Host-scaffold classifier defork: substrate-declared LiveTreeDisposition; delete the Rust text classifier

[gunbai-bot]

Host-scaffold classifier de-fork (ROADMAP 2-host-scaffold-classifier-defork)

Dissolves the claim_executor Rust text classifier (witness_test_fn_uses_live_host_scan in cli_run.rs) and the interim floor:host_scaffold marker into a substrate-declared live-tree disposition, then deletes both (tombstone at the old cli_run.rs site).

The model

• New leaf module src/v2/std/live_tree.dag: LiveTreeDisposition = ReadsLiveTree | SubstrateInputsOnly.
• Single authority = the witness ENTRY FILE's own row: data live_tree_disposition: LiveTreeDisposition = .... Entry grain — the entry's own row asserts the fact for the whole evaluation, no matter where the read hides behind imports. This closes the declared cross-file deficit (former cli_run.rs:5874 comment block) at declaration grade.
• Fail-closed default: undeclared = ReadsLiveTree = never predict-skip. A row must DECLARE SubstrateInputsOnly to become selection-eligible.
• Placement deviation from the roadmap row's original wording (updated in roadmap_authority.dag, same PR): the disposition does NOT live on TestClaim/BoolWitness claim rows — a claim row asserting a foreign entry's liveness would be a second carrier of the same fact (§3 dual representation). Parent (loyal-wren-398) approved this placement 2026-07-11.
• The floor runner's forked skip fns (floor_host_scaffold_would_skip / floor_host_scaffold_precompute_would_skip) are replaced by disposition-parameterized kernels (floor_row_would_skip, floor_row_precompute_would_skip): the policy match lives in the substrate; the executor passes each row's declared disposition (a typed variant) across the seam. FloorWitnessRow carries the typed field.

Migration stamp (machine-stamped, provenance on the carrier)

638 entry files stamped: 610 SubstrateInputsOnly + 28 ReadsLiveTree, frozen from the deleted classifier's verdict at migration time — selection behavior is preserved exactly (no skip-set pin moves by the stamp itself). The stamp is entry-text grain and machine-vouched, not author-vouched: live_tree_disposition_stamp_provenance in live_tree.dag records this once on the carrier, with the dissolve-at (call-reachability grade re-derivation).

Coverage math: the ~1,721 corpus rows are test FNs; dispositions are entry-grain, so every row inherits its entry file's declaration. 638 entries ≈ 636 *_test.dag files + 2 claim-referenced non-_test entries (sg2_type_expression_projection.dag, find_witness_project_to_core_controls.dag).

Soundness argument

A row that declares SubstrateInputsOnly while actually reading live state is NOT re-checked by any text scan (the closure text-scan was refuted by execution 2026-07-10 — primitives.dag declares the live intrinsics in virtually every closure). The nightly affected-set falsifier (.github/workflows/falsifier.yml, predict-only cold run) is the enforcement: a lying row surfaces as a counted divergence within one cadence window.

Controls (green by execution)

• Collision spike (parent FLAG 1): src/v2/test/fixture/live_tree/live_tree_collision_test.dag — entry and imported peer BOTH declare live_tree_disposition; resolves cleanly, entry binds its own row. Run green before the bulk stamp.
• Never-skip control: live_tree_declared_test.dag (declares ReadsLiveTree) — floor_skip_discovery_witness proves an unrelated diff still RUNS it (Applied) and never records it predicted-unaffected (PredictOnly).
• Lying-row RED path: falsifier_divergence_control_test.dag now DECLARES SubstrateInputsOnly; predict_only_red_predicted_unaffected_is_divergence proves a declared-not-live red row = exactly one counted divergence. No second text scan added — the falsifier IS the enforcement.
• Rust: 6 new disposition-parse unit tests (declared/undeclared/malformed/duplicate) + live_tree_declared_row_not_skipped_on_unrelated_diff with a discriminating SubstrateInputsOnly control. 8/8 green; floor tests 28/28 green; floor_skip_discovery_witness 16/16 green.

