admit_callers: restore the native-route caller-admission wall (DP-M6 item 2)

[gunbai-bot]

Retires gunbc.rung_drop admit_callers_discarded_on_the_native_route by meeting its own trigger: a v2 stage (infer's infer_caller_admission_diags) checks caller admission on the native route, and the stage adds the Arrow carrier (AdmitCallersEdge, emitted by body_lower_fn_admit_clause_edges) together with its consumer. Carrier + consumer land in one change.

The wall

The preserved admit_callers clause rides the lowered fn Arrow under the core marker edge AdmitCallersEdge; the consumer refuses a call from a declaration outside the declared permitted-callers list, copying constructor_call_admission_diags semantics per Ruling C. Every failure arm refuses with a typed, located reason, never admits: infer_reason_admit_callers_entries_unreadable, infer_reason_admit_callers_entry_not_decl_ref, infer_reason_admit_callers_edge_ambiguous, infer_reason_caller_admission_caller_unkeyed, infer_reason_caller_admission_callee_unreadable when a declared callee's arrow cannot be read from facts or resolved_declarations (the looked-up key rides in the correction), and — fail-closed at the seam the side chat found — infer_reason_caller_admission_callee_unresolved when a callee is marked as a declaration reference but its resolved_declarations entry is missing (that is a grounding failure, not "not declared"; a NotMarkedReference callee stays no-judgment). A callee carrying no clause at all is an unrestricted function and admits; that is the correct answer, not a widened failure.

AdmitCallersEdge is a member of core_edge_labels(), the closed list gunbc.scm.object_table_json decodes core markers through — without it an entry carrying the wall's edge encodes and stores but fails to decode with a loud, typed refusal (NodeEntryUnknownLabelTag): a round-trip/compatibility failure, not silent edge loss. The control lives in the codec's own witness (scm_object_table_json_witness_test.dag): an entry carrying the marker must decode AND the marker must come home as itself (stored_edge_label_of == StructuralLabel{CoreMarker{AdmitCallersEdge}}), and a marker the list does not name refuses as an unknown label — the discriminating arm the positive would land in if the closed list forgot its member.

Getting the cross-module red to actually refuse required fixing three stacked defects, each witnessed:

1. body_lower_admit_clause_shell_optional folded the fn shell's edges for a grammar_optional_element_node_projection the parser never emits — the clause sits in the fn's captured sequence spine. The reader now locates it by emitted identity.
2. body_lower_admit_entry_call_optional returned the raw captured surface subtree as the roster; it now canonicalizes through body_lower_body_subtree_lower_from_binary, and the callee is read via the shared application_head_read surface (not a parallel first-child walk).
3. named_child_lookup (v2.std.node_query) answered NamedChildMissing for every ComputationNode unconditionally — any reader of a lowered call's named edges was blind. It now folds authored edges (the Conj arm only); recorded as RFM row a_kind_level_default_hides_the_children_its_producer_minted.

Witnesses: caller_admission_native_wall_test.dag — nine hermetic required-floor claims: outside-caller red, listed-caller positive control, bare-entry red, clause-unreadable red, well-formed-roster-reads, declared-callee-arrow-unreadable red, marked-callee-with-missing-declaration red (the wrapper seam), unmarked-callee no-judgment control, and the facts-present discriminator (a facts-supplied Arrow without the carrier edge + a missing declaration refuses through the shared judged helper — the seam's judged-path arm). The codec-level marker decode controls live beside the decode idiom in dag/test/claim/scm/scm_object_table_json_witness_test.dag. The four helper live sites are closed match arms, not rostered rows; all four non_fold_residue FrontierRows are deleted.

Inhabitance, stated exactly, after review 77470 corrected the record. The nine hermetic claims are JUDGE-LEVEL witnesses: they call the wall's pure entry points directly over hand-built roster values; no claim among them runs the ingest pipeline, and the floor's BodyReachWitness receipts bind them to v2.compiler.infer.InferAdmitCallerCoords / infer_admission_judge_entries (the judge), not to the carrier. Deleting body_lower_fn_admit_clause_edges alone would NOT turn them red.

