gunbai-bot · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026
diff --git a/dag/extdeps/realization/eval_memo.dag b/dag/extdeps/realization/eval_memo.dag
diff --git a/dag/gunbc/ci/ci_materialization.dag b/dag/gunbc/ci/ci_materialization.dag
@@ -505,7 +505,7 @@ data ci_sccache_provider_shell_injection_dissolution_trigger: Disposition = Scaf
   }
 }
 
-data ci_floor_materialization_receipt_note: String = "Increment 1 of INFERRED materialization (operator ruling 2026-07-10: code is forcefully framed under materialization — running IS enrolling; and: plural pure demand means a provider or a hard error, no wall-clock term in any verdict, exemptions only as declared human-signed rows). The interpreter ledgers every keyed pure call (fn identity x argument content identity); every InterpContext absorbs its ledger totals into a process-wide accumulator on Drop — BY CONSTRUCTION, so no eval path (threaded, memoized, or future) can escape the receipt by forgetting a harvest call. claim_executor writes target/floor-materialization-receipt.txt at walk end. WHAT GATES NOW: the receipt must exist and parse, and keyed_calls must be nonzero (a floor that evaluated nothing is a lie — an explicit GUNBC_RECOMPUTE_TRACE=0 zeroes the receipt and reds this gate, so disabling is loud, never an escape hatch). PIN RETRACTION (2026-07-10 — the resolve gate's declare-measure-refuse-retract loop applied to this gate's own promise): the first counted CI receipt landed (run 29123412337: keyed=2313593 unkeyed=2516564 duplicated=50766) and the promised exact count pins were REFUSED twice over. By measurement: keyed/distinct/duplicated sum PER-CTX numbers and witness-to-ctx grouping is a thread-pool accident — back-to-back identical full floors differed by a few counts (duplicated 50713 vs 50711 locally; CI +54 vs local) — an exact pin would flap on schedule, and a flapping wall is a fail-open generator. By architecture: the affected-set enrollment flip (ci_spec_discovery_flip_note, merged 2026-07-10) makes this job's evaluated witness set diff-dependent BY DESIGN, so ANY count pin at this job's grain reds on nearly every PR for the wrong reason. What survives is what is diff-independent: unkeyed_calls is corpus-deterministic (measured identical five times across schedules, machines, debug/release, truncated and full floors — 2516564) but diff-scoped under the flip, so its terminal form is the RELATION unkeyed == 0, not a count. Count-shaped pins at full-corpus grain belong to a full-corpus surface, and AS OF 2026-08-15 NO SUCH SURFACE EXISTS: this sentence named the nightly affected-set falsifier as the place they would go, falsifier.yml was deleted at 611fd02770 (#8283), and the repository carries three workflows none of which runs the corpus cold. The deferral was therefore made to a consumer that no longer exists, which is a different standing from a deferral still waiting on its owner -- it is censused as PremiseInvalidated in gunbc.deleted_cadence_reference_census with its restoration trigger, rather than left reading as a plan; duplicated accounting pins only when the frame grain is structural (deterministic witness-to-ctx assignment, or content-keyed cross-ctx identity — the outer-frame store direction). Until a wall lands, this gate is a DISCLOSURE gate: receipt existence, parseability of every field, keyed nonzero. unkeyed_calls is known NONZERO on the floor (measured 2026-07-10: the corpus is fold-heavy and every fold-family call carries a predicate closure, and a closure argument has no computed identity — the ONE disclosed unkeyed class, per the interpreter ledger's own disclosure); the wall's dissolve-on is captured-env content identity for closure arguments, at which point unkeyed == 0 lands as the identity-computability wall (underspecified identity = error, operator ruling) — a relation, diff-independent under affected-set enrollment. duplicated_keys burns down via the eval-frame provider (single_site class, discharged wholesale) and the multi_site rewire worklist, then flips to hard error per frame-class at zero. PROVIDER LANDED (2026-07-10, extdeps.realization.eval_memo): the eval-frame memo serves repeated pure demands from the first evaluation — verified-hit serve (argument names AND values must equal; collision recomputes, never lies), demands still counted on hits so this receipt keeps observing plurality, hits/misses/overflow disclosed in the receipt. Measured on the artifact-regen workload: single-site duplicated keys 7285 -> 505 (93.1 percent), wasted_ms 586 -> 57, regenerated artifacts byte-identical memo-on vs memo-off. wasted_ms lines are observational timing and MUST never gate. Consciously NO new witness entry file: this gate is a derived ci.yml step, so ci_floor_declared_resolve_count stays untouched by this increment."
