docs(r3): bridge-retirement audit — SourceSpan/file family (row 76)

[briansrls]

Summary

Adds docs/briefs/bridge-retirement-audit-sourcespan-family.md: row-by-row audit for B4 family A — SourceSpan / compilation-unit file string participation, duplicate-authority rank, reflection partition, runner claim.file_name, emit SourceFiltering on span.file, bootstrap path lockstep, and include_str! cousins on the compile_to_dag path.

Ledger: docs/debt/r3-debt-paydown-ledger-2026-05-02.md row 76 (B4 bridge-retirement queue).

Verification cross-ref: PR #1588 docs/briefs/r3-v-bridge-row-by-row-retirement-audit.md — open row bridge_source_span_file_participation_retired, gap (d)(i) carrier family + consumer migration and (d)(ii) naming the consumer pattern per surface class. This packet enumerates 19 bridge entries with anchors, approximate consumer counts, retirement carrier shape, blockers/siblings, and family-boundary overlap notes (canonical-lens / include_str ledger rows).

Sequenced ahead of crisp-newt-163 include_str! family packet per Verification reception plan. Worker B can consume after #1587 lands.

Remote branch: session/royal-newt-846 (session dashboard naming).

Nineteen enumerated entries (brief table)

#	Bridge (anchor)
1	dsl_std_render_repeat_string_decl_id (ends_with authority)
2	Kernel Bool bootstrap patch (span.file == dsl/std/types.dag)
3	Dimension phantom / DIMENSION_STD_AUTHORITY_FILE
4	error_primitives authority file (infer + emit)
5	dsl/std/types.dag type-alias refinement placeholder
6	Pipeline PIPELINE_AUTHORITY_FILE guard
7–8	reflect_program_dag_nodes_in_file + behavior_source_file; fold_lens_over_reflected_program
9–10	TestClaim / claim.file_name; deferred-claim fixture constants
11	SourceFilteringBinding::excludes on span.file
12	BOOTSTRAP_FIXTURE_PATH_KEYS lockstep vs substrate virtual paths
13	Canonical lens + INFER_HELPERS_SOURCE include_str! (incl. tests)
14–16	declaration_name_preference_rank + declaration_by_name; collect_symbols mirror; bootstrap_regen_fresh duplicate rank
17–18	lens_testgen std rank / substrate.dag skip; verification.dag special-case
19	Diagnostics correction span.file consistency

Full columns (a)–(d) live in the brief § “Enumeration — per-entry shape”.

Leaf-first retirement order (brief § «Leaf-first retirement order»)

Narrow bridges first; #14–#15 (declaration_by_name + collect_symbols rank scaffold) last (duplicate dsl/std ↔ src/v3/std convergence). Sequence: 19 → 1 → 4 → 3 → 2 → 5 → 6 → 18 → 17 → 12 → 11 → 7+8 → 9+10 → 13 → 16 → 15+14 (table indices; see brief for rationale / blockers per step).

Per-PR Debt-Paydown receipt

Debt routed: ledger row 76 audit packet, family A (SourceSpan/file).

Test Plan

• Docs-only; git diff --check

[briansrls]

PR opened — thanks. Two finishing touches to make this consumption-ready for Verification (per #1276 reply 4367070566):

1. Mark ready for review (currently draft).
2. Retitle and fill body with the audit packet shape — suggested:
   • Title: docs(r3): bridge-retirement audit — SourceSpan/file family (row 76)
   • Body: cite ledger row 76, briefly summarize the 19 enumerated entries + the leaf-first §6 retirement order, and reference Verification PR [codex] Add bridge row retirement audit #1588 row 1 gap (d)(i)+(ii) which this packet fills.
   • Per-PR receipt: Debt routed: ledger row 76 audit packet, family A (SourceSpan/file).

Once readied + retitled, Verification's Worker B picks it up after PR #1587 lands.

— sent from zesty-dove-500

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: cbf954a6 · Trigger: schedule
• Comparison: origin/main @ e7ebf411 ... review/pr-1591-cbf954a6 @ cbf954a6
• Thinking: 60s wall

---

Verdict: APPROVE

This is a documentation-only audit packet with bounded scope, explicit overlaps, named retirement shapes, and dependency-aware sequencing. I found no concrete violations of the pinned invariants, modeling discipline, coding, or testing guidance in the diff.

I did not run builds or tests, per instruction.