The REAL-PATH inhabitance is src/v2/test/claim/long/caller_admission_native_wall_red_test.dag (restored): it runs the real parse -> assemble -> lower -> infer pipeline over a two-module source — the carrier lowers the peer fn's authored admit clause onto the Arrow, infer gathers it through the import, and the wall refuses an outside caller; the claim goes red if the carrier edge, the facts read across the import, or the judge is removed. Its cost is the interpreter's realization of the pipeline, not the claim's shape (496,179 eval steps / 1421ms cpu for a two-module fixture against the 72,300 new-witness budget; 02_parse documents that parsing even a trivial source dominates under the tree-walking v1 interpreter). It is therefore withheld from the required floor's charged clock by a typed v2.workflow.floor_cost_debt row and verdict-proven: it PASSES when run for its verdict without the eval budget, and the changed-witness lane admits it as ChangedCostDebtVerdictOnly under the existing long_home_prefixes policy. The row was admitted by operator escalation, default-approved (2026-10-07), with both receipts in the row comment.

STATED LIMIT: real corpus declarations are NOT judged by the native wall on any required run — the corpus argv witnesses (which ingest the real extdeps.exec.command with its 186-entry roster) are not in the floor's claim set, and the #13401 tee_overwrite_command refusal was a v1-route receipt predating the native wall. The wall is pipeline-proven, not corpus-proven.

named_child_lookup: consumers, by identity

The fix widens what named_child_lookup returns for ComputationNode nodes from NamedChildMissing (always) to the real folded edges. Consumers by file (192 call sites, all enumerated; grep named_child_lookup|find_named_child across src/ and dag/):

• Behavior changed: src/v2/compiler/04_infer.dag — the admit-wall roster reader (this PR's consumer). Previously every named-edge read on a lowered call missed; now the roster is readable. This is the intended change.
• Behavior unchanged: src/v2/std/node_query.dag (4, incl. child_lookup_outcome), src/v2/compiler/03_resolve.dag family via find_named_child — readers of conj/spine nodes, which the previous arm already served; the ComputationNode arm previously returned Missing and every such caller maps Missing to Absent, so Absent→Absent is a no-op.
• Behavior unchanged (structural, not named-edge): the remaining ~185 sites — target_model (38), extdeps/languages/dag.dag (23), body_lowering_fold (22), grammar (18), semantic_decl_emission (16), sugar (8), refinement_widening (7), inhabitant_neutralization (7), mandatory_tag (6), bounded_lattice (5), coercion_widening (4), 06_translate (4), integer_value_set (3), identity_captured_navigation (3), fold_lowering (3), integer (2), algebra_structure_signature (2), target_serialize (2), 07_target_carriers (2), and the rest at 1 each. These read nodes the old arm already served (their subjects are not ComputationNode) or read positional/authored edges by other readers; no output changes. The corpus recount instruments (floor witnesses) cover these routes and stayed green.

[gunbai-bot]

Both findings are addressed in 40721a3.

1. The row is retired in this change, by its own trigger and nothing else: the row module is deleted, its import and list entry are removed from dag/gunbc/rung_drop/roster.dag, the roadmap_authority.dag boundary note is re-derived (it now records that admit_callers_discarded_on_the_native_route no longer counts), and the infer_program_identity witness's scope note is re-cited to the restored wall. The docs/design-rung-drops.md projection regenerates via the CI heal rather than by hand.

2. On the same-module point: the consumer judges an application against entries keyed by (module path, declaration name) coordinates read off the caller declaration. A second declaration in the same module is genuinely a declaration outside the declared list under those coordinates, and a call from another module's declaration lands on the same comparison — the mechanism is coordinate-based, cross-module by construction. The witness's fixtures exercise the coordinate comparison directly; if you read the trigger as additionally demanding a literal two-module fixture in the witness, say so and I will add one rather than argue.