+data ci_floor_materialization_receipt_note: String = "Increment 1 of INFERRED materialization (operator ruling 2026-07-10: code is forcefully framed under materialization — running IS enrolling; and: plural pure demand means a provider or a hard error, no wall-clock term in any verdict, exemptions only as declared human-signed rows). The interpreter ledgers every keyed pure call (fn identity x argument content identity); every InterpContext absorbs its ledger totals into a process-wide accumulator on Drop — BY CONSTRUCTION, so no eval path (threaded, memoized, or future) can escape the receipt by forgetting a harvest call. claim_executor writes target/floor-materialization-receipt.txt at walk end. WHAT GATES NOW: the receipt must exist and parse, and keyed_calls must be nonzero (a floor that evaluated nothing is a lie — an explicit GUNBC_RECOMPUTE_TRACE=0 zeroes the receipt and reds this gate, so disabling is loud, never an escape hatch). PIN RETRACTION (2026-07-10 — the resolve gate's declare-measure-refuse-retract loop applied to this gate's own promise): the first counted CI receipt landed (run 29123412337: keyed=2313593 unkeyed=2516564 duplicated=50766) and the promised exact count pins were REFUSED twice over. By measurement: keyed/distinct/duplicated sum PER-CTX numbers and witness-to-ctx grouping is a thread-pool accident — back-to-back identical full floors differed by a few counts (duplicated 50713 vs 50711 locally; CI +54 vs local) — an exact pin would flap on schedule, and a flapping wall is a fail-open generator. By architecture: the affected-set enrollment flip (ci_spec_discovery_flip_note, merged 2026-07-10) makes this job's evaluated witness set diff-dependent BY DESIGN, so ANY count pin at this job's grain reds on nearly every PR for the wrong reason. What survives is what is diff-independent: unkeyed_calls is corpus-deterministic (measured identical five times across schedules, machines, debug/release, truncated and full floors — 2516564) but diff-scoped under the flip, so its terminal form is the RELATION unkeyed == 0, not a count. Count-shaped pins at full-corpus grain belong to a full-corpus surface, and AS OF 2026-08-15 NO SUCH SURFACE EXISTS: this sentence named the nightly affected-set falsifier as the place they would go, falsifier.yml was deleted at 611fd02770 (#8283), and the repository carries three workflows none of which runs the corpus cold. The deferral was therefore made to a consumer that no longer exists, which is a different standing from a deferral still waiting on its owner -- it is censused as PremiseInvalidated in gunbc.deleted_cadence_reference_census with its restoration trigger, rather than left reading as a plan; duplicated accounting pins only when the frame grain is structural (deterministic witness-to-ctx assignment, or content-keyed cross-ctx identity — the outer-frame store direction). Until a wall lands, this gate is a DISCLOSURE gate: receipt existence, parseability of every field, keyed nonzero. unkeyed_calls is known NONZERO on the floor (measured 2026-07-10: the corpus is fold-heavy and every fold-family call carries a predicate closure, and a closure argument has no computed identity — the ONE disclosed unkeyed class, per the interpreter ledger's own disclosure); the wall's dissolve-on is captured-env content identity for closure arguments, at which point unkeyed == 0 lands as the identity-computability wall (underspecified identity = error, operator ruling) — a relation, diff-independent under affected-set enrollment. duplicated_keys burns down via the eval-frame provider (single_site class, discharged wholesale) and the multi_site rewire worklist, then flips to hard error per frame-class at zero. PROVIDER LANDED (2026-07-10, extdeps.realization.eval_memo): the eval-frame memo serves repeated pure demands from the first evaluation — verified-hit serve (argument names AND values must equal; collision recomputes, never lies), demands still counted on hits so this receipt keeps observing plurality, hits/misses/overflow disclosed in the receipt. Measured on the artifact-regen workload: single-site duplicated keys 7285 -> 505 (93.1 percent), wasted_ms 586 -> 57, regenerated artifacts byte-identical memo-on vs memo-off. wasted_ms lines are observational timing and MUST never gate. Consciously NO new witness entry file: this gate is a derived ci.yml step, so ci_floor_declared_resolve_count stays untouched by this increment. PROVIDER RETIRED (2026-09-19, gunbc.recurring_failure_mode.memo_key_rehashes_a_growing_persistent_value second instance): the eval-frame memo derived an identity for every pure call before any admission was asked, and std.materialization_ladder never discharges a demand into a provider scoped to one shared-state frame (rule 5: single undeclared demand recomputes; rule 1: a within-frame repeat is Share, never Memoize), so its admitted population was empty and the per-call key was pure cost -- quadratic on a fold threading a document through recursion. The memo, GUNBC_EVAL_MEMO and the memo_hits/memo_misses/memo_overflow receipt fields are deleted; the ledger still counts every demand under GUNBC_RECOMPUTE_TRACE=1 and now also discloses argument_identities_derived, its own keying work. The duplicated_keys burn-down named above proceeds by the multi_site rewire worklist and by declared providers (the roster-admitted cross-claim tier), which is what the ladder prescribed for it all along. ALSO RECORDED HONESTLY: no consumer of take_process_eval_recompute_totals exists in the tree today, so the receipt file this note names is not written by any current surface; that gap predates this change and is a separate finding."
