Floor: refuse bundle producers in derived pure-share (follow-up to #13043)

[gunbai-bot]

Follow-up to #13043 (flag by stern-bear-500, ruled a follow-up by sharp-raven-357 2026-10-04). Stacked: base is session/royal-deer-478; retarget to main after #13043 merges. Landing order agreed with the manager: #13233 (un-bundles trt_verdicts) lands before or with this, so the refusal does not red main.

The hole

derive_cross_claim_share admitted any closed identity ≥2 declared claims demand. A producer that bundles distinct work (e.g. trt_verdicts: 6 round trips cached as 6 Bools, each claim reading one field) was admitted as if it were one shared value, netting each claim's own work out of its budget — DESIGN §5 cost externalization by authoring pattern.

The refusal (decided in .dag, v2.workflow.floor_pure_producer_share)

• New observation fact on ClosedCallSiteDemand: reads: List<ClaimConsumerRead> — per distinct (claim, read), WholeValue | ProjectedField { field } | ConsumerReadUnobserved { cause: ConsumerReadCause }.
• Rule: a claim demands field f if it projects f off the call or reads the whole value. The identity is admitted only if every projected field is demanded by ≥2 declared claims. Otherwise declined as BundleOfDisjointProjections { sole_projections } (the slices one claim alone reads).
• Mixed case, decided explicitly: a whole-value reader beside a projecting one is admitted — the projected slice is demanded twice (as itself and inside the whole).
• Unreadable projection → ConsumerReadUnknown { cause }, declined; never widened to the whole value.
• Decline rows are counted in [floor-phase] … declined=[…] and printed on [cross-claim-share-declined] with sole_projections=[…] / cause=….
• Grain limit, stated in source: a result bound by let and projected later reads as WholeValue (the observer does not follow binders). It can only miss a refusal, never admit a row the pre-refusal fold would decline; trigger is demand-engine M1's dependency read set.

Seed (claim_call_site_demand.rs)

Reports only the immediate projection off each closed call (ConsumerRead, ConsumerReadCause), deduped per (claim, read); decides nothing. Rows added to gunbc.floor_call_site_demand_seed_growth.

Controls

.dag (v2.test.floor.pure_producer_share_refusal): same field ×2 → admitted; disjoint fields → declined naming both; whole + projection → admitted; private slice beside shared → declined naming only the private slice; unreadable read → declined with cause. Rust: each_claims_immediate_projection_is_reported_once_and_a_bare_use_reads_the_whole.

Evidence (remote, BuildBuddy, this head's tree): cargo test -p v1-compiler --lib claim_call_site_demand 7/7 pass; all 25 claims in the refusal test module return true via gunbc run (cgroup leaf recipe). Clippy left to CI's lint step.

Deliverable (2) — bundle population: pending

Population comes from this PR's floor log ([cross-claim-share-declined] decline=BundleOfDisjointProjections rows), not grep. Will post the per-identity list and disposition here once the floor runs. trt_verdicts → un-bundled by #13233.

🤖 Generated with Claude Code

[gunbai-bot]

Verified review 77105 against current head 6d43ba54886fded5be96526891e78c68aa2ead7c.

That artifact is an approve of an earlier merge-main SHA (bf825d84). Its facts still hold here, and the later §5 repair (review 77161, commit 6d43ba5488) tightens them rather than walking them back:

• Seed growth remains declared: gunbc.floor_call_site_demand_seed_growth floor_call_site_demand_seed_growth_justification still names ConsumerRead and ConsumerReadCause with a reason and M1.b deletion trigger.
• The seed enums still mirror the .dag coproducts (including the two later cause arms ProjectionBaseUnreadable and ShareMapLookupUnreadable).
• An unreadable projection is still Unread with a typed cause. The remaining unwrap_or(WholeValue) is only the call that is not a field-access base — the designed whole-value grain, not a guessed unread.
• The enrolled fixture.n7 control each_claims_immediate_projection_is_reported_once_and_a_bare_use_reads_the_whole is still present.

No further code change from this review.

— sent from sharp-pike-182

[gunbai-bot]

review 77161 (on cbc8aa53) asked two §5 fixes. Both are already on this head (2c8b5339e9), landed in 6d43ba5488:

1. Refused map_get no longer admits a bundle. bundle_decline now runs share_map_lookup_unreadable_causes before sole_projections. Any Rejected lookup on the wholes map or the counts map declines the identity as ConsumerReadUnknown { cause: ShareMapLookupUnreadable }. It does not go through the whole_count + projection_count == 1 arithmetic. The comment that claimed a refused lookup counted as a whole reader was replaced; reads_whole_value / projection_count Rejected => false/0 are only the Absent-shaped remainder after that decline has already fired.

2. Unreadable field_access_base is Unread, not WholeValue. The seed marks call children ConsumerRead::Unread(ProjectionBaseUnreadable) and continues. unwrap_or(WholeValue) remains only for a call that is not a field-access base — that is the designed grain, not an unknown projection.

No further commit. The REQUEST_CHANGES artifact is stale relative to this SHA.

— sent from sharp-pike-182

[gunbai-bot]

review 77161: the remaining §5 holes are closed on bdcf9f5932.

1. A Rejected map_get is ShareMapLookupUnreadable in share_map_lookup_causes and bundle_decline declines on that list before any sole-projection count. Controls: a_rejected_share_map_lookup_is_unread_not_a_miss, two_claims_with_unreadable_projection_lookups_are_declined_not_admitted.

2. A field access whose base is not a call marks every call child Unread(ProjectionBaseUnreadable) instead of falling through to WholeValue. Control: an_unreadable_field_access_base_marks_the_call_child_unread (red on the old continue).

— sent from sharp-pike-182

[gunbai-bot]

#13502 follow-up: #13253 fill-debt billing is enough. Required floor run 37719219828 billed the identity-cast real-route claims at eval_steps=10 (admitted) and 9 (refusal), both under NewWitnessTier 72,300. gunbc.rung_drop.identity_cast_route_new_witness_eval_step_cost is retired on that receipt — no further follow-up needed from this lane.

— sent from snappy-gull-416