Add a Superseded revocation disposition; revoke the stranded entry-graph-union-construction receipt

dag/gunbc/roadmap/roadmap_acceptance_event_history.jsonl

@@ -14,3 +14,4 @@
 {"variant":"acceptance_recorded","receipt":{"node":"ladder-measurement-schema","criteria_digest":"74da4d8be7125c81","red_control":{"variant":"red_control_executed","witness_module":"test.claim.guarantee_measurement_witness_test","witness_fn":"duplicate_class_id_reds_uniqueness","executed_on":"2026-08-01"},"handback":{"variant":"handback_delivered","first_artifact":"dag/gunbc/guarantee_measurement.dag","further_artifacts":["dag/test/claim/guarantee_measurement_witness_test.dag"]},"accepted_by":"operator","accepted_on":"2026-08-01"}}
 {"variant":"acceptance_recorded","receipt":{"node":"v2-emitter-producer-provenance","criteria_digest":"f1c76111c83a0a60","red_control":{"variant":"red_control_executed","witness_module":"v2.test.claim.self_host.emitter_producer_provenance_witness_test","witness_fn":"witness_restored_binding_without_executed_receipt_does_not_authorize_reds","executed_on":"2026-08-02"},"handback":{"variant":"handback_delivered","first_artifact":"src/v2/compiler/self_host/frontier.dag","further_artifacts":["src/v2/test/claim/self_host/emitter_producer_provenance_witness_test.dag"]},"accepted_by":"operator","accepted_on":"2026-08-02"}}
 {"variant":"acceptance_recorded","receipt":{"node":"v1-seed-honesty-decision","criteria_digest":"1717cfe258d9afe1","red_control":{"variant":"red_control_executed","witness_module":"test.claim.seed_honesty_discharge_unavailable_test","witness_fn":"seed_honesty_undecided_would_keep_closing_contract_red","executed_on":"2026-08-02"},"handback":{"variant":"handback_delivered","first_artifact":"src/v2/workflow/bootstrap.dag","further_artifacts":["dag/test/claim/seed_honesty_discharge_unavailable_test.dag","dag/gunbc/ci/ci_layer_roots.dag"]},"accepted_by":"operator","accepted_on":"2026-08-02"}}
+{"variant":"acceptance_revoked","exact_prior_receipt":{"node":"entry-graph-union-construction","criteria_digest":"3502539e920d9e40","red_control":{"variant":"red_control_executed","witness_module":"v1-compiler-tests.union_resolve_receipts_test","witness_fn":"shared_typecheck_distinct_compute_count_is_order_invariant","executed_on":"2026-08-01"},"handback":{"variant":"handback_delivered","first_artifact":"docs/plans/entry-graph-union-slice2-typecheck-attribution.md","further_artifacts":["docs/plans/receipts/entry-graph-union-slice2/receipt-broad-disjoint.json","docs/plans/receipts/entry-graph-union-slice2/receipt-post-merge-representative-50.json","docs/plans/per-entry-assembly-decomposition-measurement.md","src/v1/tests/src/union_resolve_receipts_test.rs"]},"accepted_by":"operator","accepted_on":"2026-08-01"},"disposition":{"variant":"acceptance_node_remains_superseded"},"reason":"The floor cut retired this work's subject; remaining cost work lives on the successor. The recorded acceptance is retained as history.","revoked_by":"operator","revoked_on":"2026-09-13"}

