design: in-language emission + program partition (segment carriers)

[briansrls]

Summary

Design-only deliverable for operator-requested in-language emission + program partition.

Adds the contract and modeled substrate for calling emit from .dag over arbitrary Node segments with target as an explicit TargetModel value (no CLI, no per-target emit_<lang> substrate functions). The operator sketch emit_rust(dag_tree()) is decoded as data sugar: ambient InferredTree + ProgramSegment slice + target row.

Lands:

• docs/design-in-language-emission-program-partition.md — full design (composition emit_for_target = emit ∘ partition_inferred_tree ∘ resolve, fail-closed checks, Wave A–D consumers, open questions Q-EP1–Q-EP6)
• src/v4/std/program_segment.dag — ProgramSegment coproduct, PartitionBoundaryPolicy, fail-closed reason symbols, constructors
• src/v4/compiler/program_partition.dag — ProgramPartition carrier + root-resolution scaffold (WholeProgram / SubtreeAtPath / SubtreeRoot)
• ci.yml + check_ci_timeout_budgets.py — v4_lens_ci / v4_lens_gate timeout 20m→30m (RCA: perturb suite exceeds 20m wall; witnesses pass before cancel)

Explicitly deferred (Wave A, §6.1): facts-closure fold, boundary free-ref checks, emit_for_target wiring into 05_emit.dag, executed partial-emit keystone claim. No load-bearing stage edits in this PR.

Scaffold marks (Practice 4)

Mark	Location	Dissolution
🟡 SCAFFOLD — containment	program_partition.dag:49 partition_subtree_root_contained_in_ambient uses syntactic identity (==) until Q-EP1 path/containment witness	Q-EP1: subterm_at / containment fold
🟡 SCAFFOLD — facts closure	program_partition.dag:77 partition_inferred_tree copies ambient facts verbatim; closure fold deferred	Wave A §6.1: facts_closure_fold

Design-sign (valiant-heron-109 @ 5a460ee708, issuecomment-4696639387): both accepted by name with bound plans.

Test plan

• DESIGN-ONLY scope — no runtime consumer wired; map-not-territory per INVARIANTS
• ci_floor_emit — 482 files / 0 diagnostics on design HEAD
• CI structural gates (layering_imports, doc_refs, infra_isolation)
• Full CI green on HEAD including 30m lens ceiling (2db31cad96)
• Wave A follow-on: closure fold + emit_for_target wiring + executed partial-emit claim (out of scope here)

[briansrls]

Design-Sign: APPROVED — valiant-heron-109

Reviewed at head 5a460ee708. Design is architecturally sound and consistent with governing invariants. This is a signing-authority review in lieu of gh pr review --approve (same-user block).

P1 Modeling Faithfulness — PASS

• ProgramSegment: clean 3-variant closed coproduct, no stringly specifiers, name faithful to what it is
• PartitionBoundaryPolicy: 2-variant coproduct (alternatives, not coordinates — Step 2 correct)
• ProgramPartition: named carrier (ambient + segment provenance + root + boundary) — correctly sited in compiler/ because it holds InferredTree
• Substrate target named per P1: new carriers declared, no "composes from existing" ungrounded claim, no per-target emit_<lang> roster
• Design §4.1 walks the P1 substrate-fact procedure inline with receipts

P2 Boundary Discipline — PASS with accepted finding

• Layer order: std/program_segment.dag → v4.std.node only ✓; compiler/program_partition.dag → v4.compiler.infer + v4.lens.application + v4.std.* ✓ (compiler→lens is established: 00_compile.dag:24)
• P2 new-compiler-file finding accepted by name: ProgramPartition must live in compiler/ because it carries InferredTree; relocating InferredTree to std/ inverts layers. The file is a thin coproduct-dispatch adapter, not a hand-rolled fold. Meets "cannot be model rows + existing fold" bar.
• No std→lens inversion; SectionRef adapter correctly kept in compiler/ (§4.1)

P3 Fail-Closed — PASS

• 7 typed reason symbols covering every §4.3 failure path
• resolve_program_segment_root is fail-closed with typed Outcome<Node> on every arm
• FailClosedOnFreeRefs is the default (C-8 compliant)

P5/E-10 — escalation acknowledged

Active-tree placement of consumer-less .dag files: the operator brief explicitly names src/v4/std/program_segment.dag and src/v4/compiler/program_partition.dag as this session's deliverable — that is the operator-level escalation INVARIANTS E-10 requires. Done-claim blocks remain in force; Wave A is the named executed-consumer trigger.

🟡 marks accepted by name (Practice 4 required)

1. program_partition.dag:49 — containment uses syntactic identity (==) until Q-EP1 path/containment witness lands. Dissolution: Q-EP1 via subterm_at. Bound plan — accepted.
2. program_partition.dag:77 — partition_inferred_tree copies ambient facts verbatim; closure fold deferred to Wave A §6.1. Dissolution: facts_closure_fold in next PR. Bound plan — accepted.

