Lane 7: inert-abstraction lens keystone + non-fold-residue audit (fail-closed walls)

[gunbai-bot]

Lane 7 — inert-abstraction lens keystone + non-fold-residue audit

Two fail-closed walls (DESIGN §5/§6), per docs/plans/upcoming-work-dispatch-plan.md Lane 7 and docs/plans/fold-ergonomics.md §3 #3.

1. Inert-abstraction lens (the keystone)

Generalizes the #5433 inert-lens floor backstop (walls unreached v2.lens.* modules) to type carriers: a carrier that is defined + self-tested + zero real consumer is DESIGN §5 coverage-by-illusion (a green test, no production consumer). The self-tested gate is what makes it a clean keystone rather than "every unused type" — it filters from the project's deliberate model-first staging (extdeps surfaces, the realization loop) down to the precise §5 trap.

• Host census src/v1/stage0/src/inert_carrier_project.rs (mirrors doc_reachability_project.rs): inert iff declared once ∧ self-tested ∧ zero use outside its own declaration block (same-file fn use counts as a consumer — so lens-local fact types are not false-flagged).
• .dag surface v2.lens.inert_carrier with construction_justification (WallAfterGrounding).
• Floor witness src/v2/lens/inert_carrier_test.dag (fail-closed, importing the lens so it is itself reached → not inert-lens).
• 8 inert carriers (AccessPolicy, CargoDependency, CargoPackage, FilePermissions, FloorWitnessRow, GitCliReportedVersion, ReactHookSite, SecretValue) on a named, shrinking roster with a stale-roster ratchet. (Seeded at 9; RbacPolicy then dropped off the roster when a real consumer landed via the ae891fcf8f main merge — extdeps/bmc/access.dag's redfish_rbac_policy — i.e. the stale-roster ratchet working as intended.)

2. Non-fold-residue audit

DESIGN §6: a finished stage is one fold; any non-fold residue is a named irreducible kernel or un-migrated modeling. A match over a CLOSED coproduct with a _ => wildcard carries a fail-open escape a total fold would not.

• Host census src/v1/stage0/src/non_fold_residue_project.rs: flags a match whose scrutinee is a bare fn-param of a known closed-coproduct type carrying a top-level _ => arm (conservative — field accesses / open domains / field-placeholder _ excluded).
• .dag surface v2.lens.non_fold_residue + floor witness src/v2/lens/non_fold_residue_test.dag.
• 71 seeded residue sites (eq-functions, lattice joins, node-eval handlers) on a named, shrinking roster + stale ratchet.

Verification bar (DESIGN §5: green-by-execution, discriminating)

Each census has synthetic RED/GREEN host controls proving discrimination by execution: inert→RED / consumed→GREEN; residue→RED / total-fold→GREEN; plus open-domain and same-file-consumer negative controls. Both floor witnesses run green through claim_batch (the real floor consumer), and floor discovery passes the inert-lens + construction-justification hygiene gates. No raw counts — the walls are named rosters; a new inert carrier / new residue reds CI, a fixed one reds the stale-roster ratchet until removed.

CONSTRUCTION-FIRST: neither class is unwritable-by-construction today (modeling-ahead-of-consumer is deliberate; exhaustiveness-by-default is a load-bearing typechecker change) — so each is the genuinely-unstructurable residue a lens is for. Both are additive corpus-gate builtins (sibling to doc_graph_* / fact_cardinality_*); they do NOT touch cli_run.rs's #5433 closure. DISSOLUTION at gunbc#5364 (.dag compile-graph access) → pure .dag Node-tree readers.

Piggybacked fix (not Lane 7, but required to keep this branch green)

src/v1/tests/src/helpers.rs + src/v1/tests/src/parse.rs — the two parse perf-fixture tests (tokenizer_non_ascii_performance_regression, source_text_at_lookup_flat_in_file_size) assert !source.is_ascii() on src/v1/02_parse.dag, but #5567's tree-wide comment-strip removed all non-ASCII (it lived in comments), so they fail on main for every PR that merges it. Fixed with a read_v2_file_with_distributed_non_ascii helper that injects an EM DASH at a prime stride (preserving char count and the byte≠char-offset condition the perf tests check). Cleanly scoped, ASCII-only logic; called out here so it isn't invisible in review.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed all review feedback in c1812402d8 (+ roster re-derivation in 5900690dac):

1. Vague roster home (FilePermissions recorded as dsl/std/*) — fixed to concrete declaring files so the stale-ratchet reviewer can grep them: FilePermissions → dsl/extdeps/access/posix.dag, and while there I corrected two more that were vague/wrong: AccessPolicy → dsl/std/access.dag (was rbac.dag), GitCliReportedVersion → dsl/extdeps/git/versioning.dag.

2. No string-literal awareness (// in a URL, match /_ => inside a string literal) — fixed at the single lexical authority: strip_line_comment in both census modules now blanks string-literal interiors (each interior byte → a space, delimiters kept, byte-length preserved for stable brace matching) and only treats // as a comment outside strings. One pass removes all three false-signal classes (//, _ =>, {/}/| inside strings). Added two discriminating controls that run the production predicate: green_control_wildcard_and_slashes_inside_string_literal_are_ignored (in-string _ =>/https:// → not flagged) and red_control_real_wildcard_survives_an_in_string_decoy (same decoy + a real wildcard → still flagged, so blanking can't suppress genuine residue).

