YAML ingest/emit: bounded-subset correct-meaning contract; retire the action-use line projection

[gunbai-bot]

Summary

extdeps.languages.yaml was an emit-only projection with a reader that reinterpreted whatever it did not model as a string. This makes the pair a bounded-subset reader/writer with a correct-meaning contract: every document the reader accepts has its correct YAML 1.2.2 meaning within a declared subset, and everything outside that subset is refused with a located reason — never reinterpreted, never silently dropped. The writer is the same contract turned around: for every value it emits, ingest_yaml_source(emit(v)) == v, and a value it cannot write that way is refused with the path to it.

That then makes the reader affordable enough for gunbc.action_use_admission's census to read every committed .github/workflows file through it, which is the trigger that retires the line projection realized_workflow_action_uses and its dissolution row realized_workflow_projection_frontier_rows. Both are deleted here.

Every wrong-meaning case in the source audit (#11663, comment 5743133113) is fixed and each has a claim with a red control:

• plain scalars resolve under the core schema (123 is an int, yes is a string) and unrecognized text no longer silently becomes a string;
• flow sequences split on commas outside quotes ([a,b] is two elements; ["a, b", c] is not split inside the quotes);
• single quotes are dropped and '' decoded; double-quoted escapes decode and an invalid escape like \q refuses;
• mapping keys are decoded, and a plain key the core schema reads as a non-string refuses;
• flow mappings are read as mappings, not strings;
• | clips to exactly one trailing newline, |- strips, |+ keeps; empty lines inside a literal are kept (the emitter used to filter them out — a semantic loss).

Why the witnesses are new rather than edited

The old ingest claims compared serialize(parse(x)) == serialize(expected), so a loss in the writer hid a loss in the reader — the "blank lines are kept" test could not fail for that reason. The old round-trip helper compared emit(parse(emit(v))) == emit(v), which a type change (YamlString "123" → YamlInt) passes. Both comparisons are gone:

• test.claim.yaml_ingest_witness — 24 claims comparing ingest_yaml_source(text) against a hand-written value, one construct at a time, each paired with a refusal that must name its line and its reason.
• test.claim.yaml_emit_witness — 9 claims comparing decoded structure, ingest_yaml_source(emit(v)) == v, over 39 tricky strings and 13 multi-line strings as values, keys and flow entries.

Refusal travels rather than being swallowed

serialize_yaml became emit_yaml -> EmittedYaml | YamlEmitRefused { path, reason }, so the five workflow generators, the compiler gate, and the srv3 seeded-install-media chain carry a typed outcome to their consumers instead of a string. gunbc.required_ci_epoch_observation's RequiredCiEpochDuplicated arm is deleted — the reader now refuses a duplicate mapping key, so that state is unreachable (DESIGN §4b: dissolution on climb).

The budget: what was cut, what the floor is, and why this PR is held

Judged against a line, not a point. .github/workflows/fleet-converge.yml is now 135,149 bytes, up from 89,935 when this reader was first fitted. It is a generated file other lanes grow, so a flat budget turns this required claim red on someone else's change. On merged main the claim measured 95,843 against the flat 72,300.

After the cuts below it measures 76,337. That is the measured floor of every remedy the cost standing admits, and it is still over the flat budget. A 2026-09-23 ruling admitted a per-entry allowance for claims whose subject is a whole corpus file. The ruling is an operator default-approval on timeout, not a deliberated ruling. #12134 landed that allowance: budget = base + per_entry × entry_count, where the census's own parse derives the count, and a claim over the per-entry rate still goes red. This PR adds the census to v2.workflow.required_floor corpus_census_roster.

Measured at this head: 1,140 entries, derived budget 101,200, census 82,717 steps. That is about 18% margin, and about 72.6 steps per entry against the declared 80. realized_census_cost_standing now names that judge and records the model as ruling-admitted. "Raising the claim's eval-step budget", per-entry rate included, stays a refused remedy.

What was cut (real work, never the population).

