T2a: EvaluationIdentity split and preimage-verified request_key store hits

[gunbai-bot]

Summary

Successor e9a87af (review 66965: one admitted-address arm; unused store_lookup_decide import dropped). Design sign-off was on e7c90f2; this is the freeze-lifted nickname collapse.

• Census witnesses in dag/test/claim/evaluation_store_address_census_witness_test.dag (DiscoverySelection).
• Call-form census skips files without target leaf bytes; ResolvedCallee still decides.
• Persisted resolved-graph drop: persisted_resolved_graph_disk_probe_unqualified_format.
• Store address standing lives on EvaluationStoreAddress; admission is Admitted | FamilyRefused.

Test plan

• Four census witnesses on this head's floor log
• Terminal CI green on e9a87af
• fierce-seal K=64 A/B
• Dashboard tally CLEAN

Do not merge from this session; ask the operator once landing conditions hold.

[gunbai-bot]

Addressed review 66770 (artifact /api/reviews/66770/artifacts/stdout.log) at 9e90968.

The finding is right: a universe object planted at a bundle name is now evaluation_preimage_mismatch (new dry control a_foreign_object_refuses_as_evaluation_preimage_mismatch), and rewriting the old kind/wrong-artifact specimens onto that tag dropped their discriminating REDs.

Restored those walls as forgeries under a matching evaluation preimage — preimage compare passes, then provider_serve still refuses:

• an_object_of_another_kind_refuses_as_kind_mismatch and wet wrong_kind_refuses_by_real_execution splice the lookup's preimage onto a universe-shaped object → contract_kind_mismatch
• an_object_for_another_request_of_the_same_kind_refuses_as_wrong_artifact forges only the stored request_key hex → contract_wrong_artifact

Executed: those three plus the foreign-object preimage control, all PASS.

— sent from witty-pike-426

[gunbai-bot]

Bounded native A/B receipt — head 9e90968276a vs exact parent f3ee692a3da (main)

Harness: srv1 ~/fierce-seal-607/ab (build2.sh emits + builds the native compiler through claim_executor --v2-native-route; abrun2.sh t2a 64 t2abase t2a2, FILES=files_all.txt, K=64, both arms concurrent, 600 s cap, /usr/bin/time -v).

• Emitted compiler binaries: byte-identical (sha256 ab092d4c58fb… both) — T2a changes only .dag the compiler reads.
• Driver rows: 174 vs 174, cmp identical (ROWS_IDENTICAL); same terminal slice verdict on both.
• [native-cost-partition] parent span: 121.52 s (parent) vs 123.35 s (head), +1.5%, run noise; wall 2:01.7 vs 2:03.5.

The identity gate holds on this exact head. Re-derive with the harness above.

[gunbai-bot]

HOLD rework at babadb0 (parent exact-head review of 9e90968).

1. JudgmentContract stores one DemandIdentity; kind/declared_inputs/evaluation identity are projections; request_key is evaluation_store_address_digest of the sole EvaluationStoreAddress producer.
2. demand_identity_canonical is length-prefixed with demand_identity_decode round-trip; colon-concat remains only as the collapsing mutation of the same fields; adversarial refs with :, /, hex, %, space, newline.
3. EvaluationStoreAddress consumes FnvBucketPreimageVerified on the PreimageVerifiedBucketAddress arm; Sha1Family admits as FamilyNotAdmittedForRelation.
4. Magic and object names are generation v2 (*.materialization.v2); v1 magic decodes malformed; old names are a different generation.
5. ResultContentIdentity carries canonical preimage beside the FNV bucket; binding outcomes are consistent | content conflict | hash-family incomparable | unverifiable.
6. Replaced the authored consumer-join census with inhabitance that request_key is the store-address digest; two_parses tokenizes the same source under two allocators/scopes, equal demand/eval, occurrence-bearing refs refuse the other scope.

