Skip to content

docs: namespace-only resolution — containment tree as single naming authority (operator-signed) - #6329

Merged
briansrls merged 2 commits into
mainfrom
session/loyal-dove-903-namespace-doc
Jul 6, 2026
Merged

briansrls merged 2 commits into
mainfrom
session/loyal-dove-903-namespace-doc

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Records the operator-signed (2026-07-06) committed direction for name resolution. Docs-only (DESIGN.md open-threads entry + the design doc); no code.

What this commits to

Name resolution collapses to one structure — syntactic containment. Nesting induces everything at once: qualified name = nesting position (T{a}→ a is T.a; T{a{a}}→ inner is T.a.a → Rule-2 by construction), reference = lexical lookup up the ancestor chain (sibling module visible, members projected node.Symbol), . = projection down (field/module-member/variant, one op), and . is the std.induction sub-value relation. One content-addressed tree grounds three consumers — resolution walks it, content-addressing hashes it, termination reads its sub-value edges (§2 Realization).

  • Supersedes resolver-graph-major §1c's import-name-universe (carries its mechanics forward: binding-edge owner, unbound/collision = error, patterns-via-scrutinee, no expected-type picker).
  • Rides on SymbolIndex = the containment tree materialized (type-env-single-authority, lively-raven lane); import-scoped and namespace-only-Y are two walk-rules over one fill-agnostic index. Gated on loyal-heron's scaling receipt before any resolver surgery.
  • Terminal step: delete the import grammar → import becomes a parse error, deps derived from container.member references (Rule-1 end-state).

Notes for review

🤖 Generated with Claude Code

briansrls and others added 2 commits July 6, 2026 19:51
…ng authority (operator-signed)

Records the operator-signed (2026-07-06) committed direction: name resolution
collapses to ONE structure, syntactic containment. Supersedes resolver-graph-major
§1c's import-name-universe (carries its mechanics forward); terminal step deletes
the import grammar (imports become parse errors, deps derived from references).

- DESIGN.md open-threads: committed-direction entry + inbound link (clears the
  orphan-doc floor lens).
- docs/plans/namespace-resolution-design.md: the full design (containment tree;
  nesting = name = scope = . = sub-value; one tree, three consumers — resolution
  walks / content-addressing hashes / termination reads sub-value edges; census;
  rides on SymbolIndex/type-env-single-authority, gated on the scaling receipt).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- §9: drop the resolved 'uniqueness test (X vs Y)' item (§4 records DECIDED: (Y))
  and the 'precise census' to-verify item (§5.1 already reports it) — same-doc
  contradictions an implementer could re-litigate.
- §8 step 2: the precise census is already run (§5.1); steps 3-4 act on its
  outputs, no re-run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Both findings valid — fixed in 4f5f263f94 (docs-only staleness from incremental edits):

  1. §9 dropped the 'uniqueness test (X vs Y)' item — §4 records DECIDED: (Y), so it's no longer open (removed the contradiction an implementer could re-litigate).
  2. §9 dropped the 'precise census' to-verify item and §8 step 2 no longer says 'run the census' — §5.1 already reports it (declared module paths, collision counts, fork worklist); steps 3–4 now act on §5.1's outputs, no re-run.

Thanks for the catch — both were exactly the kind of same-doc single-authority drift the design itself argues against. — sent from loyal-dove-903

@briansrls
briansrls merged commit 81a07b1 into main Jul 6, 2026
2 of 3 checks passed
@briansrls
briansrls deleted the session/loyal-dove-903-namespace-doc branch July 6, 2026 20:08
briansrls pushed a commit that referenced this pull request Jul 6, 2026
…t.dag; corpus import hygiene; artifact regens

The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup,
found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical
import-list additions), the network_identity param typed to the alias it
actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its
generating authority because #6329 hand-edited the artifact without
back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to
the committed operator-signed version). falsifier.yml/.gitignore regens are
main_wet output. The complexity_r1 citation-string repoints are reverted out
of this PR: touching those files enrolls a fixture whose lens hits a
pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T');
moved to follow-up with that deficit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Jul 6, 2026
…te-now forks (#6334)

