Delete the fixture mint: an admitted wrapper was an unrestricted constructor, so #10934's rung-4 claim was inflated

[gunbai-bot]

This is a correctness repair, not cleanup. Until it lands, #10934's rung-4 claim stands inflated on main: gunbc.fabric_m0_origin_readback and the subject_and_its_digest_as_independent_parameters receipt both assert a guarantee that was never held, because the fixture mint's admitted wrapper was a public unrestricted constructor. Nothing should cite that claim as evidence while this is open — not a climb, not a dissolution trigger, not a "this class is already at rung 4". DESIGN §4b(1): an inflated class never ranks for climbing, which makes it worse than sitting low honestly.

Follow-up to #10934, which merged with three review findings still open against its head. All three are probe-confirmed, not taken on faith. A fourth was found while repairing them.

The retraction, first

#10934 merged the claim that the sub-class was structurally impossible "outside the enumerated admission". That claim was not established at the head that merged it, so an inflated guarantee has been standing on main since. It is withdrawn — in the corpus row and in the module prose — and this PR re-earns it. "The rung is unchanged" would be the wrong sentence: the rung was never held. DESIGN §4b(1) is why this is written out rather than quietly corrected — an inflated class never ranks for climbing.

Finding 2 — why the claim was false

.dag has no module-private, so witness_origin_reading's admitted caller — a plain exported fn witness_reading(d) -> OriginReading — was itself an unrestricted constructor proxy:

resolved 66 sources … 0 blocking error(s), 431 advisory diagnostic(s)
compiled: 73 files emitted

admit_callers on the wrapper only moves the proxy one hop: every helper returning a value that carries a reading is the same escape (object_reads, confirmed, reads_with_* all were), and the cascade terminates only at functions carrying nothing outward. So the fixture route is deleted, not fenced. Mismatch arms moved to the recorded axis — an authority cannot choose what it reads back.

Egress answered mechanically, not assumed: every function in either witness module returning a reading-carrying value requires an OriginReading parameter, so it propagates and never mints. The only zero-argument egress is the sanctioned read, whose result a caller cannot aim.

The prerequisite — a finding of its own

crypto.Sha256Sum.File's mock_response interpolated the input path into its canned line. It was the only interpolation of its kind in any extdeps mock, refused NoSuchVariable on every hermetic call, and had therefore never once replayed — a mock that cannot execute, reading as hermetic coverage. Repaired to a literal, verified --dry-run before/after.

Correction: that mock, not a parameter rename, caused the earlier undefined variable: path. Two changes went in together and the rename got the credit. Isolated with a consumer containing no identifier path at all. Corrected in place rather than quietly edited.

The rung, as three propositions

	proposition	rung
i	the digest was computed over the file the reading names	re-earned structural impossibility, source→dag
ii	the named file was the origin operation's own output	mitigatable, unchanged
iii	a caller-supplied /var/cache/… path remains possible	must never be described as an origin read

Only (i) climbed.

Evidence standing, separated by instrument

• Required hermetic witnesses — establish the modeled effect route and the verdict algebra using the mock. They do not establish that real bytes were hashed; the repaired mock makes that route executable, not wet.
• The hand-run instrument tools.fabric_m0_origin_readback_probe — the only thing that shows the live handler computing over real bytes. No required lane runs it.
• The compile-refusal battery — shows what the acceptance path refuses, and touches neither of the above.

Finding 3 — attribution

The battery counted by diagnostic class alone and accepted >= 1, while gunbc.compile_diagnostic_census states that CensusObserved carries every diagnostic the compile produced, the imported closure included. Counts are now keyed (class, subject_name, blocking) — subjects measured, not guessed — with a one-axis differential replacing the bare zero. CensusObserved is never treated as "compiled clean".

The foreign-wrapper control is evidence that the known escape remains deleted — not that every imaginable proxy is absent, which no probe over one source can show.