 
 data ci_floor_materialization_receipt_path: String = "target/floor-materialization-receipt.txt"
 

diff --git a/dag/gunbc/instruments/cause_assertion_census.dag b/dag/gunbc/instruments/cause_assertion_census.dag
@@ -629,8 +629,11 @@ fn cause_complete_report(acquisition: CauseCorpusAcquisition, declarations: List
 }
 
 // On-demand only. Whole-corpus acquisition must not enter ordinary witness discovery.
-// GUNBC_EVAL_MEMO=0 gunbc run --source-root dag --source-root src/v2 \
+// gunbc run --source-root dag --source-root src/v2 \
 //   --entry dag/gunbc/instruments/cause_assertion_census.dag --function census --arg report=/tmp/causes.tsv
+// (The GUNBC_EVAL_MEMO=0 prefix this invocation once carried selected the seed's recompute
+// realization over its eval-frame result memo; that memo is retired -- an undeclared single
+// demand derives no identity -- so recompute is the only realization and the prefix is gone.)
 fn census(report: String) -> ProcessExit {
   let roots = ["dag", "src/v2"]
   match floor_discovery_source_inventory_live(pool_roots: roots) {
@@ -642,7 +645,7 @@ fn census(report: String) -> ProcessExit {
         let acquisition = cause_corpus_acquire(subjects: subjects, modules: module_declaration_facts_live(pool_roots: roots))
         let complete = count(acquisition.refusals) == 0
         let content = if complete {
-          join([join(["rederive with selected realization: GUNBC_EVAL_MEMO=0 gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/cause_assertion_census.dag --function census --arg report=", report], ""),
+          join([join(["rederive with: gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/cause_assertion_census.dag --function census --arg report=", report], ""),
             cause_complete_report(acquisition: acquisition, declarations: data_decl_type_facts(pool_roots: roots))], "\n")
         } else {
           join(["ACQUISITION_REFUSED: no negative coverage conclusions are available",
-Original file line number
+Diff line change
@@ Expand Up @@
       }
     }
-    data ci_floor_materialization_receipt_note: String = "Increment 1 of INFERRED materialization (operator ruling 2026-07-10: code is forcefully framed under materialization — running IS enrolling; and: plural pure demand means a provider or a hard error, no wall-clock term in any verdict, exemptions only as declared human-signed rows). The interpreter ledgers every keyed pure call (fn identity x argument content identity); every InterpContext absorbs its ledger totals into a process-wide accumulator on Drop — BY CONSTRUCTION, so no eval path (threaded, memoized, or future) can escape the receipt by forgetting a harvest call. claim_executor writes target/floor-materialization-receipt.txt at walk end. WHAT GATES NOW: the receipt must exist and parse, and keyed_calls must be nonzero (a floor that evaluated nothing is a lie — an explicit GUNBC_RECOMPUTE_TRACE=0 zeroes the receipt and reds this gate, so disabling is loud, never an escape hatch). PIN RETRACTION (2026-07-10 — the resolve gate's declare-measure-refuse-retract loop applied to this gate's own promise): the first counted CI receipt landed (run 29123412337: keyed=2313593 unkeyed=2516564 duplicated=50766) and the promised exact count