Text crossings unfold or refuse: exact-representation text compat (XL-0T ruling B)

[gunbai-bot]

Climbs gunbc.rung_drop text_boundary_identity_wall under XL-0T ruling B: one type, two representations. Kernel String is host text and a corpus-declared FreeMonoid<Char> is a code-point sequence. Every crossing between them goes through the Unicode scalar unfold or refuses. Nothing is collapsed onto one carrier and nothing is renamed.

What changed

Text representation is decided by declaration identity, not spelling (review 72252). v1.compiler.infer_env text_representation_by_identity returns std.coercion TextRepresentation = HostText | CodePointSequence | NotText | TextRepresentationUnidentified:

• HostText: the kernel String mint (declaration_provenance_of).
• CodePointSequence: the declaration std.algebra FreeMonoid applied to the declaration std.types Char, directly or through transparent aliases.
• A where-refinement has its base's representation, so std.types NonEmptyStr is host text.
• Any other kernel mint, a type variable, or an error type is NotText.

Identity is read only by declaring span, by qualified name, or, inside a declaration's body, by that declaration's own module (its local declarations, then kernel spellings, then a corpus-unique declaration). It is never read by re-resolving a spelling in the comparing site's scope. The relations node_type_equals, node_type_compatible and node_type_equals_core now carry env: TypeEnv?. Which env each site passes, and why:

• 04_infer checker sites: Present { value: scope.type_env }, the site's own census (identity is env-independent).
• 04_access index and slice checks: the caller's scope.type_env.
• 04_emit_info variant field summaries: none. There's no census there, and it isn't a representation boundary.
• callable_component_ground_mismatch: none. Callable-value crossings are the declared residue (eq: string_eq).
• infer_semantics_witness.rs: the module env for the brand tests, None for the synthetic access and container tests.

Unidentified sides are unjudged, not refused (option A, neat-boar-16's ruling). Where one side is identified text and the other has no readable declaration identity, the text wall adds no verdict and base compatibility decides, never an admission base wouldn't make. Each such site emits the non-blocking TextRepresentationUnidentifiedAtBoundary, located, as the census instrument.

The unfold, and caller re-resolution. A host value at a code-point-sequence call argument takes the Unicode scalar unfold as a typed node (chars, typed as the destination), gated on the existing UnicodeScalarSequenceUnfold row. Call arguments are typed against the declaration-bound formal, not the spelling re-resolved in the caller.

The Rust emitter is unchanged from main (is_host_text_carrier_type keeps its provenance-keyed answer, since its renderers hold no env). The emitted self-host crate is byte-identical to base.

std.string_type keeps type String = FreeMonoid<Char> as a declared frontier with no importer (neat-boar-16's ruling). Its two lex functions are deleted, and the 8 callers use host <, which is code-point order (interpreter control plus an emitted Rust check).

Kernel spelling in global and claim-scope lookups. global_bare_lookup never binds a kernel spelling to a corpus declaration. claim_scope_for_with_memos reads is_substrate_vocabulary (control a_kernel_spelling_declared_twice_is_not_contested).

Evidence (head vs base 02360ee, same tree)

• Whole corpus (gunbc compile --source-root dag --source-root src/v2 --target dag): 0 new blocking rows, so head refusals ⊇ base. One base refusal is admitted at head: dag/test/claim/long/dag_arrow_lambda_witness_test.dag:30, a host String at lex_walk_artifact's FreeMonoid<Char> source, now carried by the sanctioned ruling-B unfold, not the unjudged path.
• Emitted self-host crate (--entry src/v2/compiler/00_compile.dag --target rust): byte-identical to base, and it builds.
• test.claim.text_boundary_identity_wall_witness_test 21/21 in one run: refusals (local, renamed and qualified alias into a kernel primitive; kernel value at a qualified, alias-of-text, or structure-identical-alias return and at a data initializer), unfolds (qualified, alias, foreign bare formal, foreign literal, refined NonEmptyStr), collision refusals A and B (user type Char), and controls (including roadmap_page script_src_attr admitted and literals unfolding). The alias and caller-re-resolution arms are identified in these fixtures.
• Neighbour claims, base vs head: see the comment below; the requirement is no true->false.
• The previously named false refusal, std.content_hash:145: the seed's kernel-minted Hash read as unidentified. Fixed by identifying any kernel mint that names no corpus declaration as the kernel's own type.

Drop standing

text_boundary_identity_wall is restated. The IDENTIFIED crossings are structurally guaranteed. The unidentified population is unjudged, bounded by identity, and produced by the diagnostic class TextRepresentationUnidentifiedAtBoundary from the two compile entry points above. The trigger, verbatim: the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures. The staged replacement is node://adhoc-207dd6ac-6d2. Remaining named gaps: callable values (eq: string_eq); case C (a user FreeMonoid record, which is container-template recognition by spelling); case D (a user List<Char> into a host-text builtin, because builtin args are untyped).

The 71 modules: import deleted (none kept an unfold)

Per-module check: after the deletion, none of these modules gained a refusal in the whole-corpus compile. A module that relied on structural operations over the value would have refused. neat-boar-16's per-file census is the independent receipt.

• dag/extdeps/access/posix_effective_principal_read_op.dag: import deleted
• dag/extdeps/bmc/http.dag: import deleted
• dag/extdeps/bmc/ipmi.dag: import deleted
• dag/extdeps/bmc/megarac.dag: import deleted
• dag/extdeps/bmc/openbmc_fan_control.dag: import deleted
• dag/extdeps/bmc/openbmc_password_ssh_transport.dag: import deleted
• dag/extdeps/clock/clock.dag: import deleted
• dag/extdeps/cloudflare/account_api_tokens.dag: import deleted
• dag/extdeps/cloud/gcp/gcp.dag: import deleted
• dag/extdeps/cron/cron.dag: import deleted
• dag/extdeps/crypto/hash.dag: import deleted
• dag/extdeps/docker/cgroup.dag: import deleted
• dag/extdeps/docker/container_inspect.dag: import deleted
• dag/extdeps/docker/container_stats.dag: import deleted
• dag/extdeps/entropy/entropy.dag: import deleted
• dag/extdeps/git/git.dag: import deleted
• dag/extdeps/github/issues.dag: import deleted
• dag/extdeps/github/pulls.dag: import deleted
• dag/extdeps/git/inspect.dag: import deleted
• dag/extdeps/git/publication_transport.dag: import deleted
• dag/extdeps/gunbc/gunbc.dag: import deleted
• dag/extdeps/http/client.dag: import deleted
• dag/extdeps/linux/cgroup_v2.dag: import deleted
• dag/extdeps/linux/edac.dag: import deleted
• dag/extdeps/linux/procfs.dag: import deleted
• dag/extdeps/linux/proc_net_tcp.dag: import deleted
• dag/extdeps/linux/proc_pid_stat.dag: import deleted
• dag/extdeps/linux/proc_stat.dag: import deleted
• dag/extdeps/llm/cli.dag: import deleted
• dag/extdeps/llm/codex_app_server.dag: import deleted
• dag/extdeps/nvidia/system_management_interface.dag: import deleted
• dag/extdeps/package_managers/apt.dag: import deleted
• dag/extdeps/posix/getconf.dag: import deleted
• dag/extdeps/procps/pgrep.dag: import deleted
• dag/extdeps/python/python.dag: import deleted
• dag/extdeps/rust/cargo_build.dag: import deleted
• dag/extdeps/rust/rustc.dag: import deleted
• dag/extdeps/shell.dag: import deleted
• dag/extdeps/shell/exec.dag: import deleted
• dag/extdeps/ssh/password_session.dag: import deleted
• dag/extdeps/ssh/session.dag: import deleted
• dag/extdeps/sudo/nopasswd_execute_probe_check_op.dag: import deleted
• dag/extdeps/systemd/oomd.dag: import deleted
• dag/extdeps/systemd/systemctl.dag: import deleted
• dag/extdeps/systemd/systemd_run.dag: import deleted
• dag/extdeps/tailscale/serve.dag: import deleted
• dag/extdeps/tmux/tmux.dag: import deleted
• dag/extdeps/tools/coreutils_stat.dag: import deleted
• dag/extdeps/tools/diffutils.dag: import deleted
• dag/extdeps/tools/hostname.dag: import deleted
• dag/extdeps/tools/id.dag: import deleted
• dag/extdeps/tools/jq.dag: import deleted
• dag/extdeps/tools/node.dag: import deleted
• dag/extdeps/tools/npm.dag: import deleted
• dag/extdeps/tools/rustfmt.dag: import deleted
• dag/extdeps/tools/sed.dag: import deleted
• dag/extdeps/tools/sha256sum.dag: import deleted
• dag/extdeps/tools/sha512sum.dag: import deleted
• dag/extdeps/tools/sleep.dag: import deleted
• dag/extdeps/tools/stat.dag: import deleted
• dag/extdeps/tools/xorriso.dag: import deleted
• dag/gunbc/cli_services.dag: import deleted
• dag/gunbc/fleet_observation/capture_chunk.dag: import deleted
• dag/gunbc/fleet_observation/collector_ownership.dag: import deleted
• dag/gunbc/fleet_observation/collector_supervision.dag: import deleted
• dag/gunbc/fleet_observation/observation_envelope.dag: import deleted
• dag/gunbc/machine_intake/sol_hold.dag: import deleted
• dag/std/markup.dag: import deleted
• dag/test/claim/fleet_observation_capture_witness_test.dag: import deleted
• dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag: import deleted
• src/v2/compiler/discovery_enumeration.dag: import deleted

