T-21 affected_set.dag Wave-0 implementation — IRT-1 whole/changed-subgraph gate

[briansrls]

Summary

Implements the Wave-0 src/v4/lens/affected_set.dag substrate front for T-21. The model now exposes a cached content_hash receipt on AffectedSetRead, records changed-subgraph vs fail-closed whole-Dag mode, and folds only Diff.edits to seed the re-exec frontier while emitting exclusion receipts for unchanged boundaries.

Test plan

• cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag -> compiled 73 modules, emitted 1 file, 0 diagnostics.
• git diff --check -> clean.

Dashboard work item: node://adhoc-915dfa8a-779

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 1e15af23 · Trigger: schedule
• Thinking: 246s wall

---

BLOCKING (1)

Root Cause

• src/v4/lens/affected_set.dag frontier outcome is modeled as independent mode plus decisions authorities → make whole-DAG fail-closed and changed-subgraph decisions mutually exclusive in the type, or derive one from the other.

⚠️ The new frontier shape needs to make the fail-closed whole-DAG case structurally unambiguous before this lands.

[briansrls]

Verified against current head f6d6c3a13f1830aa40bcccc76965419480ce191a: this is already structurally prevented in the current file. mark_whole_dag(acc, reason) ignores the accumulator and returns only WholeDagAcc { reason: reason }; frontier_from_acc then translates that arm to WholeDagFailClosed { reason: reason } with no decisions field. Prior Excluded decisions exist only inside ChangedSubgraphAcc { roots, decisions } / ChangedSubgraphFrontier { roots, decisions }, which is mutually exclusive with the whole-DAG arm. So the current substrate cannot represent both whole-DAG rerun and root pruning in the same frontier value. — sent from neat-badger-436

[briansrls]

I verified this against current head 69bce37618de716eb9d51661e15521f1be148cd6. The review is reading changed_subgraph_frontier_edges(dag, path) as a one-hop adjacency query, but in this Wave-0 substrate front that field is the read-model boundary for the closed changed-subgraph frontier from path, not the one-hop downstream edge accessor. expand_path intentionally folds that bounded frontier once because the recursive/worklist version was rejected by the v4 source-root complexity gate as same-argument recursion.

So the current authority split is:

• hash_receipt decides unchanged/changed/unknown at the edited boundary.
• changed_subgraph_frontier_edges supplies the bounded transitive changed-subgraph frontier for the changed root.
• propagation_receipt decides, per frontier edge, whether to rerun, exclude with proof, or escalate to WholeDagFailClosed.

I attempted to encode the transitive contract more explicitly with a renamed/typed frontier-return field, but the v2 bridge rejected that shape. The current code compiles cleanly (cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag -> 0 diagnostics) and the substrate contract is not a one-hop algorithm unless changed_subgraph_frontier_edges is implemented incorrectly by a later consumer. That implementation would violate this read-model boundary, not this file's fold. — sent from neat-badger-436

[briansrls]

I verified this against current head f6d6c3a13f1830aa40bcccc76965419480ce191a. I do not think this finding is valid for this surface.

WholeDagFailClosed is not “failure to produce an affected-set read”; it is the conservative affected frontier value. The affected-set/workflow design explicitly requires unknown affected-set receipts to select the conservative superset rather than aborting selection (docs/design-ci-workflow-emitter-dispatch.md has the workflow_affected_set_fail_closed row: unknown affected-set receipts select conservative superset; the T-WAD binary-shim design also names “superset” as the fail-closed path).

So the distinction is:

• Witness::Violates would mean the lens could not produce a frontier value at all.
• Holds { value: WholeDagFailClosed { reason } } means the lens did produce a sound frontier: rerun the whole DAG / conservative superset because precise narrowing was not proven.

That is fail-closed, not fail-open: consumers have a typed reason and a structurally unambiguous all-rerun frontier. Changing this to Violates would remove the conservative plan that downstream CI selection is supposed to consume. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: f6d6c3a1 · Trigger: schedule
• Thinking: 255s wall

---

BLOCKING (1)

Root Cause

• src/v4/lens/affected_set.dag ReExecFrontier models changed-subgraph membership both as a root list and as Rerun decisions → make one carrier authoritative and derive any ordered/root view from it.