pins were REFUSED twice over. By measurement: keyed/distinct/duplicated sum PER-CTX numbers and witness-to-ctx grouping is a thread-pool accident — back-to-back identical full floors differed by a few counts (duplicated 50713 vs 50711 locally; CI +54 vs local) — an exact pin would flap on schedule, and a flapping wall is a fail-open generator. By architecture: the affected-set enrollment flip (ci_spec_discovery_flip_note, merged 2026-07-10) makes this job's evaluated witness set diff-dependent BY DESIGN, so ANY count pin at this job's grain reds on nearly every PR for the wrong reason. What survives is what is diff-independent: unkeyed_calls is corpus-deterministic (measured identical five times across schedules, machines, debug/release, truncated and full floors — 2516564) but diff-scoped under the flip, so its terminal form is the RELATION unkeyed == 0, not a count. Count-shaped pins at full-corpus grain belong to a full-corpus surface, and AS OF 2026-08-15 NO SUCH SURFACE EXISTS: this sentence named the nightly affected-set falsifier as the place they would go, falsifier.yml was deleted at 611fd02770 (#8283), and the repository carries three workflows none of which runs the corpus cold. The deferral was therefore made to a consumer that no longer exists, which is a different standing from a deferral still waiting on its owner -- it is censused as PremiseInvalidated in gunbc.deleted_cadence_reference_census with its restoration trigger, rather than left reading as a plan; duplicated accounting pins only when the frame grain is structural (deterministic witness-to-ctx assignment, or content-keyed cross-ctx identity — the outer-frame store direction). Until a wall lands, this gate is a DISCLOSURE gate: receipt existence, parseability of every field, keyed nonzero. unkeyed_calls is known NONZERO on the floor (measured 2026-07-10: the corpus is fold-heavy and every fold-family call carries a predicate closure, and a closure argument has no computed identity — the ONE disclosed unkeyed class, per the interpreter ledger's own disclosure); the wall's dissolve-on is captured-env content identity for closure arguments, at which point unkeyed == 0 lands as the identity-computability wall (underspecified identity = error, operator ruling) — a relation, diff-independent under affected-set enrollment. duplicated_keys burns down via the eval-frame provider (single_site class, discharged wholesale) and the multi_site rewire worklist, then flips to hard error per frame-class at zero. PROVIDER LANDED (2026-07-10, extdeps.realization.eval_memo): the eval-frame memo serves repeated pure demands from the first evaluation — verified-hit serve (argument names AND values must equal; collision recomputes, never lies), demands still counted on hits so this receipt keeps observing plurality, hits/misses/overflow disclosed in the receipt. Measured on the artifact-regen workload: single-site duplicated keys 7285 -> 505 (93.1 percent), wasted_ms 586 -> 57, regenerated artifacts byte-identical memo-on vs memo-off. wasted_ms lines are observational timing and MUST never gate. Consciously NO new witness entry file: this gate is a derived ci.yml step, so ci_floor_declared_resolve_count stays untouched by this increment."
