From 3a01dc1680c75b87c79c8f7b741108de626af6df Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 20 Sep 2026 14:46:52 +0000 Subject: [PATCH 1/5] Roadmap: seven rows for the fleet-health program and the eval-memo rewire program Wind-down of the fleet-health lane (operator, 2026-09-20: step back and prioritize v1 performance and the v2 migration). What is built, what is measured and what remains now live on the roadmap rather than in a session: - fleet-health-0-live-receipt: gunbc#11681 is built and green; one live run under the qualified recompute realization is what it needs to leave draft. - fleet-health-1-admitted-baselines / fleet-health-2-serving-admission: the two slices the ruling named, with their input seams already in product.host_health. - srv1-srv2-bmc-firmware-exposes-memory-errors: two of four hosts cannot report memory errors out of band on the 2.07 image (srv1 has 255 corrected errors in-band since August). - srv3-srv4-fan-threshold-flapping-floods-the-event-log: 982 of 1200 entries are one fan's deassert, so the log wraps within hours and memory records roll off with it. - dimm-temperature-limits-need-a-citation: srv1 DIMM C1 read 99 C with the BMC reporting OK. - eval-memo-admission-rewire-program: the held retirement gunbc#11741 and its staged rewires (gunbc#11784, gunbc#11835 green and awaiting merge; stage 3 next). Co-Authored-By: Claude Opus 5 (1M context) --- dag/gunbc/roadmap/roadmap_authority.dag | 105 ++++++++++++++++++++++++ 1 file changed, 105 insertions(+) diff --git a/dag/gunbc/roadmap/roadmap_authority.dag b/dag/gunbc/roadmap/roadmap_authority.dag index 77220464627..f4419ea7046 100644 --- a/dag/gunbc/roadmap/roadmap_authority.dag +++ b/dag/gunbc/roadmap/roadmap_authority.dag @@ -1758,6 +1758,111 @@ fn declared_roadmap_nodes() -> List { handback: "The predicate consumed by every repo-lane commit writer, the incident witness pair red then green, and the two writer bindings carried as countable work rows rather than prose." ) ), + ticket_row( + identity: "rn_Z3FS3HMD5WWH1Z7FGPK1KAWJBM", + id: "fleet-health-0-live-receipt", + done: false, + t: fields( + headline: "HEALTH-0 is built and green; it needs one live run under the qualified realization to leave draft", + boundary: "gunbc.fleet_health fleet_health_check is an out-of-band, read-only, goal-blind check over fleet_intent_known_hosts: firmware-derived telemetry surface, five sampled fan/temperature windows, an event-log window with wrap/clear continuity, assessment over std.goal_assessment, and a receipt whose first line discloses the evaluation realization. gunbc#11681 carries it with 29 passing witnesses, including a call-reachability wall that no mutation is reachable from the entry. What remains is one live run under GUNBC_EVAL_MEMO=0 whose receipt matches the current code, and attaching it to the PR.", + displaced_cost: "Three real conditions were found by the first live run and nothing else in the repository observes them: srv1 FAN4 rotating in 1 of 5 samples and FAN5 in 2 of 5, srv2 FAN5 in 2 of 5, srv3 logging 14 corrected memory errors and DIMM_HOT in a single half-hour window, srv4 DIMM_HOT on two channels. Until the check runs on a cadence those degrade unobserved.", + first_slice: "One live fleet_health_check run against srv1-srv4 with an operator access token, its receipt attached to gunbc#11681, and the PR flipped out of draft.", + red_control: "The enrolled fixture's bare-call mutations are found by the same reachability derivation that reports the health closure clean; a service-call mutation is asserted INVISIBLE so the claim fails when the instrument gains service-call identity.", + out_of_scope: "Admitted baselines (HEALTH-1) and serving admission (HEALTH-2) are their own rows. No in-band fallback for any signal the BMC does not expose.", + handback: "A merged gunbc#11681 with a live receipt in its body, and gunbc#11696 landed after it to delete the consumed namespace admission rows." + ) + ), + + ticket_row( + identity: "rn_TD7X82087026JR4X3XKSHAT7Z6", + id: "fleet-health-1-admitted-baselines", + done: false, + t: fields( + headline: "Health baselines: tell new errors from history without letting a divergent run rebaseline itself", + boundary: "product.host_health already takes HostHealthBaselineBasis as an input seam and answers NoPriorBaseline today. This selects the last ADMITTED or explicitly dispositioned receipt, verifies subject, counter epoch and evidence manifest before subtracting, and makes diagnosis or operator disposition the only route to a replacement baseline.", + displaced_cost: "Without it every host with any history stays indeterminate forever: srv3 and srv4 carry 1200-entry event logs that can never be dispositioned, so the check can report change but never quiet. The automatic-rebaseline trap is the specific harm: run A sees a new corrected error, run B takes A as its baseline, and the unresolved error disappears after one cycle.", + first_slice: "Durable receipt selection plus the refusal that a divergent observation may not mint a baseline, with the four counter-window cases already witnessed re-expressed against a stored receipt.", + red_control: "A divergent run cannot produce an admissible baseline; a baseline for another host, another counter epoch or another endpoint set refuses; history that was never dispositioned stays an unknown rather than becoming zero.", + out_of_scope: "Serving admission consumption. Any new cache or store beyond the receipt the check already writes.", + handback: "A health run that reports new-since-last-admitted for memory counters and event records, with the rebaseline refusal witnessed." + ) + ), + + ticket_row( + identity: "rn_YWBBMCMY5FHC2Q5VCX9AA8MA46", + id: "fleet-health-2-serving-admission", + done: false, + t: fields( + headline: "A host serves only on