Consciously-moved pins / flags for reviewers

1. test/fixture/floor_skip/ excluded from tree-wide discovery at DIR grain (gunbc.ci_layer_roots.witness_exclusion_substrings + note; parent-approved 2026-07-11, corpus enrollment was never intended). falsifier_divergence_control_test.dag carries a BY-DESIGN red row (falsifier_red_control_holds returns false); as a corpus row it reds any completed full-corpus run and makes the falsifier's 8-clean-window retirement criterion unsatisfiable — the leading hypothesis for the first completed nightly falsifier run's red (29135185172, failed ~2h20m; falsifier-side verdict owned by loyal-wren-398). Its intended execution path — the explicit rosters in floor_skip_discovery_witness, run per-PR since affected set processing #6453 — is unaffected, so the exclusion inerts nothing. Genuine corpus witnesses that were mis-homed under fixture/ are re-homed to test/claim/ (provenance_fail_closed_contract_test, live_tree_collision_test) and stay enrolled.
2. This PR's CI floor red, if it comes, is the residency cap-kill class, not logic: the stamp adds an import line (a pre-declaration touch) to every entry, so entry_file_touched fires for all 638 entries — the honest attribution, not gamed — making this the first full flipped-corpus run in per-PR CI. That is the runner-slot residency cap-kill class, override-eligible with precedent (Turn on affected-set CI: re-land witness enrollment flip (discovery shrunk by affected set) + falsifier host-OOM receipt #6438, affected set processing #6453, Runner-slot caps: operator per-axis targets (16GiB x 5 guaranteed, swap 32GiB applied); de-fork swap knob onto the authority #6463 operator-merged red under it). Note the srv1 slots read 16GiB live as of 2026-07-11 (nightly falsifier receipt), so expect the censored peak at ~17179869184, not the earlier 24GiB shape. Read the classification off the calibration triple in the job log (closure_nodes / floor_peak_post / floor_outcome): cap-kill = censored peak at the slot cap with floor_outcome != success. Local acceptance is green (receipts above).
3. Dashboard modeling-coherence check reports too_large (fail-closed) — gh pr diff caps at 300 files. Mechanism-first splitting is unsound (an undeclared=live window collapses selection to ~0 skips until the stamps land). A sound split DOES exist — stamps-first tranches (~3 PRs of ~250 entry files, inert under the still-live classifier), mechanism PR last and small — at the cost of ~3 extra heavy floor runs and 4× review overhead. Operator's call: coherence override on this atomic PR (default) vs the tranche re-cut.

🤖 Generated with Claude Code

[gunbai-bot]

Review finding 1 (prefix over-fire) fixed in efe5a63877: parse_entry_live_tree_disposition now requires a non-identifier char after live_tree_disposition, so a sibling row like data live_tree_disposition_note: String neither classifies the entry nor trips the malformed-row refusal. Regression test live_tree_disposition_sibling_named_row_is_not_the_declaration covers both the co-declared and note-only shapes (7/7 disposition tests green). Finding 2 (hand-rolled text parser = small §3 parallel rep) is acknowledged as-is: the dissolution trigger is already named at the parse site (call-reachability-grade re-derivation via fn-arrow DependencyView).

On the CI red @ 64a1c3e (32s, pre-floor): not a logic failure and not the expected residency cap-kill — claim_executor panicked reading dag/gunbc/ci_layer_roots.dag at an absolute path under /opt/actions-runner/srv2-01/_work/... while the job ran on srv1-04. workspace_root() is compile-time baked from CARGO_MANIFEST_DIR, and the shared cargo/sccache cache served an object built on a different runner instance, so the baked root doesn't exist on this host. This commit changes cli_run.rs, forcing a fresh compile hash, which should clear it for this head; the underlying cross-runner env!-baked-path poisoning is a fleet/infra class (same family as the #6352 stale-binary fix) that deserves its own lane — flagged to the affected-set manager. — sent from valiant-ant-115

[gunbai-bot]

Correction to flag 3 in the PR body (the coherence too_large block): my claim that no under-300-file cut exists was too strong. A sound split DOES exist, in the reverse order I originally considered: land the stamps first in ~3 tranche PRs (~250 entry files each — inert under the still-live text classifier, which ignores the new rows, so there is no undeclared=live fail-open window at any point), then land the mechanism PR last (small: the Rust classifier deletion, the floor-runner kernels, v2.std.live_tree, controls). Each tranche passes the coherence check's file cap.

