Stop committing pure generated documentation projections

[gunbai-bot]

Summary

• Flip artifact_commit_policy to NotCommitted for every ProjectDocumentation artifact except DesignArtifact (DESIGN.md remains the session-loaded README/CLAUDE target).
• git rm ROADMAP, docs/design-rung-drops.md, docs/onboarding.md, and generated plan markdown. .gitignore / .gitattributes follow the registry; DESIGN.md links name tools.docs_projection_gate regen.
• Delete the heal-delegated concurrent-repair arm (HealRegeneratesAfterProvisionalMerge / merge-driver ledger recipe). It had no remaining subject.
• Hold for Source layout cutover: module a.b.c is stored at <root(a)>/b/c.dag (epochs C0–C4, one PR) #13783: after it lands, merge main, port, then side-chat review of the new head. Do not race.

Test plan

• Consumer check: workflows, hooks, heal, drift-watch, merge driver, .gitattributes do not read those committed bytes.
• main_wet_one twice on .gitignore, .gitattributes, DESIGN.md — second pass zero diff.
• docs_projection_gate regen writes the ignored files; git status --short empty after.
• Remote claims on generated_artifact / gitignore_emit / heal (see receipts). witnesses is not evidence (v1_required_lanes_withdrawn).
• required_lane_claim_agreement same FAIL on origin/main (pre-existing).
• Residual carrier(path:) / DOC_PLAN_ROOTS do not read uncommitted files as checkout inputs.

Execution receipts for cool-lark-903 (head cf8aa34019)

Producer: BuildBuddy https://app.buildbuddy.io/invocation/a0ad2351-cc6f-4b02-9b95-5602b70dd3c2
ctrl-build --remote --timeout 2h -- bash -lc with export GUNBC_MEMORY_BUDGET_BYTES=6000000000 inside that bash (not forwarded). Built target/release/gunbc in the same dispatch.

(A) documentation_wet on a fresh clone at cf8aa34019

• git clone then git checkout --detach cf8aa34019 → FRESH_HEAD=cf8aa34019503f17300b2432e92a787bfc39a68e
• 36 uncommitted ProjectDocumentation paths (ROADMAP, failure-modes, rung-drops, onboarding, 32 AuthorityOnly plans including source-layout): all ABSENT (absent=36 present=0)
• gunbc run … generated_artifact_gate --function documentation_wet exit=0; wrote each path once (MISSING_AFTER_1=0), including Filesystem.Write ROADMAP.md and docs/plans/source-layout-authority.md
• Second documentation_wet exit=0; sha256 of all 36 paths identical to pass 1 (BODIES_EQ_SECOND_GENERATE=yes) — written body == artifact_generate re-run
• git status --short empty (ignored)

ROADMAP.md sha256 54c36bff9ae0c0d6d7e6d8a449654e736abac3bf26780a77d562fbac01bd6dd6

(B) main_wet_one DESIGN.md from the merged authorities (not a hand merge)

Two passes, both exit=0. Hash unchanged:

• before / after1 / after2: d5c62b46b97f780a9297f08c3233a4406badc7eb644214b2b2782baa716f1e80
• second pass zero diff; no DESIGN.md commit

---

Receipts (remote BuildBuddy, export GUNBC_MEMORY_BUDGET_BYTES=6000000000 inside bash -lc)

Head 635f6fdd05 (docs-gate sentence refresh). Prior receipts on ad54b45011. Invocations: https://app.buildbuddy.io/invocation/92c4a533-1763-45d3-8c71-823bb66dd175 , https://app.buildbuddy.io/invocation/4b9951f9-efff-4b15-a453-692a05e3c26e , main control https://app.buildbuddy.io/invocation/e215058c-3597-46e9-808d-698ed54fa0ce .

(1) Producer regen, second pass zero-diff

main_wet_one --arg path= for .gitignore, .gitattributes, DESIGN.md. Each pass exit=0. Pass1 hashes = pass2 hashes; git diff empty.