a fresh satisfied health receipt", + boundary: "Serving admission consumes the health inspection and the convergence standing as a product: same host identity, expected fleet and policy revisions, satisfied assessment, freshness, window continuity, and where required a health window opened after a named apply receipt. Unknown health denies new placement without pretending an emergency shutdown was authorized.", + displaced_cost: "Health that nothing consumes is a report nobody is obliged to read. Today a host with a dead fan or new uncorrected errors is as admissible for work as a clean one.", + first_slice: "New-host admission requires a fresh satisfied receipt; previously serving hosts with divergence become drain candidates.", + red_control: "A stale receipt, a receipt for another host, and an indeterminate assessment each deny admission; a satisfied fresh receipt admits.", + out_of_scope: "Automatic workload kill, reboot or repair from the health route.", + handback: "Admission consuming health, with the deny arms witnessed." + ) + ), + + ticket_row( + identity: "rn_FH7X3QWQJ14MVMN9ES41C4HNZ6", + id: "srv1-srv2-bmc-firmware-exposes-memory-errors", + done: false, + t: fields( + headline: "srv1 and srv2 cannot report memory errors out of band on firmware 2.07", + boundary: "Both hosts run the ASRock 2.07 image: no MemoryMetrics resource and an empty Redfish event log, so the out-of-band check is structurally unable to see memory errors there. srv3 and srv4 on OpenBMC 3.22 do report them as MemoryECCCorrectable records. The work is the flash and its qualification, not a health-side workaround.", + displaced_cost: "srv1 has recorded 255 corrected memory errors in-band since its August boot with all of them unattributed to a DIMM; out of band the health check must report that host unknown on memory indefinitely. Two of four hosts are unobservable on the signal most likely to precede a failure.", + first_slice: "Qualify the 3.22 image on one of the two hosts through the existing BMC firmware route, then confirm the health check reports memory events for it.", + red_control: "After the flash, a health run reports the host's memory signal as observed rather than not-exposed-out-of-band.", + out_of_scope: "Any in-band EDAC read as a substitute. The standing rule is out-of-band only.", + handback: "Both hosts on an image whose event log carries memory records, with a health receipt showing the signal observed." + ) + ), + + ticket_row( + identity: "rn_W1PKZZXFM2CS3TKAXDG59PD29S", + id: "srv3-srv4-fan-threshold-flapping-floods-the-event-log", + done: false, + t: fields( + headline: "Fan threshold flapping overwrites the BMC event log within hours", + boundary: "srv3 and srv4 log a FAN threshold assert/deassert pair repeatedly: 982 of srv3's 1200 entries on 2026-09-18 were one fan's deassert, and the log wraps at about 1200, so entries roll off in hours. Either the fan curve or the thresholds are wrong for these chassis. gunbc.bmc_fan_converge already owns fan policy.", + displaced_cost: "Event-log continuity is the health check's only out-of-band route to memory errors, and it survives only over windows shorter than the wrap. Every memory record older than a few hours is already lost on those two hosts.", + first_slice: "Establish whether the flapping fan is below its own threshold because the threshold is wrong or because the fan is failing, then converge whichever is wrong.", + red_control: "After the change, an event log read twice a day apart still contains its earlier newest entry.", + out_of_scope: "Raising the health check's sampling rate as a substitute for fixing the flapping.", + handback: "A log whose wrap horizon exceeds the health cadence, and a fan policy that stops asserting." + ) + ), + + ticket_row( + identity: "rn_H1TH1ZJTFQNC5G2Q7YHJ7RMZZF", + id: "dimm-temperature-limits-need-a-citation", + done: false, + t: fields( + headline: "No temperature limit is cited, so every sensor reads unestablished", + boundary: "product.host_health carries TemperatureLimit with its authority as a field and refuses to invent one; the fleet goal declares all twenty board sensors with TemperatureLimitUnestablished. The work is citing limits for the DIMM parts and the board sensors that have them, per component grade, so the check can judge a reading rather than only carry the BMC's verdict.", + displaced_cost: "srv1 DIMM C1 was read at 99 C with the BMC reporting OK, because the BMC carries only a 105 C critical line and no caution threshold. srv3 and srv4 assert DIMM_HOT. Nothing in the corpus can say whether those readings are acceptable.", + first_slice: "Cite the JEDEC or vendor limit for the installed DDR4 parts and bind it to the DIMM sensors, leaving the rest unestablished rather than guessed.", + red_control: "A sensor above its cited limit diverges; a sensor whose limit is uncited still cannot produce a green.", + out_of_scope: "Fleet-wide default limits. An uncited number is refused by construction.", + handback: "Cited limits on the sensors that have them, with the citation on the row." + ) + ), + + ticket_row( + identity: "rn_NBX7Z3E7CSV0JBT611DGGXG1AD", + id: "eval-memo-admission-rewire-program", + done: false, + t: fields( + headline: "The seed keys every pure call before admission; the rewires that make retirement landable", + boundary: "gunbc#11741 holds the retirement (memo, GUNBC_EVAL_MEMO and its provider row deleted) because retiring it turns the required floor red: 2767 of 4161 claims do more work without it, 76 cross their step ceiling and 23 flip to budget-interrupted. The ruling is root-first, option A: repair the shared producers, then qualify the combined cutover. Stage 1 gunbc#11784 (integer decode reads carried tables) and stage 2 gunbc#11835 (grammar backward selection resolves each tree once) are