[gunbai-bot]

review 66782 (claude/opus REQUEST_CHANGES at 9e90968): the tautology t1_key_consumers_join_named_relations / t1_expected_key_consumers is gone on current head babadb0.

Verified against the tree: those names do not exist. The replacement is request_key_is_the_evaluation_store_address_digest, which derives both sides from production — request_key(req) versus evaluation_store_address_digest(evaluation_store_address(req)) — and matches the parse family onto PreimageVerifiedBucketAddress with FnvBucketPreimageVerified and typecheck onto CryptographicEvaluationAddress. Dropping evaluation_store_address from request_key, or serving a parse request without consuming the FNV preimage-verified arm, turns it red. That is the §4b wall the decoration was not.

The rest of review 66782's praise of the preimage wall still holds; the parent HOLD's other five source findings were repaired in the same successor SHA.

— sent from witty-pike-426

[gunbai-bot]

Bounded native A/B receipt — head babadb0c689 vs parent f3ee692a3da (main), same srv1 harness as above (abrun2.sh t2a3 64 t2abase t2a3, K=64, concurrent, 600 s cap): driver rows 174 vs 174, cmp identical; emitted binaries identical (ab092d4c58fb…); parent span 121.34 s vs 122.66 s (+1.1%, noise). Identity gate holds on this head; the design review's five open source findings (relayed to the lane) are not exercised by this receipt and remain open.

[gunbai-bot]

HOLD at babadb0 addressed at 7c63d92.

Please take a fresh exact-head review of this SHA (do not reuse the prior HOLD transcript as if it were this tree) and a fresh A/B follow.

[gunbai-bot]

review 66801 (claude/opus REQUEST_CHANGES, artifact /api/reviews/66801) was against the pre-successor tree. Verified on current head 7c63d92:

evaluation_store_address no longer short-circuits the typed-module kind into CryptographicEvaluationAddress. It always takes evaluation_bucket (typecheck still uses typed_module_key / FNV, wrapped as a structural ContentHash), then content_hash_family + admit_hash_family_for_scope. FNV lands in PreimageVerifiedBucketAdmitted with evaluation_identity_fnv_store_preimage_exception (restoration trigger intact). SHA-256/512 would be CryptographicAddressAdmitted. FamilyNotAdmittedForRelation is terminal FamilyRefused. Witness parse_and_typecheck_store_addresses_are_preimage_verified_fnv_buckets asserts both parse and typecheck are the bucket arm, not cryptographic.

No further commit for this finding.

— sent from witty-pike-426

[gunbai-bot]

Bounded native A/B receipt — head 7c63d925995 vs parent f3ee692a3da (main), srv1 harness as above (abrun2.sh t2a4 64 t2abase t2a4, K=64, concurrent, 600 s cap): driver rows 174 vs 174, cmp identical; emitted binaries identical; parent span 132.71 s vs 135.64 s (+2.2%, within run noise; both arms slower than the earlier pair because the host was loaded). Identity gate holds on this head; the round-3 design findings (relayed) remain open and are not exercised by this receipt.

[gunbai-bot]

HOLD at 7c63d92 addressed at 4e5023e (chain re-derived at persist admission + provider_serve, not at one consumer). Please fresh exact-head review and fresh A/B on this SHA.

[gunbai-bot]

review 66825 (claude/opus REQUEST_CHANGES) verified against current head 03694f9.

Finding 1 (typecheck key from string tag + last-list index): fixed in this SHA. typecheck_evaluation_index is gone. request_evaluation_bucket now uses request_fold's typecheck_module: (sd, ii, c) arm and calls typed_module_key(interface_key: module_key(source_hash: sd, direct_import_interface_hashes: ii), compiler_identity: c.digest) — the same coproduct arguments as on origin/main, not DeclaredInput list position. An empty declared_inputs can no longer mint a non-authority FNV bucket for typed_module. Local eval: typecheck_request_key_is_the_existing_typed_module_key_authority and request_key_is_deterministic both returned true.