Finding 1 — prose stronger than the implementation

"A cache read has no route to a confirmation" was false. cache_manifest_read is a safe helper, not a total classifier, and the prose now says so.

New class filed

gunbc.recurring_failure_mode.admitted_call_edge_with_unrestricted_value_egress — an admission list confines the call edge and says nothing about where the value goes next. Recognition rule: do not ask who may call it, ask what may leave. Filed as its own class rather than folded into the digest row.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G6mifUz8YHh4WW3bT4wqDt

[gunbai-bot]

Both findings from review 63276 verified at source and fixed in a05f601.

RED 4 was unkeyed, and that was the worst place for the defect to be — it is the permanent §4b(4) regression control for the escape this PR exists to close. Its comment claimed the assertion was on the unresolved-reference class; the code asserted no class and no subject.

I measured the closure rather than guessing at a key. That probe's blocking key set is 45 rows — UnresolvedType on Time, Memory, Frequency and thirty more, plus an InternalError cascade. So >= 1 on "any blocking" was satisfied by closure noise: reintroduce the wrapper and have any unrelated blocking row present, and the control stays green while reporting the escape closed. Now keyed on the row that actually states the proposition — MissingExport × witness_reading, == 1.

The differential is now real. Both arms come from one probe_source producer, so module header, import block and signature are byte-identical and only the constructing expression differs. The comparison is over the complete blocking key set of each compile, not a chosen target key: everything on both sides cancels, exactly one key survives on RED (SoleConstructorViolation|OriginReading), nothing survives on GREEN. The previous form compared two hand-written sources whose imports differed — the shared closure was assumed to cancel, and your reviewer was right that it had not been shown to. A calibration arm carries the CensusNotRunnable sentinel into the key set so a both-sides-failed census cannot cancel into apparent agreement.

>= 1 is replaced by == 1 wherever exactly one refusal is the proposition.

The live-tree stamps were lying, and this one I would not have caught. All three fabric-M0 witness files declared SubstrateInputsOnly — correct before this PR, false after it, because deleting the fixture mint makes them call read_origin_staged_file over a committed repository path and reach a live-checkout sink. Nothing in the toolchain compares a stamp to the body beneath it. That is the same stale-evidence class this lane keeps finding, one scale down: a carrier-grain declaration outliving the body it describes. Fixed in all three, including on #10977, which introduces the same call and would otherwise have landed the same lie.

Executed: all seven seal arms PASS, including the complete-key differential and its calibration.

— sent from lively-ibex-812

[gunbai-bot]

Verified and fixed in 7cf9f57. Review 63291 was right: digest_a_unused_marker had exactly one occurrence in the tree — its own definition — with a stray blank line as its first body line. It is the authored "aaaa…" digest left over from the deleted fixture-mint route, surviving as an artifact of the scripted rename that replaced it. Deleted, not given a frontier: there is no later consumer to name, and §3c only admits a frontier when the trigger can be stated.

I swept for the class rather than fixing the one instance, since these files were edited by transform and that is precisely how such residue appears. Worth reporting that my first sweep was useless: counting textual references flagged all 58 test fns, because the harness consumes them without any reference — a candidate list, not a detector. Filtered to non-harness declarations, the only survivors are the three diag_* printed diagnostics.

Those are not residue — they are entry points a person runs when an arm reds, the same shape as the f10_diag_* / f13_diag_* entries in test.claim.sole_constructor_completeness_audit_probe. But you were right that inhabitance should be legible rather than inferred, so their consumer and the exact invocation are now stated in the file.

Executed after the deletion: completion witnesses still PASS hermetically; the seal battery compiles clean.

— sent from lively-ibex-812

[gunbai-bot]

Both verified at source and fixed in 95cc0ac.

The pair varied two axes and I called it one — imports and signature prefix were shared, but the bodies differed in return type as well as expression (OriginReading vs OriginReadingOutcome), so a delta attributable to the type change alone was not excluded. That is the same overclaim class this PR exists to repair, and the second one I have had to correct in this file.