• .gitignore a17dad2f93f3951d8528c98f1d531eb0698fae889f235dec320f35d642330586
• .gitattributes 79766194a8ada090f9ef9f104f0befd6ceaad5ff391addd1cabf2e921f9c72ed
• DESIGN.md d365ba2678264781311dac37594ae8d0ed0069140fe10fd76ffa38626b9b8626

(2) Docs regen writes ignored files; status clean

docs_projection_gate regen exit=0. Wrote docs/design-failure-modes.md (4.2MiB), docs/design-rung-drops.md (580KiB), docs/onboarding.md (46KiB). git check-ignore hits .gitignore:194-197. git status --short empty after.

(3) Remote claims

entry	this PR	origin/main@5dbac90f
generated_artifact_assessment	0	—
generated_artifact_merge_driver_recipe	0	—
generated_artifact_producer_coverage	0	—
gitignore_gate	0	—
heal_candidate	0	—
heal_publication_boundary	0	—
required_lane_claim_agreement	1	1

w_no_projected_ledger_denies_a_lane_the_roster_requires FAIL on both trees (same four controls PASS). The wall reads expected_design_failure_modes_md() (producer text), not checkout bytes. docs/design-failure-modes.md is already absent on main. Pre-existing; this flip did not cause it.

(4) Residual path names: who reads the file?

roadmap_authority carrier(path:) — Pointer.path is a citation label. Production uses it as ROADMAP/page href, dispatch-brief JSON, and markdown link text (roadmap_emit, roadmap_presentation, roadmap_spawner, roadmap_dispatch_actuator). Nothing Filesystem.Reads those paths. pointer_resolves / node_carrier_clean exist only in roadmap_model_test against a supplied fixture list. Rows that still name docs/design-rung-drops.md or a generated plan path are labels for a file that exists after regen, not checkout inputs. Not repointed: the Pointer type is path-shaped, not a DeclarationRef, and the rows are not a file-reader.

Seed DOC_PLAN_ROOTS = ROADMAP.md, DESIGN.md — build_doc_graph_report does read_to_string each root. Missing file is continue, not a refuse (cli_run.rs). DESIGN.md stays committed and is still read. ROADMAP.md is read only when present after on-demand regen; a checkout without it skips. gunbc.doc_graph_roots extra_roots already omit PlanIsAuthorityOnly; remaining plan slugs are admitted only if they exist under docs/. Seed left as-is (v1 seed, optional-when-present root).

[gunbai-bot]

Addressed review 79012: DESIGN.md §3b (from gunbc.design_argument) now cites gunbc.plans.demand_engine_program instead of the deleted docs/plans/demand-engine-program.md path. The two named comment citations in materialization_store_local and floor_materialization use the same symbol.

[gunbai-bot]

review 79012 REQUEST_CHANGES is already discharged on head ad54b45011.

• dag/gunbc/design_argument.dag Keys / hashing boundary now cites `gunbc.plans.demand_engine_program`, not [demand-engine-program.md](docs/plans/demand-engine-program.md). The still-committed relation model stays [keying-relation-design.md](docs/plans/keying-relation-design.md).
• DESIGN.md §3b matches that row (same wording). Producer regen of DESIGN.md is still in flight remotely (main_wet_one twice); this line is already the intended projection text.
• The two comments named in the review already cite the module, not the deleted path: dag/extdeps/realization/materialization_store_local.dag (gunbc.plans.demand_engine_program EvaluationIndexCorrupt) and dag/gunbc/floor/floor_materialization.dag (context-assembly cut of gunbc.plans.demand_engine_program). No further edit.

— sent from silent-otter-245

[gunbai-bot]

review 79058 REQUEST_CHANGES is discharged on 23aa65d1ce8.

• artifact_commit_policy for PlanArtifact now reads Plan.projection. PlanProjectsCommittedMarkdown / PlanProjectsDerivedMarkdown still mean committed; PlanIsAuthorityOnly means not. The fourteen plans whose markdown left the checkout declare PlanIsAuthorityOnly with a ruling (a295e17 / Clean up archived planning documents and receipts #9635 precedent). plan_projects_committed_markdown therefore drops them as doc-graph roots.
• Onboarding RemediedByDerivation no longer claims DESIGN.md links docs/onboarding.md. It names gunbc.contributor_onboarding_path and tools.docs_projection_gate regen, matching design_document.dag.

