Main's exactly_two_of_eight_legs_carry_a_reading is the executing evidence for the six-unread-legs claim, and it passes here.

The import conflict in fabric_switch_observed was my rename against main's added LegNeverRead; both taken.

The census found a third consumer that no conflict would have surfaced. main added test.claim.spark.spark_fabric_switch_witness importing product.cable_plant_converge. That merges textually clean — an import naming a module that no longer exists is not a conflict — so only the census finds it. Fixed in 3be7c35ae4a. That is the third wave of new authorship against this module set while the PR has been open, each one breaking silently.

Evidence: 30 witnesses green across four entries post-merge, including main's new spark witness. Repo-wide grep for the old module and declaration names is clean.

Unchanged from before: repo_ruleset is still not execution-verified, for the Observed arm collision on main between BeltObserve and gunbc.self_host_compile_phase_frontier.

— sent from sleek-newt-698

[gunbai-bot]

Both findings from review 62920 confirmed and fixed in 95f288db617. The first is the sharpest finding on this PR and it is rung inflation in the module whose subject is rung honesty.

The goal still chose what was read — you are right, and it is the same mechanism, not a residue of it. fabric_switch_subject() built the observation request by mapping over the intent's own interfaces, so an undecided intent produced an empty request and therefore an empty snapshot because of the goal. Closing the parameter route while the request stayed goal-derived renamed the argument and removed nothing. §4b(1) is exactly the right citation: I was reporting structural-against-the-parameter while another path stayed silent.

Closed rather than declared. No RouterOS capture of this switch exists, so the honest request is empty whatever anyone wants. Unknowns are still one per intent lane because switch_unknowns joins the intent's declared roster on the assessment side — the stage that is allowed to know the goal. Same reported answer; the goal no longer reaches the read. The goal-derived roster function is deleted, since nothing consumed it once the request stopped calling it.

The residual disclosure was wrong by omission — three routes, not two. A request is caller-constructed, so no type can stop a caller computing it from the goal, and this module's own binding was the proof. All three are now enumerated, with this binding recorded as the worked example. One next-rung trigger covers both review-mitigated residuals, because they are the same shape: a goal reaching the read through a value rather than a parameter.

goal_assessment.dag:36 — confirmed false. "receives an ObservationRequest and NOTHING ELSE" was written before an earlier review restored the subject to the observer, and went stale in that very edit. Corrected there and in the switch module's copy of the same claim.

One thing you did not ask about, which I owe you: my first control for this was permanently green. It compared the fleet subject against an undecided-intent subject and asserted both requests were empty — but both are empty under the defect too, because the fleet's real intent is undecided today. Mutation caught it: I restored the defect and the check stayed PASS. That is the identical fault this PR deleted two_goals_over_one_request_produce_one_observation for, committed while correcting it.

The property was unobservable because the goal never varied, so fabric_switch_subject_under(intent) takes it as a parameter now and the control supplies a decided intent naming two lanes; under the defect that request carries two entries. Mutation-confirmed — FAIL on the defect, positive control green. The dead first version is recorded in the witness rather than swapped out.

Evidence: 12 witnesses green, the new control proved discriminating by mutation.

Standing count on this PR: three of the last four findings have been one class — a claim outliving the shape it described. Stale annotation, false "NOTHING ELSE", under-enumerated residual, inflated rung. All were invisible to 40+ green witnesses, because no Accepted program reads an annotation and a passing test says nothing about whether it can fail.

— sent from sleek-newt-698

[gunbai-bot]

Confirmed on all five bindings and fixed in 71c801f78a0. You are right, and the framing is right too — this is the one place the PR's own subject recurred, and I introduced it while fixing the previous instance.

Verified before acting: plant, switch and subject appear only in the signatures of assess_cable_plant, assess_fabric_switch and ruleset_assess; both witness assessors ignore theirs as well. Five signatures, zero uses, with a justification beside it that none of them exercises.

I took drop, not consume. Locating PlantHoldsNoLegs / SwitchIntentNamesNoLanes by subject would put a second copy of the identity beside the one GoalInspection already carries in both arms — the exact redundancy this PR removed when it dropped switch from SwitchHoldsNoLanes. Consuming the parameter would have undone that reasoning in order to justify a parameter that should not have been added.

The asymmetry that remains is real and is now stated in the module. The observer keeps its subject: repo_ruleset's observer builds its request path from subject.owner and subject.name, which is the one consumer that earns it. I swept for signature-only parameters and the two corpus-data observers do ignore theirs — legitimate, since their read is a projection of declared data and one genuine consumer is what §3c asks of a generic parameter. The assessor had none anywhere; that is the difference, and I would rather report the sweep result than leave it for the next reviewer to find.

Dropping it cascaded: witness_subject in the repo-ruleset witness lost its only reader, so that fixture and its two imports went with it.

Provenance of the defect, since it is the interesting part: an earlier review established that the observer needs its subject. I extended that to the assessor by symmetry without checking whether any assessor would read it. Fourth claim in this change to outlive the code it describes — and the second I created in the act of correcting another. Recorded in std.goal_assessment rather than silently reverted.

Evidence: 41 witnesses green across four entries.

— sent from sleek-newt-698