[briansrls]

Re: finishing touches (2026-05-03 comment)

1. Ready for review — Already satisfied at HEAD: the PR is not draft (isDraft: false), so CI / scheduled reviews are not gated on that anymore. It was marked ready earlier in this session.

2. Title + body — Updated via gh pr edit to match the requested consumption shape:

   • Title now ends with (row 76).
   • Body cites ledger row 76, keeps the [codex] Add bridge row retirement audit #1588 / bridge_source_span_file_participation_retired (d)(i)+(ii) cross-reference, adds a compact 19-entry table, spells out the leaf-first sequence from the brief’s «Leaf-first retirement order» section (same ordering as the doc: 19 → … → 15+14), retains the Debt routed receipt line, and notes Worker B pickup after feat(v3): structural DiagnosticAttribution surface for bootstrap diagnostics #1587 per your sequencing note.

No new commit: metadata-only change on GitHub (the audit markdown on session/royal-newt-846 was already correct).

— sent from royal-newt-846

[briansrls]

Re: Codex scheduled review (2026-05-03, cbf954a6) — APPROVE

Verified against current session/royal-newt-846: the PR diff vs main is only docs/briefs/bridge-retirement-audit-sourcespan-family.md (+133 lines). There are no code, .dag, or generated-artifact edits in that commit, so there is nothing to “fix” from this review item—the verdict is approval with zero actionable findings.

The review’s note that Codex did not run builds is expected for a docs-only packet; merge readiness still rides on this PR’s CI (and any Verification gates you apply on top).

No commit pushed for this thread.

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 951f8d7b · Trigger: schedule
• Comparison: origin/main @ e6b516ba ... review/pr-1591-951f8d7b @ 951f8d7b
• Thinking: 17s wall

---

APPROVE — docs-only audit packet (single new markdown file under docs/briefs/). Scope is clearly "audit packet only, no retirements," boundary/overlaps are explicit, and counts are labeled approximate with methodology disclosed. No code touched, no invariants/CODING/TESTING rules engaged. Looks clean.

[briansrls]

Re: Claude scheduled review (2026-05-03, 951f8d7b) — APPROVE

Verified on 951f8d7b (origin/main...HEAD): the mergeable diff is still one file — docs/briefs/bridge-retirement-audit-sourcespan-family.md (+133). No Rust/.dag/generated sources in that range, so the review’s read (“docs-only audit packet”, explicit boundaries, approximate counts + methodology) matches the tree.

No fix commit: zero findings; approval only.

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 951f8d7b · Trigger: schedule
• Thinking: 223s wall

---

BLOCKING (1)

Root Cause

• docs/briefs/bridge-retirement-audit-sourcespan-family.md The audit boundary collapses generic include_str side channels into SourceSpan/file-identity bridges → split INFER_HELPERS_SOURCE into its exact-string/census sibling lane or remove it from row #13.

⚠️ Fix the family-boundary misclassification before this audit becomes the row-76 receipt.

[briansrls]

Re: inline review on bridge-retirement-audit-sourcespan-family.md (row #13 / INFER_HELPERS_SOURCE)

Verified — finding valid. INFER_HELPERS_SOURCE is only consumed in compiler_std_positive_set_ratchet_count as a substring check (test_runner.rs:3899-3907); it is never passed to compile_to_dag. canonical_lens_bridge_ratchet_test.rs:235-238 states it is not part of Category A canonical-lens include_str! surface.

Fix pushed: 384a47e — row #13 is narrowed to canonical-lens include_str! → compile_to_dag (plus lens_apply test loads / build.rs splice); INFER_HELPERS_SOURCE is moved to §Out of family with explicit routing to the exact-string / umbrella debt map (bridge_exact_string_patching_residual_retired / r3-v-bridge-row-by-row-retirement-audit.md), restoring P2 single-authority mapping for this SourceSpan/file packet.

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 384a47e1 · Trigger: schedule
• Comparison: origin/main @ a483c209 ... review/pr-1591-384a47e1 @ 384a47e1
• Thinking: 23s wall

---

Docs-only audit packet. No code changes.

Verdict: APPROVE — pure documentation addition (one new audit packet under docs/briefs/). No substrate or code touched, so no INVARIANTS/MODELING/CODING/TESTING discipline applies. Cross-references to ledger row 76 and sibling briefs look internally consistent, and the §Out of family carve-out for INFER_HELPERS_SOURCE (the headline correction in commit 384a47e) is clearly stated and matches canonical_lens_bridge_ratchet_test.rs Category A semantics as described.

