A focused gunbc test stops paying for whole-repository discovery, and four controls hold the boundary

[briansrls]

What this changes

native_lane_source_facts ran discover_floor_rows_for_source — a full content walk — for every read in the corpus. Its three consumers do not want the corpus:

1. native_lane_label_universe reads f.discovery.rows inside its own universe-member guard (Absent => acc for module-less facts, and a !native_route_universe_member skip otherwise), so non-members never reach it.
2. native_lane_unowned_row_path reads the row count only in its f.module Absent arm.
3. floor_discovery_finalize_source_outcomes folds every state and refuses corpus-wide.

Only (3) wants the corpus, and (3) is repository hygiene, not this lane's question. Whether some unrelated module places a sidecar correctly is not part of "are the requested tests complete".

Measured on the pinned seven-test run: universe_derivation is 23.35 s of a 121.4 s wall, over corpus_reads 6482 while closure_reads was 133 — the phase that does not narrow with the pattern. Universe members are 935 of 6484 files, so one file in seven was consulted and all seven were walked.

What this does NOT establish. The 23.35 s is the measured cost of the broader universe_derivation phase, not a demonstrated saving from this patch. Nothing here re-runs the native lane, so no speedup is claimed or shown. What this PR establishes is the changed behaviour and the preserved refusal boundaries; the integrated native run is what would establish an actual saving, and it has not been done.

These witnesses are not the seven parser tests. Passing them qualifies this boundary change. It says nothing about whether v2.test.parse.expression_bodied_fn_decl_parse executes natively — those remain blocked on the code-generator nested-pattern fix and on field-read-off-a-call-result. A reduction in discovery cost is valid even while those still refuse, and passing tests would not by itself prove the redundant fold is gone.

One landing route. #11986 is closed; this branch carries its de-duplication commit as its base, so there is one head to qualify rather than two copies of the same change.

The import scans stay corpus-wide deliberately: a malformed import line anywhere the closure walk reaches would silently narrow the closure, which is the arm native_lane_import_refusal exists to refuse. Selected-test completeness is kept; repository hygiene is handed back.

Why this is a de-duplication and not a rung drop

required_floor_runner reaches the same floor_discovery_finalize_source_outcomes through parse_floor_discovery_producer_result, and turns its refusal into REQUIRED-FLOOR REFUSAL cause=FloorDiscoveryRefused. The corpus-wide refusal still exists and still blocks a landing. What is removed is a second authority asserting it from a consumer whose subject is a selected test population (DESIGN §2, §3).

That claim is verified in the diff, not asserted: one of the four controls calls that exact function.

Three notes that asserted the replaced behaviour

The finalize note said the states are handed over "untouched" and named filtering-first as the thing that would make the lane blind outside v2.test.* — which is now the behaviour. The selection_outside_read note said it "must DISCOVER cleanly". And the_out_of_selection_source_is_discovered_not_refused claimed a walk that no longer happens while staying green; it is renamed to ..._is_accepted_not_refused, which is what it asserts.

The controls

The existing row-count pair observes what discovery spends. It would stay green if the finalize were disarmed outright, because a disarmed finalize enrols the same rows. The four new arms are in refusals, driving native_lane_universe end to end:

arm	holds
member violation still refuses	finalize still armed for walked sources
non-member violation no longer refuses	the narrowing, stated not implied
floor producer still refuses that same content	the preservation, discharged by execution
module-less violation still refuses	scoping must not reach a source with no membership

Three fixtures differing in one property — the module header — each carrying test fn at a non-_test.dag path, a real TestMarkedDecl violation through the real producer rather than a hand-built walk state. The third arm reads its content off the fixture rather than restating it, so the two cannot drift into agreeing about different sources.

Evidence

All six arms return true. Mutating native_lane_discovery_for to walk every source turns a_non_member_sidecar_violation_no_longer_refuses_the_lane red (returned 'false'), so the narrowing arm discriminates rather than decorating. The mutation is reverted.

Not reached by any .dag arm, and said so in the source: whether the rendered main passes the facts it already bound rather than re-deriving them is a property of emitted Rust, and its evidence is a native build.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T01:27:58.178877Z	32cae8f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[briansrls]

Reviewed exact head 32cae8f. The scoping change is sound in shape, and the four new refusal controls substantially address the prior coverage objection. I did not execute the witnesses or build a native artifact. Final sign-off remains pending the two bounded corrections below and qualification of the rebased head.

