complexity enforcement for affected set floor

[briansrls]

Summary

PR-2 of complexity-as-compilation: the AuditOnly stopped-line ledger over the gated v2 compile door (DESIGN §5 factory model). Builds on PR-1 (#6527, merged), which enrolled the accumulator-copy lens as a required root-grain compile lens so a complexity violation is a compile failure.

v2.workflow.compile_door_ledger drives real affected-set .dag paths through the gated door (compile_source_root_ingest_with_admission) and produces one typed, counted DoorLedgerRow per path — DoorCompiled | DoorRefused{reason} — aggregated into a cause histogram: the burn-down list toward "v2 compiles the repo". A shared module-graph census runs once per call; each row's import_closure is fed into the door ingest.

The per-lens flip-to-Blocking triggers are modeled as data in the carrier (known_frontier_causes; DESIGN §6, no parallel-ledger doc): each frontier cause → owning lane (ThisLaneCalibration | SharedSelfHostCriticalPath | MigrationOwned) → named flip trigger. Attribution is fail-closed — an unknown cause is UNATTRIBUTED, never silently bucketed.

Deliberately NOT a CI floor gate

The seed compile path has no lens stage, so there is no stopped line to gate. A per-PR affected-set gate now would either block every PR (the whole corpus refuses) or pass despite refusals — the DESIGN §5 absorbing fallback. Gate wiring is deferred behind a named trigger: v2 interpreted compile becomes the actual compile path (the migration). The ledger's CI presence today is the frontier-pinning witnesses; when a cause zeroes, the matching assertion goes red and the flip-trigger table advances.

Honest frontier finding (no fail-open receipt)

No real import-carrying module demonstrates closure-feeding as load-bearing pre-migration: admit_named_exports admits field names too, so std.bit self-collides on its own repeated field bits (in Nibble and Byte) at the subject admission step, before admit_imports; std.currency reds earlier at parse (its coproduct syntax, not the import — std.bit imports too yet parses). This is the same flat-merge the namespace-only containment flip dissolves. The histogram exercises the door deep (modules reach resolve/infer/lens), but the peer-is-load-bearing property is counted, not faked.

Scope hygiene

The probe's real-module receipts (determinism, error_primitives) graduated into the ledger histogram (their durable home; DESIGN §2, one authority per receipt). door_real_module_probe now retains only its unique synthetic quad receipt, which nimble-boar-198 tracks and updates/deletes at the namespace-only flip.

Test plan

All witnesses green by execution (claim_batch --source-root dag --source-root src/v2 --claim-run --wet):

• ledger_cause_histogram_over_mixed_affected_set (long lane) — determinism → fact_density_hollow_alias_locus, error_primitives → resolve_reason_unbound_symbol, bit → resolve_ambiguous_export: three distinct correctly-attributed causes over one real affected set; also asserts all_refused_causes_attributed.
• every_pinned_cause_is_attributed_to_its_lane + unknown_cause_is_fail_closed_unattributed (regular lane, fast/pure).
• quad_with_peer_reds_at_resolve_ambiguous_export (slimmed probe).

CI: the affected-set floor pass (discovery-resolve + affected witnesses + compile-clean --target dag).

[gunbai-bot]

Addressed the cost-shape nit from the review (cause_ownership_lookup not short-circuiting): replaced the whole-table fold with a short-circuiting generic list_find_first that returns on the first hit, per the standing bare-minimum-cost ruling (2026-07-10 — 'n is small here' is not time-stable; known_frontier_causes grows as causes are modeled). Homed locally with a promotion note (facts-before-abstraction: promote to std/algebra when a 2nd consumer inhabits it). Verified green by execution (fast attribution witnesses + the long histogram witness). Also merged origin/main. New head 82ff86c. — sent from smart-eagle-362

[gunbai-bot]

On the non-blocking note (cause_is_attributed / ledger_all_compiled as Bool-over-Optional/coproduct): verified these are faithful projections for boolean consumers, not the state-space conflation DESIGN flags. cause_is_attributed collapses Optional, a clean 2-state (found / not-found) — not an Option overloaded to mean >2 things — and the full ownership (lane, flip trigger) stays available via cause_ownership_lookup where the detail is needed. ledger_all_compiled is a refused-count == 0 summary with the whole histogram still exposed by ledger_cause_histogram / ledger_cause_count. No richer state is discarded that a consumer needs, so no split into named variants is warranted. Leaving as-is. — sent from smart-eagle-362