• The reader's accepted-path block walk is rewritten, not added to. yaml_entry returns the pair a mapping holds. It reads one-line, nested and literal entries directly and hands every other chunk to yaml_entry_general. That function is now the only refusal reading: the separate multi-line read dispatcher and yaml_literal_entry are deleted.
• Each routing decision is a function of exactly what it reads, so a shape the document repeats is decided once:
  • an entry's first line (yaml_first_line_route)
  • a sequence item's head (yaml_item_head_opens_mapping)
  • a block's indentation (yaml_indent_marks)
  • a mapping's key sequence (yaml_key_sequence_is_clean, with an exact per-key fallback when a decoded key holds a control character)
  • a flow sequence's inner text (yaml_flow_inner_is_plain)
  • a literal's leading whitespace (yaml_line_lead)
• The census traversal's own cost shape. realized_jobs_reading flattens each job into its use readings in document order. It no longer threads a stop flag through every step or copies the accumulated uses at every use; the first refusal in that order is the one the stopping scan reported. realized_distinct_uses pushes instead of copying.
• gunbc.action_use_admission realized_census_cost_standing's remedy now names both repairs.

Repeated-shape slope. Measured over workflow step items of one shape with distinct content per repetition, between 20 and 40 items. Identical repetitions are memoized by the evaluator and read as nearly free, which makes a naive repeated-shape measurement misleading. The cost per added step item went from about 1,013 to about 830 steps.

Why the floor is where it is. Every evaluated expression node costs one step. The remaining cost is per distinct line and per block, and each is near its node floor:

• the one-line entry path: about 45 steps per distinct line
• block setup: about 35–50 per block
• yaml_lookup's per-field filter: about 4 per field

Going well under 72,300 would need a new string builtin, which is Rust seed growth and not done here, or one of the standing row's refused remedies. The subject also keeps growing, so any constant cut is spent again.

The instrument, not the figures. Every number here is re-derived by claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/action_use_admission_witness_test.dag --functions census_fleet_converge_uses_are_modeled_and_executed_exactly, read from its [witness] line. The per-component split came from a temporary per-line step counter in the seed interpreter. It was a local instrument only and is not committed.

The std.types predicate

std.types commit_sha_text_holds is respelled as sixteen whole-string removals. Both that and the per-character spelling are linear, so this buys a constant factor in the interpreter, not a cost-shape repair (review 70343). The comment says so, and it names the dissolution trigger: the per-character evaluation cost fixed at its source. It was admitted by an operator ruling (stern-carp-604, 2026-09-20), not by this diff. test.claim.std_commit_sha_text_witness keeps the per-character spelling as an oracle, with a failing case for each refusal cause.

What CI establishes

The floor's whole-blob dag/std/types.dag kernel guard used to refuse this PR's changed-witness planning. That refusal was a defect, and #12087 fixed it; this branch integrates main after #12087. The floor now plans and runs the changed witnesses. Two things it found on this branch:

• install_media_remaster_ensure_grub_cmdline_inserts_by_real_execution had no executing lane. It moves to the local-repo wet lane, holds when run wet, and its sibling fetch file made the same move on 2026-09-09.
• The census claim was over the flat budget; it is now rostered under Floor: per-entry eval-step allowance for whole-file corpus-census claims #12134's per-entry allowance.

emit-build's E0573 PointerWidth red is inherited from main and owned by #12070.

Test plan

Run with a seed built from this tree:

• claim_batch --entry dag/test/claim/yaml_ingest_witness_test.dag: 31/31
• claim_batch --entry dag/test/claim/yaml_emit_witness_test.dag: 11/11
• claim_batch --entry dag/test/claim/action_use_admission_witness_test.dag: 34/34, with the census claim at 82,717 against its derived budget of 101,200
• claim_batch --entry dag/test/claim/corpus_census_allowance_witness_test.dag: 5/5
• claim_batch --wet --entry dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag: PASS
• src/v2/test/claim/local_repo_wet_terminal_test.dag: all pass
• gunbc run --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main: no drift

Landing-checklist evidence added:

• Route test over a real workflow. a_real_uses_line_respelled_outside_the_subset_refuses_and_respelled_inside_it_reads_the_same rewrites heal-publish.yml's first uses: line into five spellings.
  • A flow sequence, an alias and an empty value must each make the file unreadable, never an empty or unchanged population.
  • A quoted key and a spaced colon are the same YAML key, so they must read exactly the original population. This differs from the checklist, which listed them as refusals: refusing them would give a valid spelling the wrong meaning, which is the defect this reader replaces. quoted_escaped_and_spaced_uses_keys_are_read_and_script_text_is_not already pins that meaning.
  • A mutation moving quoted_key into the must-refuse set turns the claim red.
• Block scalars against an independent reader. literal_{clip,strip,keep}_chomping_matches_the_independent_reader_for_every_trailing_blank_count cover |, |- and |+, each with 0, 1 and 3 trailing empty lines, at document end and before a following key, over a body with a more-indented line. All 18 expected values were produced by the npm package yaml v2 parsing the same bytes as YAML 1.2, and are written as literals.
• No dag/test/claim/scratchprobe/* residue: the repeated-shape probes were local and are deleted.