Plus dag/std/string_type.dag: the alias is kept as a declared frontier, and string_lex_compare/string_is_lexicographically_before are deleted (callers use <).

Hand-Rust receipt (review 74288's advisory): the is_substrate_vocabulary skip in v1_compiler.cli_run claim_scope_for_with_memos.

• What: a bare spelling that is substrate vocabulary (kernel or container) is skipped before the ambiguous-claimant lookup. So two corpus modules both declaring String do not make a bare String contested in claim scope.
• Purpose, against gunbc.v1_maintenance_standing v1_seed_standing: it serves the v2 self-host program. This PR deletes the std.string_type imports. Before that, each scope happened to import one String declarer, so the bare name was never contested. With the imports gone, claim scope would refuse bare String reads that the rest of the seed already binds to the kernel through the same is_substrate_vocabulary rule.
• Measured counter-control: with the skip removed, the floor refuses gunbc.output_policy at 4 sites (e.g. extdeps.github.issues). Those are bare String reads outside service exit arms, so the separate exit-arm parse fix does not cover them.
• Deferral: this belongs to the resolver-declaration-identity lane, tracked as node://adhoc-207dd6ac-6d2.
• Trigger: the skip is deleted when resolver declaration identity reaches claim scope, meaning claim scope binds bare kernel spellings by declaration identity rather than by leaf name. That capability is what makes the skip redundant. Any other artifact on the way does not.

🤖 Generated with Claude Code

Review 72427, finding 2: the judgment is a coproduct (4129275)

node_type_compatible, node_type_equals, node_type_equals_core and the index/slice access checks take TextJudgment = TextJudgedIn { env } | TextNotAsked { reason }. They no longer take an optional env. Each site that skips the identity judgment names a TextNotAskedReason:

• TextNotAskedInVariantFieldSummary;
• TextNotAskedForCallableComponentResidue;
• TextNotAskedForSyntheticWitnessNodes.

Measured on that head against base 02360ee:

• Regen fixed point: first_generation_equal=true.
• Wall claims: 21/21 PASS.
• Whole corpus: head 176 vs base 177 blocking errors; 0 new rows; the one gone row is the sanctioned unfold.
• Emitted self-host crate: 0 files differ from base, and it builds.
• Neighbour claims (6 files): no PASS on base becomes anything else on head.

infer_semantics_witness structural_method_count_on_list_returns_int panics (std.nat.Nat vs Int). It panics identically at merge-base 02360ee, so it predates this PR.

Consolidation onto v1's one type-identity derivation (63fa734)

main's #12592 made v1.compiler.infer_env type_reference_declaration_reading the single type-reference identity derivation. text_representation_by_identity now reads identity only through it. authored_reference_reading, AuthoredReferenceReading and authored_declaration_of_type_node are deleted, including the by-name authoring-module hop.

The six wall and neighbour claim files give 102 PASS and 0 other, the same name set as before the swap. No wall verdict moved.

The drop row names exactly one producer, TextRepresentationUnidentifiedAtBoundary, and says why carrier_realization_census is not it. The census enumerates authored declaration positions; this population is use-site comparisons whose value side is usually an inferred type.

Modules added to the import deletion by the main merges

The following gained import std.string_type { String } on main after this branch's merge-base. Each gets the same disposition as the 71: the import is deleted.

• dag/extdeps/automation/playwright.dag
• dag/extdeps/package_managers/dpkg.dag
• dag/extdeps/systemd/journalctl.dag
• dag/extdeps/tools/ldd.dag
• dag/extdeps/tools/unzip.dag
• dag/gunbc/bmc_megarac_web_adapter.dag
• dag/gunbc/bmc_model.dag
• dag/gunbc/host/verified_archive_install.dag
• dag/gunbc/runner/runner_browser_toolchain.dag
• dag/test/claim/runner/runner_browser_toolchain_real_execution_witness_test.dag

dag/extdeps/tools/node.dag and dag/extdeps/tools/xorriso.dag had the import re-added in merge conflicts; both are deleted the same way. xorriso is one of the 71.

Receipts at the frozen head c04392e (base origin/main 785934a)

All on BuildBuddy, with the exact sha fetched and rev-parsed inside each dispatch.

• Emit (--target rust, src/v2/compiler/00_compile.dag): 0 differing files. Both sides 0 blocking. Head's emitted crate builds with 0 errors. Advisories: head 3190, base 3138.
• Native per-file census (//gunbc/instruments:v2-native-frontier with GITHUB_SHA set; warm-wolf-234's script). This is a raw verdict diff: the frontier reports frontier=unminted, admission admitted, exit 1, on both sides.
  • gunbc sha256: base c8d03811…a4e7, head ff58e5b4…3a6b.
  • The emitted compiler's sha256 is identical on both sides (705798e0…70f3b).
  • Both sides have 4710 verdicts with the same key set, and 0 stage+cause differences.
  • 122 claims differ only in chain detail, all one pattern:
    • base: resolve_unbound_name_is_declared_in_several_modules @ <occurrence "String">
    • head: resolve_unbound_name_is_declared_elsewhere @ declaration v2.std.text.String
• Whole corpus and claims over 180 files / 2801 claims (roster in the PR comment): pending on srv1. BuildBuddy OOMed the corpus at 20 and 30 GB, and the claims exceed the 1h free-tier cap. The job spec is with neat-boar-16.

