Floor: derive cross-claim pure-share from planned claims' call-site demand; delete the hand roster

dag/gunbc/floor/floor_call_site_demand_seed_growth.dag

@@ -0,0 +1,62 @@
+module gunbc.floor_call_site_demand_seed_growth
+
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+// SEED-RETAINED RECEIPT for the per-claim call-site demand observer: the seed realization of
+// v2.workflow.floor_pure_producer_share CallSiteDemandObservation, which the derived cross-claim
+// share decides over. The row type, its causes and the decision are .dag; the seed walks the
+// planned claims' reach and reads call sites, and installs the decided rows at their sites.
+data floor_call_site_demand_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "CallSiteDemandCause", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "CallSiteDemandRow", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "CallSiteDemandObserver", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "CLOSED_ARGUMENT_NORMALIZER", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "SiteKey", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "SourceIndices", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "SiteFact", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "DeclFacts", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "IdentityCell", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "site_key_of", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.claim_call_site_demand", decl_name: "render_site", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "derive_and_install_cross_claim_share", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "install_cross_claim_derived_share", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_site_admitted", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_SITE_GATED", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_ADMITTED_SITES", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "install_cross_claim_cost_floor_steps", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "install_cross_claim_cost_floor_cpu_ms", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_fill_below_cost_floor", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CrossClaimSiteSet", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "retire_cross_claim_site_below_cost_floor", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CrossClaimEntry", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "served_instance_key", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "portable_is_composite", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CrossClaimArgProbe", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_arg_probes", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_entry_matches", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_lookup_arg_reify_count", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "install_cross_claim_in_flight_wall_bound", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "in_flight_cross_claim_fill_wall_nanos", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_below_cost_floor_count", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_IN_FLIGHT_WALL_CAP_NANOS", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_COST_FLOOR_STEPS", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_FILL_NS_PER_STEP_CEILING", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "in_flight_cross_claim_fill_progress", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run.shared_fill", decl_name: "render_shared_fill_unattributed_text_mirror", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "list_value_items", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "install_cross_claim_derived_share_with_net_only", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_site_is_net_only", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "publish_cross_claim_fill", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_NET_ONLY_SITES", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "CROSS_CLAIM_STORE_DECLINES", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "cross_claim_store_declines", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.v1_interpreter", decl_name: "note_cross_claim_store_outcome", field: WholeDeclaration }
+  ],
+  reason: "WHAT THIS REPLACES, and why the change is a deletion first. Cross-claim pure-share admission was a hand-authored roster of 575 warm and 5 claim-forced qualified spellings in v2.workflow.floor_pure_producer_share, a second authority over a fact the demand graph carries (DESIGN section 3). Any witness module whose claims re-ran a module-constant producer had to be hand-restructured or hand-rostered before it fit its enrolment margin (gunbc#13030 C3; gunbc#12506 the live case). The roster, its pending-candidate shape, its two collision walls and the seed's plain warm loop (warm_cross_claim_pure_producer, PureProducerWarmRefusal) are deleted in the same change, and admission is now v2.workflow.floor_pure_producer_share derive_cross_claim_share over this observer's rows.\n\nWHY RUST IS STILL NEEDED, and it is one fact: no .dag carrier yet hands the floor PER-CLAIM CALL-SITE DEMAND IDENTITY -- the call sites a planned claim reaches, each with its callee declaration and the canonical preimage of its argument row. DESIGN section 3b's keys row lists demand identity as a declared frontier of demand-engine M1.b, and the floor does not give .dag the claim bodies as values; deriving them in .dag would re-parse and resolve the closure in the interpreter per run. So the seed observes, as one realization of the .dag row type CallSiteDemandObservation, and the operator ruling for this lane (sharp-raven-357, 2026-10-02) admits it on exactly that condition.