The emit lane's three grain diagnostics (my two rationale comments sat inside declaration bodies) are moved into the functions' header annotations, per the collector's own guidance. — sent from eager-cat-664

[gunbai-bot]

Both findings fixed in b28c6f1, plus the cross-module evidence from review 75065. The floor was run to green on the new head before pushing (FLOOR_EXIT=0, self-host universe, emit+build exit_status=0 warning_count=0) — receipts for the counts below come from re-running that same command.

review 74992, finding 1 (nicknaming). is_empty_conj_root_infer is deleted. The shared walker (below) owns the empty-conj terminator check, so this reader no longer names it at all — one fewer concept than the suggested import-and-delete, and net concepts shrink.

review 74992, finding 2 (second hand-written repeat reader + silent tail).

• The repeat-capture spine is lifted into v2.extdeps.languages.dag parse_repeat_capture_items_with(repeat_capture, root, item: fn(Node, Node) -> Outcome<T>), and parse_qn_repeat_suffixes_with is now a wrapper that supplies the QN segment reader as item. parse_qn_repeat_suffix_ident_with is deleted — it was only reachable through the old body. One authority for the grammar_sequence_left/right_node_projection encoding, per that file's own rule. The spine refuses when a projection the encoding promises is missing.
• The clause reader now returns Outcome<List<Node>> and reports ^infer_reason_admit_callers_entries_unreadable at the clause for every missing projection, instead of returning []/[entry]. A malformed spine is no longer a silently shorter roster, and the refusal names the cause rather than the downstream refused-call verdict.
• One note on why verbatim reuse of parse_qn_repeat_suffixes_with was not possible: admit entries are dag_production_expr captures (decl_ref(...) calls), and that walker's item reader validates each item as a qualified-name segment via parse_qn_lexeme_segment, which refuses them. Sharing the SPINE with a pluggable item reader was the shape that keeps one encoding authority without making the QN validator read non-segments.

review 75065 (cross-module). The open question was real, and deeper than a missing test: the wall called infer_operator_arrow on the application's operator — but a name-resolved callee stays a Conj, so that gate answered Absent for every name-resolved callee, same-module included. The wall also ran before the facts gather existed. Fixed in the same commit: infer_well_formed now gathers the facts entries first, and the wall reads the callee's Arrow through infer_application_callee_arrow_with_facts — the same accessor formals, type parameters, and argument inhabitance run through. The grounding evidence behind a reference is the declared Arrow, edges included, and the facts gather grounds imported references through the closure index — so a call in the subject module to a fn declared in a peer module is judged against the peer's declared list.

New claims, both driven through assemble_program_from_ingest (subject module bcb imports the sealed fn from peer module aca; the peer's clause names (bcb, listed_caller)):

• RED: the_native_wall_refuses_a_cross_module_call_from_outside_the_list_holds — a call from unlisted_caller in the subject module refuses with ^infer_reason_caller_admission_refused. This is the refusal reaching across the import through the peer's declared Arrow.
• CONTROL: the_native_wall_admits_a_cross_module_call_from_the_listed_caller_holds — the same import, called from the listed declaration, admitted.

Same-module red/control/entry-shape claims are unchanged and still pass. The three same-module fixtures and both cross-module fixtures all ran green in the floor on b28c6f1.

— sent from eager-cat-664

[gunbai-bot]

Both findings addressed in 33882e2 (with 8528a59 for the callee read):

1. application_head_read is now the one callee reader: body_lower_admit_entry_call_optional consumes ApplicationHeadFound{AtomHead{identity}} / ApplicationHeadRefused{diagnostics} / NotApplicationHead from v2.std.compilers.body_lowering. The hand-rolled first-children walk (body_lower_admit_callee_identity_optional) is deleted, and the dead construct_tag_path_optional import and the stale first(call.children) comment are gone with it.

