Declare the rung drop for the witness floor leaving the required gate (#11742)

dag/gunbc/rung_drop/roster.dag

@@ -41,6 +41,7 @@ import gunbc.rung_drop.required_gate_bankruptcy { required_gate_bankruptcy }
 import gunbc.rung_drop.text_boundary_identity_wall { text_boundary_identity_wall }
 import gunbc.rung_drop.fabric_evidence_gating { fabric_evidence_gating }
 import gunbc.rung_drop.rust_unit_tests_off_the_merge_path { rust_unit_tests_off_the_merge_path }
+import gunbc.rung_drop.witness_floor_off_the_required_gate { witness_floor_off_the_required_gate }
 import gunbc.rung_drop.emit_copy_qualification_without_a_consumer { emit_copy_qualification_without_a_consumer }
 import gunbc.rung_drop.floor_cost_high_cpu_withheld { floor_cost_high_cpu_withheld }
 import gunbc.rung_drop.spark_role_scoped_retirement_production_root { spark_role_scoped_retirement_production_root }
@@ -106,6 +107,7 @@ data rung_drop_roster: List<RungDrop> = [
   text_boundary_identity_wall,
   fabric_evidence_gating,
   rust_unit_tests_off_the_merge_path,
+  witness_floor_off_the_required_gate,
   emit_copy_qualification_without_a_consumer,
   floor_cost_high_cpu_withheld,
   spark_role_scoped_retirement_production_root,

dag/gunbc/rung_drop/witness_floor_off_the_required_gate.dag

@@ -0,0 +1,45 @@
+module gunbc.rung_drop.witness_floor_off_the_required_gate
+
+import std.types { NonEmptyStr }
+import gunbc.rung_drop { RungDrop, Standing, TypedDeclaration, DeletedWithoutReplacement }
+import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable }
+
+// WHY THIS ROW EXISTS SEPARATELY FROM THE CHANGE THAT CAUSED IT. gunbc#11742 replaced the emitted
+// witnesses.yml with gunbc.compiler_gate_workflow, whose header carries the operator ruling, the
+// measurement and a dissolve-on condition -- and it is a good header. What it is not is a row on
+// the roster DESIGN section 4b(3) names as the authority for a lowered rung, so the drop was
+// invisible to gunbc.rung_drop and to docs/design-rung-drops.md while the capability was gone.
+//
+// THE TRIGGER WAS SELF-ERASING, WHICH IS THE LOAD-BEARING REASON AND NOT A FILING PREFERENCE. The
+// header's dissolve-on condition ends by deleting the module that carries it, so on the day the
+// gate is restored the only written record of what was lost would be removed by the act of
+// restoring it. A drop is retired BY ITS TRIGGER AND BY NOTHING ELSE, so a trigger that disappears
+// when satisfied cannot be checked afterwards by anyone asking what the gate used to hold.
+//
+// THIS ROW DOES NOT DISPUTE THE DECISION. The fleet was stalled: about 100 self-hosted
+// runner-minutes per push across build, floor and heal on a ~45-runner fleet, with queues reaching
+// 49 minutes and the merge queue stalled behind them. Cutting the gate to a compiler build is the
+// operator's call and this row records its cost rather than arguing it.
+data witness_floor_off_the_required_gate: RungDrop = RungDrop {
+  identity: "witness_floor_off_the_required_gate" as NonEmptyStr,
+
+  subject: "The witness floor as a required merge gate",
+
+  declared: "2026-09-20",
+
+  standing: Standing,
+
+  declaration: TypedDeclaration {
+    previous: MechanicallyPreventable,
+    temporary: Mitigatable,
+    reason: DeletedWithoutReplacement,
+    population: [
+      "the whole enrolled witness population (4185 claims executed on the last measured run 35462055101) rather than a named subset of it",
+      "the namespace-wave-admission phase -- the refusal that catches a consumed transition-admission row",
+      "the generated-artifact phase -- the refusal that catches a committed projection diverging from its authority",
+      "the regen fixed-point phase",
+      "the parse sweep over every authored root",
+    ],
+    restoration_trigger: "THE CAPABILITY: the required gate again plans and executes the enrolled witness population on the revision that lands, at a cost the fleet can carry. gunbc.compiler_gate_workflow's header names the construction expected to get there -- the fold's preparation cost cut, by reusing resolved-module and reach-probe results across runs or by scoping preparation to a diff's closure -- and the MEASUREMENT that makes this the right target is that the claims were never the cost: on run 35462055101 the 4185 claims executed in 53 seconds while strict-preparation of 3197 modules took 14.3 minutes, reach probes 11 minutes, and parse, admission and bookkeeping the rest. WHAT DOES NOT RETIRE THIS ROW, stated because each is the likely mistake: re-emitting witnesses.yml from gunbc.witness_floor_workflow without the preparation repair, which restores the cost that caused the cut; a faster floor that still does not run on the merge path; and deleting gunbc.compiler_gate_workflow, which removes the stopgap rather than restoring the gate. The row retires on an OBSERVED required run that planned and executed the population on a landing revision, not on an emission",
+  },
+}

