Emitter ownership de-fork: kill silent clone-fallback O(n2) by briansrls · Pull Request #6249 · gunb-ai/gunbc

briansrls · 2026-07-05T01:13:39Z

Summary

De-forks the emitter's clone-vs-move decision onto the single ownership authority (ownership.dag make_decision), killing the silent clone-fallback that is the root of emit O(n^2) (~72min whole-tree compile, 85-90% emit: default-clone keeps Rc refcounts >= 2, so every Rc::make_mut container op copy-on-writes the whole container per iteration).

Full design + adjudication verdict: docs/plans/emitter-ownership-defork.md (in this PR).

Increment 1: build_movable_set derives from make_decision == SoleOwner + params, with a zero-borrow wall (a latent use-after-move in the original draft: movable gates EVERY var-ref emission while Consumed records only at tail).
Increment 2 (whole-value half, implemented): per-use-site move licenses (Perceus-style backward liveness in ownership.dag, key name@span_start, fail-closed on span-0 / captures / TCO), consumed by emit_var_ref; the silent Rc::try_unwrap(..).unwrap_or_else(|rc| (*rc).clone()) fold fallback replaced by a typed, located, counted take_owned_counted (DESIGN.md §5: a failure arm must refuse or be counted, never silently widen). Witnesses: dag/test/claim/ownership_movable_test.dag.

Rustc-adjudicated by execution (2-generation regen, differential vs a same-scope control of pre-existing drift):

Zero E0382 (use-after-move) across thousands of newly-licensed move sites at gen-2.
Emitted clones drop ~10% (infer.rs 4768→4294, emit_rust.rs 6543→5805, ownership.rs 407→361).
The silent fallback string is gone from emitted output (2→0), replaced by located counted calls.
One defect class found and walled: match-bound reference bindings (borrow-pattern &T) licensed bare lost the deref their .clone() doubled as → emit_var_ref refuses per-site moves for MatchBoundBinding/FunctionValueBinding/VariantValueBinding. RED control passed at gen-2′: the three discriminating (n > 0) sites went 3→0 and the re-adjudicated build (including the defect-carrying complexity.rs) is 0-error.

Scope label: this fixes whole-value clone-vs-move and the §5 fallback. The dominant dag_collect field-clone hot path (acc.seen.clone()) needs the generalized entry take-owned rewrite in emit_fn_def, deliberately deferred to the restoration-tail validation window (template-level use-after-move is only adjudicable by rustc there). Until then owned_bindings (fold-acc field moves) and per-site licenses (whole-value moves) coexist.

Seed delta is exactly one file: v1_rt.rs gains take_owned_counted + its counters (+34 lines on main's base). Remaining validation obligations (byte-identical bootstrap_fixed_point, dag_collect emit receipt min→s, pipeline.rs 2-arg build_movable_set + licensed-but-cloned counted check, ratchets) serialize behind the emitter-restoration lane (proud-moth) and are enumerated in the design doc's checklist.

CI status on this PR is the repo-wide dark-CI 10-minute-timeout artifact (operator-ruled by design); local receipts: cargo build -p v1-compiler 0-error on this tree, witness corpus green at authoring.

Test plan

Discriminating witnesses in ownership_movable_test.dag (per-name and per-site: last-use licensed; span-0/capture/earlier-use/field-order/branch-path all fail closed).
2-gen regen adjudication as above; receipts + adjudicated crate snapshot preserved in session scratchpad.
Full fixpoint validation lands with the restoration tail per the checklist.

🤖 Generated with Claude Code

…rom make_decision SoleOwner + admits params De-forks the whole-value move predicate onto the single ownership authority (make_decision) instead of the coarse binding_fan_out re-derivation; adds discriminating witness ownership_movable_test.dag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ounted take-owned fallback Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ed take-owned fallback + increment-1 soundness wall - ownership.dag: build_move_site_licenses / license_walk — per-site last-use verdicts computed in reverse evaluation order; zero-span and lambda/foreach captures fail closed; branch arms licensed per-path, liveness merged OR-union. - ownership.dag: build_movable_set additionally requires zero Read/Threaded edges — movable gates every whole-value var-ref emission site, so Read-then-Consume would emit use-after-move (latent hole in the first increment-1 draft; witnesses added). - v1_rt + runtime_rust.dag template + 05_emit_rust.dag fold lambda: silent Rc::try_unwrap(..).unwrap_or_else(clone) replaced by take_owned_counted (per-site located counter, DESIGN.md §5 refuse-or-count). - ownership_movable_test.dag: per-site witnesses (span-0 fail-closed, capture fail-closed, field-then-whole blocked, distinct fields licensed, per-path branch licenses). Validation blocked on the v1 self-resolution fixpoint (clever-swift-531); PR stays draft, seed not hand-synced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ion) - build_ownership_results computes build_move_site_licenses per function; OwnershipBuildResult/EmitGraphInfo carry move_sites_index + per-fn move_sites (TCO functions fail closed to empty: loop-rewritten bodies reuse bindings across iterations, so per-site last-use does not transfer). - emit_var_ref: moves when per-name movable OR move_licensed_at_site (span-keyed name@span, read_only_params excluded, span-0 refused); both callers thread the use-site span the license walk keyed on. - Field-move consumption (entry take-owned generalization, deletes owned_bindings) held for post-fixpoint compile feedback — addendum in docs/plans/emitter-ownership-defork.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…equencing) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gunbai-bot · 2026-07-05T01:55:26Z

CI status note: the red ✗ on this PR is not a test failure. rust_tests passed on the last full attempt; every 'ci' floor job on this draft is being cancelled at ~10 min by gunbai-bot (draft-PR CI gate policy — the dashboard itself notes scheduled CI is skipped while in draft; concurrency cancel-in-progress accounts for the earlier ones during the push burst). There is nothing to fix on this branch for that signal. The PR stays draft deliberately until the v1 self-resolution fixpoint (#6250) restores validation — see the validation-time checklist in docs/plans/emitter-ownership-defork.md; CI will run to completion when this flips to ready.

The probe regen (gen-1: old seed binary over the new corpus) proved (a) the get registry fix greens regen — promoted to standalone PR #6255 — and (b) the ownership proof-side emitted code compiles clean, but the regenerated emit-side seed cannot build until the pre-existing old-emitter debt lands (#6243 deref-boxing restoration: 119 mechanical sites in emit_rust.rs, plus the std_measure tower gaps — all reproduced from main, none ownership-shaped). Auto-WIP commits captured the mid-splice state; this restores the committed seed at the merge baseline. All .dag work stays; clean regen + full rustc verdict re-runs after #6255 and #6243 merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gunbai-bot · 2026-07-05T03:02:54Z

Correction to the CI note above: the ~10-min cancellations are NOT a draft-gate policy — the generated ci.yml sets timeout-minutes: 10 per job, and currently every run repo-wide (including all recent main runs) is killed at that timeout. The substance stands: the red ✗ here is not a test failure on this branch (rust_tests was green on the one attempt that completed it). Fix belongs to the ci-timeout lane. — sent from snappy-newt-504

…e state auto-WIP'd in; results snapshotted to scratchpad)