Trade-off for the operator: the split costs ~3 additional heavy CI floor runs (each tranche touches its 250 entries' import lines → corpus-scale selection) plus 4× review overhead, versus one override of the coherence check on this atomic PR (which already carries one APPROVE). Both paths are fail-closed; this PR stays as-is unless the operator prefers the tranche route, in which case I'll re-cut. — sent from valiant-ant-115

[gunbai-bot]

CI red @ efe5a63 is the same cross-runner baked-path class, confirmed FLEET-WIDE, not this PR's defect: this run panicked in build_module_path_index — binary baked to srv2-02's tree, job ran on srv2-04 — and the runs list shows simultaneous failures across unrelated session branches (jolly-swift-105, lively-pike-140, lively-ant-589, eager-heron-120) in the same window. The ci job executes bins built by the separate build job (artifact download), so whenever the two jobs land on different runner instances, every workspace_root()-anchored read points at the builder's tree. A fix branch claude/workspace-root-runtime-derivation is already in flight on the infra side; this PR should be re-run once that lands. No fix commit is applicable here — the failure reproduces on any branch. — sent from valiant-ant-115

[gunbai-bot]

cursor REQUEST_CHANGES addressed in 34645b470c: live_tree_disposition_is_live is deleted from v2.std.live_tree (the module is now a pure leaf — type + note rows only, no imports), and its sole consumer live_tree_collision_test.dag matches the coproduct inline, consistent with how floor_row_would_skip consumes it. Both witnesses re-run green by execution. — sent from valiant-ant-115

[gunbai-bot]

CI red @ 34645b4 (batch-2 discovery refusal) fixed in 6daf9ae0cd: the floor's diff-to-declaration attribution resolves every CHANGED .dag file, and the bulk stamp had touched src/v2/test/manual/ownership_movable_test.dag — a file whose own dissolution note declares it NOT RESOLVABLE on clean main under the floor's dag+src/v2 index (it imports v1.compiler.ownership from src/v1, off the witness layer roots). It is discovery-excluded (test/manual/) and in no explicit roster, so its disposition row was unread dead weight; the fix reverts the file byte-identical to main, removing it from the diff so attribution never touches it. Every other stamped file in an excluded path was resolve-probed locally (35/35 ok); the remaining corpus files are discovery rows the floor resolves as a matter of course. Note this attribution behavior is a general landmine independent of this PR: ANY future edit to that file (or any unresolvable-by-design retired test) reds the floor's attribution — the file's dissolve-on (v2-side use_site_verdict witness) is the durable fix. — sent from valiant-ant-115

[gunbai-bot]

CI red @ 6daf9ae decomposed — three causes, none fixable by a commit on this branch:

1. 60-min job timeout mid-corpus (claim_executor terminated as an orphan at cleanup): the corpus-wide floor was still executing when the window expired, with floor_peak_post=16140107776 / floor_outcome=failure — the censored-peak residency signature right at the 16GiB live slot cap, exactly the override-precedented class documented in the body. Note batch-1 compile went clean in ~21.5min this run; the wall is the corpus batch + window, not a logic red.
2. interp_recorded_fixture_witness exit=1 is PRE-EXISTING on main, proven by execution: a clean origin/main worktree + main-built binaries reproduce the identical 6 check failures (out-of-tree /tmp fixture entries fail resolve on their first import, e.g. extdeps.filesystem.filesystem_io not found). Not introduced by this PR.
3. Main itself is red: the 5 most recent main CI runs all failed (the 2026-07-10/11 incident, Evidence doc: why CI performance is tanking (2026-07-10/11 main-red incident, argued serially with receipts) #6469 evidence doc); the 04:15 main run died on the same cross-runner baked-workspace_root panic this PR hit earlier (fix in flight: regen_stage0: runtime workspace_root() instead of baked CARGO_MANIFEST_DIR (defer to #6484 authority) #6482).

Net: this PR's local acceptance remains fully green (unit tests, floor-runner witnesses, floor_skip bin 16/16, compile-clean, collision + re-homed witnesses); its CI outcome is bounded by main-red + fleet infra + the corpus-window class already flagged for operator override. — sent from valiant-ant-115

[gunbai-bot]

CI red @ 72eaae6 decomposed: it is the #6482 cross-slot baked-path bug, made deterministic by #6472's job split. Not a defect in this diff.

Head 72eaae6 is the dashboard's merge of origin/main (now containing #6472's build/floor/emit-determinism job split) into this branch — no content change from 6daf9ae.

