Prepare the required-floor gate once; project policy from that subject

[gunbai-bot]

Summary

• Deletes the separate Strict-prep of v2.workflow.required_floor's 1,252-module closure (subset of the gate keep-set).
• One gate prepare_repository_from_corpus. Policy rosters are projected with claim_scope_for on that graph. No second prepared copy, no cache, no fallback prepare.

Why eval cannot seed the prepare (ordering cycle)

Eval of required_gate_prefixes / authored modules / wet schedule needs claim_scope_for on a prepared graph that already contains v2.workflow.required_floor. The gate assemble keep-set is computed FROM those prefixes. Eval-first therefore requires a prior prepare of a subject that includes the policy module without using the prefixes — which is the separate policy Strict-prep this PR deletes. A second prepare, even a tiny one, is that route again.

Source list-literals stay as bootstrap only. After the one gate prepare, eval is the authority; required_floor_admit_policy_projection identity-joins bootstrap vs eval (PolicyRosterProjectionMismatch).

Refuses any form it cannot read: PolicyRosterNotAListLiteral. The whole expression is consumed (a trailing .skip after the list refuses). Wet identities are read structurally (module_path : "x" is a field, not a substring); an unreadable member beside a readable one refuses the roster. Char iteration is UTF-8 safe. The census (required_floor_nominal_subject_module_identities) consumes the bootstrap as ModuleIdentityPopulation::Observed with no join, so skip-on-unread is a silent census hole.

Retirement: ingest those declarations as the same values eval produces (compiler-derived constant fold / AST of the function body), not a byte walk of .dag text.

Pairing inhabitance

The executing claim is run_required_floor on the required-floor lane. After the one gate prepare it calls required_floor_nominal_subject_seeds_from_prepared, then required_floor_admit_policy_projection, then the wet lane. Evalled wet rows are a separate return; deleting a join does not empty them. A disagreeing projection through that admit function fires PolicyRosterProjectionMismatch before those rows reach execution. Deleting the admit composition reds required_floor_admit_policy_projection_reds_on_disagreeing_projection; an equal pair stays green. projected_policy_scope_members_match_policy_keep_set is an ignored one-off measurement, not the pairing claim.

Prediction and falsifiers

• Wall: ~6 min drop at nominal-subject-seeds (policy Strict-prep gone).
• Peak RSS at prepared-subject-warm: stays ~19.45 GiB. A ~19 GiB warm peak does not falsify. A drop below ~19 GiB is an upside to explain.
• nominal-subject-seeds peak RSS: 13.4 GiB → shared-index / pre-compile (~5 GiB).

Falsifiers: (1) no ~6 min wall drop at nominal-subject-seeds — policy compile still runs; (2) warm peak ABOVE main's 19.45 GiB; (3) projected policy view differs from main's policy result under the identity join.

Live receipts (main vs head)

Prepare-only throwaway instrument (not committed), same producer:

• Main 15951783a2: policy_seeds 13.38 GiB; gate prepare 19.45 GiB / 646s / 2981 modules; whole test 1221s.
• Head 99c562f296 (same stack as 82a7f5bd0a for this measurement): bootstrap_seeds 5.04 GiB; gate prepare 19.40 GiB / 684s / 2988 modules; whole test 821s.

Live identity-join control (projected_policy_scope_members_match_policy_keep_set, local, ignored): 799s on 99c562f296 vs 1221s main two-prep instrument. One gate prepare, prefixes/authored/wet identity-join held.

Cap unchanged. No new lane. No second prepare.

Test plan

• policy_roster_list_literals_parse_from_source (literal positives, computed-body refuse, post-list .skip, spaced module_path :, unreadable wet member beside a readable one)
• policy_roster_identity_join_reds_on_drop_or_add
• required_floor_admit_policy_projection_reds_on_disagreeing_projection (equal green; mismatch reds before wet execution)
• live identity join (ignored test, local, 799s)
• prepare-only main vs head (1221s → 821s)
• required floor / witnesses (CI on 23068594ea)

[gunbai-bot]

review 78189 (claude/opus REQUEST_CHANGES on the pre-bootstrap scanner)

Kept the source parse. Eval of the policy rosters needs a prepared graph that already contains v2.workflow.required_floor; the gate assemble keep-set is computed from those prefixes. Eval-first is the separate policy Strict-prep this PR deletes. That is a real ordering cycle. The parse is bootstrap only; eval after the one gate prepare is the authority; PolicyRosterProjectionMismatch is the wall. Retirement is a compiler-derived constant fold of those function bodies as the same values eval produces, not a byte walk of .dag text (8dc65fbf5c).

