Retire 10 legacy extdeps frontier rows whose module defines exactly one declaration

[gunbai-bot]

What

10 extdeps modules declare extdeps_model_scope: ExternalModelScope (subject = the module's single declaration, citation = the module's pre-existing extdeps_external_authority_anchor) and their rows leave the frozen legacy manifest dag/gunbc/legacy_extdeps_scope_frontier.tsv in the same change — the manifest's own prescribed migration shape (add scope + carrier row + delete manifest row, remove-only, line-grain enforced by the placement gate).

Frontier: 382 → 372 rows (372 = 382 − 10. Main's manifest is 382 — the session-start baseline — and has not changed since 2026-09-26, #12341; there was no parallel shrink. This PR's 10 rows are exactly main's current manifest minus these ten.) Carrier roster rebuilt from current main + 10 (rosters disjoint; three-way cover holds).

This is a walk-back of this PR's first push (203 rows) in response to review: 158 of those modules are returned to the frontier. The review was right — see "Subject selection" below.

Subject selection: the rule, and why only 45 rows could carry it

The scope's subject is a DeclarationRef that must name the declaration the module exists to model. For 158 of the original 203, the pick was positional (first declaration), and positional picks are guesses:

• Validated against the precedent set: main already carries 464 hand-adopted scopes. In every module of that set defining exactly one candidate declaration (type/data/fn, helper and authority names excluded), the hand-pick is that declaration — 114/114, zero counterexamples. Conversely, the hand-set proves there is no mechanical rule for multi-declaration modules: 274 of the 464 hand-picked subjects are not local types at all (observation-surface rows, qualified cross-module refs like github.CodeSearch), and among type-subjects the hand-picks agree with the local reference-DAG root only ~half the time.
• So this PR retires only the true single-declaration modules (10 — after the first push's 45 was itself tightened when review showed modules like bmc/ipmi.dag pair one type with a service and helper declarations) — where uniqueness does the reading — and returns the rest to the frontier: 122 multi-root type modules, 24 multi-fact modules, 2 ambiguous data/fn modules, 35 single-type-but-multi-declaration modules (one type plus a service and/or helper declarations — e.g. bmc/ipmi.dag), plus llm/cli.dag (three anchors spanning Anthropic and OpenAI products — independently versioned upstreams; DESIGN 3 wants a split or per-product modules before any single scope).
• Multi-type modules whose unique reference-root disagrees with a first-type pick (e.g. access/aws_iam.dag, where the composite root is PolicyDocument, not Effect) were treated as ambiguous and reverted: an orphan root can equally be a second subject's component (access/posix.dag has two disjoint type components), so the root test alone is not a reading.

Per review point

1. Restating comments: the 4-line comment block is deleted everywhere (DESIGN 4c); the declaration is self-describing.
2. Subject choice: rule + validation + walk-back above. The 158 returned rows are exactly the "not obvious" set; the multi-upstream set is on the frontier, not covered by a single scope.
3. Grounding, plainly: this change declares placement; it adds no new grounding. first_citation reuses the anchor each module already carries. Anchor audit: all 10 kept modules' anchors cite real, non-self upstreams that are not Wikipedia (uri + locator). One of the ten, boot/framebuffer.dag, cites the OSDev Wiki (wiki.osdev.org) — accepted as the specialized reference for VGA hardware programming, which is exactly the hardware the module models; the exclusion that keeps the other 24 anchor modules on the frontier is the general encyclopedia (en.wikipedia.org) as a domain-shape citation, not a specialized reference wiki. On "declared version": external_model_scope_law records the operator verdict (gunbc#7571) that the scope deliberately carries no revision field — a subject module legitimately models multiple releases, and an exact revision is a fact on the module's data rows (fact grain), never a property of the module scope. The 28 self-cited and 24 wiki-cited anchor modules stay on the frontier, where they remain until §3 rules on self-citation and non-versioned sources.
4. Witnesses:
   • Removal → carriers_declare_scope_on_disk (hermetic suite dag/test/claim/external_model_scope_witness_test.dag). Shown red on this branch: stripping one kept module's scope → exit 1, exactly one failing claim, all 27 other claims (incl. the red_* machinery self-checks) still pass; restore → 28 PASS. Shown red at base: at origin/main, stripping adopted carrier vendor/microsoft.dag's scope → the suite refuses at resolve grain (the adopted-vendor claim references extdeps.vendor.microsoft.extdeps_model_scope directly), exit 1.
   • Wrong subject → no witness goes red today, and this PR states that as a gap rather than papering over it: the hermetic suite verifies the scope declaration's presence, not that its decl_name resolves. The natural closure is an index-grain host fact declaration_resolves(module_path, decl_name) wired into the frontier roster exactly like the floor's host-supplied is_carried; proposed as a follow-up.

