v1 closeout: fold sharp-raven-357 (+#13428, #13643)

.gitignore

@@ -77,12 +77,12 @@ __pycache__/
 # regenerable from committed source — symlink to target/release created by codegen
 /bin/
 
-# --- Derived failure-mode roster [owner: gunbc.recurring_failure_mode] ---
-# regenerable from committed source — membership list derived from sibling row files before compile; not a second authored authority
+# --- Retired failure-mode roster file [owner: gunbc.recurring_failure_mode] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/recurring_failure_mode/roster.dag
 
-# --- Derived rung-drop roster [owner: gunbc.rung_drop] ---
-# regenerable from committed source — membership list derived from sibling RungDrop row files before compile; not a second authored authority
+# --- Retired rung-drop roster file [owner: gunbc.rung_drop] ---
+# superseded; canonical home: the in-memory roster module contributed by source acquisition (v1_compiler.cli_run.derived_row_roster acquire_dir_files); a file at this path is a legacy artifact of an older gunbc and is refused by the loader — legacy file an older gunbc wrote on every source walk; the roster module is now derived in memory and never written
 /dag/gunbc/rung_drop/roster.dag
 
 # --- Generator stamp files [owner: gunbc.generated_artifact] ---

DESIGN.md

@@ -99,7 +99,7 @@ The domain roster is a modeled fact, not this prose: `gunbc.design_argument` `co
 