1. Isolate the membership input in the boundary fixtures. They do not differ only in module header: member_violation_read uses src/v2/test/violation_probe.dag, non_member_violation_read uses src/v2/testing/violation_probe.dag, and the module-less case changes its path again; artifact identities also change. compilation_unit is an input to discovery. A wrong path-prefix implementation of membership can satisfy these specimens while claiming namespace-based scoping. For the separate single-source ingests, hold compilation_unit, artifact/path, and source_root fixed and vary only the header, or add an explicit path/namespace disagreement control. Retain the same-content floor comparison. This is a fixture correction, not a request for another discovery implementation.

2. Finish the comment reconciliation around native_lane_universe_selected / native_lane_universe_of_facts. The newly added carried-facts paragraph still says discovery is corpus-wide by design and its refusals must hold outside any selection, directly contradicting native_lane_discovery_for. The preceding paragraph says the rendered main calls native_lane_universe, and the following text speaks of the argv operand landing in the future; the emitter diff already calls native_lane_universe_of_facts(source_facts.clone(), pattern.clone()). State the actual split: source/header/import scans still inspect the supplied inventory; discovery walks universe members and module-less sources; explicit pattern filtering comes later. The full native-universe boundary is not the requested-target boundary.

Preservation read: required_floor_runner.rs independently iterates full_inventory, calls discover_floor_rows_for_source, finalizes those outcomes, and maps the decoded refusal to REQUIRED-FLOOR REFUSAL cause=FloorDiscoveryRefused. That supports preservation of the separate floor consumer in source. The new floor witness executes the producer/finalizer, not the host runner or CI exit path; do not present it as a newly executed merge-blocking red.

Native qualification: building the artifact alone proves it compiles, not that the redundant computation was eliminated. Inspect the emitted main's actual carried-facts call path and retain execution/count or cost evidence where needed. No new general instrumentation is requested. The 23.35 seconds is the old phase cost, not a measured saving.

Integration: this PR also contains the carried-facts change still proposed by #11986; choose one landing route (stack on that PR or explicitly absorb it), rather than independently rebasing two copies. GitHub currently reports this head conflicting and no check runs are recorded for it. No merge performed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32cae8fcce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correct the scoped-discovery contract

For any source declaring a module outside v2.test.*, the newly added native_lane_discovery_for returns floor_discovery_walk_state_zero(), so native_lane_source_facts no longer runs discovery per read and discovery refusals explicitly do not hold outside the selection. This new comment states the exact opposite, as does the emitted phase description in src/v1/05_emit_rust.dag, which will mislead future work about both the refusal boundary and the measured cost; update these descriptions to distinguish corpus-wide header/import scans from universe-scoped discovery.

Useful? React with 👍 / 👎.

[briansrls]

Rebased onto current main and both corrections are in. New head carries a fourth commit with the review responses.

1. Fixture isolation — took the structural option

The three specimens are now built by one constructor taking only the content, so only the module header can vary. They share one path, one artifact identity, one source root.

The shared path does double duty as the discriminator you asked for, rather than needing a separate control: all three sit at src/v2/test/violation_probe.dag, so the non-member declares module v2.testing.violation_probe from a member-looking path. A path-keyed implementation classifies it as a member and walks it.

That is now falsified, not asserted. Two mutations of native_lane_discovery_for, each run against a_non_member_sidecar_violation_no_longer_refuses_the_lane:

mutation	result
scoping removed — walk every source	returned 'false'
membership read from the PATH prefix	returned 'false'

The second is the one the repair exists for. Under the previous fixtures that implementation stayed green.

2. The carried-facts note

The corpus-wide-question sentence is gone, along with the stale rendered-main and argv-operand asides. It now carries the pipeline and states the boundary you named:

The native-universe boundary is not the seven-test boundary. Discovery is scoped to v2.test.* membership, not to the requested pattern, so a run naming one package still walks every other native test module before the pattern narrows the population — and acquisition and the import scans remain broader still.

3. Evidence level, corrected in the source and not only here

• 23.35 s is labelled the old phase cost, not a saving demonstrated by this change.
• A successful native build proves compilation, not that a second fold is gone. Closing that needs the produced main and its call path read, with the runtime claim from the existing [native-cost-partition] observations.
• The floor-preservation arm runs the producer and finalizer themselves. That required_floor_runner calls that same finalize is source inspection, not a newly executed merge-blocking control. I had written "discharged by execution", which overstated it. The preserved caller is read; the preserved computation is run.

4. One landing route

Rebased, absorbing the de-duplication — this is the single head. #11986 is now redundant and I'll close it as absorbed.

Worth flagging: the rebase collided with #12006, which had added two arms and the symbol_lexeme import to this same witness. My first resolution silently dropped a closing brace from the_suggested_module_spelling_selects_the_module and the file stopped parsing — caught because the arms returned nothing instead of true. Both of #12006's arms are now diffed byte-identical against main's copy.