Controls (final tree)

• Hermetic witness suite: 28 PASS / 0 FAIL, exit 0 (rosters resolve, disjoint, floor > 150, carriers content-verified on disk). Also green: the NonFoldResidue frontier test — the placement gate's diff-added-paths fold now names all nine GitDiffChangeStatus variants with no wildcard.
• Generated mirrors: first_generation_equal=true (zero drift; extdeps_languages_python_types.rs updated via the sanctioned --regen-round-cost round).
• Placement-gate arms vs this diff: no files added under dag/extdeps; manifest removals only; no post-freeze rows touched. The earlier floor RosterStale (yaml/types.dag#get) is gone: that row's discharge came from this PR's std.decl_ref import pulling std.methods (which declares get as a method) into the file's provider closure; with yaml/types.dag back on the frontier the pair is carried again and the debt roster is byte-identical to main.

What remains (372 rows), classified

(The class table below was drawn at the intermediate 45-row pass, whose remainder was 337 = 382 − 45. This PR ships 10, so the live remainder is 372 = 337 + 35 — the 35 single-type-but-multi-declaration modules tightened out last (see subject selection) rejoin the frontier and are being reclassified by the follow-up batches.)

Count	Class	Disposition
158	single-upstream, but multi-declaration modules	need a per-module reading (as the 464 adopted carriers got), a split, or a vocabulary extension before a scope can be honest — returned to the frontier by this PR
19	several independently versioned upstreams in one module	§3: split first
3	no placeable subject declaration	redesign first
2	service-shaped bodies	redesign first
28	self-cited (gunb-ai)	§3 ruling needed
24	wikipedia-cited	§3 ruling needed
103*		(the 158 above include the earlier "103 mechanically placeable" rows — they are placeable only in the sense that a subject can be attached; attaching the right one is the reading this PR could not certify at scale)

Inherited stale row

Current main's carrier roster carried a row for bmc/ipmi_boot_selection.dag although that file declares no scope (it also sits in the frozen manifest). The suite only gates PRs, so main never noticed. This PR drops that one disk-contradicting carrier row (its manifest row is untouched — the file stays tracked on the frontier); flagged to the roster's owners.

[gunbai-bot]

Fixed by a surgical rebuild — new head 0eca3397e4 (single commit on current main).

The 180-file commit was a working-tree accident, not an intended change: unrelated dirty state from an older base (fleet deletions, derived_type_origin, spark, transport strings, Cargo.lock) got swept into the squash. review 38602's reading is exactly right — "a working tree built from an older base, regenerated, and committed on top of the newer base."

The rebuilt branch was constructed from origin/main plus only the intended paths, and verified: 49 files total — 45 extdeps modules, the frontier manifest (382 → 337, remove-only), the carrier roster (464 → 509), one corrected comment in extdeps_scope_placement_gate.dag, and one regenerated mirror (extdeps_languages_python_types.rs, via the sanctioned --regen-round-cost round, converged). floor_unimported_bare_provider_debt_roster.dag is byte-identical to main (the spark/v41_* get pairs main retired are untouched; yaml/types.dag#get is carried again since that module is back on the frontier). No fleet, std, spark, or workflow paths are touched; no witnesses or recurring-failure-mode rows removed; §4b(4) red/positive controls intact (28 PASS / 0 FAIL on the branch; removal of an adopted carrier's scope shown red at base via the resolve-grain refusal).

