Scope the jointly-incompatible-open-PR mitigation, and land checkpoint 1: joint_claim_join, the instrument behind its figures

.gitignore

@@ -213,3 +213,4 @@ src/v2/test/claim/manual/sg2_scratch_probe.dag
 /docs/plans/v2-complexity-capability-parity.md
 /docs/plans/v2-corpus-self-host.md
 /docs/plans/import-namespace-program.md
+/docs/plans/joint-incompatibility-claim-join.md

dag/gunbc/guarantee_stall/joint_claim_join_private_corpus_unindexed_stall.dag

@@ -0,0 +1,39 @@
+module gunbc.guarantee_stall.joint_claim_join_private_corpus_unindexed_stall
+
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+import gunbc.guarantee_stall { GuaranteeStall, AwaitsOneGrounding, UncountedNotEnumerable, climbs_when }
+
+// FILED AS A STALL AND NOT AS PROSE IN THE PLAN THAT FOUND IT (gunbc.plans.joint_incompatibility_claim_join
+// section 6), on the manager's 2026-09-11 ruling: an instrument that is blind to almost every module in
+// the other repository, and does not say so in a typed way, will later be cited as coverage it never had.
+//
+// THE SUBJECT. The joint-claim join (v1_compiler.bin.joint_claim_join) reads ModuleDeclarationRecords,
+// and a record exists only for a module the .dag parse sweep reaches. gunbc-private's witness workflow
+// (strategy.private_witness_workflow) builds the public seed at main and runs gunbc run entries over a
+// copied overlay at public/private_overlay/dag -- no parse phase, no claim_executor --required-ci, and the
+// overlay path is outside DAG_PARSE_SWEEP_ROOTS (src/v1, dag, src/v2). So no DeclarationIndex covers the
+// private corpus, on any run, anywhere.
+//
+// WHY THE EXPOSURE IS LARGER THAN THE INTRA-REPO ONE. Measured on the private tree at #62 with a text
+// scan of import lines against its own module list: 113 of 114 private modules import from 77 distinct
+// public modules. A public PR that shrinks a surface is never compiled against private at all -- not
+// before merge, not after -- and private learns of it only when its next run resolves against a main that
+// has moved. That is exactly the join with the private corpus standing as one more subject whose claims
+// are the whole overlay's import set; the join cannot run because the subject has no records.
+//
+// THE BLOCKER IS ONE GROUNDING AND THE OVERLAY ALREADY NAMES IT. The overlay's own annotation states its
+// dissolution: gunbc admits an extra --source-root outside process_workspace_root with module-scope
+// annotations attaching as they do for an in-workspace root. The day the sweep admits that root, private
+// records exist and this row's trigger is met by the same change.
+data joint_claim_join_private_corpus_unindexed_stall: GuaranteeStall = GuaranteeStall {
+  subject: "the joint-claim join is blind to the gunbc-private corpus: no DeclarationIndex is built over private modules (no parse phase there; the overlay is outside DAG_PARSE_SWEEP_ROOTS), so a public change shrinking a surface a private module claims is joined by nothing, before or after merge",
+  current: Mitigatable,
+  ceiling: MechanicallyPreventable,
+  blocker: AwaitsOneGrounding {
+    grounding: "the private overlay is not a source root the .dag parse sweep can read: DAG_PARSE_SWEEP_ROOTS is a closed triple of in-workspace roots, and the private workflow copies its dag/ to public/private_overlay/dag precisely because gunbc does not yet admit an extra --source-root outside the process workspace root with module-scope annotations attaching as for an in-workspace root -- the overlay's own declared dissolution trigger",
+  },
+  population: UncountedNotEnumerable {
+    reason: "every private module that imports a public module, on every future public change that shrinks a surface; open rather than a list, and listing the 113 importing modules here would be a second representation of the private corpus's import edges that rots on its next commit. IT IS MEASURABLE AND THE PREDICATE IS THE INSTRUMENT: joint_claim_join with the private corpus as one subject whose added claims are its whole import set answers it the moment private records exist; until then the count is a text scan of import lines against the private module list (113 of 114 at gunbc-private #62), a scoping figure and not a producer",
+  },
+  next_rung_trigger: climbs_when(capability: "THE PRIVATE OVERLAY IS AN ADMITTED SOURCE ROOT OF THE .dag PARSE SWEEP, so a ModuleDeclarationRecord exists for every private module on the same ingestion the public corpus gets -- sufficient for the private corpus to stand as one subject of joint_claim_join against every public change's removed surface, at which point a public change is joined against private BEFORE it merges rather than discovered by private's next run after it, and this row's class is mechanically preventable on the same instrument as the public one"),
+}

