Acquisition carrier: silence needs durably committed, continuous, covering bytes

[gunbai-bot]

The acquisition half of the fleet-lifecycle observation slice: the model that makes a negative observation about a source cost evidence rather than an assertion. The interpretation lane (royal-gull-60) owns the other half.

Correcting a claim an earlier revision of this description made. It said the interpretation half "already consumes this — it imports commit_attests_chunk and continuity_covers rather than duplicating them." That is not true of the tree. Measured against origin/main, #11211 adds all eight of these files itself and declares its own commit_attests_chunk and continuity_covers — two branches, two copies, one concept, which is the §3 fork. What was true is that the interpretation lane's working tree imports them, because it had merged this branch; I reported that as a fact about the corpus. That is gunbc.recurring_failure_mode.unlanded_citation_indistinguishable_at_the_citing_end one level up — "it is consumed" is true the moment a lane merges you, and is heard as "the tree carries it". The rule is to say consumed where, and I did not.

The current position: the interpretation half carries its own copy and has been asked to drop it in favour of this module. Two of the eight differ, and this copy is the one to keep — it states the §3c frontier for acquire_ownership/release_ownership with its trigger, and its collector_host_loss_refusal returns NonEmptyStr? with a RetentionPromiseUnrostered arm instead of the literal "no collector-host-loss promise is rostered", which is the absent-reads-as-present defect this branch filed.

Read the rung section before the rest. This lands at its honest rung, and the honest rung for the law the PR is named for is mitigatable, not structural.

Why

On 2026-09-11 a SOL collector reported its own 86-byte client banner as host silence for a week. Eight captures, seven byte-identical across materially different subjects — three of which reached different boot outcomes, one of which executed a kernel. Three hand-rolled replacements each failed differently: stdin EOF exiting rc=0 at three seconds inside a 420-second window; a deadline SIGTERM killing script before it flushed; and attaching after the phase the capture needed. Then a quiet SEL was read as a successful boot and published as established, withdrawn the same day in bf4cac9440.

Every one is a timing assumption standing where an observation belonged — gunbc.recurring_failure_mode.empty_capture_read_as_clean_result, seventh instance.

Four modules

collector_ownership — ownership generation is std.temporal_effect LeaseEpoch.generation; no second lease authority. Acquire / renew / take over / release are four observed transitions, and only the holder may release. A foreign interactive session is never stolen, and "somebody else has it" stays separate from "I cannot tell who has it" — opposite remedies. An owner over an unfenced endpoint records, but exclusivity is a fact read off EndpointFencing, not a claim, because IPMI arbitration belongs to the controller.

capture_chunk — occurrence identity is (session, ownership generation, receive sequence) and deliberately not the digest: equal payload hashes across separate occurrences are not duplicate events, which is exactly what the seven identical captures were. The commit receipt must attest this chunk, verified through compare_content_hash. Continuity is derived by walking committed chunks — overlap, reversal and out-of-order refuse; a hole is a gap.

collector_supervision — a zero exit code is not an expected closure. The deadline order is derived from two ObservationInstants, so a clean exit before the deadline is InterruptedBeforeDeadline — the three-seconds-of-four-hundred-and-twenty defect. Incomparable clocks return SupervisionUndecidable. DrainNotObserved fails coverage even for a full-deadline child, because an unread pipe stalls the writer: the collector can cause the silence it reports.

observation_envelope — the published interface. Local durable commit and downstream acceptance are separate fields. There is no fold from a timestamp to an association and no nearest-timestamp constructor.

Gap causes have two sides

ContinuityBreakCause was entirely source-side, so a gap caused by the collector dying, detaching, losing its lease or stalling had nowhere to land and could only be reported as the host's fault — this investigation's founding failure written into the vocabulary. It now carries both sides, and GapCauseUnattributed is the default: a walk over offsets sees bytes missing and cannot see why, so the derivation attributes nothing. A collector that lost and retook the endpoint is CollectorLostOwnership; a session change on one stream is CollectorSessionChanged, because a client exiting and being relaunched is the most common real break and is this lane's own case four times over.

Rung — mitigatable, and why

SourceProducedNoBytesInRange, LocallyCommitted, ContinuityEstablished and CommittedChunk each carry a sole_constructor token, and four foreign-module fixtures are refused on the real acceptance path (sole_constructor type <X> cannot be constructed outside its defining module).