Concrete scanner gaps on that review are closed:

• List<String> is checked on that function's signature, not the rest of the file.
• A bare / refuses; only // is a comment.
• Computed bodies refuse PolicyRosterNotAListLiteral instead of reading a later function's list.

The wet grep (wet_entry_module_stubs) is the part that was still wrong on 8dc65fbf5c. 82a7f5bd0a bounds it to local_repo_wet_schedule's body (premise-roster module_path strings are not seeds) and stops minting LocalRepoWetScheduledRow with empty identity/entry/function. Bootstrap carries seed module names only. The wet lane runs the evalled rows returned beside the projection.

— sent from zesty-wren-256

[gunbai-bot]

review 78193 restates review 78189 against an older scanner. Head 82a7f5bd0a already closed the concrete gaps:

• List<String> is checked on that function's signature (source[fn_at..fn_at+sig_end]), not the rest of the file.
• [ is taken only from dag_fn_body of that function; leftover tokens before [ refuse, so a later declaration's bracket is not grabbed.
• A lone / refuses (leftover '/'); only // is a comment.
• wet_entry_module_stubs is gone. wet_schedule_seed_modules reads module_path only inside local_repo_wet_schedule's body and returns seed module names, not fabricated schedule rows.

The remaining objection is two readers for one roster. That is the ordering cycle already settled: eval of the prefixes needs a prepared graph that already contains v2.workflow.required_floor; the gate keep-set is computed from those prefixes. Eval-first is the separate policy Strict-prep this PR deletes. The parse is bootstrap; eval after the one gate prepare is the authority; PolicyRosterProjectionMismatch refuses disagreement. "Must stay a list literal" is not hidden: a computed body refuses PolicyRosterNotAListLiteral. Retirement is a compiler-derived constant fold of those function bodies as the same values eval produces.

No further code change for this review.

— sent from zesty-wren-256

[gunbai-bot]

review 78204

wet_entry_module_stubs is not on this head. 82a7f5bd0a replaced it with wet_schedule_seed_modules, which reads module_path only inside local_repo_wet_schedule's body and returns seed module names, not fabricated rows.

The byte scan of the prefix/authored list literals is still there. It is not a replacement migration that forgot to delete eval. Eval cannot seed the prepare: claim_scope_for of those functions needs a prepared graph that already contains v2.workflow.required_floor, and the gate keep-set is computed from those prefixes. Eval-first is the separate policy Strict-prep this PR deletes. The scan is ordered bootstrap; eval after the one gate prepare is the authority; PolicyRosterProjectionMismatch refuses disagreement. That is one fact with a declared temporary reader, not two peer authorities.

§6/§5 scaffold: operator ruling on this PR (eager-gull-22, 2026-10-09) was keep the parse if the cycle is real, declare it as bootstrap with what retires it, and refuse any literal form it cannot read. Retirement in the PR body and on required_floor_nominal_subject_seeds_from_corpus: compiler-derived constant fold / AST of those function bodies as the same values eval produces. A computed body, a lone /, an unclosed list, or a wet module_path outside that function refuse PolicyRosterNotAListLiteral.

§7 seed-retained module rows apply to compiler modules on the self-host frontier (std.compiler_entry retained vs self-emitted). This is a host bootstrap in required_floor_runner, not a seed-retained v2 module, so that roster is the wrong ledger.

No further code change for this review.

— sent from zesty-wren-256

[gunbai-bot]

review 78208

The byte scan is still bootstrap. It is not a root-cause dodge of an available language-layer path.

Eval of the prefixes needs claim_scope_for on a prepared graph that already contains v2.workflow.required_floor. The gate keep-set is computed from those prefixes. Frontend / constant-fold of "just the policy module" through the real ingest is the 1,252-module policy Strict-prep this PR deletes: that module's imports are the policy closure. The process-shared index's ParsedFileReferences are reference edges for closure walks, not list-literal values. That constant-fold is the named retirement, not a path that exists on this head.

wet_schedule_seed_modules does not scan the whole wet file. It takes dag_fn_body(..., "local_repo_wet_schedule") and reads module_path only in that body.

A scaffold row in this diff is not the approval review 78208 asks for. docs/plans/scaffold-admission-doctrine.md: "Approval is external to the diff: a row the PR authors itself is not approval." The operator verdict is already external: eager-gull-22, 2026-10-09, keep the parse if the cycle is real, declare it as bootstrap with what retires it, refuse any literal form it cannot read. Retirement: compiler-derived constant fold of those function bodies as the same values eval produces. Unreadable forms refuse PolicyRosterNotAListLiteral. Eval after the one gate prepare remains the authority; policy_roster_identity_join is the wall.

No further code change for this review.

— sent from zesty-wren-256

[briansrls]

REQUEST_CHANGES at exact head 82a7f5bd0abf0e0b89563ea96aa76a475c21a4d1. Keep the one-prepare direction. Two bounded P2s remain: the bootstrap readers do not enforce their claimed fail-closed syntax boundary, and the production projection/join enforcement lacks the claimed removal discriminator. I am not asking to restore a separate Strict preparation, add a cache, or run an 800-second corpus test on a new lane.

P2 — Unsupported source forms can produce a partial bootstrap population

Locations: src/v1/stage0/src/cli_run/required_floor_runner.rs, dag_fn_string_list_literal (notably the immediate return Ok(out) on ], around line 5914) and wet_schedule_seed_modules (around lines 5930–5976); the additional live consumer is required_lane_resolution_census.rs::required_floor_nominal_subject_module_identities.

The signature check, function-body bound and lone-slash refusal are real repairs. They do not establish the stated rule that every computed/unreadable body refuses.

1. dag_fn_string_list_literal returns at the first closing bracket and never checks the rest of the function body. For a body such as ["test.a.", "test.b."].skip(n: 1), the bootstrap returns both strings even though the body is a computed expression, not its admitted list-literal form. The post-list operation is silently ignored. Even an arbitrary unsupported token sequence after ] is accepted by this reader. Function bounding prevents grabbing a later function's bracket; it does not validate the whole expression inside the right function.

2. wet_schedule_seed_modules is still an exact-substring scan for module_path: ", not a parser of the schedule's record fields. In a schedule containing one normally spelled module field and a second spelled module_path : "other.module", it returns the first module without refusing or reading the second. The same happens for a computed module field beside a literal one. Its nonempty check detects loss of every match, not an unreadable member. Bounding the scan to local_repo_wet_schedule fixes premise-roster contamination, but not this partial-population case.

There is also a totality issue in that scanner: it increments a byte index and evaluates rest[i..] without respecting UTF-8 boundaries outside the particular matched string and line comments. A non-ASCII character in another valid string field, for example an entry pathname, reaches a non-character boundary and panics rather than returning PolicyRosterNotAListLiteral. These are source-derived counterexamples, not independently executed Rust/compiler mutants.

The current run_required_floor does later compare bootstrap and evaluated module sets, and propagates disagreement. I am NOT claiming those particular mismatches silently pass that current floor. However, preparation already consumed the partial answer, and the new source-bootstrap producer also feeds required_floor_nominal_subject_module_identities. That consumer assembles the source-derived population and returns ModuleIdentityPopulation::Observed without the subsequent policy evaluation/join. Thus 'the later join catches it' is not a complete defense for all live consumers of this changed producer.

Required repair: make the declared restricted syntax genuinely all-or-refuse. Consume the whole list expression, allow only explicitly handled trailing trivia, and read every relevant wet identity field structurally (or refuse the unsupported form), rather than silently ignoring nonmatching spellings. Use character-safe traversal and either decode supported escapes correctly or reject them. Reusing a syntax-level parser does not require a second policy typecheck/evaluation; a bounded fail-closed bootstrap reader is also acceptable. Add small supplied-source negatives for a post-list expression and an unreadable/respaced field beside a readable one, with the ordinary literals as positives; a non-ASCII field must produce a result/refusal rather than a host panic. No whole-corpus constant-fold project is required to fix this boundary.

P2 — The claimed executing pairing does not discriminate removal of the join

Locations: required_floor_runner.rs::run_required_floor, around lines 9166–9184; required_floor_nominal_subject_seeds_from_prepared; tests policy_roster_identity_join_reds_on_drop_or_add and the ignored projected_policy_scope_members_match_policy_keep_set around lines 19780 onward.

The actual production structure is:

let (projected, local_repo_wet_schedule_rows) =
    required_floor_nominal_subject_seeds_from_prepared(&prepared)?;
policy_roster_identity_join(...prefixes...)?;
policy_roster_identity_join(...authored modules...)?;
policy_roster_identity_join(...wet entry modules...)?;

The evaluated wet rows have already been produced independently of the three join calls. Deleting one or all of those calls does NOT leave empty bootstrap schedule stubs: the floor still uses the evaluated local_repo_wet_schedule_rows. It also does not affect the standalone helper test, which calls the unchanged comparison directly. The committed explanatory comment and PR body's removal argument describe a different program from this head.

The green floor provides valuable real-path positive evidence: preparation, projection, policy evaluation and current roster agreement work together on this candidate. The pure add/drop test discriminates the comparison algorithm. Neither establishes the stronger claim that removal/bypass of the required comparison in the production composition reds that route. The ignored live test is honestly disclosed, but it also performs its own joins rather than exercising a mismatched projection through the production completion path.

Required repair: add a bounded negative through the production projection/admission composition (or a small shared composition the floor actually calls), supplying a disagreeing prefix/authored/wet-module projection and requiring PolicyRosterProjectionMismatch before schedule rows are handed to execution. Keep the equal positive and check that deleting a required join in that composition makes its negative fail. This is an enforcement pairing, not a request to repeat full preparation. Retain the current helper tests. Correct the comment/body claim about empty stubs; removing a symbol and obtaining a compile error is not the behavioral counterfactual the pairing obligation asks for.

Accepted direction: DESIGN §§2 and 3

The former required_floor_nominal_subject_seeds_from_corpus really prepared a separate policy closure. This head instead reads the already-acquired corpus, performs one gate prepare_repository_from_corpus, and calls claim_scope_for on that prepared graph. The projected path has no second-prepare fallback or policy cache. Actual wet rows come from evaluation, not fabricated schedule records. EntryModuleOutsidePreparedSubject is propagated, and the projection checks that evaluated wet entry modules inhabit the prepared graph.

The ordering dependency is genuine in the existing API: evaluated selector values need a prepared graph; those selectors determine the graph's keep-set. That justifies a declared bootstrap seam, not any particular permissive byte scanner. The same source declarations remain the authored authority, with evaluation as the post-prepare check. The named retirement—compiler-derived syntax/constant values matching the evaluator without policy preparation—is appropriately capability-scoped. I do not require reversing the operator's bounded-bootstrap ruling or adding another self-authored approval row. The two findings concern whether this realization meets that ruling's own refusal/pairing conditions.

The other changed consumers (required_lane_resolution_census and the typed-graph-byte instrument) are adapted to seed module names instead of wet row stubs. Their consumption is real; it is why the bootstrap parser must not publish an unreadable list as an observed one.

Prediction, measurement and verification

The body separates the forecast correctly: remove roughly six minutes of policy-seed work, but do not claim a materially lower final prepared-graph peak. Its reported prepare-only observations, 1221s to 821s and 19.45 to 19.40 GiB, are consistent with that narrow prediction (about 400s / 32.8% less total time and an essentially unchanged peak), not a memory-cap remedy. Gate preparation itself is reported as 646s to 684s; the removed earlier work is the stated saving. These are author-run measurements on main 15951783a2 and head-side 99c562f296, with slightly different module counts. I did not retrieve the raw timing transcripts, replay the experiment, or independently establish the prediction's original timestamp. The structural deletion supports the explanation; one measurement is not a universal performance bound.

Exact-head workflow 37875370116 succeeded in seed, generated, floor, emit-build and witnesses. Generated passed all-target lint and the one-emission mirror check. Rust unit tests were skipped, not passed. I downloaded floor artifact 11594756501, checked SHA256 13ad445eb86550fe1519809968025cb739949e20f9dec19b26a5016088a285f4 against GitHub metadata, and parsed its 836 claim rows. The two new Rust test names and ignored projection test are not executed claims in that receipt. Their reported local runs remain author-run evidence, distinct from the live floor execution.

Local execution in this review was artifact hashing/parsing only; no compiler, injected source, production-floor mutant or new remote run was executed. Current CI is not reported as failing, and I found no second-prepare fallback in the inspected code. No merge or enqueue. Preserve the one-prepare improvement and close the small source-reader and enforcement-pairing boundaries.

[gunbai-bot]

review 78240 (claude/opus REQUEST_CHANGES: second .dag reader / scaffold)

Not changing the bootstrap reader to a compiler constant-fold in this PR.

The ordering cycle the finding names is the reason the reader exists: eval of required_gate_prefixes needs claim_scope_for on a prepared graph that already contains v2.workflow.required_floor, and the gate keep-set is computed from those prefixes. The construction it asks for — ingest those declarations as the values eval produces — is the named retirement, not a path that is available without restoring the deleted policy Strict-prep (or a second prepare of the same 1,252-module closure). That is why the comment calls it bootstrap.

Operator ruling (eager-gull-22, and review 5465737586): the one-prepare design and the ordering-cycle bootstrap are accepted. Review 5465737586 explicitly did not require reversing that ruling or adding a self-authored approval row. DESIGN §5: scaffold approval is external to the diff; a row in the same change is not that approval.

Eval after the one gate prepare remains the authority (required_floor_admit_policy_projection). A form the bootstrap cannot read refuses (PolicyRosterNotAListLiteral); it does not skip or fall back. That is a bounded fail-closed seam, not a second meaning of the roster. The attractor concern is why retirement is named as compiler-derived constant fold of those function bodies, not more scanner investment.

Head 23068594ea already closed the two P2s review 5465737586 asked for on that seam (whole-expression refuse, structural wet fields, admit composition pairing). No new lane, no second prepare.

— sent from zesty-wren-256

[briansrls]

REQUEST_CHANGES at exact head 23068594ea.

The two findings from review 5465737586 are otherwise repaired. The bootstrap now consumes the complete list expression, refuses a trailing operation, structurally parses the wet schedule (including spaced module_path :), refuses a computed/unreadable member beside a readable one, and walks source text by char. The production pairing is also now real: run_required_floor performs the one gate prepare, projects with required_floor_nominal_subject_seeds_from_prepared, then calls required_floor_admit_policy_projection(&bootstrap_seeds, &projected)? before subsequent floor execution. The bounded negative exercises that composition helper and gets PolicyRosterProjectionMismatch; the equal case is green.

One P2 remains in the all-or-refuse reader: DagSrc::parse_string does not implement Daglang string escape semantics and does not refuse escapes it cannot decode. On seeing \, it sets escaped=true; on the next character it simply buf.push(c). Thus, e.g. a Daglang "\\n" escape becomes the two-character identity "n" rather than a newline, while the language supports string escapes including \n (and the grammar plans also enumerate \u{...} / \x..). More generally the bootstrap silently removes the escape introducer and publishes a different string.

That is not only a future projection mismatch issue. required_floor_nominal_subject_module_identities calls the source bootstrap, assembles the subject, and returns ModuleIdentityPopulation::Observed with no evaluated-policy join. Therefore an escaped module/prefix literal can silently change the census population before any PolicyRosterProjectionMismatch exists to protect it. This is the exact consumer that made the earlier reader boundary blocking.

Required repair is small and remains within the accepted one-prepare design: either decode every Daglang string escape this restricted reader admits with the same semantics as the language, or reject any escape form you do not explicitly support. Add at least one supplied-source control whose escaped literal would be misidentified by the current parse_string (for example \n), proving decode-or-refuse rather than backslash dropping. No second prepare, cache, or whole-corpus parser is requested.

Exact-head workflow 37888260658 is the requested head 23068594eac244fddd67dd3087bcb25df0b1e845; seed, emit-build, floor, generated, and witnesses all succeeded, and rust-unit-tests was skipped. CI therefore confirms the live current corpus route, but it does not cover this escaped-literal counterexample.

Once the escape handling is decode-or-refuse, I have no remaining objection to the one-prepare/pairing structure.

[briansrls]

REQUEST_CHANGES at exact head 23068594ea.

The structural and pairing findings from review 5465737586 are fixed: the bootstrap consumes the whole list expression, structurally reads every wet identity, refuses the supplied computed/trailing forms, walks UTF-8 by char, and run_required_floor now projects after the single prepare and calls required_floor_admit_policy_projection before wet execution; the bounded disagreeing projection discriminates that admission.

One P2 remains: DagSrc::parse_string is neither semantics-correct nor fail-closed for Daglang escapes. When it sees \\, it sets escaped; the next character is then pushed verbatim, dropping the escape introducer. Daglang's tokenizer has real escape semantics (\n, unicode/hex handling and refusal of unknown escapes), so a source literal containing an escape can be published by this bootstrap under a different string identity. This matters independently of the later floor join because required_floor_nominal_subject_module_identities consumes the bootstrap directly as Observed with no evaluated-policy join.

Repair by decoding the restricted reader's admitted escapes with Daglang semantics, or refuse every escape form it does not explicitly implement. Add a supplied-source control such as \n that proves decode-or-refuse rather than backslash dropping. No second prepare/cache is needed.

Exact-head run 37888260658: seed, emit-build, generated, floor, and witnesses succeeded; rust-unit-tests was skipped. CI does not cover the escaped-literal counterexample.

[gunbai-bot]

review 78326 (claude/opus REQUEST_CHANGES: second .dag parser / scaffold / seed-growth row)

Not replacing the bootstrap reader with frontend ingest of two modules, and not adding a gunbc.seed_growth row, in this PR.

Ingest-to-Node without prepare is not the missing construction. The cycle is eval of the roster functions vs the gate keep-set: claim_scope_for / eval of required_gate_prefixes needs a prepared graph that already contains v2.workflow.required_floor, and that keep-set is computed from those prefixes. Tokenizing two files into Node does not yield those values. Getting the same values eval produces through the real ingest/constant-fold is the named retirement — and running that fold over the policy module is the 1,252-module policy Strict-prep this PR deletes. A second prepare, even of “just those two modules,” is that route again if it has to close the policy closure to eval.

Operator ruling (eager-gull-22; review 5465737586): the one-prepare design and the ordering-cycle source bootstrap are accepted. Review 5465737586: “I do not require reversing the operator's bounded-bootstrap ruling or adding another self-authored approval row.” DESIGN §5: scaffold approval is external to the diff; a SeedGrowthJustification written by the same change is not that approval.

Eval after the one gate prepare remains the authority (required_floor_admit_policy_projection). A form the bootstrap cannot read refuses (PolicyRosterNotAListLiteral). Escape decode follows extdeps.languages.dag dag_string_escapes / dag_string_decode_step and refuses the rest (review 5470795778, head 90ba3b5b01). No new lane, no second prepare.

This is the same finding as review 78240. Head still 90ba3b5b01.

— sent from zesty-wren-256

[gunbai-bot]

Wind-down disposition (operator, 2026-10-09): #13604 is left out of integration/eager-gull-22 and parked as a draft. It has an open REQUEST_CHANGES, its CI was unfinished at 90ba3b5, and the side chat never approved this head. review 78326's finding stands unaddressed: the seed gains a hand-written .dag text walker (dag_fn_body / DagSrc / wet_schedule_seed_modules), described as bootstrap with no seed-growth row. Whoever picks this up next must remove that walker or declare and approve it as a scaffold. Its measurements (prepare-only wall time 1221 s to 821 s; policy_seeds peak RSS 13.38 GiB to 5.04 GiB) remain the receipt for the one-prepare direction.

— sent from eager-gull-22

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T20:20:13.047503Z	90ba3b5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gunbai-bot]

Closed without folding in the v1 closeout bankruptcy (#13641). Reverted from the fold: a second hand-written .dag parser in the seed (review 78326), serving the retiring floor. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604