dag/gunbc/roadmap/roadmap_belt_actuate.dag

@@ -3404,7 +3404,7 @@ fn belt_run_once_in(
           audit_outcomes: audit_outcomes,
         }
       }
-    RoadmapAuthorityProjected { doc: doc, accepted: _ } =>
+    RoadmapAuthorityProjected { doc: doc, accepted: _, withheld: _ } =>
       belt_tick_for_instance(
         instance: instance,
         state: roadmap_belt_production_spawn_mode,
@@ -6030,7 +6030,7 @@ fn belt_lookup_node(node_id: String) -> BeltNodeLookup {
   match roadmap_authority_projection() {
     RoadmapAuthorityProjectionRefused { detail: detail } =>
       AuthorityProjectionRefused { detail: detail }
-    RoadmapAuthorityProjected { doc: doc, accepted: _ } =>
+    RoadmapAuthorityProjected { doc: doc, accepted: _, withheld: _ } =>
       belt_find_node_in(nodes: doc_all_nodes(doc: doc), node_id: node_id)
   }
 }
@@ -6244,7 +6244,7 @@ fn belt_launch_host_standing_for_page_over(
   let pre = belt_launch_host_standing(instance: instance)
   match plan {
     RoadmapAuthorityProjectionRefused { detail: _ } => pre
-    RoadmapAuthorityProjected { doc, accepted: _ } => {
+    RoadmapAuthorityProjected { doc, accepted: _, withheld: _ } => {
       let graph = launch_graph_of_document(doc: doc)
       let merged = authored_merged_prs()
       match belt_page_sessions_need(standing: pre, graph: graph, merged: merged, nodes: doc_all_nodes(doc: doc)) {

dag/gunbc/roadmap/roadmap_forecast.dag

@@ -859,9 +859,9 @@ fn schedule_forecast(
   } }
 }
 
-// THE FORECAST'S PLAN IS A PARAMETER. The accepted set is carried BY the projection -- it is the
-// field roadmap_authority_projection fills from accepted_roadmap_node_ids_projection -- so the fold
-// reads it from the plan it was handed rather than re-deriving it from the public carrier. That is
+// THE FORECAST'S PLAN IS A PARAMETER. The accepted set and the withheld set are carried BY the
+// projection -- fields the authority fills from one history load -- so the fold reads both from
+// the plan it was handed rather than re-deriving them from the public carrier. That is
 // what makes a caller-supplied plan forecastable at all: a second read would have answered about
 // the public roadmap while the nodes came from the caller's.
 fn roadmap_schedule_forecast_over(
@@ -872,11 +872,11 @@ fn roadmap_schedule_forecast_over(
   match plan {
     RoadmapAuthorityProjectionRefused { detail: detail } =>
       ScheduleForecastRefused { refusals: [ForecastRoadmapAuthorityRefused { detail: detail }] }
-    RoadmapAuthorityProjected { doc: _, accepted: accepted } =>
+    RoadmapAuthorityProjected { doc: _, accepted: accepted, withheld: withheld } =>
       let builds = roadmap_cycle_time_observation_builds()
       schedule_forecast(
-        nodes: active_roadmap_nodes_for_accepted(accepted: accepted),
-        edges: active_roadmap_edges_for_accepted(accepted: accepted),
+        nodes: active_roadmap_nodes_for_accepted(accepted: accepted, withheld: withheld),
+        edges: active_roadmap_edges_for_accepted(accepted: accepted, withheld: withheld),
         observations: accepted_cycle_time_observations(builds: builds),
         history_refusals: cycle_time_history_refusals(builds: builds),
         population_exclusions: cycle_time_population_exclusions(builds: builds),

dag/gunbc/roadmap/roadmap_launch_admission.dag

@@ -474,7 +474,7 @@ fn launch_graph_of_document(doc: RoadmapDocument) -> LaunchGraphStanding {
 fn launch_graph_of_projection(proj: RoadmapAuthorityProjection) -> LaunchGraphStanding {
   match proj {
     RoadmapAuthorityProjectionRefused { detail } => LaunchGraphUnobserved { detail: detail }
-    RoadmapAuthorityProjected { doc, accepted: _ } => launch_graph_of_document(doc: doc)
+    RoadmapAuthorityProjected { doc, accepted: _, withheld: _ } => launch_graph_of_document(doc: doc)
   }
 }
 

dag/gunbc/roadmap/roadmap_model.dag

@@ -6,6 +6,7 @@ import std.content_hash { content_hash_atom, content_hash_combine_structural, co
 import gunbc.roadmap_status {
   RoadmapItem, DriftVerdict, Signoff, signoff_accepts, signoff_drift,
   TicketFields, line_ticket,
+  DerivableLine, AuthoredLine, PlainLine, SupersededLine, TicketLine,
   RedControlEvidence, HandbackEvidence,
   RedControlNotRun, RedControlExecuted,
   HandbackNotDelivered, HandbackDelivered,
@@ -162,6 +163,33 @@ fn receipt_matches_node(r: RoadmapAcceptanceReceipt, rn: RoadmapNode) -> Bool {
     }
 }
 