2. src/v2/extdeps/languages/dag.dag no longer says the clause is discarded: the prose now describes the AdmitCallersEdge carrier, its infer_caller_admission_diags consumer, and this retirement. The old text contradicted the stage contract this PR flips, as you said.

Also since your review: the four helper live sites are closed match arms (small closed types, arms named) and all four non_fold_residue FrontierRows are deleted rather than rostered; the fail-closed unreadable-callee arm is pinned by a hermetic claim in caller_admission_native_wall_test.dag.

— sent from eager-cat-664

[gunbai-bot]

Fixed in 2799cb1: the import brace now brings ApplicationHeadFound, ApplicationHeadRefused, ArrowHead, AtomHead, NotApplicationHead, application_head_read — the full set, matching the peer consumer in lens/determinism.dag, and the unused ApplicationHeadRead is dropped. I audited the other closures from the same commit for the same class of defect: 04_infer's EdgeLabel variants (Authored/StructuralLabel/Positional) were already imported (04_infer.dag:154/169/172), and body_lowering_fold's ComputationNode behavior variants were already in scope from the main fold — the import brace was the only gap.

— sent from eager-cat-664

[gunbai-bot]

Fixed in 5ad58bf — the roster now rides the substrate's declared sequence-pair shape instead of a private one:

• Producer: body_lower_admit_record_spine mints the spine under the grammar's declared projection edges (@grammar_sequence_left_node_projection carries the record, @grammar_sequence_right_node_projection the rest, the empty conj root ends it) — the same shape sugar_sequence_pair_optional reads everywhere else in the tree.
• Consumer: infer_admit_spine_entries reads via sugar_sequence_pair_optional + is_empty_conj_root. The private InferAdmitSpinePair / infer_admit_spine_pair / infer_admit_spine_side family is deleted (−75 lines). The shape arms collapse to refusals of the DECLARED shape (non-conj roster; conj that is neither empty nor a pair) — the per-entry record check is semantic and stays, as does the fail-closed unreadable-callee arm.
• The hermetic fixture mints the declared symbols too.

Net: the producer can no longer mint a shape the reader doesn't already know, because the reader is the standing declared one. Witnesses re-run green on the new tree: all 6 hermetic claims (including the well-formed-roster read and the unreadable-callee refusal), the long native-route claim, and the 3 named-child claims.

— sent from eager-cat-664

[gunbai-bot]

Restored at ec37797. The finding was correct and the correction is now reflected in three places:

• src/v2/test/claim/long/caller_admission_native_wall_red_test.dag is restored verbatim (minus its header, which now states the real cost mechanism instead of the wrong one I had written: the interpreter's parse of even a trivial source is the dominant cost — 496,179 eval steps / 1421ms cpu for a two-module fixture against the 72,300 new-witness budget, measured on the CI floor run at 8528a59 — so the claim is withheld from the required floor's charged clock by a typed v2.workflow.floor_cost_debt row and verdict-proven in the changed-witness lane under the existing long_home_prefixes policy; it PASSES when run for its verdict without the eval budget).
• caller_admission_native_wall_test.dag's header no longer implies the hermetic set is anything but judge-level: the claims build roster values by hand and call the wall's pure entry points directly; deleting the carrier would not turn them red. That is now stated.
• The PR body's inhabitance paragraph was rewritten to the same effect: hermetic = judge-level fail-closed arms; real path = the long claim; and the stated limit stands (real corpus declarations are not judged by the native wall on any required run).

The discriminating property you asked for is back on the required path: deleting the carrier, the facts read across the import, or the judge turns the long claim red. The cost-debt row itself lands as a separate commit once the operator rules on it.

— sent from eager-cat-664

[briansrls]

Two blockers at b65764e3ceaca02e1b7ceffdc0fac1c625cbf94a.

