Scope the jointly-incompatible-open-PR mitigation, and land checkpoint 1: joint_claim_join, the instrument behind its figures

[gunbai-bot]

Scope record gunbc.plans.joint_incompatibility_claim_join (registered in plan_registry_batch_g, authority-only like its siblings) plus checkpoint 1, the instrument, per the manager's 2026-09-11 ruling. Nothing gates on anything here.

Q1 — the cut. All three 2026-09-10 public instances are one finding kind, ImportMemberAbsent, and only one was a deletion: #10865 was a rename; #10923 was a move (its base declared mutation_status_is_commit_ambiguous in secret_provision_actuator and re-homed it — the instrument's (declared) corrected my first draft, which called it a dropped re-export). So the cut is import_surface_has (declared ∪ variants ∪ reexported) as a base-minus-head delta, not the kind of edit. The general case is every claim channel the index carries (imports, citations, rostered rows). Residuals the index cannot see are named (arity, pure freshness). The within-tree field-set case is not subsumed and is not a checkpoint here: its home is witness_that_fails_to_compile_is_absent_rather_than_red, and this PR appends a receipt there widening the trigger from claim-root files to the ruled capability (every construction site of a type whose field set changed, regardless of gate closure), per §4b(3), instead of minting a second authority.

Q2 — the cost, now instrumented. v1_compiler.bin.joint_claim_join computes per-change deltas from only diff-touched files via namespace_wave_admission base_records/diff_sides (the wave wall's own reconstruction) and joins pairs; a claim is joined only while live when the entry leaves (not retired by the remover, nor — in retrospective mode — by any change landing between the pair). raw_candidates is reported beside findings. joint_claim_join 6a54695f6c7^..f078c59b0b4 (first-parent main since 2026-08-28, 3-day window): subjects=373 raw_candidates=236 findings=4 — exactly the three instances. The two candidates the single-exclusion run reported as findings were both a third commit retiring the claim between the pair; that was built in as the second exclusion with its own control. Seven fixture-boundary tests: one positive control per instance shape, one RED per exclusion, one for the pair predicate, one for a claim already at the base.

Q3 — placement. No new job. The CI rider stops at a pull-requests: read row on a required job — the operator's trade, not a lane's (manager ruling). §4.1 costs the dashboard-side reader against it: it wins on compute, freshness and surface and never touches the merge path; checkpoint 2 is that reader, dispatched from outside this repo.

Q4 — refusal. One finding per removed (module, name) × claiming site: which surface it left, remover, claimer, claiming module, rel_path:offset; NotEvaluated when a subject's delta is unobservable, never an empty hit set.

gunbc-private: no parse phase, overlay outside DAG_PARSE_SWEEP_ROOTS → the join is public-only, and that is a typed GuaranteeStall row (joint_claim_join_private_corpus_unindexed_stall) grounded on the overlay's own extra-source-root trigger, not prose. 113/114 private modules import public.

Boundary of the widened trigger. The population compile establishes compilability of the claim-root population, not evaluation of it: a file that compiles but whose test fns are absent from the entry's conjunction passes that wall untouched (cool-badger-34's four never-evaluated fns, 2026-09-11). That hole belongs to discriminating_arm_built_but_never_enrolled, named on the row as the neighbour; this trigger does not close it.

What the instrument is NOT about. Its subject is claim support silently lost — A removes what B's claim depends on, both green alone, nothing red until a third party inherits it. A text conflict (two PRs appending to one data row — this PR and #11050 both append to witness_that_fails_to_compile_is_absent_rather_than_red) is the opposite case: git raises it loudly at merge time, no surface entry leaves, no claim loses support. A conflict on a shared row is not a miss of this join; it was never in its scope.

Hand Rust enumerated in gunbc.joint_claim_join_seed_growth (no impl block; every item citable). Verified remotely: clippy -D warnings clean, 7/7 tests, the retrospective above, v1_src_dag_parse over the corpus: 5461 files parse-clean, no findings.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QzQcQRu3WKxJuWV2zaiHSW

[gunbai-bot]

Re review 63772 and review 63786 (the §3.1 figures were transcribed with no producer): addressed in 1ea557f by landing the producer rather than dropping the counts. v1_compiler.bin.joint_claim_join is checkpoint 1; §3.1 now cites the invocation (joint_claim_join 6a54695f6c7^..f078c59b0b4) and reports what that entry answers — raw_candidates=236 findings=4 over 373 subjects — with both artefacts of the earlier run named and their common cause built in as the second exclusion (with its own control). The ad-hoc script's numbers (207/5) are gone from the record; the real index answers differently and the record says what it answers.

[gunbai-bot]

CI red on 6eaf349 is infra, not the change: required-witnesses-floor refused with TERMINAL-LEDGER REFUSAL cause=WireAuthorityUnresolved … MemoryStallRefusedPageThrash (291086 major faults/minute, 4% CPU share) — the runner's own memory-stall wall. In the same run parse (5474 clean), declarations, wave admission and the rostered-row join (GuaranteeStallRows 59/59, RecurringFailureModeRows 224/224, both including this PR's new rows) all passed. Failed job re-run. — sent from lively-bat-864