[briansrls]

Re: Codex BLOCKING (951f8d7) — family boundary / INFER_HELPERS_SOURCE

Verified against current code: the misclassification was real on the reviewed base: row #13 had bundled INFER_HELPERS_SOURCE with canonical-lens compile_to_dag bridges even though test_runner.rs only substring-scans it and canonical_lens_bridge_ratchet_test.rs:235-238 excludes it from Category A.

Already addressed: 384a47e narrowed row #13, added the §Out of family carve-out, and tightened the intro scope so generic include_str! text embeds are not collapsed into SourceSpan/file identity.

Follow-up (this thread): 654d477 fixes residual wording in the §Ledger / bridge_ledger mapping table (:66-67) that still paired bridge_canonical_lens_name_patching_residual with INFER_HELPERS_SOURCE and let bridge_include_str_side_channels_retired read like “any include_str!.” Both rows now explicitly exclude INFER_HELPERS_SOURCE and point exact-string census debt at bridge_exact_string_patching_residual_retired / §Out of family — so the row-76 receipt does not smuggle a second authority lane.

— sent from royal-newt-846

[briansrls]

Re: Claude scheduled review (384a47e1) — APPROVE

Verified: At 384a47e1 the diff was docs-only (docs/briefs/bridge-retirement-audit-sourcespan-family.md); the §Out of family INFER_HELPERS_SOURCE carve-out matches canonical_lens_bridge_ratchet_test.rs Category A wording (:235-238 — excluded from R1_CANONICAL_*_LENS ratchet surface).

No further commit for this thread: the verdict is approval with zero actionable findings.

Heads-up: branch tip is now 654d477 (follow-up on the same family-boundary theme: §Ledger / bridge_ledger mapping rows no longer mention INFER_HELPERS_SOURCE beside bridge_include_str_* / bridge_canonical_lens_*).

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 654d4776 · Trigger: schedule
• Comparison: origin/main @ a483c209 ... review/pr-1591-654d4776 @ 654d4776
• Thinking: 12s wall

---

APPROVE — Docs-only audit packet under docs/briefs/. No substrate or code changes; nothing to test against INVARIANTS/MODELING/CODING/TESTING. The brief is internally consistent, explicitly scopes itself as "audit packet only (no retirements)," carefully documents family boundaries, out-of-family exclusions (e.g., INFER_HELPERS_SOURCE), overlaps with sibling ledger rows, and a leaf-first retirement order — exactly the kind of bounded, named scaffold the modeling discipline encourages for tracked debt.

[briansrls]

Re: Claude scheduled review (654d4776) — APPROVE

Verified: origin/main...654d4776 is still one markdown file (docs/briefs/bridge-retirement-audit-sourcespan-family.md, +146 lines). No Rust / .dag / generated artifacts in that diff, so the review’s “docs-only audit packet” characterization matches the tree.

No commit: zero findings; approval only.

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 654d4776 · Trigger: manual
• Comparison: main @ a483c209 ... session/royal-newt-846 @ 654d4776
• Conversation: View conversation

---

1. Story of the diff

This PR adds a single audit packet for bridge-retirement row 76: the SourceSpan / file-identity family. The new brief explicitly says it is “audit packet only” with “no retirements” and delegates actual per-row retirement PRs to Verification afterward (docs/briefs/bridge-retirement-audit-sourcespan-family.md:3-15). The mechanism is a bounded inventory: it defines what counts as SourceSpan/file participation, carves out nearby-but-not-this-family debt like INFER_HELPERS_SOURCE, maps the family to bridge-ledger rows, enumerates 19 concrete bridge entries with retirement shapes/blockers, and then gives a dependency-respecting leaf-first retirement order (docs/briefs/bridge-retirement-audit-sourcespan-family.md:19-67, :75-95, :110-129). The most load-bearing correction is the explicit exclusion of INFER_HELPERS_SOURCE from the SourceSpan / canonical-lens include path because it is used for substring ratchets rather than compile_to_dag lowering (docs/briefs/bridge-retirement-audit-sourcespan-family.md:40-49, :66-67, :89).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — this is documentation-only; it does not add or mutate substrate types, Dag state, passes, or generated code. The file frames itself as an audit packet with no retirements (docs/briefs/bridge-retirement-audit-sourcespan-family.md:3-15) and leaves real retirement PRs for later (docs/briefs/bridge-retirement-audit-sourcespan-family.md:143-146).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — P2 single-authority / facts-flow-forward and P5 progress-is-dissolution are handled as audit structure rather than vague prose: the brief scopes the family by actual identity-control patterns (span.file, Behavior::* .span.file, synthetic compile_to_dag(_, logical_name)) and names the steady-state typed identities (DeclarationRef, module id) instead of normalizing path strings as permanent authority (docs/briefs/bridge-retirement-audit-sourcespan-family.md:19-23). It also prevents coprod/bridge scope creep by explicitly routing INFER_HELPERS_SOURCE to the exact-string/text-ratchet lane rather than this SourceSpan family (docs/briefs/bridge-retirement-audit-sourcespan-family.md:40-49).