— sent from silent-otter-245

[gunbai-bot]

review 79087 REQUEST_CHANGES is already discharged on head 438aa89fca7.

.gitignore:102 is [owner: gunbc.ci.ci_failure_class], which is module gunbc.ci.ci_failure_class in dag/gunbc/ci/ci_failure_class.dag. The stale flat name was on the pre-cutover regeneration; main_wet_one after merging #13783 rewrote the tag. DESIGN.md cites gunbc.instruments.docs_projection_gate regen, not tools.docs_projection_gate. Leftover path comments stay: they name files regen still writes.

— sent from silent-otter-245

[briansrls]

REQUEST_CHANGES for the requested tree at 1bfbcd55aa7c48943344b7a9ccedca1f74267c46. The PR now names head 438aa89fca76c09660b95a8778b23bbd8d91b634, but both commits carry the identical tree fe410a5193a4f1977a74379f1960826e509f6267, so this review is anchored to the current head and applies exactly to the requested content.

The heal-arm deletion, merge-driver simplification, derived .gitignore, deletion of the tracked projections, and retained committed DESIGN.md are coherent. Two blockers remain.

1. The source-layout plan was missed by the post-cutover port

The PR says all plan markdown leaves the committed population, but gunbc.plans.source_layout_authority still imports and declares PlanProjectsCommittedMarkdown. Accordingly the regenerated .gitattributes still contains:

docs/plans/source-layout-authority.md merge=generated-artifact

and .gitignore does not ignore that path. This is a real surviving committed pure plan projection, not a residual prose citation. It appears to be the plan added by #13783 after this branch was originally built.

Required correction:

• change source_layout_authority_plan.projection to the intended uncommitted disposition;
• delete docs/plans/source-layout-authority.md;
• regenerate .gitignore and .gitattributes from the final tree;
• add a registry-derived invariant over the whole population: the exact set of CommitRequired { consumer: ProjectDocumentation } artifacts is { DesignArtifact }.

The new documentation_projections_except_design_are_not_committed claim spot-checks only DesignFailureModesArtifact, RoadmapArtifact, and DesignArtifact; it omits rung drops, onboarding, and every PlanArtifact, which is why this gap passed.

2. ROADMAP and plan markdown have no completing on-demand writer after becoming NotCommitted

gunbc.instruments.generated_artifact_gate writes only committed_generated_artifacts() in both main_wet and main_wet_one. After this change that excludes ROADMAP and authority-only plans.

gunbc.instruments.docs_projection_gate regen writes only the three docs for which docs_projection_producer returns Present: failure modes, rung drops, and onboarding. It explicitly returns Absent for RoadmapArtifact and every PlanArtifact.

So the receipt that docs_projection_gate regen wrote three ignored files is valid, but it does not establish the PR's broader contract. From a clean checkout there is no completing ProcessExit route in this tree that writes ROADMAP or any of the deleted plan markdown, despite the new plan rulings saying “Generate locally” and residual citations being justified on the premise that the files exist after regen. Pure rendering functions remain, but no actuator reaches those artifacts once they leave the committed roster.

Required correction: provide one registry-derived on-demand regeneration route for the complete uncommitted ProjectDocumentation population—ROADMAP, the three docs projections, and every uncommitted plan—or a generic full-registry main_wet_one door plus an aggregate docs command. It must not restore them to committed_generated_artifacts().

The discriminating receipt should start from a clean checkout with those files absent, run the public command, and prove:

• every expected uncommitted documentation path is written exactly once;
• the population is derived from the registry/commit policy rather than a literal roster;
• each body equals its producer output;
• git status --short remains clean because every written path is ignored.

This is also the exact class named by docs_markdown_projections_have_no_completing_actuator: a pure renderer is not a completing actuator.

The reported required_lane_claim_agreement baseline failure is not an additional blocker, and I found no defect in deleting HealRegeneratesAfterProvisionalMerge once its final committed subject disappears.

[gunbai-bot]

Review 79111 APPROVE plus the GitHub CHANGES_REQUESTED on tree fe410a5 (same content as 438aa89) named two real leftovers. Both are on 1b2ef9577b7.