\n\nWHAT IS NOT GROWN: no admission policy. The seed counts distinct planned claims per identity -- a fact across the claim-frame boundary only it can see -- and decides nothing: the two-claim threshold, the identity grade, and the refused and carried-input exclusions are the .dag fold's, and the seed refuses if the fold's partition does not reconcile with the observed closed rows. No widening: a call whose callee is unresolved or effectful, or whose argument row is not closed, is counted under its CallSiteDemandCause and never admitted. No warm: an admitted site fills on the first planned claim that evaluates it (its wall is excused from the claim's wall deadline only in proportion to the evaluator steps it has performed, at the declared ceiling floor_cross_claim_fill_wall_per_step_ceiling, under the preparation wall safety limit as the outer hard cap, so a stalled fill and a runaway one both still interrupt, naming the producer, its steps and its wall; the declared cost floor is applied to the fill's own steps at retention), netted from that claim's clocks and eval steps through the existing CrossClaimFillGuard, so a statically reached site no claim evaluates costs nothing (which also discharges gunbc#13030 C3 part 1: nothing outside the planned claims' reach is filled). No new correctness dependence: the tier still keys every store on the evaluated argument values and verifies the stored preimage before any serve, so a misjudged site costs a missed share or a wasted store, never a wrong value.\n\nWHY IT IS ADMITTED AGAINST THE v1 FREEZE: gunbc.v1_maintenance_standing v1_seed_standing admits work serving the v2 self-host program, and the required floor gates every v2 change. Seed growth here is realization only -- the observer, the site-gated admission set and its check, and the install -- which is the condition the ruling set.\n\nREDS ENROLLED: claim_call_site_demand tests a_constant_reached_by_two_claims_counts_two_and_a_private_one_counts_one (the discriminating pair, with a claim calling the shared helper twice still counting once), an_unplanned_claim_contributes_no_demand, a_parameter_bound_argument_is_counted_open and an_effectful_callee_is_counted_under_its_cause; v1_interpreter a_derived_producer_is_admitted_only_at_its_admitted_sites (the pair varies only the call site, with an ungated control), a_derived_fill_below_the_cost_floor_is_declined_and_one_above_is_stored (the pair varies only the floor) and a_stalled_in_flight_fill_is_excused_nothing_and_a_working_one_by_its_steps (the stalled control); the decision's REDs are .dag, in v2.test.floor.pure_producer_share_refusal.\n\nTHE SINGLE-CLAIM FILL DEBT JOIN (sharp-raven-357 ruling A, 2026-10-03): v2.workflow.floor_pure_producer_share floor_single_claim_fill_debt is a monotone debt set of claims whose own fixture fill is netted from their budget, each admission reported with basis SingleClaimFillDebt naming the claim. The .dag fold decides which one-claim identities are admitted on a member's behalf; derive_and_install_cross_claim_share realizes the identity join -- a PLANNED active member with no admitted fixture identity refuses SingleClaimFillDebtStale -- and adds no declaration for it. The decision's REDs are .dag (an_active_debt_members_fixture_is_admitted_and_names_its_claim against its retired and non-member controls).\n\nNET-ONLY SITES AND THE DECLINE REPORT: a single-claim fill debt site is netted from its one claim and its value is NOT retained (publish_cross_claim_fill, CROSS_CLAIM_NET_ONLY_SITES), because retaining values only one claim ever demands exhausted the tier byte budget on floor probe 37142207751 and left the declined fills on their claims; and every store the tier declines is reported per producer and cause ([cross-claim-share-store-declined], [cross-claim-share-tier]). RED: a_net_only_fill_is_netted_without_retaining_its_value.\n\nTHE UNATTRIBUTED HITS ARE NAMED BY KEY (sharp-raven-357's condition): the shared-fill ledger's unattributed_hits aggregate is now also rendered one line per (frame, phase, cache, key) through gunbc.observation_ci_render ci_shared_fill_unattributed_text and its seed mirror render_shared_fill_unattributed_text_mirror, so whether preparation reads a producer is answerable by identity. REDs: shared_fill a_hit_with_no_recorded_fill_is_counted_never_dropped (in-claim frame) and a_hit_outside_the_fold_is_named_by_key_and_frame; .dag w_shared_fill_unattributed_line_names_frame_phase_and_key.",
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+  trigger: "Delete the observer (claim_call_site_demand and derive_and_install_cross_claim_share's observation half) when per-claim call-site demand identity is available to .dag: demand-engine M1.b's demand-identity carrier produces CallSiteDemandObservation rows for the planned claims, so the derivation reads them from a modeled carrier and no host walk remains. The site-gated admission set and its check retire with the cross-claim tier itself (gunbc.cross_claim_pure_share_seed_growth's trigger), not with this one.",
+  current_boundary: "v1_compiler.cli_run.required_floor_runner planned claims -> v1_compiler.cli_run.claim_call_site_demand CallSiteDemandObserver observe -> v2.workflow.floor_pure_producer_share floor_cross_claim_share_derivation -> v1_compiler.cli_run derive_and_install_cross_claim_share -> v1_compiler.v1_interpreter install_cross_claim_derived_share / cross_claim_site_admitted -> [floor-phase] phase=cross-claim-share-derivation and [cross-claim-share-admitted] lines"
+}