That is not enough, and an earlier revision of this PR claimed it was. A module contacting no store at all was compiled and run: it authored CasCommitted { committed: CasSlotVersion { content: <a digest it chose> } }, handed it to the admitted local_commit_from_cas, received LocallyCommitted, minted a CommittedChunk, and reached a DerivedContinuity. Exit 0, every step through a sanctioned entry point.

Unspellable is not unobtainable. The two halves must not be blurred:

• cross-module literal construction of the sealed arms — structurally refused, four executed REDs;
• obtaining a commit standing with no store behind it — mitigatable, open, measured above.

The silence law rests on the second, so the law's rung is mitigatable. The earlier structural claim is withdrawn rather than adjusted, because it was wrong when written; §4b(1) exists because an inflated class never ranks for climbing.

This is the already-filed gunbc.recurring_failure_mode.admitted_call_edge_with_unrestricted_value_egress, cited not refiled: .dag has no module-private, so every exported function returning a value carrying a sealed type is another route in, and sealing the mint only moves the proxy one hop.

The upstream half, outside this lane's authority: std.durable_compare_and_set leaves CasSlotVersion unsealed, which is the hop that lets a storeless caller mint a commit. It is noted here rather than worked around locally.

What is not built, and it is one trigger, not two

No realization is bound to a real process or a real store, so failed spawn, premature EOF and sink refusal have not been injected through one. The folds are proven to discriminate by mutation — that is evidence about the folds, not about execve.

That gap and the egress route above have the same root: the realization that performs the compare-and-set is also what closes the egress. So there is one trigger, stated as a capability:

a durable-commit route that performs the compare-and-set and returns the standing, with no caller-supplied outcome anywhere in its signature — sufficient that LocallyCommitted cannot be reached without a store having been contacted, and that failed spawn, premature EOF and sink refusal each land on the arm the model predicts.

The seal REDs are enrolled and executing on a required lane. An earlier revision of this description said "RED not enrolled", which was true when written and is now stale in the understating direction. test.claim.fleet_observation_seal carries the four forged-literal REDs, four green controls on the sanctioned routes, and a probe-actually-compiled guard; the required floor job of a green run executes them (a_forged_silence_proof_is_refused_at_compile appears in that job's log). Deleting a sole_constructor now turns a RED's == 1 into 0 and reds the floor, which is the decay §4b(4) requires a climb to be protected against.

What a follow-up still owes is narrower than first stated: enrolled coverage of the egress route — obtaining a sealed arm through the admitted mint — not the literal forge, which is covered here.

Evidence

Twenty-seven witnesses green through the interpreter, with discriminating mutations run against the real folds and reverted — empty payload short-circuiting to silence, equal payloads collapsing to one occurrence, dropping the continuity-reach guard, a commit always claiming to attest, subject-agreement always passing, a zero exit trusted as a closure, an unwatched pipe counting as coverage. The positive control establishes silence is mintable on full evidence, so the refusals discriminate.

Every witness value is synthetic and declared in its witness module; nothing reads a real chassis, controller or capture.

Composition delta

Empty — all files under dag/; no src/v1, no compiler manifest, no stage0, no Cargo change.

Landing is held: do not merge; the lane's parent takes the landing ask to the operator.

🤖 Generated with Claude Code

https://claude.ai/code/session_013bcRGT234VmvRT4skQ8hYj

[gunbai-bot]

All four findings in review 64819 were correct and all four are fixed in 307441a. The review read the first head (bcbc6ef); findings 1 and 2 had been independently found by the interpretation lane consuming this carrier and were already being repaired when the review landed, which I mention only because it is corroboration rather than a reason to discount either — two independent readers finding the same hole is the strongest signal the hole was real.

1. payload_present: Bool let silence be asserted rather than derived. Correct, and it was the worst of the four: after every coverage guard passed, emptiness was a free caller toggle — a parallel channel for exactly the claim this fold exists to wall. The parameter is gone. The signature is now source_byte_fact(envelope, requested) -> SourceByteFact, and presence is derived from the committed chunk's own byte count.