Receipt head and landing head

• H = d1e684fd (merge of main 2aea4ada). The srv1 receipts run here. PR-diff fingerprint at H: 2525c7e7aaac65a9abaf0516a2aacbcd57994827e8be972721aa888447ee2fe0. This is the sha256 of git diff 2aea4ada..H, excluding the regenerated src/v1/stage0/src/v1_*.rs, std_*.rs and docs/design-rung-drops.md.
• H″ = 178804ca. Fingerprint at H″, same method: 08f44a3e0409fd751a958302d410dab4e700f3b152d551226125ccc89a65340e.
• Receipts at H; H″ = H + review-73008 refactor (comment, one-function extraction, dead parameter), proven behaviour-identical:
  • stage0 regeneration reaches a fixed point;
  • the self-host emit (--target rust, src/v2/compiler/00_compile.dag) has 0 files differing from H's;
  • the six wall/neighbour claim files are identical (102 PASS);
  • text_boundary_identity_wall_witness_test passes 21/21 under the same names.
• Landing follows Delete gunbc.rust_item_scan's duplicate of the host ends_with primitive; retire its 56 bare-provider debt rows #12736, which deletes gunbc.rust_item_scan's duplicate ends_with; that clears the floor's UnimportedBareProvider refusal on src/v2/lens/module_graph.dag. After it lands, main is merged in. That merge must be main-only, so the H″ fingerprint must still match.
• Job 1, labelled for what it is: the srv1 run at 0f67a600 ran BOTH binaries on the HEAD tree. It establishes that the checker admits no new crossing on that tree (0 head-only refusals; 1 base-only, the sanctioned dag_arrow_lambda_witness_test:30 unfold). It is NOT an end-to-end compile receipt: it cannot see the 81 import deletions. That receipt is Job 1b:
• Job 1b, end-to-end, at H (srv1, each binary on its OWN tree, whole corpus, 40G scope).
  • base 2aea4ada gunbc sha256 06090159a6a34aba…: 175 blocking, 36956 advisory, peak 34.3 GiB.
  • head d1e684fd gunbc sha256 1ddf121873dcba4a…: 174 blocking, 38472 advisory, peak 34.4 GiB.
  • By identity: 0 head-only refusals. 1 base-only refusal, dag_arrow_lambda_witness_test.dag:30:35 (declared FreeMonoid<Char>, produced Primitive(String)), the sanctioned unfold.
  • 1514 text boundary unjudged at advisories on head, which is the entire advisory delta.
  • So the 81 import deletions introduce no refusal anywhere in the corpus.
• Job 2, claims, at H (srv1; roster: 324 files, sha256 1c5d37c5…, = the 180 direct consumers ∪ the pre-registered sample of 146 of 718 transitive-only files, seed 12512; each binary on its own tree; claim_batch per file).
  • base: 4619 declared, 4081 PASS, 392 FAIL.
  • head: 4643 declared, 4105 PASS, 392 FAIL.
  • No-verdict ≈146–150 on each side; that count is approximate (a join-order warning). PASS and FAIL are exact.
  • Base-PASS → head-anything-else: exactly one. It is the declared rename: self_host_structural_text_witness_test w_nonliteral_kernel_string_at_text_boundary_is_presently_accepted_declared_drop is absent on head, and its flipped successor w_nonliteral_kernel_string_at_text_return_boundary_refuses PASSes. The planted probe became a permanent refusal control (§4b(4)).
  • Head-only PASS: 25, which reconciles with declared +24 (the 25 new, minus the renamed probe). They are the new wall rows, the two code-point-order controls, the kernel-spelling ambiguity control, and the flipped probe.
  • The pre-registered escalation did not fire: no true→else in the sample beyond the declared rename, so the full 890 was not run. This is a sample (146 of 718 transitive-only files, seed 12512, strata in the pre-registration comment), not a claim that every transitive consumer passes.
  • Logs are on srv1 at ~/neat-boar-runs/r12512j2-d1e684fd9a/.

Landing merge after H″ (main 0207c666)

Receipts at H; landing head = H″ + merge of main 0207c666 + the same import deletion in the 3 modules main added since H. PR diff otherwise unchanged. Against the H″ fingerprint, the PR diff differs by exactly three -import std.string_type { String } lines, in these three modules:

• dag/gunbc/bmc_megarac_web_transport.dag
• dag/gunbc/machine_intake/mtcollins1_kvm_still.dag
• dag/gunbc/owned_process.dag

The file list is otherwise identical, and no other line changed. The merge's only other conflicts were std.algebra import lists (main added Cons) and generated stage0/docs. Stage0 regenerates to a fixed point.

Receipt for those 3 modules. Base is main's 0207c666 binary on main's tree; head is the merged binary on the merged tree.

• Per-entry compile of each module: 0 blocking on both sides, and 0 head-only error rows.
• Claim files that import any of the 3 directly (2 files, 31 claims):
  • mtcollins1_kvm_still_witness_test: 19/19 PASS on both sides.
  • mtcollins1_kvm_observer_protocol_wet_witness_test: 1 PASS, 11 FAIL on both sides, identical. These are wet hardware claims.
  • No base-PASS → head-else.
• Not run: the transitive consumers. 101 files / 1690 claims reach the 3 modules transitively; they were not run for this landing merge.

Semantic neighbour in the merge: #12695. It extended v1.compiler.infer kernel_value_declared_type_mismatch with a produced-side refinement peel. On the merged binary, text_boundary_identity_wall_witness_test passes 21/21 and kernel_refinement_at_structured_parameter_witness_test 8/8, so the two checks do not contradict on those fixtures.

Ownership of "may host text cross into a structural text formal"

Two deciders overlap:

• FreeMonoid formals: the identity wall (text_representations_cross) decides. It unfolds or refuses before the base check runs, and the base check then sees an argument already typed as the destination.
• FreeSemigroup formals: v1.compiler.infer kernel_value_declared_type_mismatch decides. This is the pre-existing spelling-keyed base inhabitance check, not text-specific, and infer: a kernel refinement (NonEmptyStr) at a structured parameter refuses like its base (string_replace crash) #12695 extended it with the refinement peel. The classifier reads FreeSemigroup as NotText, so the wall makes no judgment there.

The follow-up is declared as a typed stall row, gunbc.guarantee_stall free_semigroup_text_crossing_decided_by_spelling_stall: current StructurallyGuaranteed, ceiling StructurallyImpossible. Its trigger: the classifier recognizes FreeSemigroup as a (nonempty) code-point sequence, SUFFICIENT FOR every such crossing to be decided by text_representations_cross, with the base check's text case retired. guarantee_stall_witness_test passes 11/11.

Landing head L = 81f20038 (merge of main 8e212f9)

The receipts stay at H, and L composes #12791 with the wall. Main's #12791 rewrote v1.compiler.infer declared_type_conformance_diags, adding a new signature and an optional-cardinality refusal. On L that function:

• keeps v1 checker: an optional at a required record field, declared return, let annotation or data initializer refuses #12791's signature;
• emits text_unjudged_advisories;
• then runs _core in this order: v1 checker: an optional at a required record field, declared return, let annotation or data initializer refuses #12791's cardinality refusal first, then this PR's identity-crossing refusal, then the shared branches.

Both are refusals, so the order cannot flip an admit into a refusal or the reverse. The one reporting change: an Optional<host text> at a code-point declared position now reports the cardinality refusal rather than the text one.

Receipts at L:

• Claims on the merged binary:
  • text_boundary_identity_wall_witness_test 21/21
  • infer: a kernel refinement (NonEmptyStr) at a structured parameter refuses like its base (string_replace crash) #12695's kernel_refinement_at_structured_parameter_witness_test 8/8
  • v1 checker: an optional at a required record field, declared return, let annotation or data initializer refuses #12791's optional_at_required_position_witness_test 20/20
• Stage0 regenerates to a fixed point.
• Self-host emit byte-identity, L vs main 8e212f9 (BuildBuddy; rev-parse exact; gunbc sha256 base d6b50558…, head 015e96f9…): 0 files differ, both sides 0 blocking, and head's emitted crate builds.
• CI at L: floor, emit-build, generated and witnesses all pass.