⚠️ The prior whole-DAG ambiguity is fixed, but the changed-subgraph frontier still needs one structural authority for rerun membership.

[briansrls]

Valid finding. Fixed in a22d65f74 by removing roots: List<Path> from both ChangedSubgraphFrontier and ChangedSubgraphAcc, deleting append_root, and making Map<ExclusionKey, FrontierDecision> the single changed-subgraph rerun/exclusion authority. The seed edit and propagation paths now record membership only through mark_rerun(...); any ordered/root view must be derived from that decision map rather than modeled as a second carrier. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: a22d65f7 · Trigger: schedule
• Thinking: 163s wall

---

BLOCKING (2)

Root Cause

• src/v4/lens/affected_set.dag AffectedSetRead separates hash_receipt from B-5 purity/effect evidence → make the boundary receipt authority carry both hash equality and purity/effect proof, or expand/fail whole-DAG when purity is unknown.
• src/v4/lens/affected_set.dag ExclusionKey drops the producer axis while PropagationReceipt is edge-specific → either key edge decisions by producer or aggregate incoming changed producers with Rerun absorbing and Excluded only after every producer is discharged.

⚠️ The prior whole-DAG/root-authority issues are fixed, but the new pruning and propagation aggregation shapes can under-rerun affected nodes.

[briansrls]

Valid finding. Fixed in 8ea7b0373 by making the boundary receipt explicitly carry the purity/effect side of the proof: AffectedSetRead.hash_receipt is now boundary_hash_receipt, and the unchanged arm is HashUnchangedPure { content_hash } rather than plain HashUnchanged. boundary_receipt can now produce UnchangedPureBoundary only from that combined B1 content-hash + B-5 purity/effect receipt; unknown or non-pure cases must use HashUnknown or HashChanged, which expand/fail closed instead of pruning on hash alone. DECISIONS.md #3153-subsumed was updated in the same change to name boundary_hash_receipt and state prune-only-at-unchanged/pure boundaries. Validation: v4 source-root compile completed with 0 diagnostics and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed in 8ea7b0373 by making Rerun absorbing for a changed-subgraph key. mark_excluded now checks the existing Map<ExclusionKey, FrontierDecision> entry with map_get; if the key already has Rerun, it preserves that decision instead of overwriting it with Excluded. A later mark_rerun still overwrites an earlier exclusion, so folding multiple producer edges for the same consumer/dimension cannot under-rerun due to edge order. DECISIONS.md #3153-subsumed now records that duplicate producer hits aggregate with Rerun absorbing Excluded. Validation: v4 source-root compile completed with 0 diagnostics and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Addressed the current-head transitive-frontier request in 8d64ff8a3. The read-model boundary is now explicitly named proven_transitive_changed_subgraph_frontier: fn(Dag, Path) -> List<FrontierEdge>, and expand_path folds that receipt rather than a one-hop-looking changed_subgraph_frontier_edges accessor. DECISIONS.md #3153-subsumed was updated in the same commit to say the decomposed read model consumes a proven transitive changed-subgraph frontier and folds that over the DAG. This keeps the Wave-0 body honest: the v4 bridge still cannot encode the recursive/worklist implementation here, so the proof obligation sits on the read-model receipt instead of being implicit or one-hop. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed in 091825577 by expanding src/v4/DECISIONS.md #3153-subsumed to explicitly ledger the touched coproduct classifications for ReExecFrontier, HashReceipt, BoundaryReceipt, PropagationReceipt, and FrontierAcc, in addition to the existing ExclusionProof and FrontierDecision entries. The row now records each green/yellow disposition and the relevant dissolution trigger or terminal authority, matching the in-file Practice 4 / Practice 9 tags. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 8ea7b037 · Trigger: schedule
• Thinking: 251s wall

---

BLOCKING (2)

Root Cause

• src/v4/lens/affected_set.dag AffectedSetRead has no edit-aware before/after frontier authority → pass the Edit or materialized post-diff Dag into the frontier/propagation receipts before expanding.
• src/v4/lens/affected_set.dag The seed boundary lacks a per-edit changed-dimension receipt → return proven or unknown changed dimensions from AffectedSetRead and seed one ExclusionKey per dimension, failing whole-DAG when dimension delta is unknown.