…ction / variant bindings Differential gen-1 vs gen-2 (identical scope + debt patches): zero E0382 across the corpus, ~10% emitted-clone reduction, silent fold fallback replaced by located take_owned_counted — and exactly one defect class of mine: a match-bound reference binding (borrow-pattern &T) licensed at last use emitted the bare ident, losing the deref its .clone() used to perform. emit_var_ref now refuses per-site moves for MatchBoundBinding/FunctionValueBinding/ VariantValueBinding (per-name movable already excluded them). Verdict and RED control recorded in the design doc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…unted v1_rt helper The earlier restore-then-merge auto-merged generated seed files across generations, committing a mixed-generation seed that does not build (732 errors) and dropping the v1_rt counted helper. The branch's intended seed delta is exactly one file: v1_rt.rs gains take_owned_counted + its counters. Verified: cargo build -p v1-compiler clean (0 errors) on this tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ge (to origin/main versions) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…+ A-site

#6249 landed the witness under dag/test/claim/ but it imports v1.compiler.ownership, which lives outside witness_layer_roots (dag, src/v2). That made dag_compile_clean_gate red once the 25m timeout let batch-1 finish. Move the witness beside its authority; Rust coverage in pipeline.rs is unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>

Adding src/v1 as a compile pool root fixed #6249 import resolution but indexed the entire v1 tree and pushed batch-1 past the 25m step budget. Relocate ownership_movable_test to src/v2/test/manual/ (excluded from floor discovery) and restore witness_layer_roots-only compile-clean pool. Co-authored-by: Cursor <cursoragent@cursor.com>

…ite quadratics (#6275) * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * Restore use_site_verdict carrier files (auto-WIP hook committed their temp removal during a local compile-isolation test) * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site * Add marker comment: two builtin-dispatch surfaces (method/pipe vs free-function) have diverged, should be one authority * Address review: cite ROADMAP hand-Rust lane for the interpreter dispatch fix REQUEST_CHANGES on #6275 correctly flagged the map_keys/map_values/ map_contains_key/map_is_empty arms as hand-Rust with no checkable receipt. Cited ROADMAP HAND kernel D (docs/plans/interpreter-kernel-d.md, v1_interpreter pure-eval dissolution) and its dissolution trigger, matching the established citation pattern (see the sgr module a few hundred lines below for the compliant precedent). --------- Co-authored-by: Brian Searls <briansearls1@gmail.com>

…parse cost) (#6280) * Thread packrat memo table through ParseExprResult in v2 parse. The parse stage inserted memo entries but discarded the updated ParseTable, so every backtrack re-parsed from an empty table. Carry table on ParseExprResult, store table-free ParseMemoEntry values in the memo map, and thread table state through all parse_expr combinators and accumulators. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * CI: raise floor step budget to 25m for compile-clean interim. Batch-1 dag_compile_clean_gate exceeds the 10m step timeout (#6263); land the interim knob from #6281 so the floor can complete while affected-set-scoped compile-clean is in flight. Dissolve-on: restore 10m when compile-clean fits the forcing budget. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * Revert "CI: raise floor step budget to 25m for compile-clean interim." This reverts commit e1bab10. * WIP: P8 fix: thread the parse packrat memo through ParseExprResult (02_parse. * CI: move ownership witness out of dag compile-clean closure. Adding src/v1 as a compile pool root fixed #6249 import resolution but indexed the entire v1 tree and pushed batch-1 past the 25m step budget. Relocate ownership_movable_test to src/v2/test/manual/ (excluded from floor discovery) and restore witness_layer_roots-only compile-clean pool. Co-authored-by: Cursor <cursoragent@cursor.com> * CI: raise floor step budget to 40m for compile-clean gate. Batch-1 dag_compile_clean_gate runs five sequential compile shells; clean-tree alone took ~23m on CI at c8b3b7d, timing out the 25m step before perturb receipts could run. Bump floor step to 40m and job backstop to 65m (15+40+5+5); dissolve-on unchanged. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>