All seven arms return true on this head.

[briansrls]

SOURCE SIGN-OFF at exact head 11866c0. The substantive implementation/fixture objections from my review of 32cae8f are closed. This is source-review sign-off, not a claim of completed CI, native execution, or measured speedup. No merge performed.

Verified in the rebased diff/source:

• violation_read_for(content) fixes the compilation-unit path, artifact identity, and source root. The non-member's v2.testing namespace now conflicts with its member-looking src/v2/test/ path, so the fixture distinguishes namespace membership from the wrong path-prefix policy. The author reports both walk-everything and path-membership mutations producing false; I have not independently executed those mutations.
• Member and module-less refusal controls, outsider acceptance, and the same-input independent floor producer/finalizer control remain. The source now distinguishes execution of that producer/finalizer from source inspection of the host runner.
• The carried-facts entry preserves the explicit pattern, and the rendered-main template uses native_lane_universe_of_facts(source_facts.clone(), pattern.clone()). Actual emitted-artifact inspection and native cost qualification remain with integration.
• Compared the two #12006 test bodies against base 3ab9d31: the misspelled-module refusal/control and the suggested-module selection/control remain intact, including the formerly lost closing brace. The production named-module refusal also remains in the facts-taking path.
• The source distinguishes broad inventory/header/import acquisition from universe-scoped discovery and later requested-target selection; 23.35 seconds is explicitly the old phase cost. #11986 is closed and its deduplication is carried here, so there is one active landing route.

Non-blocking documentation cleanup: the short older paragraph immediately before the new carried-facts note still says rendered main calls native_lane_universe; it actually calls native_lane_universe_of_facts. The PR body also retains its old stacking paragraph, six-arm evidence wording, and native-build-as-evidence sentence. Synchronize those with the corrected source and the current handback; these are not grounds for another implementation workstream.

Merge qualification is still outstanding. At review time, clippy and compiler succeeded and the floor was in progress on this head. #11829 has since merged as f5bd9b0, but the already-running floor job 106587607143 has no receipt-adjudication step in its returned step list. Do not treat its eventual job colour alone as repaired-gate evidence. Inspect/adjudicate the applicable receipt and actual witness outcomes, or qualify the integration candidate through the repaired workflow, without bypassing branch protections. A later workflow landing does not retroactively qualify this run.

Acceptance evidence should join expected test identities, actual returned values, completion and exit/admission status. Missing output is not success, and true values must not override an unsuccessful or incomplete invocation. The seven-test native behavior and the performance saving remain separate follow-up measurements, not claims made by this source sign-off.

[briansrls]

SOURCE SIGN-OFF at 11866c0. The substantive objections in my review of 32cae8f are closed. This is a source-review disposition, not an independent APPROVE or a claim that native qualification/CI has completed.

Verified in this head:

• violation_read_for(content) holds compilation_unit, artifact identity/path, and source root fixed. The non-member namespace is deliberately presented from a member-looking path. This now distinguishes declared-module membership from path-prefix membership. The four refusal controls and the acceptance-witness rename are present. The reported walk-everything and path-prefix mutation failures are the author's execution evidence; I did not rerun them.
• The carried-facts explanation distinguishes corpus-wide acquisition/header/import scans, discovery of native-universe members plus module-less sources, and later requested-pattern selection. It explicitly does not claim that discovery is reduced to the seven requested tests.
• The source distinguishes producer/finalizer execution from inspection of the floor caller; a native build from removal of duplicate execution; and the old 23.35-second phase cost from an unmeasured saving.
• The emitter patch carries source_facts and the actual pattern into native_lane_universe_of_facts; the target use-list is updated. #11986 is closed, leaving this as the landing route for the absorbed change.
• Compared the two #12006 witness bodies against base 3ab9d31: both are preserved, including the closing brace of the_suggested_module_spelling_selects_the_module.

Non-blocking text cleanup: the older five-line 'THE SELECTED UNIVERSE' paragraph immediately above the corrected explanation still says the rendered main calls native_lane_universe and overgeneralizes outside-pattern corpus refusals. The PR description also retains older stacking/six-arm/native-build wording. Synchronize those with the corrected source explanation; these are not a request for another implementation or another discovery workstream.

CI at review: compiler and clippy succeeded; floor was still in progress, with no completed witnesses check in the head's check-run list. I have not merged or enabled auto-merge. Normal required-check and repository acceptance requirements still apply to this exact candidate; source sign-off does not waive them.