Follow-up to #6329. Verified by reading the decls (2026-07-06): the 2 same-name
pairs the census flagged are NOT genuine cross-tree §3 forks, so the doc + DESIGN.md
should not send an implementer to merge them:
- Reconciliation is a HOMONYM — std.realization_reconcile.Reconciliation<A,E>
  (Converged|NotConverged, effect-grounding) vs product.budget_tree.Reconciliation
  (AllSatisfied|Evicted|GuaranteedShortfall, budget-admission). Different concepts;
  the 'identical variant-set' was a census extraction artifact. Consolidating = wrong.
- ImportTrigger is one of 8 types in a whole-file v1-seed mirror (src/v1/languages.dag
  vs dag/std/languages.dag) — DESIGN §7 seed-shrink, not standalone.

Corrects §5.1 + the DESIGN.md open-thread entry.

Co-authored-by: Brian Searls <briansrls@gunb.ai>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Jul 7, 2026
…: one-level visibility by construction (floor resolve 286.7s -> 2.4s) (#6331)

* WIP: gunb compilation test

* Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow)

Operator ruling 2026-07-05: the silent clone arm in the rc_* update family
is a degradation that must stop the pipeline, not widen. Every shared-Rc
update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and
take_owned_counted's clone arm now routes through rc_shared_update_guard:

- GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the
  generated caller (#[track_caller]) — the work-queue key for licensing.
- =count: per-site ledger, first-hit line + ranked exit report (Drop on the
  thread_local), so degradation frequency is observable per §5.
- =allow: interim escape hatch.

tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at
infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) —
the profiled O(n^2) cold-compile root cause.

Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same
pattern as #6249.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5

Operator rulings 2026-07-05:
- GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and
  count (stopped-line audit: full ledger, still not a green run). No mode
  silences a refusal.
- DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge
  REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen,
  fabricated default, uncounted degradation, escape hatch) is a hard reject
  in review.
- 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites
  in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust)
  hand-synced to take_owned_counted — the guard's known bypasses closed;
  regen supersedes the hand-sync.
- take_owned_counted count arm ledgered into the same exit report as rc_*
  (one stopped-line audit surface).
- Interpreter: Bool True|False vs Value::Bool cross-representation `==`
  straddle now refuses (CrossRepresentationEquality), mirroring the numeric
  arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution
  receipt joins the cross_representation receipts behind the stopped line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* WIP: gunb compilation test

* WIP: gunb compilation test

* Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map)

Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05).
The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any
shared update — while the interpreter already realized Value::Map as
im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the
generated code imports (extdeps/languages/rust/types.dag import row +
runtime_rust.dag header + seed hand-sync; type spellings and call sites
unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each
insert copies an O(log n) node path — shared update becomes the designed
path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists
and sets keep it until they migrate too).

By-execution receipts (frozen-unit cold-compile benchmark):
- tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone)
- tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0
- remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert —
  the named follow-up (List/Set -> persistent carriers need emitter type
  template work, not just the import row)

im-rc serde feature enabled for the artifact-serialization derives; hand
seams (cli_run, interpreter, bins, test mods) repointed per direction —
host-internal std maps stay std. fmt + clippy -D warnings green across all
targets. Run-to-run artifact nondeterminism predates this change (open
v2.std.determinism thread), verified by pre-change A/B.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix import order in v2 manual ownership_movable mirror (imports precede items)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Merge origin/main into session/sharp-wolf-473

Resolves #6269 test-migration collision: accept main's deletion of
src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal
edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers
(hashes -> Rc<im_rc::Vector>, Node children/params via .into()).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment

Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7):
- v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet)
  and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing
  the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n)
  COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true.
- 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet
  alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the
  bidirectional regen hazard).
- v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets
  'remain O(n)-copy carriers and keep the guard'.

Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still
emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main
(maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane
(loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need
focus/push_back/VecCompat + the trait emission itself).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens

The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup,
found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical
import-list additions), the network_identity param typed to the alias it
actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its
generating authority because #6329 hand-edited the artifact without
back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to
the committed operator-signed version). falsifier.yml/.gitignore regens are
main_wet output. The complexity_r1 citation-string repoints are reverted out
of this PR: touching those files enrolls a fixture whose lens hits a
pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T');
moved to follow-up with that deficit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations

The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import
fix) demand-resolves this lens; fold_list<T,A> over n.children left T
un-instantiated on that path (no field 'label' on 'T') while batch reconcile
typed it fine — a batch/demand inference divergence. The children fold now
uses the builtin fold idiom fact_density.dag already uses (resolves on both
paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by
execution); the registry fold_list over a concrete FreeMonoid in the same
module types fine and stays.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Revert "WIP: emit -> realization"

This reverts commit 3ad16c9.

* WIP: emit -> realization

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Jul 7, 2026
* WIP: gunb compilation test

* Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow)

Operator ruling 2026-07-05: the silent clone arm in the rc_* update family
is a degradation that must stop the pipeline, not widen. Every shared-Rc
update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and
take_owned_counted's clone arm now routes through rc_shared_update_guard:

- GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the
  generated caller (#[track_caller]) — the work-queue key for licensing.
- =count: per-site ledger, first-hit line + ranked exit report (Drop on the
  thread_local), so degradation frequency is observable per §5.
- =allow: interim escape hatch.

tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at
infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) —
the profiled O(n^2) cold-compile root cause.

Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same
pattern as #6249.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5

Operator rulings 2026-07-05:
- GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and
  count (stopped-line audit: full ledger, still not a green run). No mode
  silences a refusal.
- DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge
  REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen,
  fabricated default, uncounted degradation, escape hatch) is a hard reject
  in review.
- 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites
  in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust)
  hand-synced to take_owned_counted — the guard's known bypasses closed;
  regen supersedes the hand-sync.
- take_owned_counted count arm ledgered into the same exit report as rc_*
  (one stopped-line audit surface).
- Interpreter: Bool True|False vs Value::Bool cross-representation `==`
  straddle now refuses (CrossRepresentationEquality), mirroring the numeric
  arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution
  receipt joins the cross_representation receipts behind the stopped line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* WIP: gunb compilation test

* WIP: gunb compilation test

* Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map)

Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05).
The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any
shared update — while the interpreter already realized Value::Map as
im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the
generated code imports (extdeps/languages/rust/types.dag import row +
runtime_rust.dag header + seed hand-sync; type spellings and call sites
unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each
insert copies an O(log n) node path — shared update becomes the designed
path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists
and sets keep it until they migrate too).

By-execution receipts (frozen-unit cold-compile benchmark):
- tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone)
- tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0
- remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert —
  the named follow-up (List/Set -> persistent carriers need emitter type
  template work, not just the import row)

im-rc serde feature enabled for the artifact-serialization derives; hand
seams (cli_run, interpreter, bins, test mods) repointed per direction —
host-internal std maps stay std. fmt + clippy -D warnings green across all
targets. Run-to-run artifact nondeterminism predates this change (open
v2.std.determinism thread), verified by pre-change A/B.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix import order in v2 manual ownership_movable mirror (imports precede items)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Merge origin/main into session/sharp-wolf-473

Resolves #6269 test-migration collision: accept main's deletion of
src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal
edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers
(hashes -> Rc<im_rc::Vector>, Node children/params via .into()).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment

Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7):
- v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet)
  and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing
  the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n)
  COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true.
- 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet
  alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the
  bidirectional regen hazard).
- v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets
  'remain O(n)-copy carriers and keep the guard'.

Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still
emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main
(maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane
(loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need
focus/push_back/VecCompat + the trait emission itself).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens

The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup,
found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical
import-list additions), the network_identity param typed to the alias it
actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its
generating authority because #6329 hand-edited the artifact without
back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to
the committed operator-signed version). falsifier.yml/.gitignore regens are
main_wet output. The complexity_r1 citation-string repoints are reverted out
of this PR: touching those files enrolls a fixture whose lens hits a
pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T');
moved to follow-up with that deficit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations

The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import
fix) demand-resolves this lens; fold_list<T,A> over n.children left T
un-instantiated on that path (no field 'label' on 'T') while batch reconcile
typed it fine — a batch/demand inference divergence. The children fold now
uses the builtin fold idiom fact_density.dag already uses (resolves on both
paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by
execution); the registry fold_list over a concrete FreeMonoid in the same
module types fine and stays.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Revert "WIP: emit -> realization"

This reverts commit 3ad16c9.