…|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…de the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… guard + move licenses (atomic) (#6307) * WIP: gunb compilation test * Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * WIP: gunb compilation test * WIP: gunb compilation test * Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map) Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05). The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any shared update — while the interpreter already realized Value::Map as im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the generated code imports (extdeps/languages/rust/types.dag import row + runtime_rust.dag header + seed hand-sync; type spellings and call sites unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each insert copies an O(log n) node path — shared update becomes the designed path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists and sets keep it until they migrate too). By-execution receipts (frozen-unit cold-compile benchmark): - tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone) - tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0 - remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert — the named follow-up (List/Set -> persistent carriers need emitter type template work, not just the import row) im-rc serde feature enabled for the artifact-serialization derives; hand seams (cli_run, interpreter, bins, test mods) repointed per direction — host-internal std maps stay std. fmt + clippy -D warnings green across all targets. Run-to-run artifact nondeterminism predates this change (open v2.std.determinism thread), verified by pre-change A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix import order in v2 manual ownership_movable mirror (imports precede items) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/sharp-wolf-473 Resolves #6269 test-migration collision: accept main's deletion of src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers (hashes -> Rc<im_rc::Vector>, Node children/params via .into()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7): - v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet) and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n) COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true. - 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the bidirectional regen hazard). - v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets 'remain O(n)-copy carriers and keep the guard'. Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main (maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane (loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need focus/push_back/VecCompat + the trait emission itself). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…ontainer-dimension seeds (92->30 verify staleness) (#6322) * WIP: gunb compilation test * Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * WIP: gunb compilation test * WIP: gunb compilation test * Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map) Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05). The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any shared update — while the interpreter already realized Value::Map as im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the generated code imports (extdeps/languages/rust/types.dag import row + runtime_rust.dag header + seed hand-sync; type spellings and call sites unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each insert copies an O(log n) node path — shared update becomes the designed path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists and sets keep it until they migrate too). By-execution receipts (frozen-unit cold-compile benchmark): - tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone) - tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0 - remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert — the named follow-up (List/Set -> persistent carriers need emitter type template work, not just the import row) im-rc serde feature enabled for the artifact-serialization derives; hand seams (cli_run, interpreter, bins, test mods) repointed per direction — host-internal std maps stay std. fmt + clippy -D warnings green across all targets. Run-to-run artifact nondeterminism predates this change (open v2.std.determinism thread), verified by pre-change A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix import order in v2 manual ownership_movable mirror (imports precede items) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/sharp-wolf-473 Resolves #6269 test-migration collision: accept main's deletion of src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers (hashes -> Rc<im_rc::Vector>, Node children/params via .into()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7): - v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet) and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n) COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true. - 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the bidirectional regen hazard). - v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets 'remain O(n)-copy carriers and keep the guard'. Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main (maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane (loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need focus/push_back/VecCompat + the trait emission itself). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…: one-level visibility by construction (floor resolve 286.7s -> 2.4s) (#6331) * WIP: gunb compilation test * Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * WIP: gunb compilation test * WIP: gunb compilation test * Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map) Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05). The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any shared update — while the interpreter already realized Value::Map as im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the generated code imports (extdeps/languages/rust/types.dag import row + runtime_rust.dag header + seed hand-sync; type spellings and call sites unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each insert copies an O(log n) node path — shared update becomes the designed path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists and sets keep it until they migrate too). By-execution receipts (frozen-unit cold-compile benchmark): - tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone) - tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0 - remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert — the named follow-up (List/Set -> persistent carriers need emitter type template work, not just the import row) im-rc serde feature enabled for the artifact-serialization derives; hand seams (cli_run, interpreter, bins, test mods) repointed per direction — host-internal std maps stay std. fmt + clippy -D warnings green across all targets. Run-to-run artifact nondeterminism predates this change (open v2.std.determinism thread), verified by pre-change A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix import order in v2 manual ownership_movable mirror (imports precede items) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/sharp-wolf-473 Resolves #6269 test-migration collision: accept main's deletion of src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers (hashes -> Rc<im_rc::Vector>, Node children/params via .into()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7): - v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet) and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n) COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true. - 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the bidirectional regen hazard). - v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets 'remain O(n)-copy carriers and keep the guard'. Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main (maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane (loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need focus/push_back/VecCompat + the trait emission itself). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup, found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical import-list additions), the network_identity param typed to the alias it actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its generating authority because #6329 hand-edited the artifact without back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to the committed operator-signed version). falsifier.yml/.gitignore regens are main_wet output. The complexity_r1 citation-string repoints are reverted out of this PR: touching those files enrolls a fixture whose lens hits a pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T'); moved to follow-up with that deficit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import fix) demand-resolves this lens; fold_list<T,A> over n.children left T un-instantiated on that path (no field 'label' on 'T') while batch reconcile typed it fine — a batch/demand inference divergence. The children fold now uses the builtin fold idiom fact_density.dag already uses (resolves on both paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by execution); the registry fold_list over a concrete FreeMonoid in the same module types fine and stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Revert "WIP: emit -> realization" This reverts commit 3ad16c9. * WIP: emit -> realization --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test * Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * WIP: gunb compilation test * WIP: gunb compilation test * Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map) Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05). The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any shared update — while the interpreter already realized Value::Map as im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the generated code imports (extdeps/languages/rust/types.dag import row + runtime_rust.dag header + seed hand-sync; type spellings and call sites unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each insert copies an O(log n) node path — shared update becomes the designed path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists and sets keep it until they migrate too). By-execution receipts (frozen-unit cold-compile benchmark): - tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone) - tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0 - remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert — the named follow-up (List/Set -> persistent carriers need emitter type template work, not just the import row) im-rc serde feature enabled for the artifact-serialization derives; hand seams (cli_run, interpreter, bins, test mods) repointed per direction — host-internal std maps stay std. fmt + clippy -D warnings green across all targets. Run-to-run artifact nondeterminism predates this change (open v2.std.determinism thread), verified by pre-change A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix import order in v2 manual ownership_movable mirror (imports precede items) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/sharp-wolf-473 Resolves #6269 test-migration collision: accept main's deletion of src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers (hashes -> Rc<im_rc::Vector>, Node children/params via .into()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7): - v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet) and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n) COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true. - 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the bidirectional regen hazard). - v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets 'remain O(n)-copy carriers and keep the guard'. Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main (maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane (loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need focus/push_back/VecCompat + the trait emission itself). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup, found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical import-list additions), the network_identity param typed to the alias it actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its generating authority because #6329 hand-edited the artifact without back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to the committed operator-signed version). falsifier.yml/.gitignore regens are main_wet output. The complexity_r1 citation-string repoints are reverted out of this PR: touching those files enrolls a fixture whose lens hits a pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T'); moved to follow-up with that deficit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import fix) demand-resolves this lens; fold_list<T,A> over n.children left T un-instantiated on that path (no field 'label' on 'T') while batch reconcile typed it fine — a batch/demand inference divergence. The children fold now uses the builtin fold idiom fact_density.dag already uses (resolves on both paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by execution); the registry fold_list over a concrete FreeMonoid in the same module types fine and stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Revert "WIP: emit -> realization" This reverts commit 3ad16c9. * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * intern_str build-green: list-get resolves Optional via free_monoid_collection get template Root cause of the list-get-by-index inference deficit: free_monoid_collection_templates (the List method table in dag/std/algebra.dag) declared first/last returning OptionalOf<ReceiverElement> but had NO get row — so `list |> get(index)` never resolved structurally and its result type defaulted to the receiver (FreeMonoid), leaving the match Bind arm un-Some-wrapped. Map-get works because PartialFunction declares get: fn(K) -> V?. - dag/std/algebra.dag: add get: [ReceiverSelf, Int] -> OptionalOf<ReceiverElement> row, mirroring the existing first/last rows (completes the model, mints nothing). [already committed] - src/v1/stage0/src/std_algebra.rs: splice the get template into the seed so the running binary's inference resolves list-get as Optional. - src/v1/00_core.dag: intern_str now matches explicit Present/Absent (was catch-all `other => other` which binds the whole Option); emits Some(s)/None, builds green. Fresh-crate cargo check: 26 -> 2 errors; the 2 remaining are the single std_integer Nat where-refinement alias-resolution root (Nat<Magnitude>). intern_str builds. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

… gate) + sorted_map_keys builtin (#6357) * WIP: gunb compilation test * Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow) Operator ruling 2026-07-05: the silent clone arm in the rc_* update family is a degradation that must stop the pipeline, not widen. Every shared-Rc update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and take_owned_counted's clone arm now routes through rc_shared_update_guard: - GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the generated caller (#[track_caller]) — the work-queue key for licensing. - =count: per-site ledger, first-hit line + ranked exit report (Drop on the thread_local), so degradation frequency is observable per §5. - =allow: interim escape hatch. tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) — the profiled O(n^2) cold-compile root cause. Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same pattern as #6249. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5 Operator rulings 2026-07-05: - GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and count (stopped-line audit: full ledger, still not a green run). No mode silences a refusal. - DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen, fabricated default, uncounted degradation, escape hatch) is a hard reject in review. - 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust) hand-synced to take_owned_counted — the guard's known bypasses closed; regen supersedes the hand-sync. - take_owned_counted count arm ledgered into the same exit report as rc_* (one stopped-line audit surface). - Interpreter: Bool True|False vs Value::Bool cross-representation `==` straddle now refuses (CrossRepresentationEquality), mirroring the numeric arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution receipt joins the cross_representation receipts behind the stopped line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: gunb compilation test * WIP: gunb compilation test * WIP: gunb compilation test * Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map) Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05). The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any shared update — while the interpreter already realized Value::Map as im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the generated code imports (extdeps/languages/rust/types.dag import row + runtime_rust.dag header + seed hand-sync; type spellings and call sites unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each insert copies an O(log n) node path — shared update becomes the designed path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists and sets keep it until they migrate too). By-execution receipts (frozen-unit cold-compile benchmark): - tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone) - tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0 - remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert — the named follow-up (List/Set -> persistent carriers need emitter type template work, not just the import row) im-rc serde feature enabled for the artifact-serialization derives; hand seams (cli_run, interpreter, bins, test mods) repointed per direction — host-internal std maps stay std. fmt + clippy -D warnings green across all targets. Run-to-run artifact nondeterminism predates this change (open v2.std.determinism thread), verified by pre-change A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix import order in v2 manual ownership_movable mirror (imports precede items) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/sharp-wolf-473 Resolves #6269 test-migration collision: accept main's deletion of src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers (hashes -> Rc<im_rc::Vector>, Node children/params via .into()). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7): - v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet) and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n) COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true. - 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the bidirectional regen hazard). - v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets 'remain O(n)-copy carriers and keep the guard'. Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main (maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane (loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need focus/push_back/VecCompat + the trait emission itself). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup, found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical import-list additions), the network_identity param typed to the alias it actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its generating authority because #6329 hand-edited the artifact without back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to the committed operator-signed version). falsifier.yml/.gitignore regens are main_wet output. The complexity_r1 citation-string repoints are reverted out of this PR: touching those files enrolls a fixture whose lens hits a pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T'); moved to follow-up with that deficit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import fix) demand-resolves this lens; fold_list<T,A> over n.children left T un-instantiated on that path (no field 'label' on 'T') while batch reconcile typed it fine — a batch/demand inference divergence. The children fold now uses the builtin fold idiom fact_density.dag already uses (resolves on both paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by execution); the registry fold_list over a concrete FreeMonoid in the same module types fine and stays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: emit -> realization * Revert "WIP: emit -> realization" This reverts commit 3ad16c9. * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * intern_str build-green: list-get resolves Optional via free_monoid_collection get template Root cause of the list-get-by-index inference deficit: free_monoid_collection_templates (the List method table in dag/std/algebra.dag) declared first/last returning OptionalOf<ReceiverElement> but had NO get row — so `list |> get(index)` never resolved structurally and its result type defaulted to the receiver (FreeMonoid), leaving the match Bind arm un-Some-wrapped. Map-get works because PartialFunction declares get: fn(K) -> V?. - dag/std/algebra.dag: add get: [ReceiverSelf, Int] -> OptionalOf<ReceiverElement> row, mirroring the existing first/last rows (completes the model, mints nothing). [already committed] - src/v1/stage0/src/std_algebra.rs: splice the get template into the seed so the running binary's inference resolves list-get as Optional. - src/v1/00_core.dag: intern_str now matches explicit Present/Absent (was catch-all `other => other` which binds the whole Option); emits Some(s)/None, builds green. Fresh-crate cargo check: 26 -> 2 errors; the 2 remaining are the single std_integer Nat where-refinement alias-resolution root (Nat<Magnitude>). intern_str builds. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: emit -> realization * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * seed-prime: sorted_map_keys builtin (registry + bridge + runtime generator) Functional gen-0' prime of the new sorted_map_keys builtin across the 3 remaining seed twins (v1_rt.rs fn + infer arms already present): - v1_compiler_infer_method.rs: builtin_function_registry row (type = list of collection_element, mirrors map_keys) - extdeps_languages_rust_emit.rs: rt bridge row (passes_by_ref+wraps_result, mirrors map_keys) - v1_compiler_runtime_rust.rs: runtime-generator emits the fn body after map_keys Enables the 2-gen bootstrap: regen_stage0 built from this seed can resolve/ emit sorted_map_keys, so a fresh regen produces the canonical seed. Ordering within gen-0' is irrelevant; canonical order comes from runtime_rust.dag:177. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * WIP: realization (SymbolIndex) * fix: .dag emits im-rc dep + qualified std::collections::BTreeSet for stage0_core/emit_core boundary files (workspace build) * test: build_movable_set 2-arg (empty param_names) — align stale test with .dag authority The .dag defines build_movable_set(proof, param_names) as 2-arg; main's seed carried a stale 1-arg divergence and pipeline.rs was written against it. accept-fresh correctly converged the seed to the 2-arg .dag form, so the hand-maintained test crate call needed updating. param_names only extends movability to sole-owned params; empty set = the param-blind count the movable_but_cloned<=45 ratchet was calibrated against. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Brian Searls <briansrls@gunb.ai>