green and awaiting merge; stage 3 is the rust.dag nullary node constants and bind_outcome chains.", + displaced_cost: "Measured: JSON parsing is O(n squared) because every pure call re-hashes its whole string argument, so a 1.08 MB event log costs about 441 s of CPU instead of 27 s, and the same shape taxes every text-processing route under the interpreter. Stage 2 alone removed 1.54B evaluation steps across 110 claims and made seven timed-out claims complete.", + first_slice: "Land stages 1 and 2, then stage 3, each with per-claim before/after under both realizations and no claim crossing its ceiling on the memo-on path the floor runs today.", + red_control: "A direct-recompute demand reaches neither key construction nor memo storage, with a control that fails when unconditional keying is restored; every stage keeps the floor population and terminal results unchanged.", + out_of_scope: "A pointer-hash string cache, a function-name allowlist, a roster memo dressed as declared recurrence, and any global memo-default flip without consumer-wide qualification -- all refused by ruling.", + handback: "The rewires landed and retirement re-qualified on the repaired corpus as one combined cutover." + ) + ), + active( identity: "rn_7VNBH0KXR5ZQWD2PLGT3MJ86CY", id: "generated-projection-registry-containment", From 1b2898ba65912c47ea162458ae66732c62a171f2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 20 Sep 2026 14:49:57 +0000 Subject: [PATCH 2/5] Roadmap: carry the memo lane's preserved stage-3 branch and its four do-not-re-derive facts Co-Authored-By: Claude Opus 5 (1M context) --- dag/gunbc/roadmap/roadmap_authority.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/roadmap/roadmap_authority.dag b/dag/gunbc/roadmap/roadmap_authority.dag index f4419ea7046..bb943a42ae5 100644 --- a/dag/gunbc/roadmap/roadmap_authority.dag +++ b/dag/gunbc/roadmap/roadmap_authority.dag @@ -1859,7 +1859,7 @@ fn declared_roadmap_nodes() -> List { first_slice: "Land stages 1 and 2, then stage 3, each with per-claim before/after under both realizations and no claim crossing its ceiling on the memo-on path the floor runs today.", red_control: "A direct-recompute demand reaches neither key construction nor memo storage, with a control that fails when unconditional keying is restored; every stage keeps the floor population and terminal results unchanged.", out_of_scope: "A pointer-hash string cache, a function-name allowlist, a roster memo dressed as declared recurrence, and any global memo-default flip without consumer-wide qualification -- all refused by ruling.", - handback: "The rewires landed and retirement re-qualified on the repaired corpus as one combined cutover." + handback: "The rewires landed and retirement re-qualified on the repaired corpus as one combined cutover. Stage 3 (rust.dag's 64 nullary Node constants as data) is drafted, resolves and passes, preserved at origin/session/merry-fox-260-stage3 c1c925060c with its nine-module comparison unfinished. FOUR FACTS A SUCCESSOR MUST NOT RE-DERIVE, each of which cost this lane real time: producer ranking comes from the floor's own required_floor_cross_claim_demand.tsv (evals minus claims), never from claim_batch, which installs no cross-claim roster and charges warm-served producers -- the lane's first ranking was wrong for exactly this reason; the 'diagnostics_merge 5,512x on one key' figure was memo-hit verification cost, not real work; a bottom-up grammar resolution matching all productions per node costs +64% on the memo-on path where the asked-lhs top-down form costs +12%; and claim_batch shares one ctx per entry, so a data row's first-touch cost lands on whichever claim runs first, which makes per-claim comparisons there unsound." ) ), From e1d3561931efa96fbe84f00525c852932e7ee663 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 20 Sep 2026 15:43:42 +0000 Subject: [PATCH 3/5] Regenerate ROADMAP.md: the seven new rows move the hidden-lane count to 137 (review 69197) ROADMAP.md is a registered generated artifact whose focus notice interpolates the live hidden active count, so adding seven ticket_row nodes (owner "", hence outside the focused owner list) leaves the committed projection stale at 130 -- a projection disagreeing with its authority, and a drift-gate red. Regenerated with gunbc.instruments.generated_artifact_gate main_wet_one on this exact head; the diff is the one derived line. Co-Authored-By: Claude Opus 5 (1M context) --- ROADMAP.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ROADMAP.md b/ROADMAP.md index c9085ec0b53..3e0344307e0 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -10,7 +10,7 @@ Parked context (non-dispatchable): [compiler algorithm survey](docs/plans/compil The graph has sixteen lanes: SCM compatibility · namespace · P-derive · observation · placement · compute · CI cost · CI control · generated artefacts · v1 exit (four finish lines: compiler fixed point, interpreter deleted, products v1-free, zero hand-maintained Rust) · shell · roadmap runtime · fleet/hygiene · judgment · hermetic toolchain · compiler-guarantee (the DESIGN §4b ladder climbs; rung STATE lives in the guarantee claims carrier and is emitted, never restated in tickets — [gap analysis](docs/plans/compiler-guarantee-recovery-gap-analysis.md)). The three independent SCM R0 models, the separate P−1 evidence carrier, R1 compatibility-shape extraction, and P0 user-contract/landing spine are accepted; the operator-authored P1 proof-kernel node is active and fail-closed pending its first discriminating closing validation, while P2 and later product lanes remain parked. The toolchain pin model is an independent root. The P-derive receipt feeds the emitter fixed point, so the v1 chain nests under it. Compute owns the one contract everything else asks for work through — an exact subject in, a typed ending and the outputs it promised back out — and it sits ABOVE CI rather than inside it, because owning CI, converging the fleet, serving models and eventually judging changes are four consumers of one fabric, not four execution systems. It grounds on the signed realization spine rather than minting a second scheduler beside it. CI control owns who starts, queues and hands out required work and how its result reaches GitHub; CI cost owns how much computation that work performs. Fleet owns whether a merge to main becomes applied machine state and whether that question has one answer. Node fields define boundary, first slice, RED control, exclusions, owner, and handback. -**Focused view — the compute fabric + the infrastructure stabilisation lanes + fleet convergence from main + the harness, roadmap workflow and dashboard lanes.