+type ReceiptNodeMatchVerdict
+  = ReceiptMatchesNode
+  | LiveReceiptOnSupersededLine { node: RoadmapNodeId }
+  | ReceiptDoesNotMatchNode
+
+fn node_line_is_superseded(rn: RoadmapNode) -> Bool {
+  match rn.line {
+    DerivableLine { prs: _, title: _, description: _ } => false
+    AuthoredLine { done: _, content: _ } => false
+    PlainLine { content: _ } => false
+    SupersededLine { by: _, content: _ } => true
+    TicketLine { done: _, ticket: _ } => false
+  }
+}
+
+fn receipt_node_match_verdict(r: RoadmapAcceptanceReceipt, rn: RoadmapNode) -> ReceiptNodeMatchVerdict {
+  if !(r.node == rn.node) {
+    ReceiptDoesNotMatchNode
+  } else {
+    if node_line_is_superseded(rn: rn) {
+      LiveReceiptOnSupersededLine { node: rn.node }
+    } else {
+      if receipt_matches_node(r: r, rn: rn) { ReceiptMatchesNode } else { ReceiptDoesNotMatchNode }
+    }
+  }
+}
+
 fn receipts_for_node(receipts: List<RoadmapAcceptanceReceipt>, id: RoadmapNodeId) -> List<RoadmapAcceptanceReceipt> {
   receipts |> filter(r => r.node == id)
 }
@@ -186,8 +214,38 @@ fn node_accepted(receipts: List<RoadmapAcceptanceReceipt>, rn: RoadmapNode) -> B
 // arms.
 
 type AcceptanceNodeReopensActiveFrontier {}
+type AcceptanceNodeRemainsSuperseded {}
+
+// The revocation disposition names the FRONTIER CONSEQUENCE, not the supersession fact.
+// SupersededLine already owns terminal standing and `by`. AcceptanceNodeRemainsSuperseded is
+// deliberately payload-free: it says the revoked receipt stays off the active frontier because the
+// referenced node remains superseded. The join to that node's existing SupersededLine is the
+// wall; `by` is read from the line, never re-authored on the event.
+type AcceptanceRevocationDisposition
+  = AcceptanceNodeReopensActiveFrontier
+  | AcceptanceNodeRemainsSuperseded
+
+fn revocation_reopens_active_frontier(disposition: AcceptanceRevocationDisposition) -> Bool {
+  match disposition {
+    AcceptanceNodeReopensActiveFrontier {} => true
+    AcceptanceNodeRemainsSuperseded {} => false
+  }
+}
 
-type AcceptanceRevocationDisposition = AcceptanceNodeReopensActiveFrontier
+fn revocation_disposition_eq(a: AcceptanceRevocationDisposition, b: AcceptanceRevocationDisposition) -> Bool {
+  match a {
+    AcceptanceNodeReopensActiveFrontier {} =>
+      match b {
+        AcceptanceNodeReopensActiveFrontier {} => true
+        AcceptanceNodeRemainsSuperseded {} => false
+      }
+    AcceptanceNodeRemainsSuperseded {} =>
+      match b {
+        AcceptanceNodeReopensActiveFrontier {} => false
+        AcceptanceNodeRemainsSuperseded {} => true
+      }
+  }
+}
 