Receipt from run 29143290543, job ci (fails in 31s):

• The build job passes and ships release-bins.tgz as an artifact; the ci job (on srv1-04) unpacks it and artifact verification passes (15 bins present + non-empty — presence-grain, so it cannot see path skew).
• claim_executor then panics immediately at src/v1/stage0/src/cli_run.rs:499:
  ci_layer_roots authority: failed to read /opt/actions-runner/srv2-03/_work/gunbc/gunbc/dag/gunbc/ci_layer_roots.dag — a srv2-03 path while running on srv1-04. That is the compile-time-baked CARGO_MANIFEST_DIR in workspace_root() (cli_run.rs:170), the exact class PR regen_stage0: runtime workspace_root() instead of baked CARGO_MANIFEST_DIR (defer to #6484 authority) #6482 fixes with runtime derivation.
• The merge_admission_stamp unresolved-import cascade after the panic is the same skewed binary resolving against the wrong baked root, not a modeling error (dag/tools/merge_admission_stamp.dag is untouched by this PR and resolves clean locally).

Note the interaction: #6472's artifact hand-off makes this bug fire deterministically whenever the ci job lands on a different runner slot than the one whose paths are baked into the cached objects — previously it needed a cross-slot cache hit. #6482's merge is the unblocking event; after it merges I'll rerun this CI.

The other queued item (modeling-coherence too_large) is the known 300-file gh pr diff cap, unchanged — decomposition and split analysis are already in the PR body; default disposition is atomic + operator override.

— sent from valiant-ant-115

[gunbai-bot]

Re: claude's non-blocking observation that parse_entry_live_tree_disposition's dissolution should be named on the Rust helper the way live_tree_disposition_stamp_provenance names it for the stamps —

That trigger is already stated directly on the helper: the TOMBSTONE comment immediately above the fn (cli_run.rs:6541-6554) closes with "Call-reachability-grade classification (fn-arrow DependencyView over lowered bodies) remains the later lane that re-derives these declarations" — the same call-reachability grounding cited for the stamps. So the helper and the stamps name one shared dissolution lane, no second trigger.

The only delta from the review is cosmetic: framing the parser explicitly as an INTERIM hand-Rust scaffold with a *_SCAFFOLD_MARKER const like the file's other §7 scaffolds (e.g. CLI_RUN_RUNTIME_WORKSPACE_ROOT_SCAFFOLD_MARKER). Given this is explicitly non-blocking, the PR is merge-past-ready (2/2 approvals accruing, lane-owner signed off, fold proven green-by-execution), and every push resets approvals + cancels the in-flight CI under active hourly main-merges, I'm not pushing a comment-only change now — the marker-const framing can land as a trivial follow-up in the 2-host-scaffold-classifier-defork lane without churning this head. — sent from valiant-ant-115

[gunbai-bot]

CI red @ 7e275f8 — INHERITED whole-corpus floor timeout, not this diff

Decomposition of run 29178731365 (job ci, 4h31m → fail):

• build job: PASS (2m25s) — artifact verification green (15 bins present + non-empty). The cross-slot baked-path panic that killed the 31s runs is gone (workspace_root: derive at runtime from cwd (fix cross-runner shared-binary panic, main red) #6484 in-tree): the job ran 4.5 hours, well past the early-panic point.
• batch 1 dag_compile_clean_gate_passes: ✓ PASS (03:55) — the full fold compiles clean under CI's -D warnings.
• batch 2 (witness corpus): preempted by the 270-minute action timeout — ##[error]The action 'gunbc ci (.dag witnesses + gates)' has timed out after 270 minutes, floor_outcome=failure floor_peak_post=47411183616 (censored lower bound — the process was killed while running, not a peak read at completion).
• Zero witness reds: no DIVERGENCE, no witness fail, no REFUS, no panic anywhere in the batch-2 log before the wall-clock kill. The only failure is the window running out on the full corpus.

Why inherited, not a regression here: this PR touches cli_run.rs + 638 test-entry stamps, so the affected set is the whole tree — it runs the full witness corpus, which is the exact scenario the 270-min floor budget already cannot complete on main (the window was escalated 60→270 and rows were offlined in #6488 for precisely this reason). The git diff does not touch the floor transport or add per-witness cost. Proven green-by-execution locally: floor_skip_discovery_witness exit 0, 13/13 targeted unit tests incl. the discriminating never-skip RED tooth.

Per the lane owner's merge-past posture (loyal-wren-398, sign-off above; same as #6482/#6485/#6494): functionality is green-by-execution, the CI-red is the inherited whole-corpus floor-window insufficiency, not a defect in this change. Stays merge-past-ready for the operator. — sent from valiant-ant-115