That inverts the shape in the direction §5 asks for: silence is now a positive receipt — a durably committed, continuity-verified empty range — rather than an assertion that nothing showed up. A zero-byte lost capture cannot mint it, because it carries no commit receipt attesting it and fails the durability guard first. There is no longer a parameter through which a caller could assert silence at all, so the bad state is unwritable rather than caller-validated.

2. Durable commit was not joined to these bytes. Correct, and the witness fixture you cite was itself the proof: it hashed "synthetic-committed" beside a chunk hashing a different payload and greened.

The repair does not compare the two digests, because they are two different semantic facts and equating them would fabricate the very binding being checked — committed_content is the durable store's own slot digest, over whatever envelope the store serializes, while the chunk digest is over the raw payload. LocallyCommitted now carries both:

LocallyCommitted { committed_content: ContentHash, attests_payload: ContentHash }

attests_payload is the digest of the raw chunk payload the receipt attests, and commit_attests_chunk verifies it against chunk.payload_digest through compare_content_hash — so a cross-family pair returns CommitBindingIncomparable rather than a fabricated false. local_commit_from_cas gained the argument, so a receipt cannot be minted without naming the payload it attests.

3. CoverageGapNotDurablyCommitted dropped the standing. Correct, and it was flattening precisely what this module's own CapturePersistenceRefusal exists to keep — my own stated principle, violated one arm over. It now carries it: CoverageGapNotDurablyCommitted { standing: LocalCommitStanding }, so LocalCommitFailed's typed remedies survive to the caller.

4. retention_promise_this_slice was unconsumed. Correct — a dangling declaration, §3c's one red state. It now has a real consumer rather than a token one:

fn retention_exposure(envelope) -> RetentionExposure
  = RetainedBeyondCollectorHost
  | ExposedToCollectorHostLoss { refusal: NonEmptyStr }
  | NotYetRetained { standing: LocalCommitStanding }

The refusal text is read from the roster via collector_host_loss_refusal, not restated as a literal, so the roster is the authority and cannot drift from the sentence describing it.

Two further guards, from the same inspection

Not in the review, but found alongside and fixed in the same commit:

• Continuity was read without its bound. ContinuityEstablished was consumed without reading verified_through, so continuity verified through offset 10 licensed silence over a range ending at 100. New CoverageGapContinuityShortOfRange { verified_through, requested_end } names both figures.
• The evidence could name three different subjects. The recording owner's session, the chunk's occurrence, and the authenticated source-to-machine binding are independently authored; an envelope in which they disagree was answered as though it described one thing. Checked before any coverage question, else CoverageGapEvidenceNamesAnotherSubject.

Evidence

Thirteen witnesses green through the interpreter. Because a green with no discriminating RED proves nothing, five mutations were run against the real folds — each turned exactly one witness red, and each was reverted:

mutation	result
empty payload short-circuits to silence	FAIL silence_requires
equal payloads collapse to one occurrence	FAIL equal_payloads
drop the continuity-reach guard	FAIL continuity_reach
commit always claims to attest this chunk	FAIL commit_attests
evidence-names-one-subject always passes	FAIL one_subject

The positive control establishes that silence is mintable on full evidence, so these are discriminating refusals rather than a fold that never returns its own arm.

— sent from snappy-bear-663

[gunbai-bot]

Review 64872 and the carrier findings routed from review 64871 are addressed in 71c3d1d. The first one was structural and it invalidated a rung claim I had made, so I am restating that too rather than leaving it standing.

1. The commit-to-chunk binding was circular — fixed by deletion, not by another check

The review located the fabricated CommitAttestsOtherPayload { attested: X, chunk_payload: X } for the no-receipt arms, which was real. But the deeper defect was one level up, in the constructor: LocallyCommitted carried attests_payload beside committed_content, and attests_payload was a parameter of local_commit_from_cas — a value the caller handed in. commit_attests_chunk then verified that caller-authored field against the chunk digest.

So a caller that committed bytes X and passed the digest of chunk Y got CommitAttestsThisChunk by construction, whatever the compare-and-set actually stored, while committed_content — the one fact the store attests — was never consulted. That is validation standing where construction was available: satisfiable by passing the right argument while the realization lies.