⚠️ The frontier now has the right whole-DAG gate shape, but the Wave-0 read boundary can still under-rerun dimension-aware affected roots and edit-introduced dependency edges.

[briansrls]

Valid finding. Fixed across 6f237e09a/fd20dacff with bridge-shape cleanup in 4280cba3c: the frontier hook now receives edit context through EditDimension { edit, dimension }, and propagation receives EditFrontierEdge { edit, edge }. expand_dimension folds read_model.frontier.proven_transitive_changed_subgraph_frontier(dag, EditDimension { ... }), then calls read_model.propagation_receipt(dag, EditFrontierEdge { ... }), so Edit.replacement is no longer dropped before dependency/frontier propagation. DECISIONS.md #3153-subsumed now records the edit-aware proven transitive frontier boundary. Validation: v4 source-root compile passed with 0 diagnostics and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed across 6f237e09a/fd20dacff with bridge-shape cleanup in 4280cba3c: AffectedSetRead now has changed_dimension_receipt: fn(Dag, Edit) -> ChangedDimensionReceipt, with ChangedDimensions { dimensions } | ChangedDimensionsUnknown { reason }. On BoundaryExpands, expand_changed_dimensions folds the proven dimensions and seeds root_key(path: edit.at, dimension: dimension) for each one. If changed dimensions are unknown, it escalates to WholeDagFailClosed; the old single sentinel root key is only used for the unchanged-pure prune proof. Validation: v4 source-root compile passed with 0 diagnostics and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Follow-up valid for the remaining sentinel use. Fixed on current head 9f4850b0fbd4c7b635265b55228894fc47ecf44f by deleting affected_dimension_value entirely and making BoundaryPruned leave the frontier unchanged instead of writing an Excluded decision under a fabricated AffectedDimension. Changed roots are still keyed only by proven dimensions from ChangedDimensionReceipt; unchanged/pure boundary pruning is represented by absence of a rerun decision, not a synthetic dimension value. Validation: v4 source-root compile completed with 0 diagnostics and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Addressed the current-head Codex summary blockers in 6f237e09a/fd20dacff with final bridge-compatible cleanup in 4280cba3c. The read model now carries edit-aware frontier and propagation receipts, plus a per-edit ChangedDimensionReceipt; unknown dimensions fail closed to WholeDagFailClosed, and proven dimensions seed one root key per actual AffectedDimension. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check was clean. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 4280cba3 · Trigger: schedule
• Thinking: 265s wall

---

BLOCKING (1)

Root Cause

• src/v4/lens/affected_set.dag AffectedSetRead/FrontierAcc have no per-edit current-Dag authority → carry the current Dag or per-edit before/after Dag through the ordered fold before calling boundary/frontier receipts.

⚠️ The prior frontier shape is much improved, but ordered Diff state still does not flow through the new affected_set fold.

[briansrls]

Valid finding. Addressed on current head 9f4850b0fbd4c7b635265b55228894fc47ecf44f by threading explicit current-Dag authority through the ordered Diff fold. The read surface now includes AffectedCurrentDagRead.post_edit_dag, affected_set(read_model, current_dag_read, dag, diff) folds an AffectedFoldAcc { dag, frontier }, and seed_edit_fold_acc evaluates each edit against acc.dag while carrying next_dag forward for later edits. Unknown boundary receipts still fail closed to WholeDagFailClosed; known expand/prune paths advance the current Dag before the next edit. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Valid fold-order finding. Fixed on head 7a87a038d: seed_edit_fold_acc_live now reads boundary_receipt before post_edit_dag. BoundaryPruned records the boundary exclusion and keeps the current Dag without invoking post-edit application; only BoundaryExpands asks for AffectedPostEditDagReceipt and then expands changed dimensions over the produced Dag. BoundaryUnknown still fails closed without paying post-edit work. DECISIONS.md #3153-subsumed was updated to record that post-edit state is consumed only for expanding boundaries. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. The executable-test finding remains the same T-22-bound test-runner issue already answered in #3349 (comment). — sent from neat-badger-436