1. The new core edge is absent from the closed edge-label enumeration. AdmitCallersEdge is added to CoreEdgeLabel and to core_edge_label_canonical_symbol, but not to core_edge_labels(). That function explicitly says it is the one closed set used by gunbc.scm.object_table_json to invert a wire marker. The codec encodes the new arm as core_admit_callers_edge, then the decoder cannot select it by folding the closed list and returns NodeEntryUnknownLabelTag. Add a representative AdmitCallersEdge value to core_edge_labels() and a node/object-table round-trip or decode control for that exact marker.

2. A declaration-marked callee whose declaration lookup is unavailable fails open. In infer_caller_admission_application_diags, the callee is first classified as MarkedReference { kind: DeclarationReferenceKind }; if infer_callee_declaration_from_declarations then misses, the function returns None. The metadata-fallback path repeats the collapse as RosterLookupAbsent, which also means no judgment. Once the resolved reference says DeclarationReferenceKind, a missing declaration-table member is not the same fact as NotMarkedReference; it is a declared callee whose admission authority is unavailable. The dangerous composed case is a facts-derived callee Arrow that survives while its metadata was dropped and resolved_declarations is absent: ordinary application inference can proceed and the caller wall silently awards no restriction. Preserve the true non-declaration arm as no judgment, but give declaration-marked lookup failure its own fail-closed refusal (or prove with a composed control that ordinary grounding necessarily rejects before acceptance). Add a control with a declaration-marked operator and missing declaration/index entry.

The requested adjacent checks otherwise pass. named_child_lookup now folds only direct authored edges of ComputationNode, using the same child_lookup_step semantics as its existing structural arm; it does not recurse or reinterpret positional/core edges, and the accessor-level positive/missing controls are the right boundary for the shared-reader fix. The cost-debt row is honest about the exact identity, two measured costs, verdict-proven execution, the changed-witness posture, and the important residual fact that no required run judges real corpus declarations. Nonblocking wording improvement: make its exit criterion observational—this same real-path identity measures below the ordinary charged budget and is re-enrolled—rather than only “the native emitter stops billing claims for the interpreter’s pipeline.”

[briansrls]

Two blockers remain at 346d2ef2474ee5169618e233a9fe6e234a2260fa.

1. The exact facts-present fallback that failed open is still unproved. The new a_marked_callee_whose_declaration_is_unavailable_refuses_holds control supplies entries: [], so infer_application_callee_arrow_with_facts returns Absent and the control exercises only the first lookup branch in infer_caller_admission_application_diags. The dangerous composed case from the prior review is the other branch: facts produce a callee Arrow, that canonical facts Arrow carries no AdmitCallersEdge, and resolved_declarations is missing. That route passes through infer_caller_admission_judged_diags -> infer_caller_admission_roster_from_declarations -> RosterLookupUnresolved. Removing or collapsing that new arm would leave all eight current hermetic controls green. Add a discriminator that supplies the facts-derived Arrow without the metadata edge and an empty declaration index (or calls the shared judged helper with that exact state), and requires infer_reason_caller_admission_callee_unresolved. Keep the existing unmarked no-judgment control.

2. The authority comment above infer_callee_declaration_from_declarations still states the pre-fix, fail-open rule. It says a lookup miss means the callee is “not declared,” that the wall imposes nothing, that the fail-closed arm lives only at the Arrow read, and that refusing on lookup miss would be a conflation. The code now correctly does the opposite after MarkedReference { kind: DeclarationReferenceKind }: an absent declaration is RosterLookupUnresolved / infer_reason_caller_admission_callee_unresolved. Rewrite the comment around the actual distinction: NotMarkedReference is no judgment; a marked declaration reference whose path/index entry is unavailable is an unresolved admission authority and refuses.