… law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ealization carrier, provider rows via provider_from_catalog (design: docs/plans/duplicate-work-graph-lens-design.md section 10b; the .dag-substrate demonstration lane) (#6422) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * Fix compiler materialization witnesses: RealizedStep carrier, plural RED fixture. Use RealizedStep<Nano> (not unit), drop 02_parse import from witnesses in favor of parse_table_carrier_grounded_on_catalog, and model cross-run memo plurality with an isolation-boundary LCA matching the CI ladder pattern. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix CI: move materialization_carriers to compiler layer (no std→extdeps import). Resolves layering_imports_gate and compile-clean failures from v2.std importing extdeps via materialization_carriers. CachedStageRealization lives in v2.compiler.materialization_carriers; staging.dag stays transport-only. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * Fix governed memo door: resolve_probe in cached_stage_governed, parse lookup match braces. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge merry-moth-539 (main-integrated); harden governed memo door witnesses. Merge origin/session/merry-moth-539 for post-main semantics alignment. Export parse_table_memo_lookup_refuses_store / parse_table_memo_insert_refused door oracles in 02_parse; witnesses call them directly (reason atom, not full Diagnostic equality). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * Regenerate ci.yml for floor resolve receipt pin at 3. CI run 29059860791 measured resolves_total=3 after enrolling the two new v2 witness entry classes; sync the emitted gate with ci_floor_declared_resolve_count in ci_materialization.dag. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * fix: escape ComputationIdentity braces in design_document.dag Rebase conflict left unescaped {bound}/{cause} in a li() string, which broke dag compile and the generated-artifact drift gate. Regenerate ci.yml. Co-authored-by: Cursor <cursoragent@cursor.com> * merge origin/main and resolve conflict markers; fix ParseTableMemo Case-A leak Integrate main (#6431) atop #6375 base. Remove leftover merge conflict markers from ci_materialization, commit_workflow, design_document, ci.yml. Gate seed ParseTableMemo insert/serve on Memoize only (after governed door) so insert-then-lookup door observables are order-independent; enroll parse_table_memo_door_order_independent witness. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: add Terminal disposition contracts for carrier predicate helpers Land v2_compiler_materialization_memo_gate_predicate_contract and v2_compiler_catalog_projection_predicate_contract on materialization_allows_memo_store / projection_is_projected — matching the Terminal predicate discipline already in materialization_ladder.dag. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: correct resolve-receipt note attribution for #6422 enrollments Pin was already 3 before #6422 witness entries; run 29059860791 held at 3 with those entries enrolled because they pooled warm on the shared index (zero additional cold resolves). Remove false per-entry bump claim. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Ground v2 ParseTable + cached_stage on materialization: inhabit the Real * fix: drop duplicate projection_is_projected; use extdeps authority Remove forked CatalogProviderProjection predicate from materialization_carriers.dag; projection_ok cells now call !projection_is_refused from extdeps.cache.materialization (§3 single authority). Remove local Terminal contract that documented the fork. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): raise floor step timeout to 45m for #6422 witness cone Receipt run 29065683045 @ a2bcd6f: batches 1-3 ~20m, batch 4 rust_monolith_gate killed at 30m step cap. Bump floor step and ci/ci_regen job backstop (85m→100m) to match rust gate step budget. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>