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* intern_str build-green: list-get resolves Optional via free_monoid_collection get template

Root cause of the list-get-by-index inference deficit: free_monoid_collection_templates
(the List method table in dag/std/algebra.dag) declared first/last returning
OptionalOf<ReceiverElement> but had NO get row — so `list |> get(index)` never resolved
structurally and its result type defaulted to the receiver (FreeMonoid), leaving the match
Bind arm un-Some-wrapped. Map-get works because PartialFunction declares get: fn(K) -> V?.

- dag/std/algebra.dag: add get: [ReceiverSelf, Int] -> OptionalOf<ReceiverElement> row,
  mirroring the existing first/last rows (completes the model, mints nothing). [already committed]
- src/v1/stage0/src/std_algebra.rs: splice the get template into the seed so the running
  binary's inference resolves list-get as Optional.
- src/v1/00_core.dag: intern_str now matches explicit Present/Absent (was catch-all
  `other => other` which binds the whole Option); emits Some(s)/None, builds green.

Fresh-crate cargo check: 26 -> 2 errors; the 2 remaining are the single std_integer Nat
where-refinement alias-resolution root (Nat<Magnitude>). intern_str builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Jul 7, 2026
… gate) + sorted_map_keys builtin (#6357)

* WIP: gunb compilation test

* Clone-fallback guard: shared-Rc updates refuse by default (fail|count|allow)

Operator ruling 2026-07-05: the silent clone arm in the rc_* update family
is a degradation that must stop the pipeline, not widen. Every shared-Rc
update (rc_map_insert/merge, rc_list_push/concat, rc_set_insert/union) and
take_owned_counted's clone arm now routes through rc_shared_update_guard:

- GUNBC_CLONE_FALLBACK=fail (default): typed, located panic naming the
  generated caller (#[track_caller]) — the work-queue key for licensing.
- =count: per-site ledger, first-hit line + ranked exit report (Drop on the
  thread_local), so degradation frequency is observable per §5.
- =allow: interim escape hatch.

tier-1 compile enumerates 205 degraded sites; top: rc_map_merge at
infer_env.rs:413 (14,360 clones), dag_collect.rs:234/239 (5,049 each) —
the profiled O(n^2) cold-compile root cause.

Template (runtime_rust.dag) and seed (v1_rt.rs) edited in sync, same
pattern as #6249.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* Fail-closed hardening: ban escape hatches, close guard bypasses, encode the factory model in DESIGN.md §5

Operator rulings 2026-07-05:
- GUNBC_CLONE_FALLBACK=allow removed. Modes are fail (default, refuses) and
  count (stopped-line audit: full ledger, still not a green run). No mode
  silences a refusal.
- DESIGN.md §5: no-escape-hatches corollary + the factory model as a merge
  REQUIREMENT — a diff landing a non-fail-closed failure arm (silent widen,
  fabricated default, uncounted degradation, escape hatch) is a hard reject
  in review.
- 6 inline pre-#6249 `Rc::try_unwrap(..).unwrap_or_else(clone)` fold sites
  in the generated seed (compile/infer_cycle/resolve x2/ownership/emit_rust)
  hand-synced to take_owned_counted — the guard's known bypasses closed;
  regen supersedes the hand-sync.
- take_owned_counted count arm ledgered into the same exit report as rc_*
  (one stopped-line audit surface).
- Interpreter: Bool True|False vs Value::Bool cross-representation `==`
  straddle now refuses (CrossRepresentationEquality), mirroring the numeric
  arm; DESIGN §5 named it the remaining decidable straddle. Its by-execution
  receipt joins the cross_representation receipts behind the stopped line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: gunb compilation test