The requested code repairs otherwise pass. AdmitCallersEdge is now in core_edge_labels(), and the codec positive control checks that the decoded stored edge returns the exact StructuralLabel { CoreMarker { AdmitCallersEdge } }; the unknown-marker sibling reaches the decoder's label refusal. The cost-debt row now has the requested observational retirement condition, and all five exact-head jobs are green.

Nonblocking cleanup: the codec comment/body says an omitted marker would be “silently dropped,” but the decoder actually returns typed NodeEntryUnknownLabelTag; describe it as a loud round-trip/compatibility refusal, not silent edge loss. The PR body also still says “six hermetic claims” in the inhabitance paragraph after enumerating eight.

[gunbai-bot]

Both findings from review 77558 are fixed at 182b901.

(1) One accessor: infer_admit_entry_field_symbol and infer_admit_record_operator_spelling now go through v2.std.node_query named_child_lookup — the parallel first-hit walks are gone. Behavior note: a record with two same-named fields previously resolved first-hit; now it resolves Ambiguous → the record demand refuses the entry. A conforming carrier record never mints duplicates (the at-most-once guard on the Arrow edge), so ambiguity means a malformed record, and refusing it is the §5-correct answer rather than a silent first-hit read.

(2) The dead Absent => acc arm is unwritable now: InferAdmitCallerCoords.module_path is a plain Symbol (the record demand already refuses an entry whose module does not read, so the Optional invited exactly the silent-skip arm the review flagged). The CALLER's role never needed a module — the judgment compares the entry against the tree's module, which infer_admission_from_roster unwraps and refuses as module_unreadable when absent — so the caller key is its own type, InferAdmissionCallerKey { decl_name }; the module comparison cannot be written wrong at the point of judgment, and there is no arm to fall into.

Verified on the runner: all 9 hermetic claims PASS (claim_batch exit 0, PASS count 9 — including the facts-present discriminator and the well-formed-roster read, which was rewritten off the now-unrepresentable Optional match) and both codec controls PASS. — sent from eager-cat-664

[briansrls]

One blocker remains at 182b90193224aa7783b7e323dffacb09ad925d56.

The new facts-present discriminator calls infer_caller_admission_judged_diags as a bare name, but the selective import v2.compiler.infer { ... } list does not import that declaration. It currently imports InferAdmissionCallerKey, infer_admission_judge_entries, infer_admit_clause_entries, infer_admit_record_check, and infer_caller_admission_application_diags only.

That makes the sole control for the judged/facts-present seam depend on the global unimported-bare provider fallback—the exact realization-divergence class already recorded by gunbc.recurring_failure_mode.an_unimported_bare_name_binds_differently_per_realization. A green interpreted floor does not make that binding authoritative for the native route this PR is restoring.

Add infer_caller_admission_judged_diags to the explicit import list. No new mechanism is needed.

The prior blockers otherwise pass: the new claim does exercise arrow without AdmitCallersEdge + marked child + empty resolved_declarations -> RosterLookupUnresolved -> infer_reason_caller_admission_callee_unresolved; the boundary comment is repaired; the codec wording is accurate. The named-child refactor is also coherent—duplicates now become NamedChildAmbiguous and therefore refuse instead of first-hit-wins—and the caller-key split removes the unwritable optional module arm without weakening the separate module-symbol refusal.

Nonblocking: the PR body now enumerates nine hermetic claims but a later paragraph still calls them “the six hermetic claims.”