 - **external facts** — each independently versioned upstream has its own module; this is the strongest instance and was, until this section, the only one with a reviewer. Home authorities: `extdeps.external_authority::ExternalModelScope`.
 - **materialization / realization** — materialization and realization are separate interfaces with admissible handlers: materialization presents and stores an admitted identity and result contract; realization orders, places and transports work. This row owns whether a handler, provider or placement faithfully realizes that admitted identity and result contract (completeness, readback, retention, transport, refusal, binding obligations) without substituting, truncating or bypassing the admitted key. Cache purity is one discriminator across that boundary, not the whole domain. Key RELATION -- what relation, what scope, what complete canonical preimage, equality and collision disposition, and whether declared inputs are complete -- is owned by conformance-identity. Home authorities: `std.realization::Materialization`, `std.materialization_provider::ArtifactRequest`, `std.artifact_store::ArtifactStore`, `std.cache_interface::StorageSurface`.
-- **leasing / locking / grants / privileged access** — exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, a named human-only step where no API exists, and a refusal for an operator token relayed by chat or between sessions. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in. Home authorities: `std.temporal_effect::HeldLease`, `std.durable_compare_and_set::CasExpectation`, `gunbc.durable_cas_file_store::file_compare_and_set_windowed`, `std.durable_exclusive_hold::DurableHoldState`, `std.scoped_authorization::ScopedAuthorization`, `std.effect_grant::Grant`, `std.resources::ResourceHandle`, `gunbc.auth.authorization_pattern_selection::select_authorization_pattern`, `gunbc.auth.github_gcp_federation::github_wif_provider`, `gunbc.auth.gcp_secret_access::SecretAccessGrant`, `gunbc.auth.access_request::AccessRequest`, `gunbc.auth.approval_capability::ApprovalCapability`, `gunbc.auth.approval_broker::redeem_capability`, `gunbc.auth.access_token_source::select_access_token_source`, `gunbc.auth.privileged_effect_census::privileged_effect_census`.
+- **leasing / locking / grants / privileged access** — exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, and a named human-only step where no API exists. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in. Home authorities: `std.temporal_effect::HeldLease`, `std.durable_compare_and_set::CasExpectation`, `gunbc.durable_cas_file_store::file_compare_and_set_windowed`, `std.durable_exclusive_hold::DurableHoldState`, `std.scoped_authorization::ScopedAuthorization`, `std.effect_grant::Grant`, `std.resources::ResourceHandle`, `gunbc.auth.authorization_pattern_selection::select_authorization_pattern`, `gunbc.auth.github_gcp_federation::github_wif_provider`, `gunbc.auth.gcp_secret_access::SecretAccessGrant`, `gunbc.auth.access_request::AccessRequest`, `gunbc.auth.approval_capability::ApprovalCapability`, `gunbc.auth.approval_broker::redeem_capability`, `gunbc.auth.access_token_source::select_access_token_source`, `gunbc.auth.privileged_effect_census::privileged_effect_census`.
 - **fabric / compute** — allocation, placement and negotiation of resources. The shared authority is product.capacity (lease, pool, seat events) and product.fabric (priced selection over a provider parameter); the subjects that consume it are compute cells (work contracts, compute layouts, cell reservations, capacity class admission) and inference serving (seat binding, co-tenancy admission). Serving is INSIDE this domain, not beside it -- but the sharing is partial and the boundary is the point: both subjects reach the same priced selection fold, and each carries its OWN occupancy producer and linearization (serving: a termed LeaseGrant settled by fabric_seat_acquire over an event chain; compute: a timeless LeaseIdentity settled by file_compare_and_set). They differ further in what the lease is over -- a compute cell is stateless between grants and settles money, a serving seat is over a replica with loaded state and is quality-conditioned instead. The argument is [the serving capacity home ruling](docs/plans/serving-capacity-home-ruling.md). Home authorities: `product.fabric.selection::select_supply`, `product.capacity.lease::LeaseGrant`, `product.capacity.pool_events::SeatRequest`, `product.fabric.work::ExecutionRequirements`, `gunbc.fabric_event_log::fabric_seat_acquire`, `gunbc.compute.work_request::WorkOperation`, `gunbc.compute.work_provider_local::ComputeLayout`, `gunbc.fabric_control_plane::CellReservation`, `gunbc.fabric_executor_class::CapacityClassAdmission`, `gunbc.harness.harness_seat::harness_bind_seat`, `gunbc.serving.turn_admission::serving_group_admission`.
 - **decision / selection** — a choice must remain attributable to its subject, candidate field, constraints, evidence and policy, and conformance exposes accidental forks of that authority; the hard selection laws -- no answer outrunning its evidence, no front standing as a winner -- stay with the §3d reviewer, and goal assessment (std.goal_assessment) is a boundary of this row, not a member of it. Home authorities: `std.decision::DecisionSubject`, `std.decision::RealizationSelectionResult`, `std.decision::SelectionReceipt`, `std.decision::select_realization`, `std.pareto::SelectionAxis`, `std.pareto::ParetoEntry`, `std.pareto::DominanceVerdict`.
 - **keys / hashing** — the row's scope today is the three keying relations that have a consumed home: structural node identity (v2.std.node content_hash over std.content_hash HashFamily), the request and artifact keys of std.materialization_provider (request_key, artifact_request_key), and occurrence identity within one source graph (std.occurrence_identity) -- plus the declared-equality admissibility of a key TYPE (std.algebra algebra_profile_equality_extensional), which governs whether distinct keys of a finite map are decidably distinct (consumed by the map-literal duplicate-key check, docs/plans/map-literal-introduction-design.md). That admissibility is instantiation-blind at this rung: an opaque brand or a type parameter admits unjudged, and its next-rung trigger is instantiation-grain admission (v1 infer equality_admission_wall_note). This row owns the key RELATION -- what relation, what scope, what complete canonical preimage derives it, what equality and collision disposition govern it -- and whether the declared inputs are complete. Faithful realization of an admitted identity and result contract (completeness, readback, retention, transport, refusal, binding; cache purity as one discriminator) is owned by conformance-realization. Two further relations -- demand identity (the question asked) and the dependency read set an answer consumed -- are a declared frontier, not members: they have no home authority yet, are modeled by docs/plans/demand-engine-program.md, and enter this row when M1 of that program lands their carriers; until then a reviewer asks nothing about them under this row (DESIGN §3b: a home that owns only part of a claimed scope is a scope mismatch, so the scope is stated at what the homes own). Each member is a named keying relation within a named scope, derived rather than authored; the relation model is docs/plans/keying-relation-design.md. Home authorities: `std.content_hash::HashFamily`, `std.materialization_provider::request_key`, `v2.std.node::content_hash`, `std.occurrence_identity::OccurrenceIdAllocator`, `extdeps.realization.cache_purity::CachePurityVerdict`, `std.computation_identity::ComputationIdentity`, `std.algebra::algebra_profile_equality_extensional`.

