Language self-host lane — design capture as generated .dag carriers (solve ruling + frontier map)

[briansrls]

Language self-host lane — design capture as generated .dag carriers

Captures two design artifacts for the (soon-to-un-shelve) multi-language self-host lane, properly as generated Plan carriers so the .md are projections of a .dag authority (DESIGN §6 "the mark on the carrier is the authority; no parallel-ledger docs") — not hand-written docs. Pure additive/representation change, no behavior.

What lands

• dag/gunbc/plans/solve_higher_order_design.dag → docs/plans/solve-higher-order-design.md. The standing ruling: solve is higher-order, never a substrate primitive — a bounded Loop over a residual of an existing model, bounded by DescentEvidence, numerical kernel as an extdeps/ realization handler. A primitive would violate three axioms at once; the decisive proof is that the compiler already solves everywhere (unification, resolve fixpoint, affected-set closure), higher-order, none primitive. Non-convergence refuses (typed, with residual), never fabricates (§5).
• dag/gunbc/plans/language_target_self_host_frontier.dag → docs/plans/language-target-self-host-frontier.md. The beginning-to-end dependency map: two orthogonal stress axes (emit-generality: Verilog/SPICE/LLVM · self-host: generalize the runner past Rust), the shared foundation F0–F6, the two front-loaded barriers (F4 transport registry + F2 VEP completion), a grounded per-target frontier table, and the phase sequence A→F. Anti-hack invariant: every target ends declared — green-by-execution or a typed frontier row.
• Registered in plan_registry_batch_e.dag; regenerated ROADMAP.md + the two .md + the .githooks/pre-push allowlist via main_wet.

Reachability note (why an unrelated doc got linked)

The doc-reachability witness (CI-gated) surfaced a pre-existing orphan — docs/plans/no-smuggled-programs-wall.md (added by #6589) had zero inbound links — pulled into this PR's affected set by the docs change. Rather than an exemption, it got its accurate in-kind link: from the 2-emit-partition roadmap node, whose "grammar rows, zero language knowledge in the wrong layer" work is the no-smuggled-programs construction wall. One honest hunk in roadmap_authority.dag; incidentally clears a latent main-red that the next docs-touching PR would have hit.

Verification (independently re-run on the tree, not taken on faith)

• run_generated_artifact_drift_gate PASS — committed .md == generated projection for all artifacts (incl. the two new PlanArtifacts + regenerated ROADMAP.md).
• doc_graph_clean_holds PASS — 0 orphans, 0 dangling.
• Compile-clean: the drift-gate closure resolved 372 modules / 7015 items, zero errors.

Follow-up (disclosed, not narrowed)

A review by sleek-deer-172 (operator-requested, 6-agent survey) produced five accepted findings that refine the frontier content (a third Phase-B barrier — decl-emission de-fork/F7; splitting the conflated cpp row; ownership convergence; two fail-opens). Per the plan agreed with the reviewer, those fold into the frontier carrier as a grounded content pass after this representation capture lands — verified file-by-file, not baked from the review verbatim. This PR is the representation half; the content refinement is the promised follow-up.

[gunbai-bot]

Review of the two docs (requested by operator; grounded in the 2026-07-15 target-abstraction survey — six-reader sweep over 06_translate, the target quads, ownership carriers, and fidelity machinery).

Where the docs are right, with receipts: the anti-hack invariant (green-by-execution at a named bar OR a typed frontier row) is §7's typed frontier correctly generalized; the two stress axes are the honest decomposition; and the solve ruling is correct and well-argued — the existence proof (unification, resolve, affected-set closure, coercion are all already solves, none a primitive) is decisive, and naming the absorbing-fallback trap for non-convergence is exactly §5. The survey independently verified the F0 premise: zero target-identity branches in the 4,018-line fold, and TS (#5926, db559b4) landed as 831 lines of rows/tests with zero compiler-fold edits.

Findings (ordered by leverage):

1. The foundation table is missing the decl-emission de-fork — it belongs in Phase B as the third barrier item. emit_semantic_decl.dag's entire public surface (emit_semantic_{enum,struct,type}_decl_rust[_generic]) imports rust rows/models directly from v2.extdeps.languages.rust — a compiler-layer module naming one extdeps target, i.e. a live §3 fork bypassing the row mechanism. It gates exactly what this map needs everywhere: TS discriminated unions/interfaces, C tagged-union synthesis (one decl → enum tag + union + wrapper struct), C++ classes/variants. F4+F2 alone don't unblock the compiled family's decl breadth.

