PR-A: typed per-cause Refusals; empty diff dissolved into the general disposition; hunkless diffs attribute at path grain

[gunbai-bot]

Implements operator rulings 1–2 (2026-07-05, relayed via cool-hawk-899): a failure arm must refuse, never widen; empty diff is not a state.

Model (affected_set_floor_runner.dag — the disposition authority)

• WitnessRunDisposition gains Refused { cause: WitnessRefusalCause }; causes are per-variant (DiffObservationRefusal, FrontierQueryRefusal) so each failure class has its own observable frequency (ruling 2: per-row counted red, witness not run, siblings continue, floor exits nonzero).
• The three absorbing arms are gone: DiffObservationFailClosed → RunWitness, FrontierFailClosed → RunWitness, and the special arm RunWitness{"empty diff — run full corpus (fail-closed)"} — deleted, together with the tests that asserted its string. An empty touched-path set flows through the general disposition (nothing affected → SkipAssumedGreen); floor_precompute_would_skip loses its twin special arm the same way.
• floor_kernel_would_skip keeps its Bool contract for the host happy path; its Refused arm is unreachable by construction (the wrapper builds only *Produced) and carries an on-carrier note forbidding refusal-through-Bool routing.

Host (cli_run.rs — realization)

• The !line_ranges_by_file.is_empty() conjunct that silently disabled selection on an empty diff (= run everything) is removed: empty diff now runs selection with structurally-empty edits → precompute skip + per-row not-affected skips.
• Observation failure message reshaped to counted refusal vocabulary (cause=DiffObservationRefusal rows=N), exit 1 — the only ignorance state, per ruling 1.
• Hunkless diff entries now attribute at path grain via diff --git header parsing. This fixes a live soundness hole beyond the ruling's scenario: pure renames, binary changes, mode-only changes, and deletions emit no +++ b/ line, so their paths previously vanished from changed_paths even in mixed diffs — their witnesses would silently skip. Departed paths (renamed-from/deleted) contribute a structurally-empty decl set (a computed ∅, not ignorance) without erroring the derivation.
• Flag-off (skip_unaffected_node_frontier: false) remains its own config state — never conflated with empty.

FLAGGED OPEN — git-interface grain (operator inline discussion, per ruling 1)

1. Surface: keep header-parse of the unified diff vs switch observation to git diff --name-status -M grain (typed rename/copy/delete rows) — the honest model of git's own vocabulary.
2. Rename pairs: both sides currently attribute as touched paths; should a 100%-similarity rename attribute as a module-identity move once InterfaceSummary lands?
3. Base-ref resolution: merge-base policy lives in DiffPolicy; unchanged here, but a name-status surface would restate it.
4. Path quoting: git quotes exotic paths in headers; the parse assumes unquoted (safe in this repo today); name-status eliminates the caveat.

Adjacent observations (not changed here)

• The legacy NodeFrontierSeeds path (collect_frontier_seeds_from_diff_line_ranges) still carries run_all() absorbing arms — it is Steps 4–5's deletion target; converting arms scheduled for deletion is wasted motion.
• A non-.dag-only diff refuses discovery loudly (pre-existing) — will surface on the first Rust-only PR under restored verdicts; proper fix is per-realization attribution, future lane work.
• DESIGN §5 e.g. prose updated (model + carrier) from open-repair to repaired.

Receipts (by execution — landing before ready-flip)

Runner witness composites, provenance contract, both-axes disposition, wet-regen + drift gate for the DESIGN carrier, clippy -D warnings, targeted host tests.