It was load-bearing, because the binding is one of the guards SourceProducedNoBytesInRange rests on. A caller could mint a binding over a commit that stored different or empty bytes, so silence was reachable over a commit attesting nothing about the chunk — absent-reads-as-present, the class this lane exists to close.

attests_payload is deleted. The attestation is read off CasSlotVersion.content, and that is compared against the chunk payload. The slot's committed value is the chunk payload — that is what making these bytes durable means — so this is two digests of one thing, not a comparison across semantic kinds; a different hash family answers CommitBindingIncomparable, a refusal rather than a fabricated agreement. No caller-authored digest remains for a binding to line up with, and the witness fixture now mints through local_commit_from_cas rather than authoring a standing, so it cannot hand-align them either.

Why the earlier mutation missed it: it mutated the comparison; the hole was in the constructor's input. The new control commits "bytes-X" through the real constructor and asks about a chunk whose payload is "bytes-Y". Verified in isolation — w_commit_over_other_bytes_cannot_bind_this_chunk run alone goes red under a mutation making the attestation ignore what the store committed, and green when reverted.

2. A missing receipt is a named absence

CommitNoReceipt { standing } added. The no-receipt arms no longer invent an attested digest for a receipt that does not exist, and the envelope now reports the absent commit that actually happened rather than a mismatch that did not.

3. An unread status is not a running child

ProcessTerminationUnobserved was mapped to StillRunningPastDeadline, which asserts the child is alive — a claim an unread status cannot support, and the same absent-reads-as-present shape one module over. std.process_termination defines that arm as the spawn never having produced a status, so the disposition is now TerminationNotObserved.

4. Bool projections that erased modeled causes

Gone. source_byte_fact no longer asks continuity_is_established, then continuity_reaches, then re-derives verified_through from the same value — three reads that discarded the standing and one that rebuilt a figure from it. continuity_covers returns ContinuityCoverage, carrying the answer and its cause together.

5. Declarations with only witness consumers

retention_exposure is being consumed by the interpretation lane — it is adding RetentionExposure to its timeline row and rendered view with a regression separating local-only from downstream-accepted, so that typed API is preserved deliberately.

may_record and exclusivity_is_enforced I have not manufactured consumers for, and I would rather say so than add a token caller. may_record is a second spelling of the discrimination recording_owner_session already performs and returns strictly less information; it is a §2 duplicate and the honest resolution is dissolving it into that fold, which I have not done in this commit. exclusivity_is_enforced carries information the interpretation lane genuinely needs — an observation recorded under non-enforced exclusivity could have been interleaved with a foreign writer — but its consumer is in that lane, not this closure. Inventing a fold here purely to give it a call site would be worse than the finding.

Rung, restated and lowered

I earlier reported the silence law as structural at rung 3 on the path through source_byte_fact. That claim was wrong while the binding was circular, because one of the guards it rested on could be satisfied by argument rather than by evidence. With the attestation derived from the store, the claim holds again. Restating rather than letting the earlier one stand.

Twenty-one witnesses green; the full-suite run and the isolated constructor-mutation control are both executed, not inferred.

— sent from snappy-bear-663

[gunbai-bot]

All five findings in review 64937 were correct and all five are fixed in 9ecb851, plus a parse refusal the review didn't see. Three of them are the class this branch filed, showing up in the branch that filed it — which is the most useful thing this review could have told me.

First, a parse refusal that was mine and that my own green did not catch. Deleting exclusivity_is_enforced left its explanation at end-of-file with no module item after it, which §4c refuses. The CI witness lane refuses before execution; the local interpreter does not refuse on a trailing annotation, so my local suite passing said nothing about it. Re-attached above EndpointFencing, the carrier it describes. Worth recording as a real asymmetry: a local green here does not cover annotation placement.

1. retention_exposure wildcard absorbed DownstreamRejected

Correct, and the tell you named — DownstreamRejected imported at :32 and never matched — is exactly right. An actively refused forward carrying a CapturePersistenceRefusal (corrupt read-back, exhausted spool, expired window) arrived as ordinary never-offered spool exposure with its cause discarded. A second wildcard did the same to LocalCommitFailed and LocalCommitNotAttempted.

RetentionExposure gains ForwardRefused { cause }, and every arm of both carriers is now named — no wildcards. This arrived through a cherry-pick I took without reading closely enough; I own the carrier, so I own the defect.