3. dissolve-on wording more aggressive than §6 demands; kernel-vs-residue tag — valid. Corrected the roster header: §6's two categories now dissolve differently — un-migrated modeling (emit_yaml_value, the eval_*_node* handlers, dag_grammar_terminal_*) shrinks as each migrates to a fold; named irreducible kernels (the *_eq _ => false off-diagonals, lattice *_join/*_meet/*_combine, *_dominates, the exit_ok/program_runtime_bool_*/is_* collapses) wall permanently and are expected to remain. The roster no longer claims it shrinks uniformly to zero. The per-entry structural tag is deferred to the gunbc#5364 dissolution (the pure .dag Node-tree reader carries each site's match shape + scrutinee type, so the classification is derived there) — hand-maintaining a 71-way tag now risks the §5-bad direction (mistagging migratable debt as a permanent kernel hides debt).

4. Each gate fn re-walks the corpus (8× per witness pass) — acknowledged; consistent with the doc_reachability_project/fact_cardinality_census sibling pattern and dissolves with the same gunbc#5364 reader. Left as-is (out of scope to block on).

Separately, the main merge ae891fcf8f pulled in #5568 (which unified the three per-artifact drift gates into one universal generated-artifact policy), so I re-derived both rosters against current main: dropped the now-deleted ci_yaml_gate/gitignore_gate/roadmap_gate exit_ok entries, added generated_artifact.dag::artifact_eq/::artifact_extra_valid + generated_artifact_gate.dag::exit_ok, and dropped RbacPolicy (now consumed by extdeps/bmc/access.dag). All 4 floor witnesses pass green-by-execution via claim_batch; both modules' suites pass (11/11 each); fmt + clippy clean. Also fixed the two parse perf-fixture tests that #5567's comment-strip broke (the non-ASCII they relied on lived in comments) by injecting distributed non-ASCII into the fixture.

— sent from lively-gull-506

[gunbai-bot]

Both addressed:

1. inert-layer-lens.md count drift → fixed in 1a1ada4899: 9 seeded → 8 carriers, with a note that RbacPolicy dissolved off the roster when extdeps/bmc/access.dag's redfish_rbac_policy consumer landed (the stale-roster ratchet doing its job).
2. Piggybacked fixture fix not called out → added a "Piggybacked fix" section to the PR body explaining the helpers.rs/parse.rs change repairs the two parse perf tests Strip .dag comments (flush — no grammar change, no ctrl dependency) #5567's comment-strip broke on main (the non-ASCII they assert lived in comments).

— sent from lively-gull-506

[gunbai-bot]

Both addressed in bd8d9192d4:

1. Per-call corpus re-walk (the OnceLock suggestion) — done. Both census modules now route their four *_count builtins through a OnceLock-memoized build_report(), so a witness eval (which calls the builtins one-by-one) plus the live-tree tests share one dsl/+src/v2/ walk + report per process instead of N. The pure compute_report/residue_sites/closed_coproduct_names still take &[files] so the synthetic RED/GREEN controls keep driving them with in-memory corpora (which never touch the cache). All 4 floor witnesses re-confirmed green-by-execution via claim_batch; both suites 11/11.

2. .dag dissolve_on says "reaches 0" but ~half the roster is permanent kernels — valid inconsistency vs the Rust comment; fixed. non_fold_residue.dag now reads: the un-migrated-modeling subset shrinks to 0 as each match migrates to a fold, while the named irreducible kernels (eq / lattice join+meet / collapse algebraic totals) remain by §6. The Rust comment and the .dag rationale now say the same thing.

— sent from lively-gull-506

[gunbai-bot]

Valid §2/§3 finding — fixed before merge (extracted, not deferred). Commit 3f3b9114ab:

The byte-identical workspace_root/repo_rel/is_test_dag/collect_dag_files/corpus_dag_files/strip_line_comment/brace_delta are lifted into one new crate::corpus_lex module that both census modules import. The string-literal-aware strip (and any future raw-string handling) now lives in exactly one place. The census-specific logic (compute_report/type_carrier_blocks for inert; residue_sites/closed_coproduct_names/parse_fns for non-fold) stays local. corpus_lex carries its own unit tests (string-interior blanking, brace-delta-ignores-strings, test-dag suffix) and is added to the self-emit hand_maintained_mods list in both v1_compiler_emit_rust.rs and src/v1/05_emit_rust.dag.

Verified: corpus_lex 3/3, inert 11/11, non-fold 11/11; both gate witnesses still green-by-execution via claim_batch; fmt + clippy clean.

(The sibling doc_reachability_project/fact_cardinality_census modules carry their own older copies of the walk — pre-existing, untouched here; corpus_lex is the convergence point they can migrate onto, and all of it dissolves into the pure .dag Node-tree reader at gunbc#5364.)

— sent from lively-gull-506

[gunbai-bot]

The REQUEST_CHANGES (review 31934) reviewed abe0339368 — an intermediate commit the background auto-committer snapshotted mid-extraction, where corpus_lex.rs existed but the wiring + duplicate-removal hadn't landed yet. Every point it raises is resolved on current HEAD 3f3b9114ab:

• (a) lib.rs adds pub mod corpus_lex; — present on HEAD.
• (b) duplicated helpers removed from both modules — inert_carrier_project.rs and non_fold_residue_project.rs now have zero local defs of workspace_root/repo_rel/is_test_dag/collect_dag_files/corpus_dag_files/strip_line_comment/brace_delta (verified grep -c = 0); both carry use crate::corpus_lex::{brace_delta, corpus_dag_files, is_test_dag, strip_line_comment};.
• (c) corpus_lex added to hand_maintained_mods — present in both v1_compiler_emit_rust.rs and src/v1/05_emit_rust.dag (so re-emit keeps it).

So the "new single-authority module is unwired/unused" state was real for exactly that one transient commit and is fixed on HEAD — corpus_lex is the sole definition and both censuses import it. corpus_lex 3/3 + inert 11/11 + non-fold 11/11 pass, both gate witnesses green via claim_batch, fmt + clippy clean on HEAD. A fresh review on 3f3b9114ab should clear this.

— sent from lively-gull-506