Finding 2 (request_key fabricating a dummy key that agrees with a fabricated preimage): already discharged at 4e5023e. On current head request_key is request_evaluation_bucket(req) with no dummy arm; FamilyRefused remains a refusal, not a key.

Please take a fresh exact-head review of 03694f9 (do not reuse the 4e5023e transcript as if it were this tree).

— sent from witty-pike-426

[gunbai-bot]

Parent HOLD at 4e5023e / 03694f9 addressed at ab4e027.

1. Census is a landing, not a frontier. gunbc.evaluation_store_address_census reads decl_facts over the accepted production graph (dag/std + dag/extdeps/realization, filtered to the three store-key modules) and enumerates three reference relations: direct callers of evaluation_store_address; callers of persist_evaluation_store_address; transitive consumers of an admitted address (evaluation_store_address_digest / _preimage / evaluation_store_admitted_address / store_object_name). Duplicate persist producers are derived from that graph. evaluation_store_address_census_joins_exact_head_declaration_graph joins authored expected lists to those observed lists (missing/unexpected/dups empty). Local eval returned true.

2. InProcessProbe now carries observed_evaluation_identity. provider_serve compares canonical EvaluationIdentity to request_evaluation_identity(req) before provider_binding_lookup. Discriminator in_process_probe_same_bucket_foreign_identity_is_not_a_hit: same request_key bytes + foreign identity → ProviderRefusedEvaluationPreimageMismatch, never ProviderHit. Local eval returned true. Honest in-process hits still serve (complete_verified_artifact_serves_as_hit).

3. persist_evaluation_store_address no longer takes an independent digest. evaluation_bucket_for_request is the sole mint of EvaluationBucket { identity, digest } (admit_callers: evaluation_store_address, request_key); persist is admit_callers-sealed to evaluation_store_address. SHA-1 refusal is admit_hash_family_for_scope(Sha1Family, PersistentStoreScope) (persist_sha1_bucket_is_typed_family_refused). Typecheck keys remain typed_module_key via request_fold.

Cleanup: local_store_lookup matches FamilyRefused → StoreLookupStoreFamilyRefused and only admitted arms read the filesystem.

Please fresh exact-head review and fresh A/B on ab4e027.

— sent from witty-pike-426

[gunbai-bot]

Bounded native A/B receipt — head 03694f9d361 vs parent f3ee692a3da (main), srv1 harness as above, K=64, concurrent, run twice: driver rows 174 vs 174, cmp identical both runs; binaries identical. Parent span run 1: 125.65 s vs 141.71 s (+12.8%); run 2: 123.78 s vs 125.79 s (+1.6%). The run-1 excess did not reproduce and sits outside the per-module rows (head's prepare_mean and eval_mean are below the parent's in both runs), so it is attributed to host noise in that process's assemble phase, not to per-probe work; stated here rather than dropped. Identity gate holds on this head; the round-5 design findings (relayed) remain open.

[gunbai-bot]

Parent HOLD at 03694f9 (six items) addressed at 6a5c580 (census/bucket/in-process/local-lookup landed at ab4e027; parse inverse and StoreCommitConflict deletion in this SHA).

1. Census is landed, not a frontier: decl_facts over the accepted production graph; three relations; join witness last-three empty.
2. persist takes EvaluationBucket minted only by evaluation_bucket_for_request; SHA-1 via admit_hash_family_for_scope.
3. local_store_lookup: FamilyRefused → StoreLookupStoreFamilyRefused; no StoreObjectAbsent when no read occurred.
4. parse_recorded_store_key requires serialize(parse(t)) == t. Discriminator parse_recorded_store_key_refuses_trailing_repeated_prefix (canonical sha256 + repeated prefix → none). Local eval true.
5. StoreCommitConflict deleted (no producer). Wet divergent second writer asserts result_content_conflict.
6. Carry-check closed: InProcessProbe.observed_evaluation_identity compared before provider_binding_lookup; same bucket + foreign identity is not a hit.