🤖 Generated with Claude Code

[gunbai-bot]

Receipts — all by execution on this head (ctrl-build remote):

receipt	result
floor_runner_node_frontier_policy_holds (16-witness composite incl. new refusal witnesses)	exit 0
floor_runner_unaffected_assumed_green_skips_holds	exit 0
affected_set_disposition_both_axes_witness_holds	exit 0
provenance_fail_closed_contract_holds	exit 0 — first execution ever: the fixture's multiline data initializer was outside the v1 grammar, so this contract was previously asserted by nothing (revived in-PR with on-carrier note)
wet regen + generated-artifact drift gate (DESIGN.md carrier from updated model)	WET_EXIT=0, GATE_EXIT=0
cargo clippy --all-targets (v1-compiler)	exit 0
parse_unified_diff host tests (incl. new header-parse behavior)	ok

Pre-existing, differential-verified NOT this PR: cli_run's two disposition_kernel_alignment tests fail identically on the near-main tree (same asserts, line offsets match this PR's added lines exactly). They exercise the legacy NodeFrontierSeeds path — Steps 4–5's deletion target — and broke during the verdict blackout; tracked with the gate-green/bare-red family.

Incidental: the regenerated ci.yml normalizes a trailing blank line — main's committed artifact is currently one byte off generator output (drift gate red-by-a-byte on main); this PR's merge fixes it.

— sent from gentle-owl-459

[gunbai-bot]

Round-3 receipts (all by execution, ctrl-build remote, head 8b8f74f):

receipt	result
floor_skip_discovery_witness binary (all witnesses incl. the two rewritten to ruling semantics)	exit 0 — first green since the S1 shared-index merge
└ empty-diff witness: unaffected row takes SkipAssumedGreen (live SKIP [assumed-green node-frontier] in output)	ok
└ invalid-base witness: typed DiffObservationRefusal Err, no run, no silent selection-off	ok
Control 6 (absent + not-departed → refusal) + Control 6b (deletion-shaped → path-grain Ok)	ok
mixed_dag_and_non_dag control (was red at the prior head)	ok
full targeted host suite	13/13
clippy --all-targets, cargo fmt --check	clean

What the last commit fixed at the root: entry_source_from_index_or_disk compared path spellings, so a relative entry against an absolutely-rooted shared index minted a second declaring SourceFile for one module and tripped the collision wall ("duplicate module declaration" / self-cycle) — red on main since S1, blackout-masked, confirmed by near-main differential. Identity is now the canonical file; genuine two-file forks still collide loudly. One fix at the single decision point instead of per-call-site absolute-spelling patches (the interim one in floor_git_diff_range is reverted).

— sent from gentle-owl-459

[gunbai-bot]

Operator ruling on the FLAGGED git-interface items (2026-07-05): faithfully model git's interface — no hardcoded assumptions that are not true of the provider generally; switching providers must not break the solution.

Disposition of the four open items under that ruling:

1. Surface: the unified-diff header scrape in this PR is INTERIM with a named dissolution — the modeled observation is git's machine contract (diff --name-status -z: typed A/M/D/R/C rows, NUL-framed), cited in extdeps/git/ with git's real vocabulary; the floor consumes a provider-agnostic touched-change shape (the DiffObservation seam already in this PR), shell is one transport.
2. Rename: becomes a typed from→to+similarity row — the two-touched-paths collapse here embeds rename≡delete+add, a git-text coincidence, not a provider truth. Derived, not received pre-flattened.
3. Quoting: dissolves with -z (no parser caveat survives).
4. Base-ref: stays workflow-layer DiffPolicy policy — already correctly homed.

Follow-up PR (this lane, immediately after this merges) lands the extdeps model + host cutover and deletes the header scrape.

— sent from gentle-owl-459

[gunbai-bot]

Correction upgrading an earlier receipt: the two floor_disposition_kernel_alignment tests I classified as "pre-existing, differential-verified NOT this PR" are now fixed by this PR — the same_canonical_file identity commit was their root cause too. By-execution at head 8b8f74f: 2/2 ok; near-main control: 2/2 FAILED (same panics as before). One root — path-spelling vs file identity in entry_source_from_index_or_disk — three symptoms, all cured by the one boundary fix: the discovery witness binary (red since S1), the mixed_dag_and_non_dag control, and these kernel-alignment tests.

On the current CI reds: the ci job is the structural whole-tree floor budget (the shard lane's assignment, not a defect here); rust_tests timed out in a cold-sccache storm before nextest ever ran (376 per-unit cache failures during clippy — infra, verdict channel working as ruled). Rerun dispatched; warm-cache nextest should now pass the FULL suite, cleaner than main.

— sent from gentle-owl-459