 type RoadmapAcceptanceEvent
   = AcceptanceRecorded { receipt: RoadmapAcceptanceReceipt }
@@ -305,12 +363,7 @@ fn acceptance_event_eq(a: RoadmapAcceptanceEvent, b: RoadmapAcceptanceEvent) ->
         AcceptanceRecorded { receipt: _ } => false
         AcceptanceRevoked { exact_prior_receipt: bpr, disposition: bd, reason: br, revoked_by: bb, revoked_on: bo } =>
           acceptance_receipt_eq(a: apr, b: bpr)
-            && match ad {
-              AcceptanceNodeReopensActiveFrontier {} =>
-                match bd {
-                  AcceptanceNodeReopensActiveFrontier {} => true
-                }
-            }
+            && revocation_disposition_eq(a: ad, b: bd)
             && ar == br
             && ab == bb
             && ao == bo
@@ -422,6 +475,11 @@ fn acceptance_revocation_disposition_digest(
         tag: "roadmap-acceptance-reopens-active-frontier-v1",
         payload: content_hash_atom(value: "AcceptanceNodeReopensActiveFrontier" as NonEmptyStr),
       )
+    AcceptanceNodeRemainsSuperseded {} =>
+      content_hash_tagged_structural(
+        tag: "roadmap-acceptance-remains-superseded-v1",
+        payload: content_hash_atom(value: "AcceptanceNodeRemainsSuperseded" as NonEmptyStr),
+      )
   }
 }
 
@@ -583,13 +641,162 @@ fn ever_recorded_receipt_accounted_for(
     || receipt_present_exact(receipts: revoked, receipt: receipt)
 }
 
+type LiveReceiptDeclarationJoin
+  = LiveReceiptsJoinDeclared
+  | LiveReceiptJoinsSupersededLine { node: RoadmapNodeId }
+  | LiveReceiptDoesNotMatchDeclaredNode { node: RoadmapNodeId }
+  | LiveReceiptJoinsUndeclaredNode { node: RoadmapNodeId }
+  | LiveReceiptJoinsAmbiguousDeclaredNode { node: RoadmapNodeId }
+
+fn live_receipt_join_declared_node(
+  r: RoadmapAcceptanceReceipt,
+  nodes: List<RoadmapNode>,
+) -> LiveReceiptDeclarationJoin {
+  let found = nodes |> filter(n => n.node == r.node)
+  if count(found) == 0 {
+    LiveReceiptJoinsUndeclaredNode { node: r.node }
+  } else {
+    if count(found) > 1 {
+      LiveReceiptJoinsAmbiguousDeclaredNode { node: r.node }
+    } else {
+      match first(found) {
+        Absent => LiveReceiptJoinsUndeclaredNode { node: r.node }
+        Present { value: rn } =>
+          match receipt_node_match_verdict(r: r, rn: rn) {
+            ReceiptMatchesNode => LiveReceiptsJoinDeclared
+            LiveReceiptOnSupersededLine { node: node } =>
+              LiveReceiptJoinsSupersededLine { node: node }
+            ReceiptDoesNotMatchNode =>
+              LiveReceiptDoesNotMatchDeclaredNode { node: r.node }
+          }
+      }
+    }
+  }
+}
+
+fn live_receipts_join_declared_nodes(
+  receipts: List<RoadmapAcceptanceReceipt>,
+  nodes: List<RoadmapNode>,
+) -> LiveReceiptDeclarationJoin {
+  fold(
+    receipts,
+    init: LiveReceiptsJoinDeclared,
+    f: fn(acc, r) {
+      match acc {
+        LiveReceiptJoinsSupersededLine { node: n } =>
+          LiveReceiptJoinsSupersededLine { node: n }
+        LiveReceiptDoesNotMatchDeclaredNode { node: n } =>
+          LiveReceiptDoesNotMatchDeclaredNode { node: n }
+        LiveReceiptJoinsUndeclaredNode { node: n } =>
+          LiveReceiptJoinsUndeclaredNode { node: n }
+        LiveReceiptJoinsAmbiguousDeclaredNode { node: n } =>
+          LiveReceiptJoinsAmbiguousDeclaredNode { node: n }
+        LiveReceiptsJoinDeclared =>
+          live_receipt_join_declared_node(r: r, nodes: nodes)
+      }
+    },
+  )
+}
+
 fn project_live_acceptance_receipts(history: List<RoadmapAcceptanceEvent>) -> List<RoadmapAcceptanceReceipt> {
   match replay_acceptance_history(events: history) {
     Present { value: state } => state.live
     Absent => []
   }
 }
 