** 130 active deliverable(s) in other lanes are declared in the authority and hidden here; nothing is deleted or parked by focusing. Clear `roadmap_focus_selection` in `dag/gunbc/roadmap/roadmap_authority.dag` to restore the full page. 11 of the rows below are NOT lane deliverables — they are prerequisites pulled in from other lanes because lane work is blocked on them: commit-writer-admission, shell-gate-migration, shell-effectplan-to-bash, shell-typed-invocation, placement-compile-pool-envelope, placement-live-roster-preflight, observation-scoped-run-consumer, observation-scoped-run-seed-growth-justification, observation-scoped-run-seed-growth-justification-closing-contract, fleet-spark-host-enrollment, confidence-semantic-impact-query. Hidden lanes remain readable through their carriers: [docs/plans/dag-scm-design.md](docs/plans/dag-scm-design.md) · [docs/plans/native-scm-cas-fit-and-consumer-cut.md](docs/plans/native-scm-cas-fit-and-consumer-cut.md) · [docs/plans/namespace-unique-on-chain-operational-plan.md](docs/plans/namespace-unique-on-chain-operational-plan.md) · [docs/plans/v2-self-hosting.md](docs/plans/v2-self-hosting.md) · [src/v2/compiler/05_emit.dag](src/v2/compiler/05_emit.dag) · [docs/plans/progress-observation-design.md](docs/plans/progress-observation-design.md) · [src/v2/compiler/self_host/candidate_generation.dag](src/v2/compiler/self_host/candidate_generation.dag) · [src/v2/compiler/self_host/stage0_production_target.dag](src/v2/compiler/self_host/stage0_production_target.dag) · [src/v2/compiler/self_host/wet_receipt_enrollment.dag](src/v2/compiler/self_host/wet_receipt_enrollment.dag) · [src/v2/workflow/rust_crate_partition.dag](src/v2/workflow/rust_crate_partition.dag) · [src/v2/compiler/self_host/v2_emitter_direct_rust_door_contract.dag](src/v2/compiler/self_host/v2_emitter_direct_rust_door_contract.dag) · [dag/gunbc/v1/v1_deletion_plan.dag](dag/gunbc/v1/v1_deletion_plan.dag) · [dag/gunbc/stage0/stage0_rust_host_observation.dag](dag/gunbc/stage0/stage0_rust_host_observation.dag) · [docs/plans/witness-realization-plan.md](docs/plans/witness-realization-plan.md) · [src/v1/05_emit_rust.dag](src/v1/05_emit_rust.dag) · [dag/gunbc/v1/v1_interpreter_primitive_surface.dag](dag/gunbc/v1/v1_interpreter_primitive_surface.dag) · [docs/plans/shell-to-dag-residual-census-and-arc-completion.md](docs/plans/shell-to-dag-residual-census-and-arc-completion.md) · [docs/plans/roadmap-workspace-ux-plan.md](docs/plans/roadmap-workspace-ux-plan.md) · [docs/plans/hermetic-tool-provisioning-design.md](docs/plans/hermetic-tool-provisioning-design.md) · [dag/gunbc/capability_binding.dag](dag/gunbc/capability_binding.dag) · [dag/gunbc/roadmap/roadmap_component.dag](dag/gunbc/roadmap/roadmap_component.dag) · [dag/gunbc/design_document.dag](dag/gunbc/design_document.dag) · [docs/plans/compiler-guarantee-recovery-gap-analysis.md](docs/plans/compiler-guarantee-recovery-gap-analysis.md) · [docs/plans/cardinality-refinement.md](docs/plans/cardinality-refinement.md) · [dag/gunbc/roadmap/roadmap_authority.dag](dag/gunbc/roadmap/roadmap_authority.dag) · [dag/test/claim/closing/2_scm_native_write_spine_acceptance_closing_contract_witness_test.dag](dag/test/claim/closing/2_scm_native_write_spine_acceptance_closing_contract_witness_test.dag) · [dag/test/claim/closing/2_scm_native_authority_program_closing_contract_witness_test.dag](dag/test/claim/closing/2_scm_native_authority_program_closing_contract_witness_test.dag) · [dag/test/claim/closing/namespace_cross_file_provenance_closing_contract_witness_test.dag](dag/test/claim/closing/namespace_cross_file_provenance_closing_contract_witness_test.dag) · [dag/test/claim/closing/v1_materialization_kernel_closing_contract_witness_test.dag](dag/test/claim/closing/v1_materialization_kernel_closing_contract_witness_test.dag) · [dag/test/claim/closing/gate_refusal_reason_survives_wrapper_closing_contract_witness_test.dag](dag/test/claim/closing/gate_refusal_reason_survives_wrapper_closing_contract_witness_test.dag) · [dag/test/claim/closing/toolchain_pin_model_closing_contract_witness_test.dag](dag/test/claim/closing/toolchain_pin_model_closing_contract_witness_test.dag) · [dag/test/claim/closing/instrument_motion_physical_qualification_closing_contract_witness_test.dag](dag/test/claim/closing/instrument_motion_physical_qualification_closing_contract_witness_test.dag) · [dag/test/claim/closing/instrument_rendered_control_coverage_closing_contract_witness_test.dag](dag/test/claim/closing/instrument_rendered_control_coverage_closing_contract_witness_test.dag) · [dag/test/claim/closing/discarded_bool_result_wall_closing_contract_witness_test.dag](dag/test/claim/closing/discarded_bool_result_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/ladder_probe_corpus_closing_contract_witness_test.dag](dag/test/claim/closing/ladder_probe_corpus_closing_contract_witness_test.dag) · [dag/test/claim/closing/method_established_surface_wall_closing_contract_witness