🤖 Generated with Claude Code

[gunbai-bot]

Both findings in review 69075 are correct. One is fixed; the other is escalated rather than decided by me, which is the point the review makes.

Transcribed figures — fixed in 2e8e65c

The row asserted it did not transcribe its numbers twelve lines after transcribing them. Deleting them alone would have left the remedy unable to say which path to cut, which is the thing the row exists to say — so the probe that produced them is now a committed instrument, test.probe.yaml_shape_cost_probe, and the remedy names it and says to run it before cutting. That instruction is not ceremony: my first two cuts were aimed at the one-line entry path on an unmeasured guess and returned almost nothing; the probe is what redirected them to the sequence and multi-line paths.

std.types — escalated, not self-admitted

The review is right that the diff does both halves of what DESIGN §5 separates: it lands the workaround and writes the row admitting it. I have not tried to resolve that by arguing in the diff. I took the review's other option first — "a different cut" — and it did not reach:

attempt	result
key start-class map + hoisted value split	−1,828
nested ifs for eager && on the multi-line path	−883
one pass instead of three in both block folds	−825
short-circuiting chunk/item/value predicates	−30
scan_to_eol for first-line extraction	not callable — contract row in std.primitives, no interpreter declaration
index_by for the key map	not bound for List<YamlKeyValue> (the known index_by registry algebra gap)
consolidating yaml_entry_general onto shared helpers	+1,135 — reverted

The last row is the useful one: an interpreted call costs its arguments and its body, so factoring a hot path into shared helpers loses. That is why the two key predicates in the reader deliberately do not call each other.

Measured, reproduced, against the 72,300 new-witness budget: 70,436 with the std.types spelling, 73,754 without it — over by 1,454. The spelling is worth 3,318 steps at two different merge bases.

I also corrected a figure of my own: the PR body said 69,496. That reading was taken at an earlier merge base and I could not reproduce it; the reproducible pair is the one above, and I will fix the body.

One hypothesis falsified cleanly, since it is the interesting part. I expected the eager && in commit_sha_text_holds — head.length() == 40 && all(chars(...)) — to be walking forty characters for every @v4 tag. Guarding it with a nested if changed the figure by zero: every ref this census validates is already forty hex, because the admission requires commit pinning. The per-character walk is genuine work, not waste, so there is no free repair hiding there.

What remains is restructuring so a sequence item stops re-entering the full block setup for a two-line compact mapping. That is a real change to extdeps.languages.yaml.ingest with a yield I cannot bound in advance, and it deserves its own PR and review rather than being appended here.

So the choice — admit the std.types spelling externally with the filed row as its trigger, or hold this PR until that restructuring lands — is escalated to my parent. Per §5 the admission is not mine to grant in the diff that needs it, and if it is granted I will record on the carrier who granted it rather than leave the row reading as self-authorised.

Separate, and not part of that question

On the last green head the floor lane printed required-ci: FAILED PHASE floor refused ... ChangedWitnessObservationFailed with phases_failed=1, and step 8 still exited 0 — so the job and the aggregating lane both reported success. The cause is that editing dag/std/types.dag makes the base side unreconstructable, so the changed-witness sublane refuses to plan. The consequence worth noting here: on that head CI was not judging the budget claim this PR is about. I will confirm it reproduces before filing it as its own finding.

— sent from still-lynx-398

[gunbai-bot]

Review 69118 read head 2e8e65c; e78927a is now pushed and changes two of its three legs at the root. The third — the empirical one — is the sharpest part of the review, and I ran it rather than argued it.

The measurement you asked for

either re-run the committed probe/claim_batch and show this predicate is actually load-bearing on the budget post-dedup, or restore the all(chars(...)) form

Both spellings, current head, minutes apart, after the realized_distinct_uses dedup that is in this same diff, against the 72,300 new-witness budget:

std.types commit_sha_text_holds	census_fleet_converge
all(chars(...)), main's form	73,754 — over by 1,454, the required claim reds
sixteen replace calls	69,496 — under, 3.9% margin

So the hypothesis that dedup removed the pressure is falsified. You were right that the class row's own sentence ("forty lambda evaluations for every head on every admission") overstated it — after dedup it is roughly ten distinct heads per file, not every occurrence. But ten forty-character walks is still ~4,200 eval steps, which is more than the whole margin. The row that said "every admission" is deleted, so that overstatement goes with it.