* WIP: gunb compilation test

* WIP: gunb compilation test

* Persistent maps: Map realization = im_rc HAMT (one authority with interpreter Value::Map)

Root fix for the clone-fallback class on maps (operator go-ahead 2026-07-05).
The compiled runtime realized Map as Rc<std HashMap> — O(n) copy on any
shared update — while the interpreter already realized Value::Map as
im_rc::HashMap (a §3 model↔realization fork). One swap of which HashMap the
generated code imports (extdeps/languages/rust/types.dag import row +
runtime_rust.dag header + seed hand-sync; type spellings and call sites
unchanged): Rc::make_mut's clone arm is now O(1) structural sharing and each
insert copies an O(log n) node path — shared update becomes the designed
path, so rc_map_insert/rc_map_merge leave the clone-fallback guard (lists
and sets keep it until they migrate too).

By-execution receipts (frozen-unit cold-compile benchmark):
- tier-1: 2.26s -> 0.66s; ledger 205 degraded sites -> 18 (all map sites gone)
- tier-10: 239s -> 41.7s (5.7x); 1.74M map clone-fallbacks -> 0
- remaining ledger is exactly rc_list_push/rc_list_concat/rc_set_insert —
  the named follow-up (List/Set -> persistent carriers need emitter type
  template work, not just the import row)

im-rc serde feature enabled for the artifact-serialization derives; hand
seams (cli_run, interpreter, bins, test mods) repointed per direction —
host-internal std maps stay std. fmt + clippy -D warnings green across all
targets. Run-to-run artifact nondeterminism predates this change (open
v2.std.determinism thread), verified by pre-change A/B.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Persistent carriers: lists+sets -> im_rc Vector/OrdSet; delete clone-fallback guard + per-site move licenses

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix import order in v2 manual ownership_movable mirror (imports precede items)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Fix sweep-corrupted emit golden; inhabitant import_path rows prelude-provided (generation-agnostic)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Merge origin/main into session/sharp-wolf-473

Resolves #6269 test-migration collision: accept main's deletion of
src/v1/ownership_movable_test.dag (v2 manual mirror carries the license-removal
edit); reconcile dag_collect_fingerprint_witness.rs bin with im_rc carriers
(hashes -> Rc<im_rc::Vector>, Node children/params via .into()).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Review fixes: interpreter Value::Set -> im_rc::OrdSet; emit_non_empty_wrappers BTreeSet alias; stale guard comment

Addresses PR #6307 review findings (cursor/composer-2.5 + claude-opus-4-7):
- v1_interpreter.rs: Value::Set was std BTreeSet (forked from runtime im_rc::OrdSet)
  and deep-cloned on every set_insert/set_union. Migrated to im_rc::OrdSet, closing
  the live model<->realization fork and the O(n) clone (now O(1) structural + O(log n)
  COW). Makes runtime_rust.dag's 'one realization with Value::Map/List/Set' true.
- 05_emit_rust.dag emit_non_empty_wrappers: std::collections::BTreeSet -> bare BTreeSet
  alias (matches the seed + prelude OrdSet alias; forward-compatible; kills the
  bidirectional regen hazard).
- v1_rt.rs: fixed the stale rc_map_insert sibling comment that still claimed lists/sets
  'remain O(n)-copy carriers and keep the guard'.

Seed-emitter import drift (emit_prelude/emit_main_mod_uses/rt_header/extdeps JSON still
emit std) is the coherent-whole emitter-fix-needs-2-gens cutover: pre-existing on main
(maps PR), tracked against RegenVerifyGate #5873, coordinated with regen lane
(loyal-dove-903). Not fixable as isolated import swaps (emitted runtime bodies need
focus/push_back/VecCompat + the trait emission itself).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* Revert speculative import addition in network_identity_subsumption (refusal is a pre-existing alias-expansion deficit, A/B-verified on the pre-diff binary)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* Back-port #6329's operator-signed DESIGN.md edits into design_document.dag; corpus import hygiene; artifact regens