ROADMAP.md

@@ -68,7 +68,7 @@ Every node declares its parent in the functional decomposition: gunbc-project-ro
 - [ ] **DP-M3: extdeps-scope closure halved** — The legacy extdeps scope manifest (dag/gunbc/legacy_extdeps_scope_frontier.tsv via gunbc.extdeps_scope_frontier) halved, and tools.extdeps_scope_placement_gate enrolled on an executing route before anything is counted. The unimported-bare-provider roster the census pairs with this is not on this line (v2.workflow.floor_unimported_bare_provider_debt_roster exists on main only). Why: An undeclared external-authority placement is a §3 citation nobody can check. [authority](dag/gunbc/extdeps_scope_frontier.dag)
 - [ ] **DP-M4: closed matches are total** — gunbc.non_fold_residue non_fold_residue_frontier (about 186 rows on this tree) down to at most 100, draining the nfr_reason_mint_era rows first (82). The six seed-Rust wildcard sites are out of scope. Why: A wildcard arm silently absorbs a new variant, which is the floor-level exhaustiveness guarantee missing. [authority](dag/gunbc/non_fold_residue.dag)
 - [ ] **DP-M5: absence is established, never inferred** — extdeps.filesystem.filesystem_io filesystem_absence_establishment_adoption_standing driven to zero open sites (each routed through filesystem_file_observation / filesystem_entry_presence), and filesystem_read_outcome_adoption_standing re-measured at identity grain. Why: Each unconverted site can report "nothing there" when it could not look. [authority](dag/extdeps/filesystem/filesystem_io.dag)
-- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) exist on main and not on this line, so this milestone's population is re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
+- [ ] **DP-M6: v2 native-route walls restored** — The native-route rung drops retired and the eval-step drop family shrunk. The three drops the census names (g0_type_decl_modifier_parse_without_sealing_property, variant_fields_unlowered_on_the_native_route, admit_callers_discarded_on_the_native_route) existed on main and not on this line. admit_callers_discarded_on_the_native_route is now retired by its own trigger -- the native route checks caller admission from the fn's declared admit_callers list, with the Arrow carrier and its consumer landing together (v2.compiler body_lowering_fold body_lower_fn_admit_clause_edges; v2.compiler.infer infer_caller_admission_diags) -- so it no longer counts. The other two remain, re-derived from gunbc.rung_drop once the line carries them. Why: Each standing drop is a known wall down on the path v2 is meant to run on. [authority](dag/gunbc/rung_drop.dag)
 - [ ] **The factory: harness, workers, CI/floor and the daily workspace, the machine that lands and verifies work** — The steps every change traverses (orientation, implementation, test, commit, publication, review, verification) are owned by the workflow as durable state, not by an agent's memory. CI and floor verdicts name what they executed and cost what their inputs require. Why: Every obligation left in prose is re-learned per session and dropped under pressure. Every finished candidate that needs hand-integration spends operator time the factory exists to save. [authority](docs/plans/harness-work-lifecycle.md)
 - [ ] **One request travels the whole factory and comes back as an independently reviewed, published candidate** — The dogfood route as one acceptance case: request, immutable subject, shared computation, placement grant, isolated execution, durable result, metering, independent review, candidate published, cleanup, result returned (production order: the belt reviews a head before publishing it) -- each established by its own typed record from the durable records the real srv2 route wrote for ONE attempt (gunbc.roadmap_dogfood_route DogfoodRouteReceipt). The start receipt is the first complete attempt, selected in refname order, by the first successful recorder to observe one (scanning durable attempt history), recorded once, create-only; attempts operated by hand before the route existed do not qualify. Why: Without one executable case the factory is a set of stages that each pass alone while no request has crossed them all, and the operator's confidence -- the gate for the first external customer -- has nothing to rest on. [authority](dag/gunbc/roadmap/roadmap_dogfood_route.dag)
 - [ ] **Publish each attempt's worker events to the fabric event log** — The harness's per-attempt worker events, today appended only to a host-local provider-events.jsonl that gunbc.roadmap_provider_events reads, are appended to gunbc.fabric_event_log as a new payload kind over its existing partitions (product.capacity.event_chain), one partition per attempt. Any consumer then reads an attempt's events from the fabric rather than from a file on the worker's host. Why: Without it, every live view depends on sharing a filesystem with the worker, and streaming cannot go through the fabric as ruled. [authority](dag/gunbc/fabric/fabric_event_log.dag)

artifacts/bmc/mtcollins1-boot-run-37102391062/SHA256SUMS

@@ -1,4 +1,3 @@
-ff115761d621d17f3c5d23d2869e9f170d8ff0090145df3d2ec633cd496d8306  ./kvm/features.json
 357c2410a75c2f46e5679bc17f2c5fa46d2444e3379756037adfa57aaf75557c  ./kvm/journal
 280137e5d0f80550ddd5ecae177344fce0d7e46ab217137d769ad178ef08a5c6  ./kvm/observer.log
 649e3a034f001c421cfa31f5e9d8746e5292ebd6e95aa728201e6e98c5343daf  ./kvm/still-1.jpg