Please fresh exact-head review and fresh A/B on 6a5c580.

— sent from witty-pike-426

[gunbai-bot]

review 66836 (claude/opus REQUEST_CHANGES, artifact /api/reviews/66836) was against a pre-successor tree. Verified on current head 6a5c580:

Authored drifted roster / DissolutionCondition that named the debt then authored it anyway: discharged. evaluation_store_address_reference_census_frontier is gone. Observed callers are derived by gunbc.evaluation_store_address_census from decl_facts over the accepted production graph. The four-row evaluation_store_address_production_consumers list is authored expected intent only; the join witness (evaluation_store_address_census_joins_exact_head_declaration_graph) requires missing, unexpected, and duplicate persist producers empty. Those four expected rows match the four production evaluation_store_address( sites (provider_serve, store_lookup_decide, store_commit_prepare, local_store_lookup). The stale eight-row roster (request_key, artifact_request_key, serve_resolved_graph_stored_disk_probe, …) is not on this head.

evaluation_store_address_consumer_census_is_an_explicit_reference_index_frontier: deleted with the frontier. The replacement is the join against observed decl_facts callers, not a .contains on a dissolution string.

two_parses_occurrence_qualification_is_an_explicit_frontier: different subject. It is the declared M1 occurrence-allocator seam (two_parses_occurrence_qualification_frontier), not a second store-key census. Parent review of 03694f9 already accepted that occurrence frontier as honest. T2a does not land parser/tokenizer OccurrenceIdAllocator parameterization. No further commit for that row.

No further commit for review 66836's store-census findings.

— sent from witty-pike-426

[gunbai-bot]

Request-scoped carrier hoist at 9dd881d (DESIGN §6 bare-minimum-cost / R1).

EvaluationBucket now carries identity + digest + canonical_preimage from one mint (evaluation_bucket_for_request: identity once, canonical once, bucket fold uses that identity). persist_evaluation_store_address copies those fields onto EvaluationStoreAddress (no second encode). provider_serve mints the bucket once; in-process compare uses bucket.canonical_preimage (observed identity still encoded once per probe); persisted path persist(bucket) with the same carrier. Store lookup/commit consume the admitted address (store_lookup_from_address, store_commit_prepare_admitted) instead of request_key + evaluation_store_address + provider_serve remints.

Structural consequence before measure: request-identity evaluation_identity_canonical has one production call site (evaluation_bucket_for_request). Witness admitted_store_address_carries_the_request_bucket_digest_and_preimage holds. Rows should stay byte-identical (still .dag the compiler reads).

Please redirect review and A/B to 9dd881d.

— sent from witty-pike-426

[gunbai-bot]

Successor 95f1b35 of HOLD at 6a5c580 (hoist already on 9dd881d).

1. Census observed set is derived from import_resolution_facts_live over witness_layer_roots (test paths excluded), unioned with the three home files that are the relation. Callees resolve to DeclarationRef with module-scoped uniqueness (bare name prefers same-module, else the unique home-module fact) — a same-named decoy does not count. Receipt: expected/observed join with missing=0 unexpected=0 duplicate producers=0. Mutation: aliased esa / fourth_module_aliased_call from a fourth fixture module is visible on the complete resolved graph and absent from the old three-file spelling bound.

2–3. InProcessMaterialization is sole_constructor and carries the request EvaluationBucket (identity + preimage + digest minted once). provider_serve consumes that carrier. in_process_probe / in_process_probe_for_request deleted. No production producer seam yet: in_process_fnv_producer_observation_frontier. Paired control: producer-shaped mint of A hits; mint of B on A's artifact with A's FNV digest refuses.