The compile-clean and artifact-drift gates, unmasked by #6331's floor speedup,
found accumulated debt: 43 unlisted-import diagnostics (12 files, mechanical
import-list additions), the network_identity param typed to the alias it
actually receives (DhcpClientHostNameOption12), and DESIGN.md drifted from its
generating authority because #6329 hand-edited the artifact without
back-porting (receipt: main_wet now regenerates DESIGN.md byte-identical to
the committed operator-signed version). falsifier.yml/.gitignore regens are
main_wet output. The complexity_r1 citation-string repoints are reverted out
of this PR: touching those files enrolls a fixture whose lens hits a
pre-existing fold_list lambda-param typing deficit (no field 'label' on 'T');
moved to follow-up with that deficit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* complexity_r1 lens: type the children fold on the demand path (builtin fold idiom); keep truthful post-deletion citations

The diff-scoped discovery frontier (enrolled via the v2.std.diagnostic import
fix) demand-resolves this lens; fold_list<T,A> over n.children left T
un-instantiated on that path (no field 'label' on 'T') while batch reconcile
typed it fine — a batch/demand inference divergence. The children fold now
uses the builtin fold idiom fact_density.dag already uses (resolves on both
paths, receipt: complexity_r1_green_merge_envs_base_holds witness green by
execution); the registry fold_list over a concrete FreeMonoid in the same
module types fine and stays.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* WIP: emit -> realization

* Revert "WIP: emit -> realization"

This reverts commit 3ad16c9.

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* intern_str build-green: list-get resolves Optional via free_monoid_collection get template

Root cause of the list-get-by-index inference deficit: free_monoid_collection_templates
(the List method table in dag/std/algebra.dag) declared first/last returning
OptionalOf<ReceiverElement> but had NO get row — so `list |> get(index)` never resolved
structurally and its result type defaulted to the receiver (FreeMonoid), leaving the match
Bind arm un-Some-wrapped. Map-get works because PartialFunction declares get: fn(K) -> V?.

- dag/std/algebra.dag: add get: [ReceiverSelf, Int] -> OptionalOf<ReceiverElement> row,
  mirroring the existing first/last rows (completes the model, mints nothing). [already committed]
- src/v1/stage0/src/std_algebra.rs: splice the get template into the seed so the running
  binary's inference resolves list-get as Optional.
- src/v1/00_core.dag: intern_str now matches explicit Present/Absent (was catch-all
  `other => other` which binds the whole Option); emits Some(s)/None, builds green.

Fresh-crate cargo check: 26 -> 2 errors; the 2 remaining are the single std_integer Nat
where-refinement alias-resolution root (Nat<Magnitude>). intern_str builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: emit -> realization

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* seed-prime: sorted_map_keys builtin (registry + bridge + runtime generator)

Functional gen-0' prime of the new sorted_map_keys builtin across the 3
remaining seed twins (v1_rt.rs fn + infer arms already present):
- v1_compiler_infer_method.rs: builtin_function_registry row (type = list of collection_element, mirrors map_keys)
- extdeps_languages_rust_emit.rs: rt bridge row (passes_by_ref+wraps_result, mirrors map_keys)
- v1_compiler_runtime_rust.rs: runtime-generator emits the fn body after map_keys

Enables the 2-gen bootstrap: regen_stage0 built from this seed can resolve/
emit sorted_map_keys, so a fresh regen produces the canonical seed. Ordering
within gen-0' is irrelevant; canonical order comes from runtime_rust.dag:177.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* WIP: realization (SymbolIndex)

* fix: .dag emits im-rc dep + qualified std::collections::BTreeSet for stage0_core/emit_core boundary files (workspace build)

* test: build_movable_set 2-arg (empty param_names) — align stale test with .dag authority

The .dag defines build_movable_set(proof, param_names) as 2-arg; main's seed
carried a stale 1-arg divergence and pipeline.rs was written against it.
accept-fresh correctly converged the seed to the 2-arg .dag form, so the
hand-maintained test crate call needed updating. param_names only extends
movability to sole-owned params; empty set = the param-blind count the
movable_but_cloned<=45 ratchet was calibrated against.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Brian Searls <briansrls@gunb.ai>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant