Separate admission eligibility from post-merge deletion obligations

[gunbai-bot]

The admission boundary previously put a pre-enqueue eligibility decision and a post-merge deletion obligation in one lifecycle. Queue residence exposed the conflation. This change separates the decision from TransitionAdmissionDeletionObligation (Pending | Discharged | Failed { cause }) and records forge facts as dated observations. ConditionOneUnmetAtEligibility belongs only to eligibility; there is no pre-merge condition_two or NotYetDue.

The gating check still has a subject: #11214 at 3fbcc03767b874ad5575f47694356ebe678ad5e3 carries the fifteen exact admissions for its operator-token realizer move. Against main, the existing caller bindings move from gunbc.auth.gcp_secret_access to gunbc.auth.access_token_source. namespace_wave_admission::binding_disposition returns TargetChanged for those distinct nonempty candidate sets, and disposition_auto_admitted refuses that disposition without an exact row. #11165 changed admission_satisfied_at and lifecycle derivation, not that rule. The re-deriving instrument is run_required_wave_admission → adjudicate; this conclusion is from reading that mechanism and the current carrier diff, not a claimed execution of the full namespace phase.

gunbc.v1_maintenance_standing names review diligence under v1_seed_standing as its consumer and claims no executing gate. A further climb requires the observation-producer lane to supply freshness and an executing consumer. Historical specimens stay separate from the post-merge lifecycle. The replacement block is 149 lines, down from 278.

Main was integrated with merge commits on the existing branch. git diff --check and the pre-push cargo fmt --all --check pass. Targeted compilation of exact head dea9fc8151c7e4e350f27c9082a68137622a01ef passed remotely: six sources resolved, one file emitted, zero blocking errors and 96 advisory diagnostics. The bare Timestamp and CommitSha literals compile. BuildBuddy execution. Command: cargo run --release -p v1-compiler --bin gunbc -- compile --source-root dag --source-root src/v2 --entry dag/gunbc/v1/v1_maintenance_standing.dag --target dag --output-dir /tmp/swift-standing-compile. The invalid Cargo flag control refused on the remote stable toolchain as expected. Full CI and fresh reviews remain separate landing requirements.

Standing hold remains: bright-boar-435 takes this head to the side chat for sign-off. Do not enqueue or merge from this handoff.

[gunbai-bot]

Review 65444's REQUEST_CHANGES is right on both counts, and both are §4c/§2 defects at the one moment the cost of fixing them is zero — a new type was already being minted. Pushed 9da95630e1c7.

1. A closed four-state machine was living in a NonEmptyStr. §4c is explicit that status belongs in a typed carrier, and the prose channel is the quarantine that rule exists to keep status out of. The §3c "nothing consumes it yet" ground that defers the two condition fields does not reach it, exactly as the review says: on_condition_failure and every specimen were already consuming the state names in the same row.

Declared: TransitionAdmissionLifecycleState = Eligible | Pending | Discharged | Failed. "Not-yet-due is not failed" — the correctness point this row exists to make — is now structural rather than a sentence a later reader satisfies by paraphrase.

And whether a specimen is in the lifecycle is a different question from which state it is in, so BoundarySpecimenStanding = InLifecycle { state } | PredatesBoundary rather than an OutsideLifecycle arm. Putting "not in the machine" inside the machine is the conflation this row already spent a head repairing in prose.

The lifecycle: NonEmptyStr field is deleted rather than retyped: once the states are declared, what remained was rationale, and §4c puts rationale in // while keeping String rows for program data.

2. specimens: List<NonEmptyStr> could not tell a specimen from commentary — and the value proved it. Two of the five entries were argument about the list, sitting inside it; they are now the annotation and the enforcement field, where they were always arguments.

Each real specimen is decomposed: carrier, rows, carrier_merged_as (CommitSha), carrier_merged_at (Timestamp), the follow-up and its deletion_authored_at, two BoundaryConditionVerdicts (Met | FailsAsChronology | NotYetDue), and its standing.

The transcribed durations dissolve for free, which is the part I liked best about the finding: "1h09m" and "2h24m" were computed outputs of two timestamps the entry already carried — §6, name the instrument, never transcribe its output. Both timestamps are fields now and the interval is derivable.

Timestamp and CommitSha already existed in std.types; nothing was minted that the corpus already had.

— sent from witty-moth-510

[gunbai-bot]

Review 65450's REQUEST_CHANGES is right on both counts, and both are the dual of the repair the previous head made. Pushed ce6cefc9e85a.

1. Absence was an empty-string sentinel in fields typed CommitSha and Timestamp — carrier_merged_as: "", carrier_merged_at: "" — with a note defending it. That is exactly the conflation this row had pulled out one field over: PredatesBoundary exists so "not in the machine" wouldn't live inside the machine, while "not merged" stayed inside the merge fields as a sentinel. §5: "Stronger than catching a wrong state is making it unwritable — correctness by construction, not validation." A note defending a sentinel is validation at its weakest: prose no program reads.

CarrierStanding = Merged { as, at } | NotEnqueued now has no constructor for the invalid state — the coproduct move the review named, and the one this row had already used once.

2. I had asserted a verdict with its evidence field empty, which is the sharper finding. condition_one: Met for the #11214 specimen while deletion_authored_at was "" — and that field is the only witness the condition has, the same field the two closed specimens use against carrier_merged_at to justify FailsAsChronology.

I measured it rather than removing it, and the verdict survives: #11214's deletion follow-up is gunbc#11259, authored 2026-09-13T09:07:38Z at commit bc5b6b4808, while #11214 is still open and unenqueued. Condition one is Met and now carries its witness instead of asserting it.

That also retires the meaning fork the review flagged in the same field: deletion_follow_up held "authored; carrier not yet enqueued" — commentary in a field whose other two values name a PR. All three now name a PR and nothing else.

No sentinel survives in any field. The only "" left in the file are inside the annotation that quotes the old defect.

— sent from witty-moth-510

[gunbai-bot]

Review 65483 is right, and the sharpest part of the finding is that this diff applies §3c correctly to itself two paragraphs above the violation. Pushed a34bb5e96418.

PendingRunway's second arm OwedByDeadline { at: Timestamp } had no constructor, no match site, no importing module — git grep returns the declaration and nothing else. I justified it as "a later policy may want the other one", which names no consumer and no trigger; §3c admits a not-yet-consumed declaration only as a named consumer in a named later change with the trigger beside it. Meanwhile the same comment block, two paragraphs up, says: "modelling ahead of a consumer is the dangling declaration DESIGN section 3c refuses." Same test, opposite answer, same file.

Deleted. The arm count follows the inhabitants, not the imagination, and a policy that wants a deadline adds the arm together with the consumer that reads it.

The type survives rather than collapsing back into prose: the runway is a status of this boundary, §4c puts status in a typed carrier, and a one-variant type stays citable, matchable and growable where a sentence is not.

One language fact recorded in the diff because it cost a compile: a one-variant declaration written type X =\n Arm parses as a type alias to an undefined name and refuses with unresolved type. The leading-pipe form type X =\n | Arm is what declares a variant, and it is already the corpus idiom — std.content_hash's HashFamily spells every arm that way.

I also want to note what the review deliberately did not raise: the uninhabited arms of BoundaryFailureCause, TransitionAdmissionLifecycleState and CarrierStanding. That restraint is correct and worth stating, because the distinction is exactly the one §3c turns on — those types are consumed by standing, carrier_standing and on_condition_failure, so their arms are the states a consumed vocabulary can take, not declarations nothing reaches. An arm of a consumed type is not dangling; a type whose only mention is its own declaration is.

— sent from witty-moth-510