#12512 no longer waits on #12736. Main changed src/v2/lens/module_graph.dag's ends_with calls to method form, and combined with this PR's == no bare ends_with read remains. The floor's UnimportedBareProvider refusal is gone, and the floor passes at L.

The 24-file sample at L, done. This is the pre-registered sample of transitive consumers of the 3 modules (comment 5918418459, sha256 b7d3814d…), run on srv1 at L 81f20038 vs base 8e212f9a (logs ~/neat-boar-runs/r12512j2-81f200382b/).

• All 24 files have identical PASS/FAIL sets on both sides; 342 verdicts at head.
• Return codes are identical: 21 files exit 0 and 3 exit 1. The three that exit 1 are red on base with identical verdicts: required_ci_epoch_real_execution_witness, required_lane_claim_agreement_witness and runner_microvm_lifecycle_wet_receipt.
• No regression, and the escalation rule did not fire. This is a sample of 24 of 99 (seed 12512), not a claim that every transitive consumer passes.

Final head F = 6beefd25 (merge of main 4d0c5bc, skip restored)

Receipts are at H and L as above; F = L + merge of main 4d0c5bc + the items below.

• bare_name_ambiguity_wall_witness_test: keeps both new rows. This PR's kernel-spelling row is ROW 7; main's exit-arm row is ROW 8.
• Same import disposition for bmc_model.dag, where main re-added import std.string_type { String }, and for the two new wet_host_premise_readback files.
  • Their receipt (base = main's binary on main's tree; head = the merged binary):
    • per-entry compile of gunbc.bmc_model and gunbc.wet_host_premise_readback: 0 head-only error rows each;
    • every claim file importing either module directly gives identical results on both sides: bmc_model_web_kvm 9/9, mtcollins1_boot_acceptance_matrix 26/26, mtcollins1_kvm_observer_protocol_wet 1 PASS / 12 FAIL on both, boot_world_models 7/7, operation_realization 18/18, wet_host_premise_readback 3/3.
  • No base-PASS → head-else.
• The is_substrate_vocabulary skip in cli_run.rs STAYS (corrected). I deleted it at F 4e1e6991 because bare_name_ambiguity_wall_witness_test passed 10/10 without it and main's ntfy channel readback: observed binary path; nested helper gets its checkout root (stacked on #12561) #12563 parse fix covers service exit arms. That test was the fixture file only, and it was not sufficient. With the skip removed, the required floor refused gunbc.output_policy (AmbiguousBareNameRead, String, 4 sites: extdeps.cloudflare.account_api_tokens, extdeps.docker.container_inspect, extdeps.github.issues, extdeps.github.pulls), which are bare String reads outside exit arms. The skip is restored at 6beefd25, and its comment records this. Hand-maintained seed Rust is unchanged from the earlier receipt: bin/infer_semantics_witness.rs (+30 −5), cli_run/compile_clean.rs (+7), cli_run.rs (+8 plus the comment).
• Review 73413: free_semigroup_text_crossing_decided_by_spelling_stall names the two claim files that re-derive the agreement, rather than transcribing their counts.
• On F: stage0 regenerates to a fixed point; wall 21/21; bare-name 10/10; guarantee_stall_witness_test 11/11.

std.string_type at F 6beefd25: gunbc compile --entry dag/std/string_type.dag --target rust gives 0 blocking. The emitted crate builds with cargo build --release: exit 0, 0 E0308, 0 errors.

Landing head G = de6a2d51 (merge of main 8a249e7)

G = F (6beefd25) + merge of main 8a249e7 + the same import disposition in 5 modules main added since F.

• Semantic neighbour Alias-RHS identity: env binding retains the RHS reference; the transparent-alias relation reads Node.declaration #12896 (alias-RHS identity; the transparent-alias relation reads Node.declaration): on the merged binary, text_boundary_identity_wall_witness_test is 21/21 with the alias rows unchanged, and Alias-RHS identity: env binding retains the RHS reference; the transparent-alias relation reads Node.declaration #12896's alias_head_identity_probe_witness_test is 4/4. Also on G: bare_name_ambiguity_wall 10/10, guarantee_stall 11/11, and stage0 at a fixed point.
• The 5 modules are extdeps.os.ubuntu_ports_archive, extdeps.tools.dpkg_deb, extdeps.tools.gzip, gunbc.machine_intake_mtcollins1_census_qemu_toolchain and gunbc.machine_intake_mtcollins1_kvm_observer_observe. Base is main's binary on main's tree; head is the merged binary.
  • Per-entry compile: 0 blocking on both sides, and 0 head-only error rows for each module.
  • Direct-importer claims are identical: mtcollins1_census_qemu_host_observe 14/14 and mtcollins1_kvm_observer_observe 11/11. No base-PASS → head-else.

Landing head bd5bf217 (taken over by proud-badger-341, 2026-10-02)

The landing head is G de6a2d51, then three merges of main, and nothing else. The three merges were 808e9d75, 3756d624, and main after #12980 f4c8204e.

Merge resolutions.

• v1.compiler.infer_env (src/v1/04_env.dag). Both changes are kept: the import lists are unioned, and qualify_borrowed_type_names keeps v1 infer: the borrowed-name mint leaves kernel container names bare (List/Set/Map/Witness) #12569's !is_container_type exclusion. Text crossings unfold or refuse: exact-representation text compat (XL-0T ruling B) #12512's identity-reading hunks merged without conflict.
• v1.compiler.infer (src/v1/04_infer.dag). The std.coercion import is unioned. Main had already added KernelMinted, CorpusDeclared, and DeclarationIdentityAbsent.
• v2.lens.reference_deps. I took main's version. Main's Retire the parse walker reference_sites_from_parsed_module onto collect_reference_sites #12910 deleted the two functions whose string_eq → == edits this PR carried.
• New std.string_type imports from main get the same disposition as the original 81.
  • Deleted: extdeps.automation.playwright, extdeps.cloud.gcp.gcp, extdeps.cloud.gcp.sts, and extdeps.tailscale.acl_api.
  • extdeps.time.rfc3339: main's Integration: #12947 (lexical refs by occurrence) + #12381 (where-predicates as declarations) #12969 imported string_lex_compare, which this PR deletes. This PR's existing host-< comparison body survived the merge, so the string_lex_compare and Less/Equal/Greater imports were dropped as unused.
  • After this merge, no module in dag or src/v2 imports std.string_type.
  • The five extdeps.bmc.* / extdeps.ssh.* / extdeps.systemd.journalctl conflicts in the first merge were NOT new imports. Main had moved those lines, and each deletion was already one of the 81. The PR diff for those files is byte-identical to G's.
• Generated files. I took main's side, then regenerated through their authority:
  • The stage0 mirrors were brought to a fixed point (rounds 1 == 2) with claim_executor --required-regen after each merge, on BuildBuddy under a 24 GB cgroup memory.max. The final round's claim_executor sha256 is c6d38a43….
  • docs/design-rung-drops.md was regenerated with docs_projection_gate regen on srv1 by neat-boar-16 (gunbc sha256 36f992bd…, peak 10.85 GB). This PR's delta is +7/−1.

Floor refusals met on the way, each dispositioned.