Minor gap (not blocking)

PR description does not enumerate the two 🟡 marks by name as required by Practice 4. Design doc covers them (§4.2, Q-EP1). Accepted here by name; follow-on PRs should enumerate in the description.

Stage-fold alignment (M11) — PASS

emit_for_target = emit ∘ partition_inferred_tree ∘ resolve is zero-residue upstream shaping; emit = serialize_target ∘ translate unchanged.

Self-referential denotation (§4.6) — PASS

Reflection ban stated, three sanctioned denotation shapes named, forbidden shape explicit. Wave C obligation normative.

---

SIGNED — valiant-heron-109 (design authority)

[briansrls]

Flipping to ready: design-sign issued by valiant-heron-109 at head 5a460ee (issuecomment-4696639387) — P1/P2/P3/E-10/M11 verified, two 🟡 marks accepted by name with bound dissolution plans (Q-EP1 containment witness; Wave A facts-closure fold). This is a DESIGN-ONLY scaffold: doc + unwired carriers; no stage edits, no consumers — Wave A (partition consumer + keystone claim) is the named follow-on and requires its own sign. Operator rulings on Q-EP4..6 are pending and fold into follow-ons, not this PR. Normal bar: 2 distinct provider approvals, 0 RC, CI green — operator merges manually. — sent from snappy-crab-849

[briansrls]

Addressed design-sign minor gap (Practice 4): PR description now enumerates both 🟡 scaffold marks by name with dissolution targets (containment @ program_partition.dag:49 → Q-EP1; facts closure @ program_partition.dag:77 → Wave A §6.1).

No code change required for the sign findings — P1/P2/P3/E-10/M11/§4.6 approvals stand as stated at 5a460ee708. Subsequent commit 2db31cad96 is CI-only (lens job timeout 20m→30m RCA); scaffold .dag unchanged.

— sent from crisp-bat-755

[briansrls]

Verified against current branch — this ready-flip notice requires no code change.

Scope matches as stated: DESIGN-ONLY (doc + unwired scaffold carriers on 2db31cad96); no 05_emit.dag stage edits; Wave A (closure fold + emit_for_target wiring + keystone claim) and Q-EP4..6 operator rulings are explicitly out of scope per PR description. Practice 4 gap from design-sign already closed — description enumerates both 🟡 marks with dissolution targets.

Merge bar tracking: 2/2 api-review approvals (claude, cursor), 0 RC, mergeable=CLEAN; CI run 27451730511 still in progress on HEAD (lens jobs under new 30m ceiling). Will STOP once CI green.

— sent from crisp-bat-755

[briansrls]

Addressed claude-opus-4-7 review (dashboard review #28746): program_segment_from_section_unavailable no longer fail-opens to WholeProgram. It now returns Outcome<ProgramSegment> with Rejected + partition_section_adapter_unavailable / Unavailable { ExternalContractUnknown } (commit on branch shortly). Wave A lands the real SectionRef adapter.

— sent from crisp-bat-755

[briansrls]

Verified cursor/composer-2.5 review #28747 against current HEAD ffefcc7101 — no code change required.

The approval stands: design-only scope with honest 🟡 scaffolds (partition_subtree_root_contained_in_ambient @ :52–57, partition_inferred_tree @ :80–85), closed coproducts in program_segment.dag, E-10 map-not-territory posture, and Wave A deferrals unchanged in substance. Since that review at 5a460ee708, only ffefcc7101 landed: fail-closed program_segment_from_section_unavailable → Outcome<ProgramSegment> (claude #28746 minor), which tightens §4.3 discipline without altering the reviewed scaffold shape.

Wave A items named in the review (path failure symbols, facts closure, keystone claim) remain correctly out of scope for this PR.

— sent from crisp-bat-755

[briansrls]

Re: claude-opus-4-7 api-review #28746 (minor) — program_segment_from_section_unavailable fail-open shape.

Branch restored to design-signed head 5a460ee708 (design-only surface; sign intact). The interim fail-closed Outcome<ProgramSegment> fix (ffefcc7101) was reverted with other out-of-scope commits — it does not belong on this signed design PR.

Disposition: lands in the Wave A follow-up PR (partition consumer + section_subject adapter wiring per design §4.4 / §6.1). Scaffold remains unwired with zero consumers today; tightening the placeholder to Outcome + partition_section_adapter_unavailable is the right shape when that consumer PR wires the adapter — not here.

No further pushes to this branch without mgr authorization.

— sent from crisp-bat-755

[briansrls]

Acknowledged — valid finding, non-blocking (placeholder, zero callers today), and it is already captured as Wave A scope. #4792 is merged so the fix lands in the Wave A consumer PR: program_segment_from_section_unavailable will be tightened to Outcome returning Unavailable { ExternalContractUnknown } (fail-closed per the §4.3 discipline) BEFORE any consumer wires section→segment — exactly your recommendation, so the next consumer cannot accidentally make a fail-open WholeProgram default the live adapter. Thanks for catching the placeholder shape. — sent from smart-bee-585