…rier (#6435) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ate (#6441) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Inferred materialization increment 1: floor demand ledger + receipt-or-red gate Running IS enrolling: the interpreter ledgers every keyed pure call and every InterpContext absorbs its totals into a process accumulator on Drop — by construction, no eval path escapes the receipt. claim_executor writes target/floor-materialization-receipt.txt at walk end; trace defaults ON in the executor, and an explicit =0 zeroes keyed_calls which the gate refuses. Gate arms this push (all verified under dash from the emitted ci.yml): receipt missing/malformed/keyed_calls=0 fail closed. Exact pins for unkeyed_calls and duplicated_keys land from the FIRST CI receipt (the resolve gate's measure-then-pin path) — unkeyed is known nonzero on the floor (count_matching takes a predicate closure; closures are the one disclosed identity-less class, dissolve-on captured-env content identity). Unit witness green: resolve -> eval -> ctx Drop -> absorb -> drain-once. Step addition bumped the claimed-natures pin 16 -> 17 consciously. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review fix: drop the racy drain-once assertion from the receipt unit test opus-4-7 finding on #6441: under plain cargo test (still the documented runner) tests share a process, the env latch is OnceLock-sticky, and sibling ctx drops could absorb between the two takes — making the drain-empty assertion racy. Absorb-on-Drop stays asserted (monotone under concurrent absorbs: siblings only ADD); drain-once is Option::take by construction, not asserted through the shared global. Comment states the sharing semantics explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… gated) (#6455) * Inferred materialization increment 1: floor demand ledger + receipt gate (#6441) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Inferred materialization increment 1: floor demand ledger + receipt-or-red gate Running IS enrolling: the interpreter ledgers every keyed pure call and every InterpContext absorbs its totals into a process accumulator on Drop — by construction, no eval path escapes the receipt. claim_executor writes target/floor-materialization-receipt.txt at walk end; trace defaults ON in the executor, and an explicit =0 zeroes keyed_calls which the gate refuses. Gate arms this push (all verified under dash from the emitted ci.yml): receipt missing/malformed/keyed_calls=0 fail closed. Exact pins for unkeyed_calls and duplicated_keys land from the FIRST CI receipt (the resolve gate's measure-then-pin path) — unkeyed is known nonzero on the floor (count_matching takes a predicate closure; closures are the one disclosed identity-less class, dissolve-on captured-env content identity). Unit witness green: resolve -> eval -> ctx Drop -> absorb -> drain-once. Step addition bumped the claimed-natures pin 16 -> 17 consciously. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review fix: drop the racy drain-once assertion from the receipt unit test opus-4-7 finding on #6441: under plain cargo test (still the documented runner) tests share a process, the env latch is OnceLock-sticky, and sibling ctx drops could absorb between the two takes — making the drain-empty assertion racy. Absorb-on-Drop stays asserted (monotone under concurrent absorbs: siblings only ADD); drain-once is Option::take by construction, not asserted through the shared global. Comment states the sharing semantics explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Turn on affected-set CI: re-land witness enrollment flip (discovery shrunk by affected set) + falsifier host-OOM receipt (#6438) * WIP: Re-land affected-set CI enrollment flip once shard resolve footprint is * WIP: Re-land affected-set CI enrollment flip once shard resolve footprint is * Fix CI OOM: pin discovery corpus spawn_width_cap to 1. Run 28999086030 OOM-killed at width=2 on the 24GiB live slot during the discovery-flip corpus batch. Gate workloads still fit at width=2; only the tree-wide discovery batch serializes via spawn_width_cap=1, with a receipt witness and dissolve-on note. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix type error in corpus discovery spawn width cap helper. Both if-branches must return Nat (hardware_thread_count_value), not a bare Int literal. Co-authored-by: Cursor <cursoragent@cursor.com> * Merge affected-set enrollment flip (takeover of PR #6403 from session/gentle-stag-677-flip) Conflict resolutions onto post-#6422/#6431/#6432/#6435 main: - ci_witness_optin_inversion: main's typed Scaffold Disposition -> Terminal (dissolve fired at the flip; roster stays as explicit-entry home, exclusivity dissolved) - floor step timeout: 45 (main) vs 60 (flip) -> 60 with provenance note - ci_spec notes: kept flip notes, stale fixed-8 phrasing dated - falsifier width note: + RESIDUE paragraph (5x exit-137 on srv2-class slots = converge lane, not plan width) Verified before commit: discovery batches charge corpus_resolve_nanos (own key), resolve_nanos=0 -> resolves_total declared 3 is NOT moved by the flip. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: affected set processing * WIP: affected set processing * WIP: affected set processing * WIP: affected set processing * Correct the false flip receipt + kill-surviving calibration receipts (space-lens loop) CORRECTED RECEIPT: run 29000557166's floor never completed - the executor was host-OOM-killed mid-discovery-corpus at ~8min; the log's ExitSuccess belongs to the merge-admission stamp tool stamping CI_FLOOR_EXIT=137. No flipped corpus has completed in CI (0/1 ci + 0/5 falsifier). Both carrier notes corrected. Calibration (coordinated with merry-owl-649's space-lens lane): - roster_import_closure_nodes_pre_resolve: shared closure-count authority (pure import walk, closure grain not entry grain), emitted BEFORE the heavy resolve so killed runs still yield the (nodes, peak) lower-bound pair - width-1 definition-drift oracle: pre-resolve walk must equal post-resolve resolved union on completed runs; refuses on divergence. Proven by execution: pre == post == 190/213 nodes across Off/Applied modes - kill-surviving cgroup memory.peak pre/post steps (post is always()) in the ci job and falsifier.yml; scope semantics labeled on the emission lines (reset=ok floor-scoped; span compares post>pre; never silently conflated) - job backstop timeouts extended by the two aux steps in both jobs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: affected set processing * Calibration pairs carry censored-vs-exact labels (methodology: killed runs are censored observations) Floor steps get id=floor; the always() post-peak step emits floor_outcome so each (closure_nodes, peak) pair is explicitly labeled: success = exact point, anything else = censored lower bound (true demand strictly greater than read). Prevents the fit from treating cap-kill reads as point estimates, which would drag the slope down and make the predictor underestimate - the dangerous direction (merry-owl methodology catch, 2026-07-10). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: affected set processing * Review fixes: explicit witness import + complete step-budget ledger - ci_floor_plan_witness_test.dag: import witness_ci_corpus_discovery_serializes_at_width_one explicitly (cursor catch on #6438). The call resolved pre-fix via the seed resolver's flat namespace, so the witness ran green by execution; the explicit import restores the file's per-symbol import convention. - ci_workflow.dag: the resolve-receipt gate step had NO step cap — a hang there could only die by job-cancel (the #6323 starvation-kill class). It now carries the aux cap (script is a sub-second receipt read) and the ci job backstop counts four aux terms (peak pre/post, resolve-receipt gate, merge-admission gate): every step budgeted, backstop = step-sum + prelude (claude review catch on #6438, sharpened). - falsifier_workflow_witness_test.dag: falsifier_backstop_is_step_sum_plus_prelude asserted the pre-calibration formula — latent red proven by execution (FAIL receipt), fixed to the live two-aux sum, re-run PASS. - ci.yml regenerated byte-stable from the carrier (backstops 125->130, gate step timeout 5m). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Rebind calibration provenance comments to real artifacts (cursor review catch) The two cli_run.rs comments cited docs/plans/space-lens-minimal-project.md, which does not exist on main — the predictor design is in flight on PR #6442 (merry-owl-649's lane) and was never landed under that path. Rebound: the shared closure-definition authority is stated as this function itself, with the in-flight design cited by PR number and the landed parent-lane authorities cited by real paths (compute-envelope-model.md fleet envelope; input-envelope-roadmap.md admission). No behavior change; cargo check clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: affected set processing * Remove stray empty file (shell-redirect artifact the auto-committer flushed) An internal-messaging command's backtick content was command-substituted by bash; a '-> fail-closed' fragment became a stdout redirect and created an empty file at the repo root, which the auto-committer then committed as 38f0a46. No tree content beyond the empty file; removing it restores the branch to e99c757's content. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: affected set processing * Scaffold-mark the cgroup peak calibration shell (cursor review catch) The three concat-built calibration runners (ci_cgroup_peak_locate_shell, ci_floor_peak_pre_script, ci_floor_peak_post_script) landed without the on-carrier scaffold markers repo convention requires for hand-shell. Each now carries a Disposition = Scaffold { dissolves_to: RealizationDispatch } row binding the decl (the ci_materialization pattern), and both scripts embed the shared dissolve-on note as a shell comment (the ci_spec pattern): dissolution = bash-emit (#5828 / gap-B emit(intent, Bash)) realizing the observation as an emitted ShellProgram intent or a typed host Observe effect. ci.yml + falsifier.yml regenerated; falsifier_workflow_witness_holds and the flip witnesses re-run PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Merge origin/main into session/loyal-wren-398 (resolve #6441 step-list conflict) Conflict resolution, all consciously declared: - ci_job steps: union — the calibration peak pre/post steps wrap the floor step (this branch) and #6441's materialization receipt gate slots between the resolve-receipt gate and the merge-admission gate (main). - The incoming materialization receipt gate step landed with timeout none — the same uncapped-step starvation-kill class this branch's review fix eliminated — so it now carries the aux cap, and the ci backstop counts FIVE aux terms (peak pre, peak post, resolve-receipt gate, materialization receipt gate, merge-admission gate); the budget disposition note records the merge provenance. - ci_run_step_natures_are_claims_counted_not_silent: RunStep count pin bumped 17 -> 19, acknowledging the two peak calibration steps #6441's count predates (conscious-count discipline; proven red at 17 then green at 19 by execution). - ci.yml regenerated from the merged carriers (backstops 130 -> 135). Verified on the merged tree: release bins rebuilt on merged Rust; falsifier workflow witness, flip witnesses, floor-plan/optin/width witnesses, and all 8 ci_materialization witnesses PASS; generated-artifact regen ExitSuccess. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * ShellProgram -> DAG: transport intent collapse + live importer ratchet (phase 0 of the sidecar dissolution) (#6449) * WIP: ShellProgram -> DAG * WIP: ShellProgram -> DAG * WIP: ShellProgram -> DAG * WIP: ShellProgram -> DAG * WIP: ShellProgram -> DAG * bash fold: native Concat/CmdSubst/WithRedir coverage + measured cost wall on the whole-tree emit path Fold-family productions extended so the fold no longer refuses word Concat/CmdSubst or stmt WithRedir (all four Redir variants): new concat_parts/word-compound/with_redir production families, lex tokens, kind-tag emit transforms, and recursive bundle arms. Byte-identity vs serialize_bash proven by execution: five depth-2 oracle tests plus the depth-4 assign_root_stmt manual probe (ROOT=$('git' 'rev-parse' '--show-toplevel' 2>/dev/null || 'pwd') byte-exact). The delegated fail-closed RED control repoints from WithRedir (now native) to Heredoc (still delegated) so the boundary guard stays discriminating. Measured cost wall, declared on-carrier (bash_program_emit_cost_wall_note): whole-tree backward row-selection is ~alternatives^depth (1s flat stmt, 64s for the single depth-4 stmt, DNF >8min for the full witness_bin program) because formal_production_unique_lhs_exact_match deep-validates every candidate per level and the descent re-validates each level again. Real-program oracles therefore stay MANUAL probes, not test fns (a discovery-run test would hang the local floor); the probe note on the test carrier names the dissolution triggers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * B1: NameResolutionPolicy row + position-tracked resolve (NamespaceOnlyY gated). Add v2.std.resolution_policy (ImportScoped default | NamespaceOnlyY). Thread ResolveContext { position, expected, policy } through resolve walk; namespace-only skips import module bindings and uses symbol_index at position. Policy pilot witness: green under NamespaceOnlyY at type position, RED under ImportScoped at module position. Import-scoped global default unchanged — zero corpus churn. Co-authored-by: Cursor <cursoragent@cursor.com> * Wave 1A - namespace-only name resolution: make the syntactic containment tree the single naming authority (qualified name = nesting position, reference = lexical lookup up ancestors, . = projection one level down). Path: confirm loyal-heron SymbolIndex scaling receipt FIRST, then SymbolIndex = conta (#6451) * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * v2.std.symbol_index: materialize containment tree as single naming authority Add SymbolIndex fill from nesting (qualified path → Node), qualified-name path algebra bridges, and discriminating witnesses. Retarget #6436 variant- visibility scaffold to dissolve into symbol_index_lexical_lookup; harvest_unique stays interim until module-scoped index scan lands. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * Fix rust fmt on qualified-name bridge host functions (CI rust_tests gate). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * Remove symbol_index_has_path; tests match symbol_index_lookup directly Dissolve Optional→Bool predicate in new std/ surface per review. Lexical lookup root termination already uses qualified_name_is_empty (not dotted string projection). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * Address review: is_empty authority, host scaffold binds, layer split - Remove qualified_name_is_empty; lexical lookup uses is_empty(xs: position) - Host dispositions bind to from/to_dotted_string bridges; add P5 receipt tests - Move extdeps-coupled fill to v2.compiler.symbol_index_fill (layer DAG fix) Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * Wire resolver through SymbolIndex; dissolve harvest_unique_disj interim. Build SymbolIndex at admission and thread it through Namespace. resolve_atom falls back to symbol_index_lexical_lookup for unbound atoms after import-scoped lookup_chain. Fill-time unique-variant aliases (suffix-scan equivalent) replace #6436 harvest_unique_disj. Equivalence witnesses prove SymbolIndex-alone covers variant visibility (green + without-alias RED control); end-to-end wire green. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Wave 1A - namespace-only name resolution: make the syntactic containment * Drop unused ResolveContext.expected until expected-type lane lands. Removes the dead field and uncalled resolve_ctx_with_expected helper flagged in #6454 review 36717 — B1 uses position-only disambiguation; expected-type filtering returns when that slice is scoped. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>