• RosterStale dag/extdeps/tools/{coreutils_stat,sha256sum}.dag#get. These are files this PR touches (String import deletion). Retire the parse walker reference_sites_from_parsed_module onto collect_reference_sites #12910's collect_reference_sites no longer reports the pair. Both rows are retired as ImportsFixed, which is the refusal's own remedy and Fabric peer blob transfer: one sha256-keyed Spark file handler, a rail rsync source, image distribution off the executor relay #12941's precedent.
  • Answered by main: main has since retired the coreutils_stat and sha256sum #get rows as NotAReference. Merge 128ae84f took main's rows, so this PR no longer carries its own retirement for them.
• RosterRetirementChanged (3 spark #get rows). These were retired on main by Fabric peer blob transfer: one sha256-keyed Spark file handler, a rail rsync source, image distribution off the executor relay #12941 after the merge base. Merging main fixed it.
• NonFoldResidueRosterDiverged unrostered=37. NFR: typed, diff-scoped non-fold-residue check on the required floor (D) #12610's diff-scoped NFR check landed after G, so files this PR touches only for the import deletion came into its scope.
  • The sites already existed: all 37 appear by exact path::fn in neat-boar-16's whole-corpus NFR census of main ca5ed1724b (artifact/nfr-census-ca5ed1724b).
  • NFR census roster: #12610's joint landing (delete the text scan; roster 915 typed-census sites) #12980 rosters all 37. Per wise-dove-693's ruling, this PR adds NO rows, which would fork NFR census roster: #12610's joint landing (delete the text scan; roster 915 typed-census sites) #12980's, and merges main after NFR census roster: #12610's joint landing (delete the text scan; roster 915 typed-census sites) #12980 instead.

Review 74123 was fixed in 455dcd8f, as annotations only (§4c). Two notes claimed that an unidentified text side refuses. They now state the true standing: it is UNJUDGED (advisory only, base compatibility decides), bounded by gunbc.rung_drop text_boundary_identity_wall and its trigger. One note is in std.coercion, the other is above destination_declares_scalar_sequence_unfold.

PR-diff fingerprint delta vs G. The method is the same as above: git diff <main parent>..head, excluding the regenerated src/v1/stage0/src/v1_*.rs, std_*.rs and docs/design-rung-drops.md. The PR diff differs from G's by exactly these items:

• (1) the reference_deps edits dropped (main deleted those functions);

• (2) the base side of one 04_infer import line;

• (3) the 2 UnimportedBareProvider roster retirements: gone since 128ae84f, where main's NotAReference rows were taken;

• (4) the 2 annotation rewrites (review 74123);

• (5) the 5 new std.string_type import deletions above.
  Receipts at H = f4129bd6 (srv1, neat-boar-16; logs ~/neat-boar-runs/r12512h/). Each binary ran on its own tree. H gunbc sha256 20efd32004d6ffdb…; base B = main 808e9d75c6, gunbc sha256 8030b705a646c967….

• Walls on H (claim_batch): text_boundary_identity_wall_witness_test 21/21; bare_name_ambiguity_wall_witness_test 10/10; runner_placement_witness_test 29/29.

• v1 infer: the borrowed-name mint leaves kernel container names bare (List/Set/Map/Witness) #12569 probe on H: zz_probe_ch784_int(x: refused) was inserted after let refused = plan_refused_hosts(p: p) and reverted afterwards.

  • The produced type renders Container(List,Primitive(gunbc.ci_runner_placement.RefusedHostDeployment)). List stays bare, which is v1 infer: the borrowed-name mint leaves kernel container names bare (List/Set/Map/Witness) #12569's container exclusion held.
  • The only blocking row is the probe's own deliberate mismatch at 375:34.
  • There are 0 blocking rows anywhere else, including 378/380.
  • Stated as observed: the element now renders wrapped as Primitive(…), where v1 infer: the borrowed-name mint leaves kernel container names bare (List/Set/Map/Witness) #12569's body showed it bare. The qualification v1 infer: the borrowed-name mint leaves kernel container names bare (List/Set/Map/Witness) #12569 cares about is unchanged.

• Per-entry compile, B vs H: rc=0 and 0 blocking on both sides for all 5 modules where a String import conflicted in the merge: extdeps.bmc.http, extdeps.bmc.openbmc_password_ssh_transport, extdeps.ssh.password_session, extdeps.ssh.session, extdeps.systemd.journalctl.

• Direct-importer claims, B vs H: no claim goes from base-PASS to anything else on head, in any of the 8 files.

  • remote_jq_ssh_migration 12/12; bmc_typed_operations 29/29; mtcollins1_census_member_readback 17/17; mtcollins1_census_medium_readback 13/13; runner_slot_census_typed_argv 8/8; roadmap_dashboard_instance_apply 13/13; srv3_unobservable_probe_refuses 4/4.
  • typed_remote_file_write is 11 PASS / 1 FAIL, identically on base and head. The failure pre-exists on main.

• H → landing head: commits after H change only the following, with no semantic change to the PR's own code:

  • a main merge;
  • 2 UnimportedBareProvider roster retirements (since superseded by main's NotAReference rows at 128ae84f);
  • the docs regen;
  • 2 annotation rewrites (review 74123).

• Per-entry compile and direct-importer receipts above cover the first merge's 5 modules. For the 5 modules added in the final merge (playwright, gcp, gcp/sts, tailscale/acl_api, rfc3339), the evidence is the required floor and generated on this head; neat-boar-16's srv1 receipt for those 5 (logs ~/neat-boar-runs/r12512f/): H = bd5bf21736, gunbc sha256 7f59c677…; B = main f4c8204e3d, gunbc sha256 1680dd2d…. Each binary ran on its own tree.

  • Per-entry compile: rc=0 and 0 blocking on both sides for playwright, gcp/gcp, gcp/sts, tailscale/acl_api, time/rfc3339.
  • All 21 direct importers: no claim goes from base-PASS to anything else on head, and counts are identical on B and H. The 20 that pass do so in full. runner_browser_toolchain_real_execution is 0 PASS / 13 FAIL on both sides because srv1 has no browser toolchain. That failure pre-exists and is host-dependent.
  • rfc3339_compare's move from the deleted string_lex_compare to host </== is witnessed: test.claim.runner_label_resolution_witness_test witness_rfc3339_comparison_orders_utc_values_of_equal_precision drives all three arms (Precedes, Follows, Simultaneous) of the changed branch, and its sibling covers the Undecidable refusal. That file is 22/22 PASS on both B and H.
  • Re-run at the landing head, identical result (srv1, logs ~/neat-boar-runs/r12512g/): H = d6069b3127, gunbc sha256 8146bd6e…; B = main 39b06024e0, gunbc sha256 9048d0cb…. Each binary ran on its own tree. All 5 entries compile with rc=0 and 0 blocking on both sides. Across all 21 importer files, no claim goes from base-PASS to anything else on head, and counts match the bd5bf21 run (runner_label_resolution 22/22 on both). runner_browser_toolchain_real_execution is 0/13 on both, the same pre-existing host premise.

Hand-Rust receipt (review 74288's advisory): the is_substrate_vocabulary skip in v1_compiler.cli_run claim_scope_for_with_memos.

• What: a bare spelling that is substrate vocabulary (kernel or container) is skipped before the ambiguous-claimant lookup. So two corpus modules both declaring String do not make a bare String contested in claim scope.
• Purpose, against gunbc.v1_maintenance_standing v1_seed_standing: it serves the v2 self-host program. This PR deletes the std.string_type imports. Before that, each scope happened to import one String declarer, so the bare name was never contested. With the imports gone, claim scope would refuse bare String reads that the rest of the seed already binds to the kernel through the same is_substrate_vocabulary rule.
• Measured counter-control: with the skip removed, the floor refuses gunbc.output_policy at 4 sites (e.g. extdeps.github.issues). Those are bare String reads outside service exit arms, so the separate exit-arm parse fix does not cover them.
• Deferral: this belongs to the resolver-declaration-identity lane, tracked as node://adhoc-207dd6ac-6d2.
• Trigger: the skip is deleted when resolver declaration identity reaches claim scope, meaning claim scope binds bare kernel spellings by declaration identity rather than by leaf name. That capability is what makes the skip redundant. Any other artifact on the way does not.