docs/design-rung-drops.md

@@ -132,6 +132,10 @@ CORRECTION NOTICE, recorded because the wrong version travelled: an earlier revi
 
 **THE RUST UNIT TESTS LEAVE CI ENTIRELY; THE ALL-TARGETS LINT DOES NOT (2026-09-04).** gunbc#10078 promoted `rust-unit-tests` into `required_lanes_roster`, making `cargo test --release -p v1-compiler --lib` and `cargo clippy --all-targets -- -D warnings` merge-blocking. The 2026-09-04 operator ruling on runner capacity deletes the JOB. The two commands are separated rather than dropped together, and that separation is the whole of this row. PREVIOUS RUNG: mechanically preventable — a regression in any of the 774 `#[test]`s under src/v1/stage0 was exposed by an enrolled test and blocked the merge through the aggregate's `$UNIT` verdict fold. TEMPORARY RUNG: mitigatable, and only barely — the tests still exist, still refuse loudly, and `cargo test --release -p v1-compiler --lib` still runs them, but NO CI STEP EXECUTES THEM, so they run when a human chooses to and not otherwise. This is the exact state gunbc#9663 was created to end, and #9886's two failing tests landing on main with every required check green is the measured harm of it; that harm is re-admitted knowingly here, not rediscovered. WHAT IS NOT DROPPED, and a reader must not infer it from the job's absence: `repo_self_clippy_command` moved to `required-witnesses-build` as `rust_clippy_all_targets_step`, keeping its step id, its verdict and its position on a REQUIRED lane. That command is the only one on any CI path that compiles the integration-test and example targets — twelve of them sat red on main (2026-08-30) behind a green required run — so dropping it would have been a below-baseline floor regression under DESIGN §4b rather than a declared drop, and the ruling did not ask for it. REASON, and it is runner supply rather than doubt about the tests: the witnesses workflow carried seven jobs against a fleet that could not serve seven, each paying its own checkout, toolchain install and release build of one tree. The required context's wall is the MAX over its lanes, so contention among jobs that could have been steps was displacing the lanes that gate. The unit tests were cut rather than folded into an existing lane because the ruling asked for the Rust test population to leave CI, not to be relocated; folding them would have preserved the cost this row exists to remove. BOUNDED POPULATION: every `#[test]` in the v1-compiler crate reached by `--lib`, and every witness whose enrollment routed through that command — including `emit_import_lines_follow_resolved_binding_identity`, whose own drop row `emitted_bytes_witness_required_lane` was RETIRED on the strength of this lane being required and is un-retired in the same motion. No other lane, phase or claim changes rung; the build and floor lanes keep every edge they had. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns while this row stands, and `test.claim.required_lane_claim_agreement_witness_test` `w_the_live_roster_is_read_and_carries_both_lanes` asserts its absence from the roster at identity grain. RESTORATION TRIGGER, named at capability grain and not as an artifact: RUNNER SUPPLY SUFFICIENT to execute the v1-compiler `--lib` test population on the real acceptance path within the required context's wall budget, concurrently with the build and floor lanes and without displacing either — concretely, a fleet that admits a third required lane at the observed unit-test wall without raising the max over lanes. THIS IS NOT RETIRED BY SOMEONE RE-ADDING THE JOB, which the roster comment in `gunbc.witness_floor_workflow` now requires operator sign-off for; a job re-added into the same shortage reproduces the contention that caused the cut. Nor is it retired by running the tests somewhere unmeasured, or on a cadence — a cadence is a different drop and would need its own row. ENROLMENT 2026-09-08 (gunbc#10822): this change adds `v1_compiler.cli_run.rostered_row_join` `file_roster_join_tests` to that `--lib` population. The restoration trigger is unchanged and covers them: they are `--lib` tests, so runner supply sufficient to execute that population restores them with the rest.
 