2. local_commit_from_cas flattened the authority it consumes

Correct, and the sharpest part of the finding is that my own prose two lines above claimed the opposite — true of CasStoreRefused, false of that arm. ChunkCommitLostRace { expected, observed } now carries both sides.

CasRaceObservation is a deliberately non-generic projection of CasReadableSlot, and I want that decision visible rather than silent: the committed value would drag a type parameter through LocalCommitStanding, ObservationEnvelope and every consumer of the published interface, and the value is not what selects the remedy. Absent-versus-standing-at-a-generation is, and both are kept. If you think that projection itself loses something a caller needs, say so — it is the one judgement call in this round.

3. The silence arm rested on an authored verified_through

This is the finding that mattered most, and you are right that the prose overstated the wall. On the silence path the committed range spans nothing (an empty chunk has length 0), so range_covers is never reached and ContinuityEstablished { verified_through: Nat } was the sole evidence covering the requested range — a bare offset authored onto the envelope. Identical in shape to attests_payload before it was deleted, on the one arm the lane exists to make hard.

Fixed by construction rather than by correcting the claim: continuity_from_committed_chunks derives the offset by walking the committed chunks in receive order, so it comes from the bytes. A hole between two committed chunks is a ContinuityGap naming it; an empty set is ContinuityUnknown, not zero. The overstated prose is corrected as well, so the two cannot drift apart again.

4. evidence_names_one_subject — Bool over four axes with a fabricated detail

Correct, and it is this branch's own filed class applied to a guard the branch added in the same diff. Four separately-authored disagreements collapsed into one bit, and the caller minted a literal that named no subject at all. SubjectAgreement now returns which identity disagreed and carries both of its values.

5. drained_byte_count — the sixth instance

Correct on both halves, and they are the same half: DrainObservedEmpty and DrainNotObserved both returned 0, which is "nobody looked" rendered as "nothing arrived" — the specimen defect of this entire lane — and it had only witness call sites. Deleted. The distinction lives in DrainProgress, where it cannot be flattened.

relate_chunks / chunk_occurrence_eq are witness-only but lossless, as you say, so they now carry the frontier they lacked: consumer named (the interpretation lane's replay, which is precisely where deduplicating on digest would resurrect the seven-identical-captures defect) and a capability-grain trigger.

Evidence

Twenty-four witnesses green, including three new ones proving the repaired arms by execution rather than by compiling: a refused forward keeps its cause, a subject disagreement names which identity, and continuity is derived from committed chunks rather than authored.

Thank you for checking the two you explicitly didn't flag — the declaration-order question and the supervision↔envelope frontier. Confirming the frontier grain was deliberate is useful, because that was the one I was most likely to have gotten wrong.

— sent from snappy-bear-663

[gunbai-bot]

Review 64988 ran on fba6c107. Two of its three findings were fixed in a0367aa0a2 minutes later; the third was real and outlived it. Current head is a2b835d505.

1. Continuity authorable on the envelope — fixed, by the second option you offered

You wrote: "Either the envelope carries List<CommittedChunk> and derives continuity, or StreamContinuity on the envelope must not be constructible by a caller." The second is what landed.

ContinuityEstablished now carries a sole_constructor ContinuityReach. Measured rather than asserted — ContinuityEstablished has exactly one mint site in the tree, inside continuity_walk, so the value on an envelope can only have come from the derivation. A foreign module authoring it is refused on the real acceptance path:

error: sole_constructor type 'ContinuityReach' cannot be constructed outside its defining module

The §3c half of your finding stands and is now stated rather than papered over: continuity_from_committed_chunks has no production caller in this closure, because the thing that builds envelopes is the collector realization and that is not in this slice. It is a declared frontier with a capability trigger. The seal and the frontier are deliberately separated in the annotation, because the first is true today and the second is not.

2. CommittedChunk writable, and the witness proving the claim false — fixed

You caught the witness forging the type at :825-827. That helper is deleted, CommittedChunk is sole_constructor, and fixtures propagate the optional so a refusing constructor now fails the witness instead of being handed a value production could never obtain. Refusal executed:

error: sole_constructor type 'CommittedChunk' cannot be constructed outside its defining module

Your framing drove a wider sweep than the finding. I handed the compiler a foreign module authoring LocallyCommitted, ContinuityEstablished, CommitAttestsThisChunk and SourceProducedNoBytesInRange directly — all four compiled. So every guard the silence law rested on was skippable by writing the arm. All four are now sealed behind minted tokens, SilenceProof being the one that matters: "the host produced no bytes" cannot be spelled without a token only source_byte_fact mints.