[briansrls]

Valid finding. Fixed on head b5cef0c9c0720deaa2877992c9c916dca054811c by making FrontierDecision.Excluded non-empty: it now carries first: PropagationExclusionProof plus rest: List<PropagationExclusionProof> instead of a plain proof list. mark_excluded creates Excluded { first: proof, rest: [] } for the first non-propagation receipt and appends later receipts to rest; Rerun remains absorbing. The expected-frontier anchors and DECISIONS.md #3153-subsumed were updated to record that proofless skip is unrepresentable. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed on head 12e75ad1f060ca367d92814dfd98980e29586a44 by making WholeDagFailClosed absorbing inside the same edit expansion, not only at the next edit boundary. expand_dimension now returns an existing whole-DAG frontier before reading the next dimension frontier, and the edge fold returns an existing whole-DAG frontier before reading propagation for later edges. This preserves the first fail-closed evidence, including diagnostic-backed evidence, instead of allowing a later unknown reason to replace it. Added a manual expected-frontier anchor for the diagnostic-preservation/absorbing case and updated DECISIONS.md #3153-subsumed. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 7a87a038 · Trigger: schedule
• Thinking: 390s wall

---

BLOCKING (1)

Root Cause

• src/v4/lens/affected_set.dag non-empty sequence cardinality is being solved locally inside the terminal frontier carrier instead of through the scheduled std/collection refinement surface → use the canonical refinement if available, or mark this field-level bridge as bounded to T-25 with a concrete dissolution trigger.

⚠️ One substrate cardinality bridge needs an explicit canonical path before this lands.

[briansrls]

Valid finding. Fixed on head 6bade1eea008cbc8a8999e7abb5fa9fe2d3c9ed4 by marking FrontierDecision yellow instead of terminal and recording Excluded { first, rest } as a bounded T-25 cardinality bridge. The carrier still makes proofless Excluded unrepresentable today, but DECISIONS.md #3153-subsumed now names the dissolution trigger: when T-25-core/std collection publishes the checked List<T> where non_empty / NonEmptyList<T> refinement, rewrite Excluded to carry that canonical refined list instead of this local head/rest bridge. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed on head 80e7e5b46c2c1270f37b4c1d23e0d9ce59373094 by importing Holds from v4.std.witness alongside Witness in src/v4/lens/affected_set.dag, matching the top-level affected_set constructor use. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Valid finding. Fixed on head bd0751ccc084ba9751336c076e07cf828c207e00 by preserving the D1 diagnostic path for boundary unknowns without adding a bridge-incompatible fourth receipt arm. BoundaryUnknown remains the valid-but-unproved symbolic boundary case, but seed_edit_fold_acc_live now probes post_edit_dag before accepting that whole-DAG fallback; if the edit/path is invalid, PostEditDagRejected { diagnostic } flows to WholeDagDiagnostic instead of being lowered to a symbolic reason. DECISIONS.md #3153-subsumed records that BoundaryUnknown must probe post-edit state before whole-DAG fallback. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: bd0751cc · Trigger: schedule
• Thinking: 360s wall

---

BLOCKING (1)

Root Cause

• src/v4/lens/affected_set.dag EditFrontierEdge has only edit plus FrontierEdge while FrontierEdge has a single ambiguous dimension role → carry the changed source dimension into propagation_receipt and model the consumer ExclusionKey dimension separately or derive it explicitly.

⚠️ One substrate dimension boundary still loses a load-bearing fact before propagation.

[briansrls]

Valid finding. Fixed on head b66bc15dbd9efbce41694c5074874dce00f58604 by carrying the scoped source changed dimension across the propagation boundary. EditFrontierEdge now includes changed_dimension, while FrontierEdge.dimension was renamed to consumer_dimension; edge_key derives the ExclusionKey from that consumer dimension, so the source dimension and consumer/key dimension are no longer conflated or dropped before propagation_receipt. DECISIONS.md #3153-subsumed records the two dimension roles. I also folded in Cursor’s approved hygiene note by importing List explicitly from v4.std.collection and updating the Consumes header. Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. — sent from neat-badger-436

[briansrls]

Verified against current head 5892f822c19ec07b166748c6b5fccac25993d734. I agree the affected-set behavior needs executable regression coverage, but I do not think this is an actionable blocker for this frozen T-21 substrate PR as scoped.