+### The witness floor as a required merge gate — declared 2026-09-20
+
+The witness floor as a required merge gate: RUNG DROP, mechanically preventable -> mitigatable (deleted without replacement). Population: the whole enrolled witness population (4185 claims executed on the last measured run 35462055101) rather than a named subset of it, the namespace-wave-admission phase -- the refusal that catches a consumed transition-admission row, the generated-artifact phase -- the refusal that catches a committed projection diverging from its authority, the regen fixed-point phase, the parse sweep over every authored root. Restored when: THE CAPABILITY: the required gate again plans and executes the enrolled witness population on the revision that lands, at a cost the fleet can carry. gunbc.compiler_gate_workflow's header names the construction expected to get there -- the fold's preparation cost cut, by reusing resolved-module and reach-probe results across runs or by scoping preparation to a diff's closure -- and the MEASUREMENT that makes this the right target is that the claims were never the cost: on run 35462055101 the 4185 claims executed in 53 seconds while strict-preparation of 3197 modules took 14.3 minutes, reach probes 11 minutes, and parse, admission and bookkeeping the rest. WHAT DOES NOT RETIRE THIS ROW, stated because each is the likely mistake: re-emitting witnesses.yml from gunbc.witness_floor_workflow without the preparation repair, which restores the cost that caused the cut; a faster floor that still does not run on the merge path; and deleting gunbc.compiler_gate_workflow, which removes the stopgap rather than restoring the gate. The row retires on an OBSERVED required run that planned and executed the population on a landing revision, not on an emission.
+
 ### The EMIT-COST-QUAL-0 wet battery's only sanctioned executing consumer — declared 2026-09-04
 
 **THE EMIT-COST-QUAL-0 BATTERY LOSES ITS ONLY SANCTIONED CONSUMER (2026-09-04).** `emit-copy-qualification-battery` shipped with `if_condition: "false"` under the ROOT-N division ruling of 2026-08-31, holding one activation token for the #9769 chain. The 2026-09-04 runner-capacity ruling spent that token on DELETION rather than activation: the job is removed from `gunbc.witness_floor_workflow` instead of having its `"false"` lifted. PREVIOUS RUNG: none was held — the job never executed, so the honest previous state is the declared standing that it WOULD execute on activation, with its `claim_batch --functions` line named as `gunbc.emit_copy_qualification_wet_battery`'s only sanctioned consumer. TEMPORARY RUNG: outside the modeled guarantee, which is deliberately not a rung — the battery's wet shards and its five instrument-falsifier mutants are now specification without execution in the sense DESIGN §5 names, and no row in `test.claim.emit_copy_qualification_witness_test` establishes anything about a running system. REASON: the job cost a roster slot and a permanently-skipped entry in the emitted workflow while establishing nothing, and under a runner shortage the cheapest honest disposition of a lane that has never run is to delete it rather than to keep holding a slot for it. Note what this did NOT save, because the opposite would be an inflated claim: the job was skipped, so it consumed no runner time and the deletion buys no capacity. What it buys is a roster that means what it says. BOUNDED POPULATION: `gunbc.emit_copy_qualification_wet_battery` — the six wet carrier shards and six calibration rows named in the deleted argv — plus the three workflow-subject rows removed from its witness file. `gunbc.emit_copy_qualification`, `gunbc.emit_copy_qualification_fixture_gen` and `tools.emit_copy_qualification_transport` keep whatever consumers they had; this row does not speak for them. COUNTABLE: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_the_deleted_lanes_do_not_return` reds if the job returns. RESTORATION TRIGGER, at capability grain: the battery's assertions EXECUTING on the real acceptance path as floor-enrolled `*_test.dag` witnesses — which is the same conversion the deleted job's own dissolution row demanded and never got, now with nothing else holding the module up. The blocker it named is real and unchanged: `v2.workflow.floor_changed_witness` refuses a changed witness identity with no terminal floor verdict, and these wet transactions route-gap hermetically (`IsExecutable`, `NoMockResponse`), so the trigger is the capability to give a hermetically route-gapped wet transaction a terminal floor verdict. RE-ADDING A JOB DOES NOT SATISFY IT and now requires operator sign-off besides; a battery that can only be executed by a lane nobody will fund is the state this row records, not the repair.