1. source-layout leak. source_layout_authority_plan is now PlanIsAuthorityOnly (same PR 13810 ruling as the other ProjectDocumentation-only plans). docs/plans/source-layout-authority.md is deleted. DESIGN cites gunbc.plans.source_layout_authority instead of a dead markdown link. .gitignore lists /docs/plans/source-layout-authority.md (last batch_g plan, registry order). .gitattributes no longer gives that path merge=generated-artifact.

   commit_required_project_documentation_is_only_design is an identity join over generated_artifact_registry: the only CommitRequired { consumer: ProjectDocumentation } row is DesignArtifact. That is the check the three-literal claim could not see.

2. completing actuator. uncommitted_project_documentation_artifacts() is the registry filter artifact_is_project_documentation && !artifact_is_committed. documentation_wet folds that list through the same artifact_generate + Filesystem.Write as main_wet. main_wet_one now selects from the full generated_artifact_registry, so ROADMAP.md and an AuthorityOnly plan can be written one path at a time. Neither route adds those rows to committed_generated_artifacts().

   documentation_wet_population_is_uncommitted_project_documentation pins Design out, Roadmap / onboarding / source-layout in, Gitignore out, and every member documentation + uncommitted. The wet “clean checkout, write once, bodies = producers, status clean” receipt is the public command itself; I have not re-run that write on a fresh clone here (same memory envelope as main_wet).

[gunbai-bot]

review 79121 is right: the PlanIsAuthorityOnly { ruling: "… PR 13810 … a295e17415 …" } sentence was one policy copied 16 times, and a PR number / commit hash is not a resolvable symbol.

On ca540fae2a5:

• gunbc.design_ruling project_documentation_projections_are_not_checkout_artifacts is the one row (enrolled in design_rulings()).
• PlanIsAuthorityOnly now carries DesignRuling, not String. Every authority-only plan — the 16 this PR flipped and the earlier 9635/a295e17415 rows that had their own copied sentences — imports that row.
• DESIGN states the rule once and cites the row: (ruling \gunbc.design_ruling project_documentation_projections_are_not_checkout_artifacts`)`.

The truncated leftover about // comments in a design-ledger file was not a second actionable defect I could pin; if it names a live docs/plans/… path that this PR deleted, say which file.

[gunbai-bot]

review 79140 is right: the heal-recipe witnesses were deleted and their enrollments were not.

On baee0b127f:

• Removed the five dead identities from gunbc.ci.ci_layer_roots bin_wet, v2.workflow.local_repo_wet_terminal WetScheduledClaim, and v2.workflow.floor_route_gap chunk 00.
• Repointed printed_remedy_is_mangled_by_the_medium_that_prints_it evidence at live recipe declarations.
• Moved emitted_driver_has_no_empty_heal_case_arm into test.claim.generated_artifact_merge_driver_recipe. That file is hermetic discovery; the real-execution module is excluded from it, so a string check of the emitted script was not executed there. It is not a wet claim and is not re-enrolled on the wet path.

[briansrls]

APPROVE at exact current head baee0b127fc61ec119a40a9d5eebce714b5c45d4.

The requested cf8aa34019503f17300b2432e92a787bfc39a68e closes both findings from review 5497808863:

• gunbc.plans.source_layout_authority is PlanIsAuthorityOnly; its markdown is deleted, ignored, and absent from .gitattributes. commit_required_project_documentation_is_only_design derives the live CommitRequired { consumer: ProjectDocumentation } population from the registry and requires its only identity to be DesignArtifact.
• uncommitted_project_documentation_artifacts() derives the NotCommitted documentation remainder from the full registry, and documentation_wet folds that population through the same artifact_generate + exact-path write used by the committed actuator. It does not widen committed_generated_artifacts(). The fresh-clone two-pass receipt covers all 36 current paths, including ROADMAP and source-layout-authority.

The branch advanced once during review. cf8aa34019 itself had stale wet/floor schedule entries naming heal-row-extractor declarations deleted by this PR. The current-head commit removes those dead enrollments and moves the still-live no-heal-case control onto the hermetic recipe path; that is the correct cleanup and introduces no new artifact-policy surface.

No requested changes remain. Exact-head witnesses and heal-generated-artifacts were queued when approved, so they remain landing gates.