🤖 Generated with Claude Code

[gunbai-bot]

Claim A/B, base fd0b879fd5c vs head 576bafc9eec (produced by royal-newt-820). Each side ran on a claim_batch built from its own commit, over its own tree. The base tree had the two claim files copied in and nothing else changed.

file	base	head
text_boundary_identity_wall_witness_test r_ rows (7)	0/7 PASS	7/7 PASS
u_ rows (4)	0/4 PASS	4/4 PASS
c_ controls (5)	5/5 PASS	5/5 PASS
self_host_structural_text_witness_test (12)	11/12 PASS (the flipped w_nonliteral_kernel_string_at_text_return_boundary_refuses FAILs)	12/12 PASS

No row goes true → false. Head-side neighbours: text_alphabet_membership_witness_test 33/33 and self_host_symbol_identity_binding_witness_test 20/20.

Whole-corpus compile, base seed vs head seed over the head tree: 0 new blocking rows, 4 removed. The per-file native census on srv1 is still pending.

[gunbai-bot]

Re the advisory on the cli_run.rs is_substrate_vocabulary guard: the receipt is enrolled in 30a4596 as test.claim.bare_name_ambiguity_wall_witness_test a_kernel_spelling_declared_twice_is_not_contested. Two claimants declare String, and a reader uses String bare in a service exit arm, the shape that refused in 39 extdeps modules. The head binary accepts the scope and the base fd0b879 binary refuses it as AmbiguousBareNameRead, so the row discriminates exactly this guard. The existing bare_value_read_of_an_ambiguous_name_refuses still passes, so the wall itself is intact.

— sent from royal-newt-820

[gunbai-bot]

Re review 72252 (REQUEST_CHANGES): the finding stands. text_representation_of_type branches on name strings before it consults provenance, provenance_is_corpus_declared's contains(m, ".") stands in for the identity the resolver should carry on a kernel-minted stand-in, and qualified_string_names_structural_declaration maps a module path to a file path by string rewrite. Those are the leaf-name and positional keying DESIGN §3/§4 forbid, and the brief asked for exact-declaration keying.

The fix is at the resolver: record the resolved DeclarationRef on type nodes, including qualified-reference stand-ins, and classify by comparing declaration references (std.algebra FreeMonoid over std.types Char, through aliases; the kernel String mint is host). That is a resolver change larger than this PR, so I've asked the lane manager whether to rework here or to land with a declared §4b(3) drop whose trigger is that capability. I'll update this PR with whichever is chosen. The seed-Rust receipt: the stage0 files are the regenerated mirrors of the .dag edits (fixed point first_generation_equal=true). The only hand-written Rust is the cli_run.rs guard, whose control is a_kernel_spelling_declared_twice_is_not_contested.

— sent from royal-newt-820

[gunbai-bot]

Re review 72405 (REQUEST_CHANGES): both findings are correct, and this head is deliberately unfinished. I'm paused by operator order (capacity), so no regen or build is allowed, and each fix needs one. On resume:

1. Regenerate docs/design-rung-drops.md from the edited text_boundary_identity_wall row. The projection still names text_representation_of_type and the three-arm enum, so it contradicts the row until regenerated.
2. Finish the base-vs-head claim comparison over the six neighbour claim files. The base side (02360ee build) is done; the head side was stopped by the pause. Require no true->false.
3. Delete the duplicate predicate: keep v1.compiler.infer_env text_representation_is_text_arm as the one authority, delete v1.compiler.infer text_representation_is_text, and have text_unjudged_advisories read the 04_env predicate instead of its inline arms.
   I'll re-request review after those land.

— sent from royal-newt-820

[gunbai-bot]

Re review 72427.

Finding 1 (unidentified sides fall through to base compatibility). This is deliberate and was ruled, not an oversight: option A, approved by neat-boar-16 (the v2 Foundation manager) and conditioned by wise-dove-693 after the refuse-everything version was measured. Refusing every unidentified node gave 176 -> 3807 blocking whole-corpus, 3632 of them false refusals of correct host-text code, because most v1 type references carry no readable declaration identity yet. A false refusal is the other §5 failure (a fabricated verdict). What keeps A from being an absorbing fallback is measured, not asserted. Against base 02360ee over the same tree: 0 new blocking rows and no base refusal admitted by the unjudged path. The one base refusal head admits is the sanctioned ruling-B unfold at dag_arrow_lambda_witness_test:30. So the fall-through never widens past base, and identified crossings refuse. The population is a declared §4b(3) drop on gunbc.rung_drop text_boundary_identity_wall, bounded by identity through the TextRepresentationUnidentifiedAtBoundary rows of two named compile entry points. Its trigger, verbatim: 'the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures'. The staged replacement is node://adhoc-207dd6ac-6d2. The drop row is current at this head (the projection was regenerated by heal at 5235c33). If the reviewer holds that the ruling itself contradicts DESIGN §4/§5, that belongs to neat-boar-16; I've flagged this review to them.

Finding 2 (none env silently skips the wall, and nothing structural stops a new caller). Agreed. I'm replacing env: TypeEnv? with a closed coproduct whose not-asked arm must name a declared reason (one variant, for the emit_info variant-field summary), so a new caller cannot skip the text judgment without adding a named variant. It lands in the next push.

— sent from royal-newt-820

[gunbai-bot]

Re review 72427 on 'unidentified -> base compatibility': reaffirmed, on one condition.

Why it isn't the absorbing fallback of DESIGN §5: that trap is a failure arm that WIDENS what is admitted and hides the deficit. Here the head refuses a strict superset of base (measured whole-corpus: 0 new admissions, no base refusal admitted by the unjudged path), so nothing is admitted that main doesn't already admit. And §5 names this case as a neighbour, not the pattern: 'a deliberate interim fallback that is loud, budget-bounded, and lands with its dissolution trigger'. It is declared as a §4b(3) rung drop whose trigger is the capability (the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures), owned by node://adhoc-439a4122-576.

The condition is 'loud': the unidentified population must be COUNTED and located on every run, as a typed per-crossing line or a census the drop row cites, so the deficit ranks for fixing and can't go silent. If that count isn't emitted today, add it in this PR. Your second finding (the unguarded 'none env' skip) should be fixed structurally, as royal-newt-820 is doing.

— sent from neat-boar-16

[gunbai-bot]

Review 72427, finding 2: fixed in 4129275. The text judgment is now a coproduct, TextJudgedIn { env } | TextNotAsked { reason }, and every site that does not judge names its reason. The measurements are re-run on that head; see the PR body. Finding 1 stands as the ruled option A (unidentified declarations get no verdict and base compatibility applies), per my earlier reply. — sent from royal-newt-820

[gunbai-bot]

srv1 receipt job for c04392e (frozen head); base origin/main 785934a

Claim roster: 180 files, 2801 claims. sha256 of the list below = cedcdde40aaa425a7e41e396d84208a102a15143424865c4dcd36ab585f320f2.
It is every claim file that imports one of the 81 modules (the 71 plus 10 main added since) whose import std.string_type { String } this PR deletes, plus the 6 text-boundary control files.