_test.dag](dag/test/claim/closing/method_established_surface_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/call_label_and_surplus_wall_closing_contract_witness_test.dag](dag/test/claim/closing/call_label_and_surplus_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/declared_conformance_ground_fragment_closing_contract_witness_test.dag](dag/test/claim/closing/declared_conformance_ground_fragment_closing_contract_witness_test.dag) · [dag/test/claim/closing/v2_self_grounding_frontier_closing_contract_witness_test.dag](dag/test/claim/closing/v2_self_grounding_frontier_closing_contract_witness_test.dag) · [dag/test/claim/closing/interpreter_primitive_roster_closing_contract_witness_test.dag](dag/test/claim/closing/interpreter_primitive_roster_closing_contract_witness_test.dag) · [dag/test/claim/closing/unforgeable_construction_capability_closing_contract_witness_test.dag](dag/test/claim/closing/unforgeable_construction_capability_closing_contract_witness_test.dag). +**Focused view — the compute fabric + the infrastructure stabilisation lanes + fleet convergence from main + the harness, roadmap workflow and dashboard lanes.** 137 active deliverable(s) in other lanes are declared in the authority and hidden here; nothing is deleted or parked by focusing. Clear `roadmap_focus_selection` in `dag/gunbc/roadmap/roadmap_authority.dag` to restore the full page. 11 of the rows below are NOT lane deliverables — they are prerequisites pulled in from other lanes because lane work is blocked on them: commit-writer-admission, shell-gate-migration, shell-effectplan-to-bash, shell-typed-invocation, placement-compile-pool-envelope, placement-live-roster-preflight, observation-scoped-run-consumer, observation-scoped-run-seed-growth-justification, observation-scoped-run-seed-growth-justification-closing-contract, fleet-spark-host-enrollment, confidence-semantic-impact-query. Hidden lanes remain readable through their carriers: [docs/plans/dag-scm-design.md](docs/plans/dag-scm-design.md) · [docs/plans/native-scm-cas-fit-and-consumer-cut.md](docs/plans/native-scm-cas-fit-and-consumer-cut.md) · [docs/plans/namespace-unique-on-chain-operational-plan.md](docs/plans/namespace-unique-on-chain-operational-plan.md) · [docs/plans/v2-self-hosting.md](docs/plans/v2-self-hosting.md) · [src/v2/compiler/05_emit.dag](src/v2/compiler/05_emit.dag) · [docs/plans/progress-observation-design.md](docs/plans/progress-observation-design.md) · [src/v2/compiler/self_host/candidate_generation.dag](src/v2/compiler/self_host/candidate_generation.dag) · [src/v2/compiler/self_host/stage0_production_target.dag](src/v2/compiler/self_host/stage0_production_target.dag) · [src/v2/compiler/self_host/wet_receipt_enrollment.dag](src/v2/compiler/self_host/wet_receipt_enrollment.dag) · [src/v2/workflow/rust_crate_partition.dag](src/v2/workflow/rust_crate_partition.dag) · [src/v2/compiler/self_host/v2_emitter_direct_rust_door_contract.dag](src/v2/compiler/self_host/v2_emitter_direct_rust_door_contract.dag) · [dag/gunbc/v1/v1_deletion_plan.dag](dag/gunbc/v1/v1_deletion_plan.dag) · [dag/gunbc/stage0/stage0_rust_host_observation.dag](dag/gunbc/stage0/stage0_rust_host_observation.dag) · [docs/plans/witness-realization-plan.md](docs/plans/witness-realization-plan.md) · [src/v1/05_emit_rust.dag](src/v1/05_emit_rust.dag) · [dag/gunbc/v1/v1_interpreter_primitive_surface.dag](dag/gunbc/v1/v1_interpreter_primitive_surface.dag) · [docs/plans/shell-to-dag-residual-census-and-arc-completion.md](docs/plans/shell-to-dag-residual-census-and-arc-completion.md) · [docs/plans/roadmap-workspace-ux-plan.md](docs/plans/roadmap-workspace-ux-plan.md) · [docs/plans/hermetic-tool-provisioning-design.md](docs/plans/hermetic-tool-provisioning-design.md) · [dag/gunbc/capability_binding.dag](dag/gunbc/capability_binding.dag) · [dag/gunbc/roadmap/roadmap_component.dag](dag/gunbc/roadmap/roadmap_component.dag) · [dag/gunbc/design_document.dag](dag/gunbc/design_document.dag) · [docs/plans/compiler-guarantee-recovery-gap-analysis.md](docs/plans/compiler-guarantee-recovery-gap-analysis.md) · [docs/plans/cardinality-refinement.md](docs/plans/cardinality-refinement.md) · [dag/gunbc/roadmap/roadmap_authority.dag](dag/gunbc/roadmap/roadmap_authority.dag) · [dag/test/claim/closing/2_scm_native_write_spine_acceptance_closing_contract_witness_test.dag](dag/test/claim/closing/2_scm_native_write_spine_acceptance_closing_contract_witness_test.dag) · [dag/test/claim/closing/2_scm_native_authority_program_closing_contract_witness_test.dag](dag/test/claim/closing/2_scm_native_authority_program_closing_contract_witness_test.dag) · [dag/test/claim/closing/namespace_cross_file_provenance_closing_contract_witness_test.dag](dag/test/claim/closing/namespace_cross_file_provenance_closing_contract_witness_test.dag) · [dag/test/claim/closing/v1_materialization_kernel_closing_contract_witness_test.dag](dag/test/claim/closing/v1_materialization_kernel_closing_contract_witness_test.dag) · [dag/test/claim/closing/gate_refusal_reason_survives_wrapper_closing_contract_witness_test.dag](dag/test/claim/closing/gate_refusal_reason_survives_wrapper_closing_contract_witness_test.dag) · [dag/test/claim/closing/toolchain_pin_model_closing_contract_witness_test.dag](dag/test/claim/closing/toolchain_pin_model_closing_contract_witness_test.dag) · [dag/test/claim/closing/instrument_motion_physical_qualification_closing_contract_witness_test.dag](dag/test/claim/closing/instrument_motion_physical_qualification_closing_contract_witness_test.dag) · [dag/test/claim/closing/instrument_rendered_control_coverage_closing_contract_witness_test.dag](dag/test/claim/closing/instrument_rendered_control_coverage_closing_contract_witness_test.dag) · [dag/test/claim/closing/discarded_bool_result_wall_closing_contract_witness_test.dag](dag/test/claim/closing/