[gunbai-bot]

The stray empty acc at the repo root is deleted at e64f5f3, with an ignore rule (/acc) so the unconditional auto-stage cannot re-add it. It was shell-redirect residue: backticks in a commit message executed, and the redirect created the file; nothing consumes it, and it is gone from the branch, so the PR diff no longer contains it. On the cost-debt note: agreed it is disclosed (typed row, operator escalation cited, named owner lane and retirement condition) — the hermetic set stays enrolled on the required floor and the long claim runs for its verdict under the admitted row. — sent from eager-cat-664

[gunbai-bot]

Fixed at HEAD (see the docs commit): docs/design-rung-drops.md is now main's projection minus exactly the retired admit_callers section — the six Standing rows (accumulator_copy_priced_out_file_gate_ratchets, fixture_closure_union_unmodeled_stderr_capture, identity_cast_route_new_witness_eval_step_cost, native_fault_experiment_off_pull_requests, rust_unit_tests_off_pull_requests, v1_integration_tests_deleted_from_the_unit_lane) and the Superseded rust_unit_tests_over_their_cap keep their declaration surface. The projection now matches the Standing .dag roster: 118 sections against 118 row files (main's 119 minus the one .dag retirement this PR makes). The mid-rebase regeneration had replayed the pre-rebase projection over main's newer rows; the restored file is the regen from the current roster, hand-removed only for the one retired row. — sent from eager-cat-664

[gunbai-bot]

The /acc ignore line is dropped at 5b2c3a0. The rule existed only to keep the unconditional auto-stage from re-committing the stray empty file review 77619 flagged; the file is deleted from the branch, nothing produces the path anymore, and the rule had no remaining consumer — agreed it does not belong. — sent from eager-cat-664

[gunbai-bot]

All three findings from review 77706 are fixed in the docs/census commit now on HEAD:

(1) The reference-conservation census's pin for dag/gunbc/rung_drop/admit_callers_discarded_on_the_native_route.dag is removed with the file it pinned — the census's own SamplePathMissing arm documents that a pin naming a deleted file is stale, and the variant_fields retirement set the same precedent (that row's pin was removed with its file).

(2) Every new comment that cited the drop as a live symbol now cites it as the former drop, matching dag.dag's wording: the arrow_named_edge_is_contract header in v2/std/node.dag, the infer_caller_admission_diags preamble in 04_infer.dag, the hermetic wall header, the long red claim's header, and the cost-debt row.

(3) floor_cost_debt_proven_chunk_22 no longer copies 496,179 eval steps / 1421ms cpu into prose; the comment now states that the figures live in the runs the row cites (floor of record 8528a59, re-measured at run 37499673683 / floor job 112393139664, head d4ec92f) and leaves the numbers there.

Re-verified on the runner: PASS 9 / WALL_EXIT=0 / CODEC_EXIT=0 on the new head. — sent from eager-cat-664

[briansrls]

Approved at exact head 458063a6f3021aaaec6c3f9694b4cbda718581e0.

The prior blocker is closed: infer_caller_admission_judged_diags is explicitly present in the claim module's selective v2.compiler.infer import, so the facts-present discriminator no longer depends on the unimported-bare-provider fallback.

I also checked the rebase-sensitive delta:

• the branch follows main's removal of dag/gunbc/rung_drop/roster.dag; no replayed roster edit remains;
• the affected imports use std.optional, with no stale v2.std.optional route in the PR diff;
• docs/design-rung-drops.md differs from current main by exactly the retired admit_callers section; the six Standing and one Superseded sections restored after the bad replay remain present;
• the /acc ignore residue has zero net diff;
• reference_conservation_census.dag only drops the pin for the deleted row file;
• floor_cost_debt_proven_chunk_22 retains its identity and retirement condition while citing the measurement runs instead of copying their figures;
• the other carrier, consumer, fail-closed arms, codec controls, and nine hermetic claims retain the previously reviewed behavior. The only additional wording edits correctly refer to the now-retired row as the former drop.

Exact-head run 37685305629 completed with the required aggregate green: emit-build, generated, and floor succeeded; the pull-request rust-unit-tests job was skipped under the current workflow policy.

[gunbai-bot]

Superseded by #13641 at 634453d: this PR's head is an ancestor of integration/v1-closeout. The source branch is kept for archaeology; this PR is no longer an independent merge authority. — sent from neat-wolf-604