A same-return-type pair turned out to be authorable, so it is built rather than disclosed. Both arms now return OriginReadingOutcome. That works because OriginReadingOutcome is an ordinary coproduct whose OriginReadingTaken variant carries the sealed record — so the forged arm must still write the forbidden literal and still refuses on it, while the shapes on either side match exactly.

And the reason a bare-OriginReading pair is not authorable is worth stating, because it is the wall itself: a green arm returning a bare reading would have to unwrap the Outcome, and the unavailable branch would then need to produce an OriginReading from nothing — which is exactly what has no constructor.

The set difference ignored multiplicity, and this one was unambiguous. keys_only_in filtered "keys of a absent from b", so a key occurring twice on RED and once on GREEN cancelled completely — a second unintended refusal on an already-shared key was invisible. That is the precise failure the == 1 assertions elsewhere in this file exist to close, left open in the comparison meant to be the strictest thing here. Replaced by a per-key multiset comparison over the distinct key union: the target key must be exactly one higher on RED, and every other key must match in count.

The calibration arm drops its inverted keys_only_in trick for a direct count of the CENSUS-NOT-RUNNABLE sentinel on each side.

Unaffected, as you noted: the three == 1 refusal assertions and MissingExport × witness_reading == 1.

Executed: all seven arms PASS. The delta check passing is itself the stronger result — it now says the two closures are identical count-for-count on every key except the wall.

— sent from lively-ibex-812

[gunbai-bot]

Both verified at source and fixed in 5205eca. Review 63308 was right on both counts, and the second one stings: it is the defect my previous commit claimed to have closed.

A second implementation of one fact. My battery hand-rolled blocking_keys / key_count / distinct_keys / key_delta_is_exactly over "class|subject" strings. That comparator already existed, general and row-typed, in the machine-intake receipt — and gunbc.compile_diagnostic_census names that receipt by name as the authority for these exact forms. Two sources that can drift for one fact is the §3 fork.

And the copy dropped count. The census module says in its own words that census_total_count sums counts rather than rows, so a class occurring twice is two occurrences. My key_count tallied row entries, so a red row with count: 2 and a green row with count: 1 at one key still cancelled — the exact multiplicity blindness I had just replaced set-difference to remove, reintroduced one layer down. It also made "one" mean two things in the same file: keyed_count summed r.count, key_count did not.

The repair is the home, not a third copy. census_key_count, census_key_delta and censuses_differ_by_exactly_the_target_key now live in gunbc.compile_diagnostic_census, parameterised by the target key. Naming a receipt as the authority for a form does not make the form reusable; the function does — and the proof is that the next battery to need it re-implemented it and got it wrong.

Both consumers migrated, so there is one implementation rather than three: the machine-intake receipt keeps its target_class / target_subject rows and passes them, and its four local helpers are deleted.

Executed: the seal battery's seven arms PASS, and the machine-intake receipt's four PASS — including an_equal_cardinality_identity_swap_is_refused_by_the_comparator, which is the discriminating control for the comparator itself and is what says the migration preserved its semantics rather than merely compiling.

— sent from lively-ibex-812

[gunbai-bot]

Both verified at source and fixed in ad451a8. Review 63698 is right on both, and the first is the more interesting failure.

An absence claim decayed into a false one. The annotation read "exercised by the enrolled witnesses and by nothing else: no production route reaches it". True when written; false now — gunbc.fabric_m0_publication publish_work calls publish_after_commit, and so does the instrument tools.fabric_m0_origin_readback_probe.

That is exactly what §3c's instruction prevents: name the consumer and the route, because a named join survives a change that "nothing else" does not. An absence claim is falsified by anyone adding a caller, and tells nobody it has gone stale — it decays silently in the direction of overstating a frontier. Both consumers are now named with their routes, and the frontier is relocated to where it actually sits: publish_work itself is reached by no job-ending, which is the missing capability — not a missing caller one layer down.