dag/gunbc/guarantee_stall/roster.dag

@@ -68,6 +68,7 @@ import gunbc.guarantee_stall.generic_lambda_parameter_receiver_evidence_stall {
 import gunbc.guarantee_stall.argument_shape_undecided_at_a_declared_position_stall { argument_shape_undecided_at_a_declared_position_stall }
 import gunbc.guarantee_stall.information_retrieval_transport_cannot_report_status_stall { information_retrieval_transport_cannot_report_status_stall }
 import gunbc.guarantee_stall.module_cited_only_in_annotation_prose_stall { module_cited_only_in_annotation_prose_stall }
+import gunbc.guarantee_stall.joint_claim_join_private_corpus_unindexed_stall { joint_claim_join_private_corpus_unindexed_stall }
 
 // THE COHORT PROVENANCE NOTES BELOW WERE AUTHORED WHEN EVERY ROW SAT IN ONE FILE, and they are
 // carried here verbatim rather than split across the row modules they describe. Their membership
@@ -231,6 +232,7 @@ data all_guarantee_stalls: List<GuaranteeStall> = [
   argument_shape_undecided_at_a_declared_position_stall,
   information_retrieval_transport_cannot_report_status_stall,
   module_cited_only_in_annotation_prose_stall,
+  joint_claim_join_private_corpus_unindexed_stall,
 ]
 
 // THE FOUR SUBJECTS RESTORED TO THE ROSTER, PINNED BY IDENTITY SO THEIR LOSS REFUSES.