…eipt-write refusal + counter invariant (#6456) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Inferred materialization increment 1: floor demand ledger + receipt-or-red gate Running IS enrolling: the interpreter ledgers every keyed pure call and every InterpContext absorbs its totals into a process accumulator on Drop — by construction, no eval path escapes the receipt. claim_executor writes target/floor-materialization-receipt.txt at walk end; trace defaults ON in the executor, and an explicit =0 zeroes keyed_calls which the gate refuses. Gate arms this push (all verified under dash from the emitted ci.yml): receipt missing/malformed/keyed_calls=0 fail closed. Exact pins for unkeyed_calls and duplicated_keys land from the FIRST CI receipt (the resolve gate's measure-then-pin path) — unkeyed is known nonzero on the floor (count_matching takes a predicate closure; closures are the one disclosed identity-less class, dissolve-on captured-env content identity). Unit witness green: resolve -> eval -> ctx Drop -> absorb -> drain-once. Step addition bumped the claimed-natures pin 16 -> 17 consciously. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review fix: drop the racy drain-once assertion from the receipt unit test opus-4-7 finding on #6441: under plain cargo test (still the documented runner) tests share a process, the env latch is OnceLock-sticky, and sibling ctx drops could absorb between the two takes — making the drain-empty assertion racy. Absorb-on-Drop stays asserted (monotone under concurrent absorbs: siblings only ADD); drain-once is Option::take by construction, not asserted through the shared global. Comment states the sharing semantics explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ncident, argued serially with receipts) (#6469) * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * WIP: Duplicate Computation * Analysis spine: spine_receipt composes dependency_view + materialize (increment 1) The Rc-safe half of run ≜ realize ∘ materialize ∘ dependency_view: compose the two catamorphisms that need no interpreter thread-safety. - src/v2/std/spine.dag: level-profile fold over the DependencyView DAG → critical_path_depth (longest dependency chain / the reduce spine) + independence_width (max nodes at one level / what parallelizes to hw width). spine_receipt emits the §9 numbers by COMPUTATION, not assertion, joining materialize's content-hash Share/dedup counts. - Discriminating RED (§9): single chain A→B→C → depth 3 / width 1 (serial); root over N independent leaves → depth 2 / width N. - Witnesses 9/9 (spine) green by execution; materialize 6/6 unchanged. The RUNNER (wall-clock parallel execution, §8 steps 3-4) stays increment 2+, gated on interpreter Rc→Arc (v1 interp is !Send). This increment measures the achievable width/critical-path floor the runner targets; it does not fabricate wall-clock N×. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Unbundle recompute-trace interpreter extension from the analysis-spine PR CI root cause: the recompute-trace extension edited v1_interpreter.rs, which hosts the atom_identity_hash/hash_combine fnv1a64 intrinsics that dag_collect_fingerprint_witness executes. That correctly invalidated the re-verify 'assumed-green node-frontier' SKIP of that witness (cone-touch, fail-closed) — but the witness is a pre-existing 806s (13min) fnv1a64 whole-corpus walk, so un-skipping it blew the 30-min floor budget. Main stays green only because its interpreter cone is untouched (witness stays skipped). The interpreter extension is a separable, env-gated (GUNBC_RECOMPUTE_TRACE=1), READ-mode diagnostic — not a dependency of the spine/materialize analysis substrate (pure .dag, content_hash-based). Reverting v1_interpreter.rs to main restores byte-identical interpreter content → the fingerprint witness returns to assumed-green SKIP → floor budget restored. The recompute-trace extension lands as its own follow-up PR where the fingerprint-witness re-run is expected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Materialization ladder: the state x decision law, as executable witnesses The operator's 4-rule business logic generalized on one axis: the decision is a function of WHEN the redundancy is knowable and WHETHER what was knowable was prepared for. Errors fire only on knowable-but-unprepared; genuine emergence and declared triviality are typed acceptances, never silence. std.materialization_ladder (dag/std): - Frame/FrameKind: SharedStateFrame | IsolatedChildrenFrame | ReplayedFrame{attempts} | UnboundedSiblingsFrame — the nested-scope axis; a 'run' at any layer is a frame, never a different kind of thing. - DemandNature: Pure | IdempotentEffect | WorldRead{envelope_declared} | FreshEffect — the D3 effect gate; TTL = unmodeled dependency XOR declared staleness, never an eviction knob. - CacheProvider: keying (ContentKeyed|ExistenceKeyed) + EvictionPolicy (ScopeExit|SpacePacked) REQUIRED by construction — rule 3 unwritable-bad. - LadderVerdict (total): AuthoredDuplication | Discharged | RefusedNoProvider | RefusedScopeTooNarrow | RefusedExistenceKeyed (the build-if-absent #6352 wall) | RefusedUnmodeledWorldRead | ExemptFreshEffect | AcceptedBelowCostFloor | AcceptedSingleRecompute. - Declared-emergent frames obligate UP FRONT: retry frames derive checkpointing, unbounded-sibling frames (server loops, CI-runs-over-time) derive persistent caches — prepare-before-demand. 12/12 witnesses green by execution; each test is one cell of the table, fixtures mirror the live worked example (workflow/jobs/steps, retry, fleet). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Docs crystallization: derived materialization placement into roadmap ④ + the state x decision table - roadmap_authority ④ (ROADMAP.md regenerated via main_wet, drift-consistent): the nested-frame law, plurality cells, declared-emergent prepare-up-front, keying/staleness walls, the caching-completion un-shelve, the ①-vs-§2 cross-run-caching contradiction subsumed into per-node derived verdicts, and the v1.compiler.ownership §3-convergence row. - duplicate-work design doc: the state x decision table as the qualifier's final verdict logic + the ownership consolidation subsection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Consolidation plan: realization + materialization + ownership are one law Operator synthesis (2026-07-09): Materialization = the verdict vocabulary; ownership = the verdict computation at the eval frame; realization = provider selection discharging the verdict at each frame's carrier. Share's handler is layer-aware — the cheapest cache is a REFERENCE (same program + ref-capable carrier + readonly => point-at-it, no copy, no destroyed memory), demoting through HAMT structural share / process memo / artifact / CAS, and demotion must be priced, never silent (#6249 clone-fallback is the receipt). Census of every hand-rolled instance found in-tree (16 rows): each named with its frame, ladder cell, action, and dissolution trigger — ownership (consolidated), Rc/HAMT (reference tier), clone-fallback (demotion wall), ParseTable + cached_stage (C5 grounding), M1 memo / intern / assumed-green / sccache / cargo-cache (C2 provider rows), PROCESS_RESOLVE_STORE (C3 = the 9GB scope fix), build-if-absent (landed as the keying wall), resolve-cache #5789 (rule-4 requirements), recompute-trace (state-4 finding source). Peers kept distinct: affected-set, Independence/Placement, mutable state. Sequence C1-C5 with C1 = this PR (ladder + live CI gate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * Ownership refactored onto materialization: the value tier, tested as providers First consolidation increment (operator-directed): v1.compiler.ownership's decision IS provider selection at the value grain, now expressed in the ladder and proven by mirror witnesses. - ProviderTier: Reference | Copy | Memo{keying} | Artifact{keying} | Cas{keying} — keying folded INTO store tiers, so an existence-keyed reference is unwritable BY SHAPE (§5 construction); frame obligations at isolation LCAs are dischargeable only by store tiers (a reference cannot cross an isolation boundary — witnessed). - Value tier: AccessMode (Read|Consume|Carry|Project), ValueUsage, value_materialization -> ValueDead | ValueMoved | ValueSharedByReference | ValueDemotedToCopy (PRICED, requires a declared CopyTier provider — the #6249 silent clone-fallback made refusable) | ValueRefusedAffine | ValueRefusedNoCarrierProvider. - Faithful to v1's THREE distinct plurality readings, kept separate: take_count = semantic_consumer_count (Consumed only, affine axis); value_access_plurality = binding_fan_out (Carry excluded, reference axis); borrow_count = whole_value_borrow_count (Read+Carry not Project, movability). - Fold-accumulator case mirrored at conservative pre-FoldAccUnwrap semantics: carries excluded from plurality but blocking the move -> demoted-to-copy. 23/23 witnesses green (14 frame cells + 9 value cells). Corpus-level equivalence against live v1 ownership folds = the C4 receipt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Duplicate Computation * WIP: Duplicate Computation/Materialization * G: exhaustive cache/share census (52 mechanisms, 6 groups) + C0 catalog-grounding of provider rows + forward-wiring walls The sweep found the tree already models caches: extdeps/cache cache_catalog (CacheInterfaceCatalogFacts, 9 rows) + extdeps/realization carrier facts + the warm==cold purity oracle. C0 grounds CacheProvider on that catalog (provider_from_catalog projection; CacheProvider.id -> CacheInterfaceId) so the ladder and the catalog never restate each other's half. Three forward walls (demands-from-DependencyView, hand-cache shape lens, live-provider-or-red) make new caches born as provider rows only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * C0: provider rows derive from the cited cache catalog (extdeps/cache/materialization.dag projection) Operator ruling 2026-07-09: extdeps stays the ground-truth/interface layer; every USE of a cache goes through materialization so memo never gets re-invented. provider_from_catalog is the only door from a catalog row into the ladder: keying/tier/eviction derived from cited facts (mechanism->class: InProcess=>ScopeExit; Ttl/Lru/SizeBounded=>SpacePacked; Never/Manual outside a process => typed ProjectionRefused, counted by the new enrolled witness; HandAuthored/prefix-fallback keys => ExistenceKeyed until key-completeness upgrades them). CI sccache row now derived, hand-typed tier facts deleted, 6/6 + 23/23 witnesses green. 10b re-scoped: v1-internal caches = inventory only (retire with seed); ParseTable/cached_stage promoted to next. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Fail-closed hardening: RefusedNatureConflict arm, weakest-claim nature default, UsesStep silence counted, ladder cells enrolled in CI The complexity-lens false-clean lesson applied to this gate before anyone relies on it: (1) heterogeneous natures on one identity were first-wins — now a typed RefusedNatureConflict (24th ladder cell, RED witness); (2) an unrostered run-step claimed PureComputation — now IdempotentEffect, the weakest claim (verdict-identical, no purity overclaim; a misdeclared WorldRead can no longer be legally memoized by default); (3) UsesStep foreign actions produced silence — now a pinned denominator (==9; a new foreign action must consciously bump it); (4) the ladder's 24 cells enroll on the CI surface so the law's own witnesses gate every run. 24/24 + 7/7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * M1 ratchet bump: declared resolve count 1 -> 3 (gate's first live catch — enrollment pays counted resolves) Run 29058798771: enrolling the ladder witness file moved resolves_total 1 -> 3 (each enrolled entry file pays one closure resolve against the shared index) and the receipt gate redded that exact run — the designed semantics, receipted in the note. Bump acknowledges the two witness-entry resolves as declared debt; M2 (one closure resolve per roots set) ratchets back toward 1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Retire the M1/M2 labels from carriers (no-codename rule; collided with DESIGN's floor-memoization M1/M2) Step renamed to 'Floor resolve receipt gate (declared cold-resolve count)'; notes and the gate echo now say what the things are: the counted cold-resolve receipt, and the shared-resolve rewire (one closure resolve per source-roots set). Naming-retirement note left on the carrier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * Run-step natures pinned as counted claims, not affordances Operator ruling 2026-07-10: hardcoded shell scripts get no affordances — run-steps are supposed to be modeled as typed intents and emitted (shell-emission-model slice 4 covers ci_workflow RunSteps). Until that slice lands, every nature in job_run_demands is a claim (rostered FreshEffect / weakest-default IdempotentEffect), never derived from a modeled effect row. Count the whole claimed-nature surface (16 by execution) and pin it in the enrolled witness: a new raw-script step must consciously bump the pin, and slice-4 migration becomes a countable ratchet ending at zero, where the pin becomes a wall. Rejected alternative recorded in the carrier note: a per-step declared-natures roster (a second parallel ledger over scripts the shell-emission plan already governs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen DESIGN.md after main merge (duplicate-work row + #6373 body-lowering row coexist) Conflict was both sides editing the open-threads list in design_document.dag: ours added the duplicate-work thread, main's #6373 rewrote body-lowering to Stages 1-3 LANDED. Resolution keeps both rows in the .dag authority; DESIGN.md regenerated from it, never hand-edited. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * Inferred materialization increment 1: floor demand ledger + receipt-or-red gate Running IS enrolling: the interpreter ledgers every keyed pure call and every InterpContext absorbs its totals into a process accumulator on Drop — by construction, no eval path escapes the receipt. claim_executor writes target/floor-materialization-receipt.txt at walk end; trace defaults ON in the executor, and an explicit =0 zeroes keyed_calls which the gate refuses. Gate arms this push (all verified under dash from the emitted ci.yml): receipt missing/malformed/keyed_calls=0 fail closed. Exact pins for unkeyed_calls and duplicated_keys land from the FIRST CI receipt (the resolve gate's measure-then-pin path) — unkeyed is known nonzero on the floor (count_matching takes a predicate closure; closures are the one disclosed identity-less class, dissolve-on captured-env content identity). Unit witness green: resolve -> eval -> ctx Drop -> absorb -> drain-once. Step addition bumped the claimed-natures pin 16 -> 17 consciously. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review fix: drop the racy drain-once assertion from the receipt unit test opus-4-7 finding on #6441: under plain cargo test (still the documented runner) tests share a process, the env latch is OnceLock-sticky, and sibling ctx drops could absorb between the two takes — making the drain-empty assertion racy. Absorb-on-Drop stays asserted (monotone under concurrent absorbs: siblings only ADD); drain-once is Option::take by construction, not asserted through the shared global. Comment states the sharing semantics explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization * WIP: Duplicate Computation/Materialization --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>