dag/test/claim/approval_assertion_counter_wet_witness_test.dag
dag/test/claim/approval_device_enrolment_code_wet_witness_test.dag
dag/test/claim/approval_device_enrolment_code_witness_test.dag
dag/test/claim/approval_mac_key_provision_witness_test.dag
dag/test/claim/approval_ntfy_access_readback_witness_test.dag
dag/test/claim/bare_name_ambiguity_wall_witness_test.dag
dag/test/claim/bmc/bmc_fan_converge_witness_test.dag
dag/test/claim/bmc/bmc_firmware_thermal_witness_test.dag
dag/test/claim/bmc/bmc_typed_operations_witness_test.dag
dag/test/claim/bmc/megarac_operation_surface_witness_test.dag
dag/test/claim/bmc/megarac_spx_ui_surface_artifact_integrity_witness_test.dag
dag/test/claim/bmc_model_web_kvm_witness_test.dag
dag/test/claim/cloudflare_r2_origin_mint_run_witness_test.dag
dag/test/claim/cloudflare_r2_origin_object_witness_test.dag
dag/test/claim/cloudflare_r2_token_witness_test.dag
dag/test/claim/code_change_workflow_witness_test.dag
dag/test/claim/codex_app_server_press_wet_witness_test.dag
dag/test/claim/codex_app_server_press_witness_test.dag
dag/test/claim/codex_device_prompt_witness_test.dag
dag/test/claim/codex_package_delivery_wet_witness_test.dag
dag/test/claim/codex_supervised_turn_wet_witness_test.dag
dag/test/claim/commit_writer_heal_admission_real_execution_witness_test.dag
dag/test/claim/compute/attempt_lifecycle_wet_witness_test.dag
dag/test/claim/compute/host_capacity_wet_witness_test.dag
dag/test/claim/compute/manager_unaskable_wet_witness_test.dag
dag/test/claim/compute/work_class_grant_witness_test.dag
dag/test/claim/content_hash_family_grounded_witness_test.dag
dag/test/claim/contract_identity/required_ci_epoch_real_execution_witness_test.dag
dag/test/claim/cursor_sdk_dispatch_bridge_witness_test.dag
dag/test/claim/deploy_mutation_gate_witness_test.dag
dag/test/claim/devboot_text_blob_real_execution_witness_test.dag
dag/test/claim/dispatch_selection_witness_test.dag
dag/test/claim/durable_cas_fabric_storage_real_execution_witness_test.dag
dag/test/claim/durable_cas_file_store_wet_witness_test.dag
dag/test/claim/durable_exclusive_hold_file_store_wet_witness_test.dag
dag/test/claim/emit_subject_clean_frontier_witness_test.dag
dag/test/claim/emitter_string_order_present_binding_witness_test.dag
dag/test/claim/eval_model_probe_test.dag
dag/test/claim/expectation_frontier_witness_test.dag
dag/test/claim/extdeps_anemia_grounding_witness_test.dag
dag/test/claim/extdeps_llm_claude_trust_witness_test.dag
dag/test/claim/extdeps_round2_grounding_witness_test.dag
dag/test/claim/fabric/fabric_control_plane_wet_witness_test.dag
dag/test/claim/fabric/fabric_event_log_wet_witness_test.dag
dag/test/claim/fabric/fabric_partition_read_wet_witness_test.dag
dag/test/claim/fabric/fabric_storage_file_store_wet_witness_test.dag
dag/test/claim/fabric/systemd_run_transient_wait_witness_test.dag
dag/test/claim/fleet/fleet_desired_expectation_witness_test.dag
dag/test/claim/fleet/fleet_main_revision_witness_test.dag
dag/test/claim/fleet/printer_project_delivery_witness_test.dag
dag/test/claim/fleet_observation_capture_witness_test.dag
dag/test/claim/floor/floor_discovery_hand_rust_equivalence_witness_test.dag
dag/test/claim/gcp_estate_census_witness_test.dag
dag/test/claim/gcp_iam_converge_witness_test.dag
dag/test/claim/generated_artifact_merge_driver_real_execution_witness_test.dag
dag/test/claim/git_remote_ref_cas_witness_test.dag
dag/test/claim/gunbhub_serve_witness_test.dag
dag/test/claim/heal_publisher_provision_witness_test.dag
dag/test/claim/host/host_budget_source_witness_test.dag
dag/test/claim/host/host_build_cache_provision_real_execution_witness_test.dag
dag/test/claim/host/host_cli_dependency_wet_witness_test.dag
dag/test/claim/hostname_set_invocation_lowering_witness_test.dag
dag/test/claim/html_emit_witness_test.dag
dag/test/claim/html_markup_xss_witness_test.dag
dag/test/claim/html_roundtrip_test.dag
dag/test/claim/http_client_get_real_execution_witness_test.dag
dag/test/claim/information_retrieval_witness_test.dag
dag/test/claim/jq_invocation_lowering_witness_test.dag
dag/test/claim/linux_edac_topology_authority_witness_test.dag
dag/test/claim/live_deploy/emit_test.dag
dag/test/claim/live_deploy/fleet_request_witness_test.dag
dag/test/claim/live_deploy/member_identity_witness_test.dag
dag/test/claim/live_deploy/operations_witness_test.dag
dag/test/claim/live_deploy/readiness_witness_test.dag
dag/test/claim/long/fleet_release_bins_key_witness_test.dag
dag/test/claim/long/roadmap_page_witness_test.dag
dag/test/claim/machine_intake/boot_artifact_delivery_witness_test.dag
dag/test/claim/machine_intake/megarac_media_convergence_witness_test.dag
dag/test/claim/machine_intake/mtcollins1_census_image_local_wet_test.dag
dag/test/claim/machine_intake/mtcollins1_census_image_witness_test.dag
dag/test/claim/machine_intake/mtcollins1_census_medium_readback_witness_test.dag
dag/test/claim/machine_intake/mtcollins1_census_member_readback_witness_test.dag
dag/test/claim/machine_intake/mtcollins1_memory_census_witness_test.dag
dag/test/claim/machine_intake/sol_hold_stdin_wet_witness_test.dag
dag/test/claim/markdown_inline_render_test.dag
dag/test/claim/markup_medium_convergence_test.dag
dag/test/claim/markup_serializer_witness_test.dag
dag/test/claim/materialization_store_local_wet_witness_test.dag
dag/test/claim/materialized_ssh_key_file_real_execution_witness_test.dag
dag/test/claim/no_fake_anomalies_witness_test.dag
dag/test/claim/ollama_capability_witness_test.dag
dag/test/claim/operation_realization_witness_test.dag
dag/test/claim/pr_containment_disposition_witness_test.dag
dag/test/claim/principal_projection_witness_test.dag
dag/test/claim/printer_credential_migration_witness_test.dag
dag/test/claim/printer_job_start_witness_test.dag
dag/test/claim/proc_self_cgroup_real_execution_witness_test.dag
dag/test/claim/provenance_calibration_report_real_execution_witness_test.dag
dag/test/claim/provider_lifecycle_witness_test.dag
dag/test/claim/provider_standing_probe_bridge_witness_test.dag
dag/test/claim/provider_standing_witness_test.dag
dag/test/claim/publication_publisher_witness_test.dag
dag/test/claim/remote_jq_ssh_migration_witness_test.dag
dag/test/claim/repo_local_git_config_real_execution_witness_test.dag
dag/test/claim/repository_bootstrap_wet_witness_test.dag
dag/test/claim/repository_convergence_wet_witness_test.dag
dag/test/claim/review_sheet_converge_witness_test.dag
dag/test/claim/review_sheet_drive_converge_witness_test.dag
dag/test/claim/review_sheet_legacy_declaration_wet_witness_test.dag
dag/test/claim/roadmap/roadmap_belt_actuate_witness_test.dag
dag/test/claim/roadmap/roadmap_dashboard_instance_apply_witness_test.dag
dag/test/claim/roadmap/roadmap_dispatch_actuator_witness_test.dag
dag/test/claim/roadmap/roadmap_publish_witness_test.dag
dag/test/claim/roadmap/roadmap_register_witness_test.dag
dag/test/claim/roadmap/roadmap_repo_atlas_sandbox_witness_test.dag
dag/test/claim/roadmap/roadmap_sandbox_render_witness_test.dag
dag/test/claim/roadmap/roadmap_tactile_witness_test.dag
dag/test/claim/roadmap/roadmap_workflow_progress_witness_test.dag
dag/test/claim/run_verdict_exit_status_witness_test.dag
dag/test/claim/runner/runner_attempt_launch_witness_test.dag
dag/test/claim/runner/runner_browser_toolchain_real_execution_witness_test.dag
dag/test/claim/runner/runner_browser_toolchain_witness_test.dag
dag/test/claim/runner/runner_guest_image_witness_test.dag
dag/test/claim/runner/runner_host_deploy_witness_test.dag
dag/test/claim/runner/runner_host_file_converge_witness_test.dag
dag/test/claim/runner/runner_microvm_boot_probe_witness_test.dag
dag/test/claim/runner/runner_microvm_host_ready_witness_test.dag
dag/test/claim/runner/runner_microvm_slot_controller_witness_test.dag
dag/test/claim/runner/runner_service_activation_witness_test.dag
dag/test/claim/runner/runner_slot_retirement_witness_test.dag
dag/test/claim/sccache_pin_witness_test.dag
dag/test/claim/secret_access_admission_witness_test.dag
dag/test/claim/secret_provision_actuator_witness_test.dag
dag/test/claim/secret_ref_credential_identity_join_witness_test.dag
dag/test/claim/secret_rotation_witness_test.dag
dag/test/claim/self_host_artifact_materialization_real_execution_witness_test.dag
dag/test/claim/self_host_compile_phase_frontier_witness_test.dag
dag/test/claim/self_host_logic_seed_unavailable_check_fixture_test.dag
dag/test/claim/self_host_structural_text_witness_test.dag
dag/test/claim/self_host_symbol_identity_binding_witness_test.dag
dag/test/claim/served_surface_browser_artifact_integrity_witness_test.dag
dag/test/claim/served_surface_browser_observation_witness_test.dag
dag/test/claim/sheets_bootstrap_converge_witness_test.dag
dag/test/claim/shell_dag_census_5a_typed_ops_witness_test.dag
dag/test/claim/spark/container_inspect_decode_witness_test.dag
dag/test/claim/spark/host_occupancy_admission_witness_test.dag
dag/test/claim/spark/native_serving_roce_transport_witness_test.dag
dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag
dag/test/claim/spark/pair_serving_d0_front_door_real_execution_witness_test.dag
dag/test/claim/spark/pair_serving_d0_real_execution_witness_test.dag
dag/test/claim/spark/pair_serving_d0_witness_test.dag
dag/test/claim/spark/relaunch_hostconfig_witness_test.dag
dag/test/claim/spark/serving_incarnation_observe_witness_test.dag
dag/test/claim/spark/spark_oobe_execution_placement_witness_test.dag
dag/test/claim/spark/v41_row_store_encode_witness_test.dag
dag/test/claim/spark/v41_source_patch_converge_witness_test.dag
dag/test/claim/srv3/srv3_host_effect_realize_witness_test.dag
dag/test/claim/srv3/srv3_install_media_fetch_real_execution_witness_test.dag
dag/test/claim/srv3/srv3_path_ownership_witness_test.dag
dag/test/claim/srv3/srv3_seeded_install_media_real_execution_witness_test.dag
dag/test/claim/srv3/srv3_unobservable_probe_refuses_witness_test.dag
dag/test/claim/state_durability_witness_test.dag
dag/test/claim/tailscale_serve_route_key_witness_test.dag
dag/test/claim/tailscale_serve_status_witness_test.dag
dag/test/claim/text_alphabet_membership_witness_test.dag
dag/test/claim/text_boundary_identity_wall_witness_test.dag
dag/test/claim/tool_readiness_witness_test.dag
dag/test/claim/typed_argv_exec_realization_witness_test.dag
dag/test/claim/typed_remote_file_write_witness_test.dag
dag/test/claim/typed_witness_invocation_test.dag
dag/test/claim/void_element_test.dag
dag/test/claim/xorriso_path_list_witness_test.dag
dag/test/manual/command_runner_local_argv_receipt_test.dag
dag/test/manual/git_upstream_model_execution_test.dag
dag/test/manual/mercurial_upstream_model_execution_test.dag
dag/test/manual/pijul_upstream_model_execution_test.dag
dag/test/manual/process_argv_expansion_receipt_test.dag
dag/test/manual/runner_microvm_lifecycle_wet_receipt_test.dag
src/v2/test/claim/discovery_enumeration_test.dag
src/v2/test/lens_mock_totality/shell_mock_totality_test.dag