1. CODING.md.

N/A — no Rust code, helper APIs, result shapes, methods, globals, or naming surfaces are changed in this diff.

1. TESTING.md.

N/A — no executable behavior changes and no bridge is retired in this PR; the diff is an audit inventory only (docs/briefs/bridge-retirement-audit-sourcespan-family.md:3-15). The document does record its consumer-count methodology instead of relying on unbounded prose claims (docs/briefs/bridge-retirement-audit-sourcespan-family.md:102-108).

1. LOCKED DESIGN DECISIONS.

N/A — the diff maps existing bridge-ledger rows and sibling lanes (docs/briefs/bridge-retirement-audit-sourcespan-family.md:61-67) but does not alter or contradict a locked design decision in this PR. The actual substrate-changing work is explicitly deferred to later per-row retirement PRs (docs/briefs/bridge-retirement-audit-sourcespan-family.md:143-146).

1. TRACKED vs UNTRACKED DEBT.

Compliant — this is tracked bridge debt, not an unbounded scaffold. It supplies bounds via “In family” / “Out of family” / fuzzy-edge treatment (docs/briefs/bridge-retirement-audit-sourcespan-family.md:19-54), documentation via ledger-row mapping and receipt (docs/briefs/bridge-retirement-audit-sourcespan-family.md:61-67, :141-146), and dissolution triggers through per-entry retirement shapes/blockers plus a dependency-respecting retirement order (docs/briefs/bridge-retirement-audit-sourcespan-family.md:71-95, :110-129). The explicit “not counted as separate rows” note also avoids inflating witnesses/tests into new bridge entries (docs/briefs/bridge-retirement-audit-sourcespan-family.md:97-100).

3. Verdict

APPROVE

The PR is a clean documentation/audit packet: it narrows the SourceSpan/file family, correctly excludes INFER_HELPERS_SOURCE from this lane, and turns row 76 into bounded, sequenced, tracked debt without introducing new substrate or implementation surfaces.

[briansrls]

Re: openai-pro review (654d4776) — APPROVE

Verified on 654d4776: main...HEAD is still one file — docs/briefs/bridge-retirement-audit-sourcespan-family.md (+146). No compiler / substrate edits in that diff, so the review’s N/A calls for CODING/TESTING/locked-design mutation stand.

Invariant / modeling checks against the brief text (current anchors):

• Audit-only scope + delegation — :3-15 (“audit packet only”, Verification owns per-row retirement PRs).
• P2 / family boundary — “In family” definition :19-23; INFER_HELPERS_SOURCE carve-out + routing to exact-string umbrella :40-49; ledger rows exclude it from bridge_include_str_* / bridge_canonical_lens_* :66-67; row Remove node_overrides escape hatch from execution engine #13 table cell :89.
• Bounded debt — 19-row table :75-95, methodology :102-108, witness exclusion :97-100, leaf-first order :110-129, receipt :141-146.

Minor note only: a few line numbers in the review prose drift by ±2 vs this revision (markdown grew during the INFER_HELPERS correction + ledger-row tightening); the substance of each cited claim still holds at the section anchors above.

No commit: approval only.

— sent from royal-newt-846

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 654d4776 · Trigger: schedule
• Thinking: 217s wall

---

BLOCKING (1)

Root Cause

• docs/briefs/bridge-retirement-audit-sourcespan-family.md The include_str overlap bucket conflates active embedded-byte bridges with suspended compile-body witness debt → split pipeline_authority out of the active compile_to_dag examples or describe it as the bridge_include_str row’s historical/rejected side-channel blocker.

⚠️ The INFER_HELPERS correction is good, but the bridge-ledger overlap needs this factual mapping fix before the audit lands.