I could not have shown you this by reading, which is the point your RUN IT BEFORE CUTTING citation was making — so thank you for insisting on it; it is now the reason the change stands rather than an assertion about it.

The two DESIGN legs

You were right on both, and neither is answered by argument:

• the self-written row — per_element_lambda_cost_unrolls_a_predicate_into_scalar_operations.dag is deleted. An operator ruling (stern-carp-604, 2026-09-20) is cited in its place. §5 says approval is external to the diff; it now is, and the carrier records who granted it rather than leaving the row to read as self-authorised.
• the comment declaring its own workaround status — rewritten. It no longer says "this is a workaround and is filed as one". It says what the predicate computes — forty characters, each a lowercase hex digit — and justifies the spelling on its own cost shape under §6's bare-minimum-cost rule: a per-character recursion in a hot, widely-shared predicate is fixed regardless of realized n, because n is not time-stable. The budget fitting afterwards is named as a consequence, not the reason.

What the change now owes, and pays

test.claim.std_commit_sha_text_witness (new, homed in std, not beside a caller) keeps the all(chars(...)) form as an oracle and claims the two spellings answer the same on every input either can be given — the lengths either side of forty, uppercase, the characters adjacent to both ranges on both sides, the empty string, a branch name. The equality is the contract; nothing in the module asserts a step count.

Its red is reachable and I executed it: respelling one stripped character from f to F turns the equality claim red. A green equality between two spellings of the same function would otherwise be decoration.

On the remedy pointing elsewhere

You are right that test.probe.yaml_shape_cost_probe points the census remedy at the reader's per-entry cost, and that remedy is unchanged — four measured reader cuts are in this PR, and the cost standing still names the structural reader cut, its own change, as what happens next. The predicate is a separate fix admitted on separate grounds; it is not the census remedy and the carrier now refuses, by name, respelling another shared predicate to buy margin.

— sent from still-lynx-398

[gunbai-bot]

Status: held, not abandoned. The authoring session (still-lynx-398) archived in the wind-down and this PR re-homed to me. I am recording its exact state rather than forcing it in, because it cannot land honestly today. Two independent reasons, both measured:

1. The census claim is over its ceiling at this head. census_fleet_converge measured 69,496 eval steps before the last main merge and 73,335 after, against the 72,300 new-witness budget. Nobody touched this lane; merging main grew .github/workflows/fleet-converge.yml from 1041 to 1100 lines through #11565, #11607 and #11788. The four green checks above are not evidence to the contrary: on this branch the floor's changed-witness sublane refuses (ChangedWitnessObservationFailed, because the PR touches dag/std/types.dag) and the lane still exits 0 — the fail-open that #11861 fixes. Landing on that green would ship a claim that reds the moment #11861 lands.

I had approved exactly one bounded cut for this (the sequence/multi-line path the measurement already located, ~1,035 steps needed). It was never made before the session archived.

2. Merging main now conflicts with a concurrent rewrite of the same subject. #11731 (CENSUS-IMAGE 0A) landed the seeded-image derivation and rewrote the srv3 chain this PR's emitter-refusal plumbing was written against: 26 conflict hunks across 8 files, including dag/gunbc/host/host_effect_realize.dag and the srv3 install-media modules. That is not a textual resolution — it means re-deriving where the writer's refusal travels in #11731's design. I aborted the merge rather than guess in a chain that reaches real machine state.

What is done and worth keeping (all on this branch, checks green): extdeps.languages.yaml as a bounded-subset reader/writer with the correct-meaning contract; every wrong-meaning case from the #11663 source audit fixed and witnessed by decoded-structure comparison, each construct with a red control, verified by planting four reader and three writer defects and watching each turn its own control red; the action-use line projection and its frontier row deleted, with the census reading all six committed workflows through ingest_yaml_source, one claim per file joined to the directory listing by identity.

What the next session must do, in order: rebase onto main after #11875 (the parse repair) lands; re-derive the writer's refusal path against #11731's seeded-image design rather than re-applying this branch's srv3 hunks; make the one bounded reader cut and re-derive the census cost with claim_batch eval_steps over ingest_yaml_source on the largest committed workflow; land only when that claim is inside its ceiling with real margin — never by raising the budget, splitting the claim, or restoring a second reader.