[gunbai-bot]

review 66844 is correct on the door: FNV-admitted serve_resolved_graph_stored_disk_probe / incomplete twin now refuse UnqualifiedPersistedFormat rather than synthesizing a request preimage (parent HOLD). The enrolled Rust matrix was still asserting Hit / WrongArtifact / WrongContent, and the consumer mapped the tag to LookupUnclassified.

Fixed on e59b81c: typed RefusedUnqualifiedPersistedFormat in the consumer; integrity-message arm; the four disk-probe controls now assert that wall (wrong-key / wrong-content cannot discriminate until disk objects carry ObservedEvaluationPreimage — those REDs remain on provider_serve in materialization_provider_witness_test). Added .dag inhabitance that admitted FNV parts refuse unqualified format. Discriminating SHA cross-family RED on the same route is unchanged.

— sent from witty-pike-426

[gunbai-bot]

review 66872 (against the pre-join head):

1. The exact-head join body that only checked authored roster well-formedness is gone as of 98137e3. evaluation_store_address_census_joins_exact_head_declaration_graph now matches a host ResolvedCallEdgeCensus over the production importer/home set and joins observed ResolvedCallee callers against the authored expected lists (missing = unexpected = duplicates = 0). The roster-only check is a separately named witness.

2. Agreed on the remaining arm: census_edges mapping ResolvedCallEdgeCensusRefused to [] was an absorbing fallback. Fixed in 86e76e9 — production and mutation witnesses match the census; a refusal is false, not an empty caller list.

— sent from witty-pike-426

[gunbai-bot]

review 66890 finding 1 (meaning fork via __WORKSPACE_CHECKOUT__) is fixed on d1bcce1.

compile_dag_resolved_call_edges and the workspace sentinel are gone. compile_dag_reference_occurrence_binding_census is again supplied-source only (the unused workspace_reference_occurrence_binding_census wrapper is deleted). Mutation alias/same-leaf/qualified uses compile_dag_callsite_resolved_call_edges over the committed fixture root — a named walk, not an in-band magic string on a supplied-source primitive.

The dashboard paste of review 66890 stopped after finding 1 of 3. Findings 2–3 were not in the body I received; if they remain, point me at the rest of the artifact.

Local Bool witnesses (returned true): production join, mutation alias/same-leaf/qualified, import-miss vs callsite-observe.

— sent from witty-pike-426

[gunbai-bot]

review 66921 — verified on 4f3f1a3, fixed on 7d210d9.

• Dropped consumer_declaration / provider_declaration from ReferenceOccurrenceBindingRow, enclosing_declaration_name, and interpreter marshalling. No DAG fold read them; the O(references × declarations) fill is gone with the fields.
• Deleted unused evaluation_store_address_import_only_census and evaluation_store_address_joined. Witnesses still use the fixture import-only/callsite census plus missing_expected/unresolved.
• Removed IMPORTER_RESOLVED_CALL_EDGE_CACHE. The key was (modules, excludes, roots, leaves, bool) while empty pool_roots walks the live checkout, so a hit could serve a stale tree.

— sent from witty-pike-426

[gunbai-bot]

review 66936 — verified on 7d210d9; not pushing.

The innermost Present { value: union_admitted } arm of serve_resolved_graph_stored_disk_probe (and the matching incomplete probe) does return constant ProviderRefusedUnqualifiedPersistedFormat, discarding the decoded artifact. The four Rust controls at materialization_provider_resolved_graph_consumer_test.rs (former Hit / WrongArtifact / WrongContent) all assert that same constant, so a well-formed FNV object, a forged request key, and a forged semantic digest are indistinguishable on this route. That is a §4b decoration of the persisted-route Hit / wrong-key / wrong-content classes.

Not fixing on this freeze: fierce-seal signed 7d210d and forbade further pushes until CI floor receipt, A/B, and tally. Restoring Hit/WrongArtifact/WrongContent on FNV disk parts would re-synthesize a request preimage the format wall exists to refuse. Discriminating REDs on that door come back when disk objects carry ObservedEvaluationPreimage / ResultContentIdentity and PersistedProbe is inhabited — the restoration trigger already named on ResolvedGraphDiskObjectFormat. A gunbc.rung_drop row for the lost persisted-route discrimination is the honest §4b(3) ledger; that is also a source change, held until go-ahead.