discarded_bool_result_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/ladder_probe_corpus_closing_contract_witness_test.dag](dag/test/claim/closing/ladder_probe_corpus_closing_contract_witness_test.dag) · [dag/test/claim/closing/method_established_surface_wall_closing_contract_witness_test.dag](dag/test/claim/closing/method_established_surface_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/call_label_and_surplus_wall_closing_contract_witness_test.dag](dag/test/claim/closing/call_label_and_surplus_wall_closing_contract_witness_test.dag) · [dag/test/claim/closing/declared_conformance_ground_fragment_closing_contract_witness_test.dag](dag/test/claim/closing/declared_conformance_ground_fragment_closing_contract_witness_test.dag) · [dag/test/claim/closing/v2_self_grounding_frontier_closing_contract_witness_test.dag](dag/test/claim/closing/v2_self_grounding_frontier_closing_contract_witness_test.dag) · [dag/test/claim/closing/interpreter_primitive_roster_closing_contract_witness_test.dag](dag/test/claim/closing/interpreter_primitive_roster_closing_contract_witness_test.dag) · [dag/test/claim/closing/unforgeable_construction_capability_closing_contract_witness_test.dag](dag/test/claim/closing/unforgeable_construction_capability_closing_contract_witness_test.dag). - [x] **Run the worker on DeepSeek V4 Flash with thinking on, straight at the engines, from briefs it can finish** — The harness posts to the Spark vLLM engines directly on the chat-completions shape with Think Max as the request switch, decodes inline reasoning client-side, replays it, and derives its deadline from the engine's own decode rate. A write brief names files small enough to hold whole and the decisions already made. Why: A day of runs with 0 files changed: briefs naming one file when the change spans its importers, a co-tenanted router killing every long step, a deadline that could not cover max_tokens, and agents deliberating modeling decisions a brief should have made. [authority](dag/gunbc/harness/harness_cli.dag) — ✓ signed off: operator curation 2026-09-06 (session 019iXPtAqzPaNBZbaaM5rxrY) - [x] **The roadmap commits, verifies, and opens the pull request itself once verification passes** — After the provider completes, the belt commits the attempt worktree, verifies the committed head in a detached checkout, admits publication only on a ValidationPassed receipt for that exact head, and the token-holding helper pushes the branch and opens the pull request, then answers with what GitHub shows. Why: Verification was checking out an uncommitted worktree's head, publication never consulted the verdict, and no operation existed to push or create a pull request, so every attempt stalled in the Agent segment and a human harvested by hand. [authority](dag/gunbc/roadmap/roadmap_publish_admission.dag) — ✓ signed off: operator curation 2026-09-06 (session 019iXPtAqzPaNBZbaaM5rxrY) From 4a88b5d05e4e02d3cc0afbc8ae931543eba3eb87 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 20 Sep 2026 16:19:04 +0000 Subject: [PATCH 4/5] Roadmap: the eval-memo row's dated status moves to its updates thread (review 69242) handback is the completion contract, so it carries one sentence saying what 'done' is and nothing dated. boundary carries the standing argument, not a stage-by-stage status. The two things that were concatenated there move to where the file already puts dated matter -- the ticket's updates thread via updated(...), same nesting the namespace row at :1239 uses: one note for the wind-down status (stages 1 and 2 green and awaiting merge, the retirement held, stage 3 preserved unopened), and one for the four measurement facts the lane established, which are findings with a date rather than a contract. Co-Authored-By: Claude Opus 5 (1M context) --- dag/gunbc/roadmap/roadmap_authority.dag | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/roadmap/roadmap_authority.dag b/dag/gunbc/roadmap/roadmap_authority.dag index bb943a42ae5..d2c5ff67ce0 100644 --- a/dag/gunbc/roadmap/roadmap_authority.dag +++ b/dag/gunbc/roadmap/roadmap_authority.dag @@ -1852,14 +1852,22 @@ fn declared_roadmap_nodes() -> List { identity: "rn_NBX7Z3E7CSV0JBT611DGGXG1AD", id: "eval-memo-admission-rewire-program", done: false, - t: fields( + t: updated( + t: updated( + t: fields( headline: "The seed keys every pure call before admission; the rewires that make retirement landable", - boundary: "gunbc#11741 holds the retirement (memo, GUNBC_EVAL_MEMO and its provider row deleted) because retiring it turns the required floor red: 2767 of 4161 claims do more work without it, 76 cross their step ceiling and 23 flip to budget-interrupted. The ruling is root-first, option A: repair the shared producers, then qualify the combined cutover. Stage 1 gunbc#11784 (integer decode reads carried tables) and stage 2 gunbc#11835 (grammar backward selection resolves each tree once) are green and awaiting merge; stage 3 is the rust.dag nullary node constants and bind_outcome chains.", + boundary: "The seed's eval-frame result memo keys every pure call before any admission decision, so a single-demand call pays full key construction -- and a key over a string argument is O(size), which makes any recursive fold over a document quadratic. The repair is root-first (option A): the demand and materialization judgment is consulted BEFORE result-memo key construction, and the shared producers the memo was concealing are rewired to carry their established value rather than re-derive it. Retirement of the provider is qualified on the repaired corpus as one combined cutover, never landed while the required floor is red.", displaced_cost: "Measured: JSON parsing is O(n squared) because every pure call re-hashes its whole string argument, so a 1.08 MB event log costs about 441 s of CPU instead of 27 s, and the