The four substantive review points are answered in the rewritten PR body: the subject-selection rule and its 114/114 validation against the hand-adopted precedent, the 203 → 45 walk-back (multi-declaration modules returned to the frontier rather than covered by a scripted scope), the explicit "placement declared, not grounded" statement with the external_model_scope_law no-revision-field verdict (gunbc#7571), and the named removal witness plus the honestly-stated wrong-subject gap (no witness is red today; proposed closure is an index-grain declaration_resolves host fact following the floor's is_carried pattern).

[gunbai-bot]

Both findings fixed and pushed as eb2b2963e1:

1. clock_gettime / parallel migrations: the root cause was that my carrier roster was rebuilt from my own older commit, while main had migrated further rows in parallel (clock_gettime among them) — my roster dropped main's newer carrier rows and my earlier commit even reverted some of main's migration content (the '7 extra' deletions you saw). The roster is now rebuilt from current origin/main plus only this PR's 10 rows, and every module file that belongs to main's parallel migrations is byte-identical to main again. The stale inherited row for bmc/ipmi_boot_selection.dag (carrier row + manifest row, no scope on disk — present at my merge base, unnoticeable because the suite only gates PRs) is dropped as disk-contradicting, with its manifest row untouched and a note in the body for the roster owners.

2. ipmi.dag ownership mismatch: agreed — one type plus a service and helper declarations is not 'a single declaration'. The bar is now exactly one top-level declaration of any kind (type, data, fn, service; helpers excluded). That demotes 35 of the previous 45 (including ipmi.dag, openbmc.dag, tcgplayer/store.dag), all restored to the frozen frontier; 10 rows remain, and the title is now literally true for each.

Also, per the floor's NonFoldResidue affected-set check (two unrostered wildcard arms in my route): the placement gate's diff_added_paths_observation fold now names all nine GitDiffChangeStatus variants explicitly — no wildcard, no residue row needed; and formats/elf/encode.dag left the route entirely with its demotion. Suite 28 PASS / 0 FAIL; regen first_generation_equal=true.

[briansrls]

Approved at eb2b2963e1. The ten migrated modules really do have one local modeled declaration, each scope cites that declaration symbolically, and the carrier/frontier/legacy-manifest moves are symmetric. Removing the stale bmc/ipmi_boot_selection.dag carrier row while leaving it on the frontier is also correct.

One wording correction remains in the PR description: boot/framebuffer.dag cites wiki.osdev.org, so the claim that all ten anchors are “non-wiki” is false as written. This is not barred by the current ExternalModelScope law, which requires one subject and one-or-more citations but has no primary-source tier. Please say “non-Wikipedia” or explicitly record OSDev Wiki as the accepted specialized reference; source-tier enforcement would be a separate policy change.

[briansrls]

Re-approved at c2b6da4. Post-eb2b2963e1 branch history contains only two origin/main merge commits and 18ea2b6, whose sole change deletes the NFR row for dag/gunbc/instruments/extdeps_scope_placement_gate.dag::diff_added_paths_observation. That is exactly the site already totalled by the approved mechanism: its GitDiffChangeStatus match names Added, Copied, Renamed, Deleted, Modified, PairingBroken, TypeChanged, Unmerged, and Unknown, with no wildcard. The current PR-owned diff is therefore the approved 10-row migration plus that one now-stale roster deletion; no other branch-authored content changed. The PR body now correctly distinguishes OSDev Wiki from Wikipedia and reconciles the shipped population to 10. All four required jobs are green at this head, and GitHub reports it mergeable.