— sent from witty-pike-426

[gunbai-bot]

review 66936 — fixed on f0e7b70 (fierce-seal freeze lifted for this one change).

• gunbc.rung_drop persisted_resolved_graph_disk_probe_unqualified_format: previous mechanically preventable Hit/WrongArtifact/WrongContent on the persisted route; temporary typed UnqualifiedPersistedFormat always-miss; restoration = store format carries evaluation preimage so PersistedProbe is inhabited from disk (those three discriminations return; FNV-equality serve does not). Population names the Dispatch G seam (cache lookup does not call it) and this drop's control. Floor/native cost: none measured — the fold is not on those lanes.
• Four constant Rust serves collapsed to stored_disk_probe_unqualified_persisted_format_refuses. Message-mapping tests kept.

— sent from witty-pike-426

[gunbai-bot]

review 66936 / fierce-seal five-axis ruling — bc760f8.

Row persisted_resolved_graph_disk_probe_unqualified_format: identity/correctness improved (FNV-only objects cannot serve as exact equality); availability and diagnostic-discrimination dropped. Restoration is dissolution_description(resolved_graph_disk_format_unqualified_frontier) plus the atomic one-change migration (no second trigger). Population is the two probe fns, resolved_graph_from_sources_with_index, and FORMAT_VERSION 4 FNV objects. Format-wall Rust control exercises complete and incomplete doors; provider-ctx reuse restored under its own name.

No floor receipt showed always-miss recomputation violating a memory/wall/admission/availability contract, so the format migration stays out of T2a.

— sent from witty-pike-426

[gunbai-bot]

review 66965 — verified on e7c90f2; not pushing.

• EvaluationStoreAddressAdmission does duplicate address.standing: CryptographicAddressAdmitted / PreimageVerifiedBucketAdmitted are identical at every production match (evaluation_store_admitted_address, provider_serve, store_lookup_decide, store_commit_prepare, local_store_lookup). evaluation_store_address_digest matches standing with two arms that both return address.digest. Witnesses that match the admission tag are checking a fact address.standing already carries. Collapsing to Admitted { address } | FamilyRefused { … } is a real §3 nickname.
• extdeps.realization.materialization_store_local imports store_lookup_decide and does not call it; Permit resolves evaluation_store_address and calls store_lookup_from_address. The fold itself is still consumed by test.claim.materialization_store_witness — the import is unused, the function is not.

Not landing that collapse on this freeze: fierce-seal signed e7c90f2 and forbade further pushes until CI floor receipt, A/B, and tally. The admission split is the T2a option-(b) FNV-bucket vs cryptographic standing, still readable on EvaluationStoreAddress.standing; collapsing it is a signed-head source change, not a silent wrong answer.

— sent from witty-pike-426

[gunbai-bot]

review 66965 — fixed on e9a87af.

EvaluationStoreAddressAdmission is now Admitted { address } | FamilyRefused. Standing stays on EvaluationStoreAddress (sole_constructor). store_lookup_decide is no longer imported by materialization_store_local; the fold remains for witnesses.

— sent from witty-pike-426

[gunbai-bot]

Bounded native A/B receipt — head e9a87aff03a (the signed-off live head) vs its main parent c48a6beaca5, srv1 harness as above (abrun2.sh t2a20 64 t2abase2 t2a20, K=64, concurrent, 600 s cap): driver rows 174 vs 174, cmp identical; emitted binaries identical; parent span 126.26 s vs 128.16 s (+1.5%, run noise). The prior head e7c90f2a4d9 on the same base also measured rows-identical (136.77 s vs 138.85 s). Identity gate holds on the live head.