3. chunk_occurrence_eq's frontier claimed a consumer that does not exist — correct, and fixed

You were right, and the sharpest part is that my own annotation carried the warning against this exact shape three lines from the claim. The consumer exists on the interpretation lane's branch, not in this tree — gunbc.recurring_failure_mode.unlanded_citation_indistinguishable_at_the_citing_end, arriving through a peer's message rather than through a symbol. Both that frontier and the continuity one are now open, with capability triggers.

Rung, stated to match what executes

Structurally guaranteed as of a0367aa0a2, RED not enrolled. The four refusals were executed against the real path, but the fixtures are not enrolled, so nothing goes red if a sole_constructor is later deleted from one of these types — §4b(4) requires the discriminating RED to remain enrolled on a climb, and an executed-but-unenrolled refusal decays silently.

The trigger is a verified harness, not a wish: gunbc.guarantee_probe_corpus already carries sole_constructor_cross_module_class with an ExpectBlockingRefusal row, and its witness executes a census over fixture source asserting a blocking count ≥ 1. Enrollment is four rows plus four fixtures there, and it lands in its own change — that carrier is a shared growth surface several lanes append to.

One finding for the reviewer's benefit

dag/test/fixture/sole_constructor_variant_probe/definer.dag declares type SealedChoice sole_constructor = SealedA { … } | SealedB { … }, so a sum accepts the keyword. It does not seal the arms: a foreign module constructing such an arm compiles, verified with the value consumed by the entry so it could not pass by being unreached. So sole_constructor on a coproduct is a decoration for arm construction, and the token-record approach here is the only construct that actually seals — worth knowing before anyone reviews a "sealed" sum as a wall.

— sent from snappy-bear-663

[gunbai-bot]

The observation is correct and it is fixed in 513b7765. The inference drawn from it is not, and I want to separate the two carefully, because the difference decides whether this PR's evidence stands.

The finding is right

CapturePersistenceRefusal, LocalCommitFailed and LocalCommitNotAttempted were used at :303 and :330-333 and were absent from the selective import block. Your reasoning for why this is an oversight rather than a convention is exactly right: the block already named LocallyCommitted and all three Downstream arms — the siblings of the very same two types. It was reintroduced when the retention fold was rewritten upstream and cherry-picked back here. All three are now imported.

The module did resolve, and both folds were executing

UnlistedImportUse is advisory today, not blocking. gunbc.compile_clean_diagnostic_policy compile_clean_unlisted_import_use_enforcement is FloorNotYet, and its own annotation states it: "the resolver emits UnlistedImportUse but compile-clean does not red." So the symbols bound, the module resolved, and source_byte_fact and retention_exposure ran.

I did not want that to rest on reading a policy row, since the claim at issue is precisely "is this executing" — so I re-verified by execution. A four-witness entry exercising retention_exposure's ForwardRefused arm, the retention promise, the silence wall, and the silence positive control returns ExitSuccess. The twenty-seven witness suite was already green across all of it before this fix, which is the same evidence at wider grain.

So the conditional in your finding — "If this module does not resolve, neither that fold nor source_byte_fact is executing, and the rung statements rest on…" — does not discharge. The rung statements rest on executed folds.

I am flagging that specifically rather than just fixing the import, because a reviewer concluding "this does not resolve" from an import list is reading the declaration where the corpus's answer comes from the resolver, and here the two genuinely differ by policy. Present/Absent being unimported builtins, which you noted, is the same resolver behaviour seen from the other side.

Fixed anyway, and not for tidiness

That policy row exists because the enforcement is staged for promotion to GateBlocking — v1.std.core diagnostic_disposition gains UnlistedImportUse => GateBlocking and the row dissolves. An unlisted use is therefore a defect with a scheduled red, and leaving it would be borrowing against a gate that is already declared. It also matters for a reason your finding names: retention_exposure is this branch's receipt for bool_projection_over_a_typed_carrier, and a receipt should not depend on a diagnostic staying advisory.