The current v4 surface still does not have the executable ReExecFrontier/TestClaim runner needed to assert these lens outcomes directly; the companion file is intentionally labeled as non-executable staging, not as a substitute for runnable coverage. The existing pre-T-22 bridge for this lane remains v4 source-root compile plus compile-visible expected-frontier data. Adding a Rust host shim or claim-looking rows that cannot execute would create a second test authority and conflict with the substrate-native/T-22 boundary already recorded in the file status and DECISIONS row.

Per the current hub ruling, #3349 is Bucket-1/frozen-like and further code/test rework is to be folded into the coherent rework rather than piecemeal head moves. So I am not moving the head for this item; executable affected-set regression coverage should land with the T-22 claim/lens execution surface or the hub-fired coherent rework. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 5892f822 · Trigger: schedule
• Thinking: 279s wall

---

BLOCKING (2)

Root Cause

• src/v4/DECISIONS.md #3153-subsumed locks a local post-edit receipt instead of consuming the existing Outcome carrier → change post_edit_dag to return Outcome or an alias to it and match Produced/Rejected.
• src/v4/DECISIONS.md #3153-subsumed references affected_set_anchors.dag as a new expected-frontier staging surface but the PR does not carry the closed-tree STRUCTURE.md enumeration/count receipt → add the file under test/claim/manual and update the checksum/ratification trail.

⚠️ Two substrate-shape issues need correction before merge.

[briansrls]

Addressed the current review cluster on head 6d99f26fae7e8d29652a2925ba544c833e3d0d41.

Changes folded in:

• The propagation exclusion receipt now preserves the source changed-dimension axis: DimensionNotRead carries both producer and changed_dimension, and the expected frontier examples were updated accordingly.
• The process-named manual affected-set anchor surface was moved into the domain-scoped src/v4/lens/affected_set_examples.dag; src/v4/STRUCTURE.md now enumerates that file and the old test/claim/manual/affected_set_anchors.dag path is gone.
• The local produced-vs-diagnostic post-edit coproduct was removed. post_edit_dag now returns AffectedPostEditDagRead, a thin record whose outcome field is the canonical Outcome<Node>; seed_edit_fold_acc_live matches Produced / Rejected from that canonical carrier. The wrapper is there because the current v2 bridge rejects a higher-order function return written directly as imported Outcome<Node>, but the success/fail authority is no longer re-declared locally.

Validation: cargo run -p v2-compiler -- compile --source-root src/v4 --output-dir /tmp/v4-t21-check --target dag completed with 0 diagnostics, and git diff --check is clean. GitHub currently has fmt/affected green with ci/v4 still in progress. — sent from neat-badger-436

[briansrls]

Verified against current head b014e4170e1902144c1b213e112c2e73cc1e70bd. I agree these affected-set paths need executable coverage, but I do not think this is an actionable blocker for this T-21 substrate PR as scoped.

The current v4 execution surface cannot yet run ReExecFrontier / lens-dry-run TestClaim assertions. src/v4/test/v2_run_preflight/MOVE1_COVERAGE.txt explicitly records that v2 compile is the reliable pre-T-22 bridge and that evaluating v4 programs plus TestClaims waits for T-22 (compiler/05_eval and the claim runner). src/v4/TASKS.md likewise places TestClaim evaluation and lens dry-run composition under T-22. Adding claim-looking rows here would create non-executable/fake coverage; adding a Rust host shim would create a second test authority outside the substrate-native path.

So the current receipt remains compile-visible expected-frontier example data in src/v4/lens/affected_set_examples.dag plus the v4 source-root compile gate. Executable regression coverage for BoundaryUnknown, whole-DAG absorption, and final frontier equality should land when T-22 provides the real runner/consumer. — sent from neat-badger-436

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: b014e417 · Trigger: schedule
• Thinking: 321s wall

---

✅ Mixed model/docs review: I found no new blocking issues in the current diff.