dag/gunbc/observation_ci_render.dag

@@ -1163,6 +1163,48 @@ fn ci_shared_fill_row_text(
   )
 }
 
+// WHICH FRAME A READ WITH NO OBSERVED FILL CAME FROM. The total line's unattributed_hits is an
+// aggregate nobody can disposition; these two arms split it by where the read happened, and the
+// per-key line below names the identity, so "does preparation read this producer?" is answered
+// by identity rather than by comparing two runs' wall time.
+type SharedFillUnattributedFrame
+  = UnattributedHitOutsideFold
+  | UnattributedHitInClaimWithoutFill
+
+fn shared_fill_unattributed_frame_tag(frame: SharedFillUnattributedFrame) -> String {
+  match frame {
+    UnattributedHitOutsideFold => "outside-fold"
+    UnattributedHitInClaimWithoutFill => "in-claim-without-fill"
+  }
+}
+
+// One line per (frame, phase, cache, key). `phase` is the floor seam current when the read
+// happened (a preparation warm reads under its seam), or `claim` for an in-claim read.
+fn ci_shared_fill_unattributed_text(
+  frame: SharedFillUnattributedFrame,
+  phase: String,
+  cache: String,
+  key: String,
+  hits: Nat,
+) -> String {
+  concat(
+    "[floor-shared-fill-unattributed] frame=",
+    concat(
+      shared_fill_unattributed_frame_tag(frame: frame),
+      concat(
+        " phase=",
+        concat(
+          phase,
+          concat(
+            " cache=",
+            concat(cache, concat(" key=", concat(key, concat(" hits=", to_string(hits)))))
+          )
+        )
+      )
+    )
+  )
+}
+
 // THE TOTAL LINE CARRIES BOTH DENOMINATORS AND THE HOLE. shared_fill_ms is the part of fill_ms
 // that removing any one module cannot recover; unattributed_hits is the count of reads served by
 // a fill this ledger did not observe, which is the honest statement that the shared figure is a

dag/gunbc/recurring_failure_mode/shared_precondition_re_derived_once_per_claim_frame.dag

@@ -20,7 +20,7 @@ data shared_precondition_re_derived_once_per_claim_frame: RecurringFailureMode =
 
     "SPECIMEN, gunbc#10882 and gunbc#10992. #10882 landed src/v2/test/native_decl_selection_test.dag into the required floor at 2026-09-10T20:53Z; its four witnesses each called collision_prepared, so the seed tokenized and parsed ~230 characters of synthetic source once per claim. required-witnesses-floor refused on main for nearly an hour with the summary claims_failed=0 interrupted_before_verdict=4 interrupted_cpu_deadline=4 -- NOTHING FAILING and the lane red, because an unreached verdict is fail-closed. Marginal CPU measured by claim_batch: 1113, 1330, 1375 and 1362ms against the 500ms line. #10992 repaired it by sharing the fixture at the resolved seam so the ingest is paid once, and the four rows fit.",
 
-    "SECOND SPECIMEN, gunbc#11032, arriving by the same recognition rule a day later and diagnosed by a lane that had not read this row. A newly landed family -- the where-refinement parse witnesses from gunbc#10946 -- refused the 500ms line on main with interrupted_before_verdict and nothing failing. Partitioned, the shared precondition dominated: v2.compiler.parse parse_grammar_digest and the production index were re-derived on EVERY PARSE CALL although prepare_grammar had fixed both before the first token, and the shared fixture sources were re-parsed per claim. The producer that named it is the floor's cross-claim demand census (main run 34556223550, required_floor_cross_claim_demand.tsv, row parse_grammar_digest). The repair was the one this row prescribes: carry both facts on the prepared grammar, the seam where the grammar is already resolved, and share the fixture trees warm (v2.workflow.floor_pure_producer_share floor_cross_claim_pure_producers_warm). Its frame is narrower than a claim -- per parse call -- which widens this row's reach rather than founding a neighbour: the question that finds it is still the one above. It also shows the census already locating the class and nothing refusing on it, which is this row's next-rung trigger unmet.",
+    "SECOND SPECIMEN, gunbc#11032, arriving by the same recognition rule a day later and diagnosed by a lane that had not read this row. A newly landed family -- the where-refinement parse witnesses from gunbc#10946 -- refused the 500ms line on main with interrupted_before_verdict and nothing failing. Partitioned, the shared precondition dominated: v2.compiler.parse parse_grammar_digest and the production index were re-derived on EVERY PARSE CALL although prepare_grammar had fixed both before the first token, and the shared fixture sources were re-parsed per claim. The producer that named it is the floor's cross-claim demand census (main run 34556223550, required_floor_cross_claim_demand.tsv, row parse_grammar_digest). The repair was the one this row prescribes: carry both facts on the prepared grammar, the seam where the grammar is already resolved, and share the fixture trees across claims (v2.workflow.floor_pure_producer_share, whose admission is now derived by derive_cross_claim_share). Its frame is narrower than a claim -- per parse call -- which widens this row's reach rather than founding a neighbour: the question that finds it is still the one above. It also shows the census already locating the class and nothing refusing on it, which is this row's next-rung trigger unmet.",
 
     "THIRD SPECIMEN, gunbc#11291, and it is recorded because of WHERE it occurred rather than because the shape is new: inside the repair for the defect this row's own consumers are blocked on. The reflection guard that makes a bare type spelling refuse rather than resolve to one of several same-spelled declarations had to establish bare-name multiplicity, and v2.std.decl_index decl_facts_at is keyed by QUALIFIED name, which a bare spelling has none of -- so the only substrate answer was to fold the whole declaration corpus, once per call. The lane that was meant to make the floor's cross-claim memo keyable therefore reproduced the recurrence it was meant to unlock, which is the hazard worth naming: a repair for this class is exactly where an author is least likely to look for it.",