same shape taxes every text-processing route under the interpreter. Stage 2 alone removed 1.54B evaluation steps across 110 claims and made seven timed-out claims complete.", first_slice: "Land stages 1 and 2, then stage 3, each with per-claim before/after under both realizations and no claim crossing its ceiling on the memo-on path the floor runs today.", red_control: "A direct-recompute demand reaches neither key construction nor memo storage, with a control that fails when unconditional keying is restored; every stage keeps the floor population and terminal results unchanged.", out_of_scope: "A pointer-hash string cache, a function-name allowlist, a roster memo dressed as declared recurrence, and any global memo-default flip without consumer-wide qualification -- all refused by ruling.", - handback: "The rewires landed and retirement re-qualified on the repaired corpus as one combined cutover. Stage 3 (rust.dag's 64 nullary Node constants as data) is drafted, resolves and passes, preserved at origin/session/merry-fox-260-stage3 c1c925060c with its nine-module comparison unfinished. FOUR FACTS A SUCCESSOR MUST NOT RE-DERIVE, each of which cost this lane real time: producer ranking comes from the floor's own required_floor_cross_claim_demand.tsv (evals minus claims), never from claim_batch, which installs no cross-claim roster and charges warm-served producers -- the lane's first ranking was wrong for exactly this reason; the 'diagnostics_merge 5,512x on one key' figure was memo-hit verification cost, not real work; a bottom-up grammar resolution matching all productions per node costs +64% on the memo-on path where the asked-lhs top-down form costs +12%; and claim_batch shares one ctx per entry, so a data row's first-touch cost lands on whichever claim runs first, which makes per-claim comparisons there unsound." + handback: "The shared producers rewired, and retirement re-qualified on the repaired corpus as one combined cutover with the required floor green." + ), + on: "2026-09-20", + note: "Status at wind-down: stage 1 gunbc#11784 (integer decode reads carried tables) and stage 2 gunbc#11835 (grammar backward selection resolves each emitted tree once) are green, approved and awaiting merge; the retirement gunbc#11741 is a held draft carrying its own handback; stage 3 (rust.dag's 64 nullary Node constants as data) is drafted, resolves and passes, and is preserved unopened at origin/session/merry-fox-260-stage3 c1c925060c with its nine-module comparison unfinished. Stage 2 also discharged the docs-regeneration blocker: the real regen route completes on the memo-retired binary in 295 s with byte-identical projections.", + ), + on: "2026-09-20", + note: "Four measurement facts this lane established, each of which cost it real time and none of which a successor should re-derive: producer ranking must come from the required floor run's own required_floor_cross_claim_demand.tsv (evals minus claims), never from claim_batch, which installs no cross-claim roster and therefore charges producers the floor serves warm -- the lane's first ranking was wrong for exactly this reason; the 'diagnostics_merge 5,512x on one key' figure was memo-hit verification cost rather than work; a bottom-up grammar resolution matching all productions per node costs +64% on the memo-on path where the asked-lhs top-down form costs +12%; and claim_batch shares one ctx per entry, so a data row's first-touch cost lands on whichever claim happens to run first, which makes its per-claim comparisons unsound.", ) ), From cc53d75e38a9b8500e777bcd29e257aef23fcb74 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 20 Sep 2026 17:36:16 +0000 Subject: [PATCH 5/5] Roadmap: name the instrument for the eval-memo row's figures (review 69299) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DESIGN §6: a measurement is cited by naming the producer that re-derives it, never by copying its numbers into prose, because a transcribed number is unreachable from the thing that owns it and rots without anyone touching either end. The note did the opposite, and said so out loud -- "none of which a successor should re-derive" is exactly the state the rule forbids. It now records each reading with the instrument that re-derives it: the required floor run's cross-claim demand TSV for producer ranking, the interpreter's own memo key trace for separating memo-hit verification cost from work, and the bounded A/B harness gunbc#11835 carries for the two grammar-resolution shapes. The review named the note. The same rule governs two more fields on the same row, so they are fixed in the same push rather than left for a second round: displaced_cost transcribed a wall-clock pair, a byte size and a corpus-wide eval-step delta, and the status note transcribed a regen wall-clock. Each now names the run that re-derives it -- the paired GUNBC_EVAL_MEMO arm, the floor run's per-claim reporting, and the generated-artifact gate's regen entry. No figures are transcribed anywhere in the row. ROADMAP.md is unchanged: the row is hidden, so its fields do not reach the projection. Co-Authored-By: Claude Opus 5 (1M context) --- dag/gunbc/roadmap/roadmap_authority.dag | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dag/gunbc/roadmap/roadmap_authority.dag b/dag/gunbc/roadmap/roadmap_authority.dag index 7b1a9e61b98..3cf888bee58 100644 --- a/dag/gunbc/roadmap/roadmap_authority.dag +++ b/dag/gunbc/roadmap/roadmap_authority.dag @@ -1917,17 +1917,17 @@ fn declared_roadmap_nodes() -> List { t: fields( headline: "The seed keys every pure call before admission; the rewires that make retirement landable", boundary: "The seed's eval-frame result memo keys every pure call before any admission decision, so a single-demand call pays full key construction -- and a key over a string argument is