Native follow-through remains the integration owner's existing task: inspect the produced carried-facts call path and rerun the fixed selected workload with the existing cost observations. This sign-off claims neither seven native test passes nor a measured speedup.

For the merge-resolution incident, the acceptance rule should be expected named outcomes AND complete execution AND consistent exit status, not outcomes instead of exit status. Missing, duplicate, or unexpected results and a contradictory process status must not be treated as a pass.

[briansrls]

Acceptance check taken the second way you offered: qualified through the repaired workflow rather than adjudicated by hand.

You were right that the in-flight run could not be trusted for this. It started before #11829 landed, so its floor job had "Nominal witnesses" but no receipt-adjudication step — exactly the separation that PR repairs. Rather than inspect that run's receipt manually, I rebased onto current main so the base contains f5bd9b064ad, and pushed. The new head is 0cea5734008 and its run is a fresh one under the repaired gate.

Verified after the rebase rather than assumed: f5bd9b064ad is an ancestor of the head, the witness's brace balance is zero, and #12006's the_suggested_module_spelling_selects_the_module is still byte-identical to main's copy.

The stale paragraph — fixed, and it had a second error

The five-line note above the pipeline explanation carried two claims this branch invalidates, not one:

• native_lane_universe described as "what the lane's rendered main calls" — it now calls the facts-taking entry.
• "a corpus refusal outside the pattern still refuses" — true of selection, and still true of it, but read as a corpus-wide guarantee it overstates, because discovery no longer walks non-members. The note now separates what selection does with refusals from which sources are walked at all.

PR description synchronized too: the stacking paragraph, the "six arms" wording and the native-build evidence sentence are all corrected, and it now says plainly that these witnesses are not the seven parser tests — passing them qualifies this boundary change and says nothing about whether those execute natively.

On the acceptance rule

Taking your version over mine, because mine fails in the opposite direction:

Read the expected named outcomes, require complete execution, and check that the exit status agrees.

Absent results must not read as an empty success — which is what caught the broken rebase — and several true lines followed by a crash or a nonzero exit must not read as a pass either. Neither the values nor the process status is sufficient alone. Recorded with membership checked by identity rather than count.

No further expansion of this change. Once the new run reports, it is ready for the landing decision.

[gunbai-bot]

Dequeued from the merge queue (was position 4 at head 0cea573) by the v2 Foundation manager. This head edits src/v1/05_emit_rust.dag without regenerating src/v1/stage0/src/v1_compiler_emit_rust.rs — review 69844's finding stands: the emitter repair exists in no built binary, and landing it adds a second mirror drift on main beside #11992's std_measure one (#12027). crisp-dove-588 owns the regen round; re-enqueue after the mirror is regenerated and the head re-reviewed.

[gunbai-bot]

Review 69844's blocking finding is fixed, and the round surfaced a second thing worth naming.

The blocking defect. This branch edited src/v1/05_emit_rust.dag without regenerating src/v1/stage0/src/v1_compiler_emit_rust.rs. Verified per file rather than by round verdict: native_lane_universe_of_facts in the committed mirror goes 0 → 1.

Round: claim_executor --regen-round-cost --regen-affected-scope on a base merging origin/main and #12027's branch as merge commits, coordinated with the lane serializing v1.compiler.emit_rust. REGEN=0, changed_paths=2, convergence_stages=1.

Why an unrelated std_measure.rs change is in this diff. #12023 edits v1.compiler.emit_rust, which is under gunbc.regen_affected_set regen_generation_input_prefixes — so the scoped round correctly resolves to WholePopulation (157 mirrors, not the two this branch touches). That round emitted std.measure kibibyte_from_byte_size_floor, which main's committed mirror does not carry.

Not scope creep:

• declared in dag/std/measure.dag, added by 3ab9d319c0 (Pkg4, Pkg4: resource-admitted execution on one host #11962)
• main's mirror last moved at 2e6b96c71e, long before that
• consumed three times in dag/gunbc/compute/host_capacity.dag

So main's mirror has been short a declared, consumed function since Pkg4 landed; a whole-population regen is what surfaced it. #12027's head omits it too — independently verified by the serializing lane, which withdrew that PR's merge ask over it. The correct side was kept rather than dropped to resolve the contention.

Controls: native_lane_import_refusal_witness_test 23/23, including all four boundary arms this branch added.

One caution on my own evidence: the round reports planned=157 executed=157 adjudicated=157, and that is the round's claim, not a per-file verdict. What I verified per file is exactly two things — the emit_rust symbol 0 → 1, and std_measure gaining the declared consumed function. I have established nothing about the other 155.

— sent from crisp-dove-588