+    data ci_floor_materialization_receipt_note: String = "Increment 1 of INFERRED materialization (operator ruling 2026-07-10: code is forcefully framed under materialization — running IS enrolling; and: plural pure demand means a provider or a hard error, no wall-clock term in any verdict, exemptions only as declared human-signed rows). The interpreter ledgers every keyed pure call (fn identity x argument content identity); every InterpContext absorbs its ledger totals into a process-wide accumulator on Drop — BY CONSTRUCTION, so no eval path (threaded, memoized, or future) can escape the receipt by forgetting a harvest call. claim_executor writes target/floor-materialization-receipt.txt at walk end. WHAT GATES NOW: the receipt must exist and parse, and keyed_calls must be nonzero (a floor that evaluated nothing is a lie — an explicit GUNBC_RECOMPUTE_TRACE=0 zeroes the receipt and reds this gate, so disabling is loud, never an escape hatch). PIN RETRACTION (2026-07-10 — the resolve gate's declare-measure-refuse-retract loop applied to this gate's own promise): the first counted CI receipt landed (run 29123412337: keyed=2313593 unkeyed=2516564 duplicated=50766) and the promised exact count pins were REFUSED twice over. By measurement: keyed/distinct/duplicated sum PER-CTX numbers and witness-to-ctx grouping is a thread-pool accident — back-to-back identical full floors differed by a few counts (duplicated 50713 vs 50711 locally; CI +54 vs local) — an exact pin would flap on schedule, and a flapping wall is a fail-open generator. By architecture: the affected-set enrollment flip (ci_spec_discovery_flip_note, merged 2026-07-10) makes this job's evaluated witness set diff-dependent BY DESIGN, so ANY count pin at this job's grain reds on nearly every PR for the wrong reason. What survives is what is diff-independent: unkeyed_calls is corpus-deterministic (measured identical five times across schedules, machines, debug/release, truncated and full floors — 2516564) but diff-scoped under the flip, so its terminal form is the RELATION unkeyed == 0, not a count. Count-shaped pins at full-corpus grain belong to a full-corpus surface, and AS OF 2026-08-15 NO SUCH SURFACE EXISTS: this sentence named the nightly affected-set falsifier as the place they would go, falsifier.yml was deleted at 611fd02770 (#8283), and the repository carries three workflows none of which runs the corpus cold. The deferral was therefore made to a consumer that no longer exists, which is a different standing from a deferral still waiting on its owner -- it is censused as PremiseInvalidated in gunbc.deleted_cadence_reference_census with its restoration trigger, rather than left reading as a plan; duplicated accounting pins only when the frame grain is structural (deterministic witness-to-ctx assignment, or content-keyed cross-ctx identity — the outer-frame store direction). Until a wall lands, this gate is a DISCLOSURE gate: receipt existence, parseability of every field, keyed nonzero. unkeyed_calls is known NONZERO on the floor (measured 2026-07-10: the corpus is fold-heavy and every fold-family call carries a predicate closure, and a closure argument has no computed identity — the ONE disclosed unkeyed class, per the interpreter ledger's own disclosure); the wall's dissolve-on is captured-env content identity for closure arguments, at which point unkeyed == 0 lands as the identity-computability wall (underspecified identity = error, operator ruling) — a relation, diff-independent under affected-set enrollment. duplicated_keys burns down via the eval-frame provider (single_site class, discharged wholesale) and the multi_site rewire worklist, then flips to hard error per frame-class at zero. PROVIDER LANDED (2026-07-10, extdeps.realization.eval_memo): the eval-frame memo serves repeated pure demands from the first evaluation — verified-hit serve (argument names AND values must equal; collision recomputes, never lies), demands still counted on hits so this receipt keeps observing plurality, hits/misses/overflow disclosed in the receipt. Measured on the artifact-regen workload: single-site duplicated keys 7285 -> 505 (93.1 percent), wasted_ms 586 -> 57, regenerated artifacts byte-identical memo-on vs memo-off. wasted_ms lines are observational timing and MUST never gate. Consciously NO new witness entry file: this gate is a derived ci.yml step, so ci_floor_declared_resolve_count stays untouched by this increment. PROVIDER RETIRED (2026-09-19, gunbc.recurring_failure_mode.memo_key_rehashes_a_growing_persistent_value second instance): the eval-frame memo derived an identity for every pure call before any admission was asked, and std.materialization_ladder never discharges a demand into a provider scoped to one shared-state frame (rule 5: single undeclared demand recomputes; rule 1: a within-frame repeat is Share, never Memoize), so its admitted population was empty and the per-call key was pure cost -- quadratic on a fold threading a document through recursion. The memo, GUNBC_EVAL_MEMO and the memo_hits/memo_misses/memo_overflow receipt fields are deleted; the ledger still counts every demand under GUNBC_RECOMPUTE_TRACE=1 and now also discloses argument_identities_derived, its own keying work. The duplicated_keys burn-down named above proceeds by the multi_site rewire worklist and by declared providers (the roster-admitted cross-claim tier), which is what the ladder prescribed for it all along. ALSO RECORDED HONESTLY: no consumer of take_process_eval_recompute_totals exists in the tree today, so the receipt file this note names is not written by any current surface; that gap predates this change and is a separate finding."
     data ci_floor_materialization_receipt_path: String = "target/floor-materialization-receipt.txt"
@@ Expand Down @@