Brian Searls and others added 3 commits July 5, 2026 01:13

Design: increment-2 per-site ownership verdict (Perceus last-use) + c…

4f13b94

…ounted take-owned fallback Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gunbai-bot Bot force-pushed the session/snappy-newt-504 branch from cf9953d to 1ad3572 Compare July 5, 2026 01:24

Brian Searls and others added 2 commits July 5, 2026 01:29

Design doc: consolidated validation-time checklist (parent-endorsed s…

d20f288

…equencing) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Brian Searls added 3 commits July 5, 2026 02:26

Merge origin/main (resolver keystone #6250)

3887918

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

6c90480

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

b637a11

gunbai-bot Bot mentioned this pull request Jul 5, 2026

Register builtin get in the resolver registry (unbreaks regen self-compile) #6255

Merged

Brian Searls and others added 17 commits July 5, 2026 03:11

Merge origin/main (get-fix #6255, P1 emit #6242)

54f1f16

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

d541383

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

a224dfd

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

4fe54c0

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

8623a27

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

7bde873

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

721ad9a

Drop gen-1/gen-2 adjudication scaffolding from the branch (local prob…

d873f7a

…e state auto-WIP'd in; results snapshotted to scratchpad)

Merge remote-tracking branch 'origin/main' into session/snappy-newt-504

4ec57c5

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

f031166

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

c12fa61

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

92893c1

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

e02a242

Restore sibling-lane files swept by the stale scaffolding-restore mer…

e97eea1

…ge (to origin/main versions) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

WIP: Emitter ownership de-fork: kill silent clone-fallback O(n2)

a306d35

briansrls pushed a commit that referenced this pull request Jul 5, 2026

WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail …

6fe45ea

…+ A-site

briansrls pushed a commit that referenced this pull request Jul 5, 2026

WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail …

6a2f31c

…+ A-site

briansrls pushed a commit that referenced this pull request Jul 5, 2026

WIP: Linearity carrier: move/last-use node fact + #6249 receipt tail …

fbbd973

…+ A-site

gunbai-bot Bot mentioned this pull request Jul 5, 2026

Linearity carrier: move/last-use node fact + #6249 receipt tail + A-site quadratics #6275

Merged

gunbai-bot Bot mentioned this pull request Jul 5, 2026

P8: thread packrat memo + memo scale witness (refutes P8 as dominant parse cost) #6280

Merged

5 tasks done

gunbai-bot Bot mentioned this pull request Jul 9, 2026

Duplicate Computation #6375

Merged

Navigation Menu

Repository navigation

Emitter ownership de-fork: kill silent clone-fallback O(n2) - #6249

Emitter ownership de-fork: kill silent clone-fallback O(n2)#6249
briansrls merged 30 commits into
mainfrom
session/snappy-newt-504

briansrls commented Jul 5, 2026 •

edited by gunbai-bot Bot

Loading

Uh oh!

gunbai-bot Bot commented Jul 5, 2026

Uh oh!

gunbai-bot Bot commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

briansrls commented Jul 5, 2026 • edited by gunbai-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gunbai-bot Bot commented Jul 5, 2026

Uh oh!

gunbai-bot Bot commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

briansrls commented Jul 5, 2026 •

edited by gunbai-bot Bot

Loading