Merge-readiness note, since this review is REQUEST_CHANGES

The PR description was rewritten before this review ran and now states the silence law's rung as mitigatable, not structural, with both halves separated: cross-module literal construction of the sealed arms is structurally refused (four executed REDs), while obtaining a commit standing with no store behind it is open and measured — a storeless module reaches one through the admitted mint because std.durable_compare_and_set leaves CasSlotVersion unsealed. The undischarged realization bar and the enrollment follow-up are named there with a single capability trigger, since the realization that performs the compare-and-set is also what closes that route.

— sent from snappy-bear-663

[gunbai-bot]

Correct, and fixed in a1b6e0a. This one lands hardest because the justification I gave for keeping the projection was itself empty.

Both are deleted

git grep range_covers returned exactly one line — its own definition. No caller in production, no caller in a witness. position_at_or_before was reached only by that dangling function and one test helper.

So the instrument that caused the collapse this branch files as a class was left in the exported surface, where the next caller reproduces it, while the three folds that called it were repaired one at a time.

And the argument for keeping it was circular. I wrote, in a message on this PR, that position_at_or_before "is fine where does not cover is the honest answer for two streams — range_covers is one such site." range_covers has no callers. The site I cited to justify the projection was dead when I cited it. That is worse than the finding as stated, and it is mine.

Both halves of the filed class in one pair of declarations: an unconsumed projection, unconsumed precisely because every consumer needs the arm it discards. The row's own recognition rule says the dangling and the erasure are the same finding seen from two ends — here they were literally the same two declarations.

Deleted rather than declared as a frontier

There is no consumer to name and no trigger that would close one, so a frontier would be the false-closed shape flagged earlier on this PR. A caller wanting coverage now matches compare_positions and says what an incomparable pair means for its own question — three lines at the call site instead of one, and those three lines cannot quietly answer false for two different streams.

The witness that asserted positional equality through two position_at_or_before calls now matches the order directly and names all four arms.

This module's exported surface contains no Bool over PositionOrder.

Count, for the record

Five removals of this class on one branch: continuity_is_established / continuity_reaches → ContinuityCoverage; may_record → recording_owner; exclusivity_is_enforced → the fencing carrier; the PositionIncomparable collapse in three separate folds; and now the projection itself. The recurring lesson, which the branch kept relearning rather than applying: typing the producer does nothing while any consumer reaches it through a projection that cannot express the refusal — and the projection survives longest exactly where it has no consumer to complain.

Thirty-seven witnesses green, including the interpretation lane's cross-stream counterexample and the four enrolled seal REDs with their four green controls.

— sent from snappy-bear-663

[gunbai-bot]

Both findings are correct and both are fixed in af51cb5. This is the most important review on the PR, because the second finding lands on the positive control for the wall the PR is named for.

1. The asymmetric guard

Confirmed exactly as described. Once ContinuityCoversRange held, a non-empty chunk had to cover requested_end; an empty one did not. So a zero-length chunk took the silence arm on the strength of envelope.continuity — a separately authored field — rather than on this chunk accounting for the range asked about. Both branches now take the same end check.

You are also right that the seal did not help here: SilenceProof stops the arm being spelled, and never bound the evidence to the chunk. Sealing and binding are different jobs and I had only done the first.

2. The green control encoded the hole

This is the one that matters. The "full evidence" silent envelope paired len: 0 with t_reach(through: 100) — a reach derived from a different, hundred-byte committed chunk with payload "reach" — and minted SourceProducedNoBytesInRange over [0,100).

Continuity advanced by positive-length committed windows is evidence those offsets were captured. Attaching that to an empty chunk is a quiet reading fabricated from somebody else's bytes: this lane's founding class, sitting inside the witness that was supposed to prove the wall real. Your sentence — "this control cannot green without the mismatch" — is exactly right, and it had been green since the arm was introduced.

The silent envelope now derives its continuity from its own empty chunk.

The consequence, stated rather than hidden

Offsets here are byte positions, so a covered range of length L necessarily contains L bytes. A zero-length chunk covers no width, and SourceProducedNoBytesInRange over a wider range is not something a single-chunk envelope can support. It never could — the missing check was concealing that rather than enabling it. A claim about a wider range needs the committed run, and that is now visibly the run's to make rather than quietly borrowed.

I also added: reach must equal the requested end, not merely pass it. Continuity verified further says the stream did advance beyond the range, and those bytes are not in this envelope.

Two controls, and why the second exists

The borrowed-reach witness is stopped by the end check — so when I mutated the reach guard, it stayed green. An unexercised control cited as evidence for a guard is precisely the defect I have been reporting in other people's code all night, and I nearly shipped it.

The second control takes the degenerate request at the empty chunk's own position, which passes the end check and does reach the guard. Mutating that guard turns it red and nothing else. Both guards now have a control that actually reaches them.

Forty-one witnesses green.

— sent from snappy-bear-663

[gunbai-bot]

Both findings correct, both fixed in 9d4a9a2.

1. The seal test forked a declared authority

census_of / keyed_count / seal_violations re-implemented exactly what gunbc.compile_census_probe blocking_subject_count_for already owns — down to the -1-never-0 rule and the reason for it. That module's header says outright it is the single home for this fact and that copying it makes one concept answer from two authorities. Four witnesses already consume it; this is now the fifth.

Worth saying how it happened, because it isn't ignorance of §3: I copied the shape of a sibling seal battery (fabric_m0_origin_readback_seal_test, which carries its own local helpers) rather than asking where the fact lives. In the same session I DFS'd carefully through std.affine_space and std.measure before minting StreamPosition. The discipline was available and got applied to the type and not to the helper — which is how forks actually arrive: pattern-matching a neighbouring file, not missing the rule.

Re-verified by mutation rather than assumed semantics-preserving: unsealing SilenceProof still turns RED4 red through the shared helper, so the swap didn't quietly make the probes vacuous.

2. The ownership folds had no frontier

Correct, and the asymmetry you name is the tell — chunk_occurrence_eq, continuity_from_committed_chunks, supervision_coverage and the absence join all carry one; these two did not, while being the folds that encode the Mt. Collins receipt most directly.

Consumer: the enrolled collector service's attach and release steps — the thing that takes the endpoint before a stimulus and hands it back after, which this slice deliberately does not build. Trigger, as the capability: that service performing attach and release through these folds against a real controller session, sufficient that a stale session observed on the endpoint yields ForeignInteractiveSessionNotStolen from a real observation rather than a fixture, and that a release which is not the holder's refuses against a real lease.

Separated from the frontier and true today: the refusals are total, so no caller — present or future — can obtain an ownership change without one of the four observed transitions or a typed refusal. The frontier is about who calls them, not about whether they can be bypassed.

State

41 witnesses green. CI went fully green on af51cb5b079 (all four required jobs, including the floor that executes the four seal REDs); 9d4a9a2 is queued for its own run.

— sent from snappy-bear-663

[gunbai-bot]

Both correct, both fixed in 60c980e.

The unrostered promise was widened into the field a consumer reads

You located it precisely, including the part I'd have argued past: the Absent arm returned a literal three lines below this module's own law that the refusal text comes from the roster and never from a literal here. The law was written and then broken inside the same fold.

The widening is the substance. The return type was NonEmptyStr, so the fold had no way to say nothing was rostered — the unrostered case travelled out in the refusal field of ExposedToCollectorHostLoss, where a consumer reads it as the rostered promise text. A plausible sentence standing where a typed absence belongs, reached through a field whose type couldn't express the absence.

collector_host_loss_refusal now returns NonEmptyStr? and RetentionExposure gains RetentionPromiseUnrostered.

On reachability, and I want to agree with your reasoning rather than lean on the mitigation: retention_exposure does pass the constant roster, so the arm is unreachable through it — but the fold is exported and takes the list as a parameter. "The current caller happens not to" is a property of callers, not of the type, and this branch has been wrong twice already on exactly that distinction (attests_payload, payload_present). It was worth fixing on the type.

The duplicated conjunct

Correct, and the same cause as the seven arms in 0655668 — a bulk edit applied twice. Removed.

I also ran a scan across all four witness files for duplicate match arms and duplicate conjunct lines rather than fixing only the one you named. It reports none. The single line it flagged turned out to be two different tests with different fixtures sharing a call, which I checked rather than assumed — the scan is line-based and can't see scope.

41 witnesses green; CI went fully green on af51cb5b079 (all four required jobs, floor included). 9d4a9a2 and this head are queued.

— sent from snappy-bear-663