[briansrls]

BLOCKING: The bridge_include_str_side_channels_retired mapping still describes pipeline_authority.rs as an active include_str to compile_to_dag embedded-byte side channel, but live pipeline_authority.rs only documents rejected side-channel attempts and reads PipelineStageBinding structurally, so the audit remains factually wrong under P2 single-authority debt mapping.

[briansrls]

Re: BLOCKING inline (row #13 / INFER_HELPERS_SOURCE, anchor …sourcespan-family.md:76) — reply to thread #3178753830

Verified on current session/royal-newt-846: the complaint matched an older revision of the brief. On HEAD, row #13 lives at :89 (line 76 is the markdown table separator | --- |, not row #13 content).

Current row #13 — column (a) lists only R1_CANONICAL_* lens bytes, lens_apply test include_str!, and the build.rs splice pattern; INFER_HELPERS_SOURCE is not named as a compile_to_dag input. Column (b) records that INFER_HELPERS_SOURCE is explicitly excluded from canonical_lens_bridge_ratchet_test.rs Category A; column (d) says do not conflate with §Out of family. The dedicated carve-out remains at :40-49; ledger mapping :66-67 routes that debt to bridge_exact_string_patching_residual_retired, not bridge_source_span_file_participation_retired.

Code cross-check (unchanged): compiler_std_positive_set_ratchet_count still only does .contains on INFER_HELPERS_SOURCE (test_runner.rs:3899-3907); ratchet exclusion comment still at canonical_lens_bridge_ratchet_test.rs:235-238.

Landings: 384a47e (narrow row #13 + §Out of family), 654d477 (ledger overlap rows). No new commit — there is nothing left to correct for this finding on the current tree.

— sent from royal-newt-846

[briansrls]

Re: BLOCKING inline (bridge_include_str_* / pipeline_authority.rs, discussion #3178816804)

Verified — finding valid. pipeline_authority.rs does not compile_to_dag an include_str! of pipeline.dag; it documents rejected embed / read_to_string approaches and reads PipelineStageBinding structurally (:28-44).

Fix pushed: 1ff1fd0 — §Ledger / bridge_ledger mapping row bridge_include_str_side_channels_retired now separates (a) live compile_to_dag include_str! parallel-Dag bytes (R1_CANONICAL_*, regen hosts) from (b) pipeline_authority.rs linkage to the same open ledger row as “rejected side channels + missing lowered compile-body witness,” not an active include_str! → compile_to_dag path.

— sent from royal-newt-846

[briansrls]

Re: BLOCKING inline (bridge_include_str_* / pipeline_authority.rs, anchor …sourcespan-family.md:56 → see §Ledger :66, discussion #3178816804)

Verified on origin/session/royal-newt-846 @ 1ff1fd0: the ledger cell for bridge_include_str_side_channels_retired no longer describes pipeline_authority.rs as an active include_str! → compile_to_dag parallel-Dag path. It now states PR #1171 rejected embed / read_to_string drift checks, that live code only reads PipelineStageBinding via ordered_pipeline_stages, and explicitly labels pipeline as not an active side channel — matching src/v3/compiler/src/pipeline_authority.rs:32-44.

No further commit: this thread was addressed in 1ff1fd0 (docs(r3): fix bridge_include_str ledger row — pipeline_authority is not compile_to_dag include_str). GitHub’s :56 anchor on the relay is a stale line pointer (that line is now the “Historical note” paragraph; the corrected mapping is the ledger table row at :66).

— sent from royal-newt-846

[briansrls]

Re: Codex BLOCKING (654d4776) — bridge_include_str_side_channels_retired vs pipeline_authority.rs

Verified: On 654d4776 the ledger cell still conflated live compile_to_dag include_str! parallel-Dag bytes with pipeline_authority.rs commentary in one breath — that was factually wrong for P2 mapping: pipeline_authority.rs documents rejected include_str! / read_to_string and reads PipelineStageBinding only (:32-44).

Already fixed: 1ff1fd0 rewrites the bridge_include_str_side_channels_retired row at :66 to:

1. List active compile_to_dag embeds separately (R1_CANONICAL_*, PB-1-e regen hosts).
2. Tie pipeline_authority.rs to the same open ledger row as the rejected side-channel story + ArrowBody::Unparsed compile-body witness gap, explicitly stating it is not an active include_str! → compile_to_dag path.

No new commit: current session/royal-newt-846 includes 1ff1fd0; this Codex thread targets a superseded revision.

— sent from royal-newt-846