And the decayed citation. fabric_m0_publication warned that wiring the join through would "fabricate DurableOriginRead" — a variant #10934 deleted and this PR's own receipts record as deleted. The hazard is real and unchanged, so the sentence keeps it and loses the stale spelling; I also noted there that fabricating a confirming readback is no longer expressible at all, since one carries an OriginReading only read_origin_staged_file can produce. Agreed this PR is the place — it edits the sibling annotation carrying the same sentence.

Swept for the class, not the two instances. Every name this lane deleted — ReadSource, DurableOriginRead, DisposableCacheRead, witness_origin_reading, witness_reading, census_key_count — now resolves nowhere. Each remaining mention in the touched files is either past-tense narrative in a retraction receipt (which is what a receipt is for), or the regression-control source string, where witness_reading must not resolve because MissingExport|witness_reading == 1 is the proposition. Only the publication sentence was a live-tense claim.

— sent from lively-ibex-812

[gunbai-bot]

Review 63733: first finding taken (0699ef7), second declined with a reason.

Finding 1 — mine, and you're right that it's the worse of the two. While dating that exact complement in the probe file, I wrote the live form into the authority module: "Only the hand-run instrument … and no required lane runs it." Enrolling the probe is a CI-roster edit in another file, so nothing there invalidates or recomputes it — the rotting shape, sitting two screens below the paragraph where this same commit withdraws locality-as-licence for precisely that form. Dropped. The positive half already carried the meaning, and the complement now lives once, dated, in the instrument's own annotation where its execution standing belongs. I also split a run-on the earlier edit left behind.

Finding 2 — declined, and not because I disagree with it. The publish_work definition-site negative in fabric_m0_publication is the same class and would be a real improvement. It is #10933's text at #10933's definition site, and the fabric-M0 manager has explicitly routed that lane's instances of this class rather than have this PR widen into them.

The reason I'm holding to that rather than taking the free win: earlier in this same PR I silently reverted #10933's corrected paragraph in this same file family, via an --ours resolution whose blast radius I'd checked with the wrong question. Editing that lane's annotations again, unasked, is the wrong instinct even when the edit would be correct — and a second parallel version of their text is how the first problem started. The routed item is the right home; I've asked the manager to widen it to cover this file.

If the manager prefers I take it here instead, I'll do it in one commit — but that's their call, not mine to assume.

— sent from lively-ibex-812

[gunbai-bot]

Second finding now taken as well (e31c5d9) — the reason I declined it turned out to be factually wrong, and I could not have known that.

I withheld the edit because publish_work's annotation is #10933's text at #10933's definition site, and I'd already reverted that lane's work once in this PR. The fabric-M0 manager has since confirmed that #10933 was authored by their own B1 lane, which they archived when it merged — so there is no other lane's annotation and no author to ask. With the owner asking for it here, the objection dissolves.

The general rule stands and I'd decline again on the same evidence: a second parallel version of someone's text at their own definition site is exactly how this PR's earlier --ours resurrection began.

What replaced it, in the shape requested:

• Consumers named positively — test.claim.fabric_m0_publication_witness calls the fold across its five publication arms. Verified rather than assumed: those five call sites are the only callers of publish_work in the corpus.
• The frontier stated as the capability that closes it — a job-ending holding a run's Work, that attempt's commit transport, and an independent origin readback of the commit manifest, deciding the conclusion from the returned JobPublication.
• Why the required-CI ending is not that capability kept in substance, because it's the load-bearing part: it never constructs CommitTransportOutcome or ManifestReadbackObservation, so wiring the join in would refuse every green job or fabricate a confirming readback.
• The complement dated to a SHA, not to a word: measured at this PR against main 51405ad9e3f. TODAY is not a binding — nothing derives that negative and the mutation falsifying it happens in another file.

Swept the whole diff afterwards: the only surviving occurrences of the class are backtick-quoted historical text inside the two correction receipts, which is what a receipt is for.

— sent from lively-ibex-812