From 16e98045a822abf2c08662f62233f92dbedd0f6f Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Thu, 10 Sep 2026 15:42:50 +0000 Subject: [PATCH 1/2] Import mutation_status_is_commit_ambiguous from the module that declares it main is red on the declarations phase: declarations FAIL IMPORT-MEMBER-ABSENT dag/gunbc/cloudflare/r2_token_mint_run.dag:69:3 imports `mutation_status_is_commit_ambiguous` from `gunbc.secret_provision_actuator`, which declares no such name The symbol has exactly one declaration in the corpus, `extdeps.transports.rest` at rest.dag:111, and `secret_provision_actuator.dag:238`'s own annotation already names that as its home. The importing module ALREADY imports `extdeps.transports.rest` at line 8, so this moves one name between two import lists that both exist. Nothing is renamed, added or deleted. Measured on both arms through `gunbc compile --entry dag/gunbc/cloudflare/r2_token_mint_run.dag`, discriminating rather than asserted: unfixed (origin/main) 1 blocking error(s), 815 advisory fixed 0 blocking error(s), 815 advisory, 132 files emitted The advisory count is identical across the arms, so the edit moved exactly the one thing it claims to. Note the compile exits 0 while carrying a blocking error, so the count line is the signal and the exit code is not. Cut as its own change rather than folded into the census PR that surfaced it: one PR, one question. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_016jFtgPtXxTj1kE8wwZUNsG --- dag/gunbc/cloudflare/r2_token_mint_run.dag | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/cloudflare/r2_token_mint_run.dag b/dag/gunbc/cloudflare/r2_token_mint_run.dag index 9e50144fadf..b221aac3d4c 100644 --- a/dag/gunbc/cloudflare/r2_token_mint_run.dag +++ b/dag/gunbc/cloudflare/r2_token_mint_run.dag @@ -5,7 +5,10 @@ import std.resources { Network } import std.process { ProcessExit, ExitSuccess, exit_failure } import std.human_intervention { HumanIntervention, ProvisioningHumanBurden } import extdeps.cloud.gcp.secret_ref { SecretRef, secret_ref_version_resource } -import extdeps.transports.rest { RestOk, RestStatusRefused, RestTransportRefused, RestBodyUndecodable } +import extdeps.transports.rest { + RestOk, RestStatusRefused, RestTransportRefused, RestBodyUndecodable, + mutation_status_is_commit_ambiguous, +} import extdeps.cloudflare.account_api_tokens import extdeps.cloudflare.account_api_tokens { CreateAccountTokenRequest, @@ -66,7 +69,6 @@ import gunbc.secret_provision_actuator { add_initial_version, VersionAddedAndVerified, VersionAdditionRefused, VersionAdditionOutcomeUnknown, VersionAddedButUnverified, verified_exact_ref, - mutation_status_is_commit_ambiguous, } // THE EXECUTING CONSUMER OF THE R2 MINT, AND THE ORDER OF ITS CHECKS IS THE WHOLE DESIGN. From 426432751d35e160a9abbe99aa86169f25187f6d Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Thu, 10 Sep 2026 16:27:30 +0000 Subject: [PATCH 2/2] Admit the stranded-caller repair's binding delta, and say the wall misclassified it The wave wall refuses this PR's own repair. It classifies base {} -> head {extdeps.transports.rest} as NewPoolCoincidenceResolution, which refuses. By the 2026-08-27 operator ruling in gunbc.compiler_frontend_program_interlock, an author writing the import that resolves a name the module was ALREADY SPELLING is AuthoredReferenceResolution, which auto-admits -- a distinction that ruling drew after the wall refused gunbc#9485, also a one-line import repair. This is that case exactly. It lands in the wrong arm because locally_authored_claim_added decides authorship with names_leaf, which reads `c.members` and never `c.target`. The base names the leaf from the wrong module and the head names it from the right one, so `names_leaf(head) && !names_leaf(base)` is false. The predicate can see a name appearing where it was ABSENT; it cannot see a name whose SOURCE changed. What makes that a defect rather than a rough edge: a REDUNDANT blanket import would have tripped the blanket_targets branch and auto-admitted. The wall is easier to satisfy by writing worse code, so it teaches the wrong repair. I did not write the blanket import -- noticing you are implementing a workaround is the line-stop signal (DESIGN section 5) -- and escalated instead. Admit was ruled; the predicate fix lands separately against a green main, because repairing a wall in the same motion that asks it for an exception makes the exception look bought. The row also fixes the attribution, which I had wrong twice: neither contributing change is wrong in isolation. #10925 wrote the import when the fn WAS declared in secret_provision_actuator; #10923 then deleted it, rehoming it correctly and leaving one edge at the old address. The defect exists only in their composition. Roster was empty at this base -- verified against 495cde7772d rather than against my other worktree, which carried two rows deleted upstream. The row carries its own deletion trigger. cargo check -p v1-compiler: Finished, 0 errors. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_016jFtgPtXxTj1kE8wwZUNsG --- src/v1/stage0/src/namespace_wave_admission.rs | 47 ++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/src/v1/stage0/src/namespace_wave_admission.rs b/src/v1/stage0/src/namespace_wave_admission.rs index 8d55b864ad7..4fd9de7f10b 100644 --- a/src/v1/stage0/src/namespace_wave_admission.rs +++ b/src/v1/stage0/src/namespace_wave_admission.rs @@ -1678,7 +1678,52 @@ pub struct TransitionAdmission { /// #10818 CpuBoundStanding rehome consumed: required floor on this PR's previous head /// (34440928699) reported both `TargetChanged` rows already satisfied at the base. This file is /// the roster, so this touch deletes them. Empty is the resting state; empty is not permissive. -pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[]; +/// mutation_status_is_commit_ambiguous stranded caller (2026-09-10, gunbc#10945). main was RED on +/// the declarations check: `gunbc.cloudflare.r2_token_mint_run` imported that spelling from +/// `gunbc.secret_provision_actuator`, which declares no such name, so the base bound it to NOTHING. +/// NEITHER CONTRIBUTING CHANGE IS WRONG IN ISOLATION and the row says so because a wrong attribution +/// here would outlive the defect: #10925 wrote that import line at 23598caecca when the fn WAS +/// declared in `secret_provision_actuator`, and #10923 then deleted the fn at 4024a3a5bdb, rehoming +/// it to `extdeps.transports.rest` (rest.dag:111) and leaving one edge pointing at the old address. +/// The defect exists only in their composition — a stranded caller. #10923's floor concluded +/// 09:50:11Z, four hours before #10925 landed at 13:48:36Z, so the verdict that would have caught the +/// stranding was computed against a base that did not yet contain the importer it was about to +/// strand. Not a race: a concluded verdict, correct about the world it measured, and that world no +/// longer existed at merge time. +/// +/// The repair points the import at the one module that declares the name, which this module already +/// imported. Required floor run 34497494076 measured parse 0 and declarations 0 — the break is gone — +/// and refused adjudication on exactly this one binding delta, `base {} -> head +/// {extdeps.transports.rest}`, classified `NewPoolCoincidenceResolution`. +/// +/// THE CLASSIFICATION IS WRONG AND THIS ROW ADMITS IT ANYWAY. By the 2026-08-27 operator ruling in +/// `gunbc.compiler_frontend_program_interlock`, an author writing the import that resolves a name the +/// module was ALREADY SPELLING is `AuthoredReferenceResolution`, which auto-admits; that ruling was +/// made after the wall refused gunbc#9485, a one-line import repair. This is that case exactly. It +/// lands in the coincidence arm because `locally_authored_claim_added` decides authorship with +/// `names_leaf`, which reads `c.members` and never `c.target`: base names the leaf (wrong module), +/// head names it (right module), so `names_leaf(head) && !names_leaf(base)` is false. The predicate +/// sees a name appearing where it was ABSENT, never a name whose SOURCE changed. The incentive +/// inversion is what makes this a defect rather than a rough edge: a REDUNDANT blanket import would +/// have tripped the `blanket_targets` branch and auto-admitted, so the wall is easier to satisfy by +/// writing worse code. Escalated rather than worked around; admit was ruled, with the predicate fix +/// to land separately against a green main — repairing a wall in the same motion that asks it for an +/// exception would make the exception look bought by the fix. +/// +/// TRIGGER: this row goes when #10945 merges. The base then binds the spelling to +/// `extdeps.transports.rest` inside `mint_r2_object_read_token`, the delta stops being producible, +/// and CONSUMED comes due on the roster's next touch — adjudicated by the declaring-module join, not +/// by this sentence. +pub const NAMESPACE_TRANSITION_ADMISSIONS: &[TransitionAdmission] = &[TransitionAdmission { + label: "gunbc#10945 mutation_status_is_commit_ambiguous stranded-caller repair", + subject: AdmissionSubject::Binding { + module: "gunbc.cloudflare.r2_token_mint_run", + in_declaration: "mint_r2_object_read_token", + spelling: "mutation_status_is_commit_ambiguous", + target: "extdeps.transports.rest", + }, + disposition: NamespaceDeltaDisposition::NewPoolCoincidenceResolution, +}]; /// The denominators a green must name (DESIGN §5): a run that cannot say what it covered is an /// instrument failure wearing coverage's clothes.