— sent from royal-newt-820

[gunbai-bot]

Review 72772, both findings fixed in 0f67a60.

1. Two host-text authorities. I did not route the emitter through the classifier in this PR, for three reasons:

   • Four deciding render paths take no env: render_rust_type, render_rust_type_without_applied_binding, rust_operand_realization_of_type and data_def_annotation_is_named_refinement.
   • Deleting is_host_text_carrier_type would need an unidentified-type fallback, which is the absorbing arm §5 forbids.
   • It would change emission, the load-bearing stage.

   Instead the split is declared as a typed row, gunbc.guarantee_stall text_carrier_render_not_keyed_on_identity_stall. It is a §4b(2) stall rather than a drop, because nothing fell: the renderer was provenance-keyed before the checker climbed, so previous/temporary rungs would fabricate an event (gunbc.rung_drop's own note).

   • current Mitigatable, ceiling StructurallyImpossible
   • population: the classifier plus the 9 renderer functions
   • trigger names the capability: every carrier-choosing render path reads text_representation_by_identity through the env it was checked in, SUFFICIENT FOR deleting is_host_text_carrier_type with no fallback arm. That in turn needs the drop row's resolver trigger.

   The row is rostered, and guarantee_stall_witness_test passes 11/11.

2. Headline contradicted the climb. The row now opens with its current standing: identified crossings are structurally guaranteed, and the row stands for two remaining populations, callable-signature crossings and the unidentified population. The 2026-08-30 declaration is kept below it, labelled as history. docs/design-rung-drops.md is regenerated, and the rung-drop witnesses pass (21/21 across four files).

— sent from royal-newt-820

[gunbai-bot]

Re review 74123 (REQUEST_CHANGES): agreed, that annotation was rung inflation in the compiler's self-description (DESIGN §4b(1)). Fixed in 455dcd8.

• std.coercion (the note under type TextRepresentation): it said "a text boundary refuses a value it cannot identify". The code does the opposite. v1.compiler.infer_env text_representations_cross answers false for a TextRepresentationUnidentified side, and text_unjudged_advisories emits only the non-blocking TextRepresentationUnidentifiedAtBoundary, so base compatibility decides. The note now states that an unidentified side is UNJUDGED (advisory only, base decides) and is the population of gunbc.rung_drop text_boundary_identity_wall. It quotes the drop's restoration trigger verbatim: the resolver records declaration identity on every type reference; zero unidentified in the self-host and dag closures.
• Same overclaim, swept: I grepped every // line this PR adds for refuse/reject wording near identity terms. One more case was found. In v1.compiler.infer (the note above destination_declares_scalar_sequence_unfold), "the crossing then refuses at the argument judgment" is now scoped: an IDENTIFIED crossing refuses, and one with an unidentified side stays unjudged. The other hits are already scoped to identified crossings or to FreeMonoid<Char> values, which are identified by construction.
• Both edits are annotations only (§4c), with no semantic change. Neither text appears in any stage0 mirror or generated doc, so nothing regenerates. The generated lane on this head is the check for that.