O(size), which makes any recursive fold over a document quadratic. The repair is root-first (option A): the demand and materialization judgment is consulted BEFORE result-memo key construction, and the shared producers the memo was concealing are rewired to carry their established value rather than re-derive it. Retirement of the provider is qualified on the repaired corpus as one combined cutover, never landed while the required floor is red.", - displaced_cost: "Measured: JSON parsing is O(n squared) because every pure call re-hashes its whole string argument, so a 1.08 MB event log costs about 441 s of CPU instead of 27 s, and the same shape taxes every text-processing route under the interpreter. Stage 2 alone removed 1.54B evaluation steps across 110 claims and made seven timed-out claims complete.", + displaced_cost: "JSON parsing is O(n squared) because every pure call re-hashes its whole string argument, so the cost of parsing a document grows with the square of its size and the same shape taxes every text-processing route under the interpreter. The shape is re-derived by running any large-document parse under the seed with the result memo enabled and again with GUNBC_EVAL_MEMO=0, which is the paired arm that shows the quadratic is the memo key and not the parse; the corpus-wide effect of removing it is re-derived by the required floor run's own per-claim eval-step and completion reporting, which stage 2 gunbc#11835 moved.", first_slice: "Land stages 1 and 2, then stage 3, each with per-claim before/after under both realizations and no claim crossing its ceiling on the memo-on path the floor runs today.", red_control: "A direct-recompute demand reaches neither key construction nor memo storage, with a control that fails when unconditional keying is restored; every stage keeps the floor population and terminal results unchanged.", out_of_scope: "A pointer-hash string cache, a function-name allowlist, a roster memo dressed as declared recurrence, and any global memo-default flip without consumer-wide qualification -- all refused by ruling.", handback: "The shared producers rewired, and retirement re-qualified on the repaired corpus as one combined cutover with the required floor green." ), on: "2026-09-20", - note: "Status at wind-down: stage 1 gunbc#11784 (integer decode reads carried tables) and stage 2 gunbc#11835 (grammar backward selection resolves each emitted tree once) are green, approved and awaiting merge; the retirement gunbc#11741 is a held draft carrying its own handback; stage 3 (rust.dag's 64 nullary Node constants as data) is drafted, resolves and passes, and is preserved unopened at origin/session/merry-fox-260-stage3 c1c925060c with its nine-module comparison unfinished. Stage 2 also discharged the docs-regeneration blocker: the real regen route completes on the memo-retired binary in 295 s with byte-identical projections.", + note: "Status at wind-down: stage 1 gunbc#11784 (integer decode reads carried tables) and stage 2 gunbc#11835 (grammar backward selection resolves each emitted tree once) are green, approved and awaiting merge; the retirement gunbc#11741 is a held draft carrying its own handback; stage 3 (rust.dag's 64 nullary Node constants as data) is drafted, resolves and passes, and is preserved unopened at origin/session/merry-fox-260-stage3 c1c925060c with its nine-module comparison unfinished. Stage 2 also discharged the docs-regeneration blocker: the real regen route was run end to end on the memo-retired binary and completed with byte-identical projections, which is the check to repeat (the generated-artifact gate's own regen entry point) before the retirement is qualified.", ), on: "2026-09-20", - note: "Four measurement facts this lane established, each of which cost it real time and none of which a successor should re-derive: producer ranking must come from the required floor run's own required_floor_cross_claim_demand.tsv (evals minus claims), never from claim_batch, which installs no cross-claim roster and therefore charges producers the floor serves warm -- the lane's first ranking was wrong for exactly this reason; the 'diagnostics_merge 5,512x on one key' figure was memo-hit verification cost rather than work; a bottom-up grammar resolution matching all productions per node costs +64% on the memo-on path where the asked-lhs top-down form costs +12%; and claim_batch shares one ctx per entry, so a data row's first-touch cost lands on whichever claim happens to run first, which makes its per-claim comparisons unsound.", + note: "Four readings this lane took, each recorded with the producer that re-derives it rather than with its number, so a successor re-runs the instrument instead of trusting a figure that has rotted. Producer ranking must come from the required floor run's own required_floor_cross_claim_demand.tsv (evals minus claims), never from claim_batch, which installs no cross-claim roster and therefore charges producers the floor serves warm -- the lane's first ranking was wrong for exactly this reason. The diagnostics_merge repeat count that first looked like hot work is memo-hit verification cost instead, and what separates the two is the interpreter's own memo key trace (its keyed-call, distinct-key and duplicated-key counters), which is the instrument to re-run before treating any repeat count as work. The comparison between a bottom-up grammar resolution that matches all productions per node and the asked-lhs top-down form is re-derived by the bounded A/B harness gunbc#11835 carries, which measures both shapes on the memo-on path; the top-down form won. And claim_batch shares one ctx per entry, so a data row's first-touch cost lands on whichever claim runs first, which makes its per-claim comparisons unsound as a cost instrument regardless of what they report.", ) ),