+type RemainsSupersededRevocationJoin
+  = RemainsSupersededRevocationsJoined
+  | RemainsSupersededRevocationOnNonSupersededNode { node: RoadmapNodeId }
+  | RemainsSupersededRevocationOnUndeclaredNode { node: RoadmapNodeId }
+  | RemainsSupersededRevocationOnAmbiguousDeclaredNode { node: RoadmapNodeId }
+
+fn join_remains_superseded_to_declared_line(
+  node: RoadmapNodeId,
+  nodes: List<RoadmapNode>,
+) -> RemainsSupersededRevocationJoin {
+  let found = nodes |> filter(n => n.node == node)
+  if count(found) == 0 {
+    RemainsSupersededRevocationOnUndeclaredNode { node: node }
+  } else {
+    if count(found) > 1 {
+      RemainsSupersededRevocationOnAmbiguousDeclaredNode { node: node }
+    } else {
+      match first(found) {
+        Absent => RemainsSupersededRevocationOnUndeclaredNode { node: node }
+        Present { value: rn } =>
+          if node_line_is_superseded(rn: rn) {
+            RemainsSupersededRevocationsJoined
+          } else {
+            RemainsSupersededRevocationOnNonSupersededNode { node: node }
+          }
+      }
+    }
+  }
+}
+
+fn remains_superseded_revocation_event_join(
+  event: RoadmapAcceptanceEvent,
+  nodes: List<RoadmapNode>,
+) -> RemainsSupersededRevocationJoin {
+  match event {
+    AcceptanceRecorded { receipt: _ } => RemainsSupersededRevocationsJoined
+    AcceptanceRevoked { exact_prior_receipt, disposition, reason: _, revoked_by: _, revoked_on: _ } =>
+      match disposition {
+        AcceptanceNodeReopensActiveFrontier {} => RemainsSupersededRevocationsJoined
+        AcceptanceNodeRemainsSuperseded {} =>
+          join_remains_superseded_to_declared_line(node: exact_prior_receipt.node, nodes: nodes)
+      }
+  }
+}
+
+fn remains_superseded_revocations_join(
+  history: List<RoadmapAcceptanceEvent>,
+  nodes: List<RoadmapNode>,
+) -> RemainsSupersededRevocationJoin {
+  fold(
+    history,
+    init: RemainsSupersededRevocationsJoined,
+    f: fn(acc, event) {
+      match acc {
+        RemainsSupersededRevocationOnNonSupersededNode { node: n } =>
+          RemainsSupersededRevocationOnNonSupersededNode { node: n }
+        RemainsSupersededRevocationOnUndeclaredNode { node: n } =>
+          RemainsSupersededRevocationOnUndeclaredNode { node: n }
+        RemainsSupersededRevocationOnAmbiguousDeclaredNode { node: n } =>
+          RemainsSupersededRevocationOnAmbiguousDeclaredNode { node: n }
+        RemainsSupersededRevocationsJoined =>
+          remains_superseded_revocation_event_join(event: event, nodes: nodes)
+      }
+    },
+  )
+}
+
+// Consequence fold only. Callers that admit a withheld set MUST first
+// remains_superseded_revocations_join against the declared nodes; a RemainsSuperseded arm that
+// does not join a SupersededLine is a projection refusal, not an empty withheld list.
+fn node_ids_held_off_active_frontier(history: List<RoadmapAcceptanceEvent>) -> List<RoadmapNodeId> {
+  fold(
+    history,
+    init: [] as List<RoadmapNodeId>,
+    f: fn(acc, event) {
+      match event {
+        AcceptanceRecorded { receipt } =>
+          acc |> filter(id => !(id == receipt.node))
+        AcceptanceRevoked { exact_prior_receipt, disposition, reason: _, revoked_by: _, revoked_on: _ } =>
+          if revocation_reopens_active_frontier(disposition: disposition) {
+            acc |> filter(id => !(id == exact_prior_receipt.node))
+          } else {
+            concat(
+              acc |> filter(id => !(id == exact_prior_receipt.node)),
+              [exact_prior_receipt.node],
+            )
+          }
+      }
+    },
+  )
+}
+
 fn acceptance_history_integrity_verdict(
   history: List<RoadmapAcceptanceEvent>,
   prior_history: List<RoadmapAcceptanceEvent>,