Carried as roadmap node action-use-yaml-reader-contract (#11857), with the margin residue as workflow-census-claim-budget-margin.

— sent from stern-carp-604

[briansrls]

APPROVED FOR MERGE on exact head be779362b29e1746c937fd3a71b1c1cd2357e1f7.

No additional direct-exit native bundle is required. The earlier direct-exit concern was specifically that piping claim_batch through a filter could preserve the filter's status instead of the producer's. That ambiguity is no longer carrying the merge conclusion: the exact-head required CI run completed successfully, and the required floor executed census_fleet_converge_uses_are_modeled_and_executed_exactly as a changed witness on the real acceptance path. It derived entry_count=1098, budget_steps=97840, then admitted the measured eval_steps=76337 — 21,503 steps of margin — under the separately merged #12134 per-entry authority.

The remaining checklist is discharged: #12087 restores truthful base reconstruction for the std.types edit; route controls prove unsupported forms refuse while quoted/spaced spellings of the same YAML key preserve the same action population; the 18 block-scalar cases are checked against the independent npm yaml v2 implementation; ingest/emit/action-census/allowance claim bundles are green; scratch probes are absent; GitHub reports CLEAN; and an exact-head source approval already exists.

A separate native wrapper around the same claim execution would duplicate the evidence route rather than close a remaining gap. This approval is for this SHA; a source change requires re-verdict.

[gunbai-bot]

Re review 70622, which asks the merger to confirm the commit_sha_text_holds ruling exists: it does. On 2026-09-20 at 11:34:25Z, this lane (stern-carp-604) sent still-lynx-398 a dashboard message answering its escalation ("Admit a std.types spelling change … or hold #11730?") with option A, as the external admission review 69075 asked for, with conditions. The comment's constant-factor wording was corrected afterwards, in response to review 70343. — sent from stern-carp-604

[gunbai-bot]

Review 70673's finding is correct and is fixed at d8994b4: refusals are now a typed arm (YamlEntryAccepted | YamlEntryRefused { line, reason }, YamlBlockResult for items, YamlScalarResult for flow entries), blocks detect a refusal by counting accepted readings and locate it in the readings already made, and every U+0001 sentinel comparison is deleted. The sentinel was not only a structural risk: a valid document with a decoded \\x01 sequence item was refused as if an item had been — a_decoded_u0001_is_content_as_an_item_a_value_and_a_key fails on the previous head and passes now. U+0001 remains only as yaml_line_join_mark, source-text punctuation. Census: 82,717 eval steps vs derived budget 101,200.

— sent from tidy-ant-630

[briansrls]

APPROVED FOR MERGE on exact head d8994b4df4a0710c485bc20f7da2a1e9ecbee6ef.

I re-reviewed the complete source delta from parent 983ac5aaa94d942d1e72a2da0102cd3f727d13c0; it changes only dag/extdeps/languages/yaml/ingest.dag and dag/test/claim/yaml_ingest_witness_test.dag. No source blocker remains.

The in-band refusal channel is removed end-to-end:

• mapping entries now carry YamlEntryAccepted | YamlEntryRefused { line, reason };
• sequence item readers carry YamlBlockResult;
• flow-entry fast paths carry YamlScalarResult;
• their aggregators derive accepted populations from those typed outcomes and scan the same outcomes for the first refusal.

No caller now compares a semantic key or value against U+0001, and no refusal is reconstructed by re-reading a value. The direct typed paths preserve first-refusal ordering and line accounting, and every accelerator delegates to the same canonical lower-level reader with the same arguments. U+0001 remains only as yaml_line_join_mark, private punctuation inserted into raw source after the document precheck; raw U+0001 is refused while decoded \x01 is ordinary semantic content.

The new decoded-U+0001 claim discriminates the former live defect across sequence item, mapping value and mapping key. The precheck-bypass red directly exercises the flow accelerators and establishes typed refusal without relying on whole-document screening.

Exact-head CI is fully green: compiler, clippy, both native emit-build targets, required floor, and aggregate witnesses. The floor completed measurement publication/adjudication and generated-artifact agreement. The corpus census is 82,717 steps against a derived 101,200-step allowance for 1,140 entries, approximately 18% margin.

Nonblocking metadata: the PR body still reports the prior 29/29 ingest count and prior 76,337/97,840 census. Refresh it to 31/31 and 82,717/101,200, and remove the stale “still open” line; a body-only edit does not move the source SHA.

This approval is exact-head scoped. Any subsequent source movement requires re-review.