dag/gunbc/joint_claim_join_seed_growth.dag

@@ -0,0 +1,222 @@
+module gunbc.joint_claim_join_seed_growth
+
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.types { String }
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+
+// Seed-growth obligation for the joint-claim join instrument, checkpoint 1 of
+// gunbc.plans.joint_incompatibility_claim_join. Homed here, beside the obligation it declares,
+// rather than in gunbc.seed_growth_admission, which owns the roster and the join.
+//
+// WHAT THE CHANGE IS. One cargo bin, v1_compiler.bin.joint_claim_join, that computes for each change
+// the two set differences a joint-incompatibility question needs -- export-surface entries removed
+// (declared, variants, reexported; base minus head) and import-member claims added or retired -- and
+// intersects them across a set of changes, excluding a claim no longer live when the entry left. It
+// reuses the parse the wave wall already performs (namespace_wave_admission base_records over
+// declaration_index record_from_module) and the diff listing it already trusts (diff_sides); it adds
+// no parse, no phase, no job and no permission. Retrospective mode walks a first-parent commit range.
+//
+// THE EXHIBITED COST, which is what admits this under the v1 PURPOSE test rather than either DESIGN
+// trigger: three main reds on 2026-09-10, about an hour each, of a class no check compiles -- two
+// individually green, textually disjoint PRs whose union does not compile. The manager's ruling on
+// the scope (2026-09-11) was that the raw-candidates-to-findings figure that decides the mitigation is worth acting on
+// only if it has an entry point behind it (DESIGN section 6: name the instrument, never transcribe
+// its output). This bin is that entry point. It is an instrument that serves the self-host program
+// the same way v1_src_dag_parse does: it measures the corpus the program compiles, and its output is
+// read by nothing that gates.
+//
+// CLASSIFIED AGAINST THE FIVE REFUSED CLASSES. NewLanguageBehavior: no -- the compile pipeline is
+// byte-untouched. NewCompatibilityObligation: no. NewEscapeHatchOrAdmissionRow: no -- nothing skips
+// anything; the bin is not on the required path. SeedFeatureCompletion: no -- the seed compiler gains
+// no capability. PublicSurfaceGrowth: no -- a bin contributes no pub mod line to the emitted lib.rs;
+// what grows is the SeedRetained roster, enumerated here in full.
+//
+// NO UNCITABLE ITEM. The one method the first draft carried (a key() on ImportClaimSite) was made a
+// free function before this row was written, so every item is nameable as a WholeDeclaration
+// DeclarationRef; test-module items are enumerated under the tests submodule path.
+//
+// RUNG, HONESTLY. The class this instrument measures stays at its ceiling record's rung
+// (gunbc.plans.ci_merge_freshness; gunbc.merge_admission receipt_is_admissible, deferred). This bin
+// establishes no rung for it: it is executed by nobody on the merge path, and its own evidence is
+// the fixture-boundary controls in its tests module -- one positive control per instance shape and
+// one discriminating RED for the exclusion -- which run under cargo test, itself off the merge path.
+
+data joint_claim_join_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "SurfaceKind",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "surface_kind_label",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "ImportClaimSite",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "ClaimKey",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "claim_key",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "ClaimDelta",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "surface_of",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "claim_sites",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "claim_delta",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "JointClaimSubject",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "JointClaimFinding",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "JointClaimJoin",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "joint_claim_join",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "render_finding",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "CommitSubject",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "commit_delta",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "usage",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "main",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join",
+      decl_name: "tests",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "records",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "subject",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "CARRIER_BOTH",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "CARRIER_ONE",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "WITNESS_CLAIMS",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "WITNESS_SILENT",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "all",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "never_between",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_claim_retired_by_a_third_change_between_the_pair_is_a_candidate_and_not_a_finding",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "variant_deleted_by_one_change_and_imported_by_another_is_one_located_finding",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_remover_that_retires_the_claim_itself_is_a_candidate_and_not_a_finding",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_dropped_reexport_is_a_finding_that_names_the_reexported_surface",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_rename_fires_on_the_old_name_and_not_on_the_new_one",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_pair_outside_the_admitted_window_is_not_joined",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.bin.joint_claim_join.tests",
+      decl_name: "a_claim_already_present_at_the_claimer_base_is_not_added",
+      field: WholeDeclaration
+    }
+  ],
+  reason: "Three 2026-09-10 main reds were pairs of individually green, textually disjoint PRs whose union does not compile, and the join that would have named them -- surface entries one change removes against import claims another adds -- is a set intersection over records the parse phase already builds. The scope record that priced the mitigation rests on the width between the raw candidate count and the finding count; a figure worth acting on needs a producer, and this bin is it. Rust rather than .dag because the two inputs it joins -- a base-side record reconstructed from a git blob and a diff listing -- are host facts the seed already owns in namespace_wave_admission, and a .dag realization would re-derive both through a host effect that does not exist yet.",
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+  trigger: "Delete every row when EITHER holds: the merge-time freshness requirement of gunbc.plans.ci_merge_freshness section 3 is in force as a witnessed property (receipt_is_admissible gating), at which point the class is unwritable by construction and the instrument measures nothing that can occur; OR the per-change delta (removed surface, added and retired claims) is a modeled operation over a modeled base-side read, at which point the join is a .dag fold over two declared inputs and this host has nothing left to do. What does NOT dissolve them: a rider consuming this join in the parse phase (that is checkpoint 2, a consumer, not a replacement), or the figure being cited in the plan (a citation is not a producer).",
+  current_boundary: "src/v1/stage0/src/bin/joint_claim_join.rs; src/v1/stage0/Cargo.toml [[bin]] joint_claim_join; dag/gunbc/joint_claim_join_seed_growth.dag"
+}

dag/gunbc/plan_registry_batch_g.dag

@@ -22,6 +22,7 @@ import gunbc.plans.extdeps_modeling_preflight { extdeps_modeling_preflight_plan
 import gunbc.plans.discrete_cost_derivation { discrete_cost_derivation_plan }
 import gunbc.plans.floor_claim_cost_distribution { floor_claim_cost_distribution_plan }
 import gunbc.plans.v2_complexity_capability_parity { v2_complexity_capability_parity_plan }
+import gunbc.plans.joint_incompatibility_claim_join { joint_incompatibility_claim_join_plan }
 
 data batch_g_plans: List<Plan> = [
   ci_humming_plan,
@@ -44,5 +45,6 @@ data batch_g_plans: List<Plan> = [
   deploy_convergence_observed_side_plan,
   v2_corpus_self_host_plan,
   import_namespace_program_plan,
-  floor_claim_cost_distribution_plan
+  floor_claim_cost_distribution_plan,
+  joint_incompatibility_claim_join_plan
 ]