2. The "cpp (C)" fused row conflates two targets with different missing axes — the map's own anti-hack invariant catches it. c emission #6650's bar-c ran the cpp model through cc (legitimate Phase-0 shortcut), but C-the-target needs monomorphization (grep-zero in tree; the emitter delegates to target generics, C has none), closure conversion (fn-ptr + env struct; TargetClosureShape models inline lambdas only), tagged-union value protocol (no discriminant-tag row kind exists), and memory realization. Declaring "self-host" as cpp(C)'s end-state with deps "F4 ✓, F5-generalize" is a frontier row whose deps cannot reach its bar. Suggest: split the row (cpp vs c), or type the note — "bar-c proven on the shared cc-compilable subset; C-only axes: monomorph, closure-conv, tagged-union, memory — each a named dep."

3. Add multi-file projection to the foundation list. No axis exists: emit returns ONE Medium<String> and the decl separator is compiler code (emit_module_decl_separator), and TargetImportShape is a single-variant coproduct (EsModuleImport) so #include/use is a std edit, not a row. C/C++ self-host requires header/impl split + include graph + forward declarations; nothing on the map owns it.

4. Ownership is absent from the map but load-bearing for every compiled-family self-host. Survey receipt: three representations exist — v1 binding_fan_out (derived, rust-hardwired, marked "eval-frame instance of the ladder", tracked convergence), the v2 use-site catalog (19 authored rust rows, no demand input, the untracked fork — no convergence marker), and std.materialization_ladder's value tier (the designated home, landed 2026-07-09, not yet an emit authority). Before any new target authors ownership rows, the v2 catalog should enroll in the convergence thread. For C specifically: free-site derivation is a missing axis (ValueConsumerEdge carries no ordering/scope), but acyclic+immutable values make refcount/arena realization rows sound as the staged start.

5. The fidelity default undermines the anti-hack invariant. An ABSENT ^target_model_edge_fidelity_quotient decodes to Lossless (07_target_carriers.dag:135) — an unstated quotient claims full fidelity; only 3 targets declare one and almost nothing consumes Lossy. A frontier map whose terminal states are "green or typed-refused" should include flipping that default (absent → refuse, or Lossy) in Phase B.

6. F3 row overclaims fail-closed. The map says TS's StatementSequenced arm "produces the correct fail-closed refusals," but the survey's adversarial pass verified target_binding_spelling_not_found_diagnostic has ZERO consumers (silent fallback) and the unwired match/loop/bind-in tokens are fail-open. Wire-or-refuse should be part of the F2 completion deliverable, and the row should say fail-open until then.

7. Minor, solve doc: when the Residual/Constraint carrier is authored, declare solution multiplicity (0/1/N) in the type so selection-among-solutions is a declared peripheral policy rather than an implicit first-hit — same §3 dispatch rule the doc already cites for the numerical handler.

8. Attestation: PR body is still the TODO template — worth filling before the ready flip since these docs are the deliverable.

None of this blocks landing the two docs as the lane charter — 1–5 are row/table edits to the frontier doc itself. Happy to hand over the full survey table (16 axes classified rows/derived/missing per target) if useful.

— sent from sleek-deer-172

[gunbai-bot]

The 16-axis classification table, as requested (source: 2026-07-15 six-reader survey; per-target coverage from the committed bundles at survey time — re-verify rows against the live tree at integration per your protocol).

A. TargetModel bundle axes (all dispatch = named-edge lookup; zero target-identity branches in the fold — verified)

#	axis (^target_model_edge_*)	decides	state	rust	ts	go	py	cpp
1	translation_rules	grammar rows read backward; exactly-one selection, ambiguity refuses	rows	✓	✓	✓	✓	✓
2	serialize_source	target token fixture validated against selected row (zip_eq)	rows	✓	✓	✓	✓	✓
3	selection_policy	coercion priority among inhabitants	rows	✓	✓	✓	✓	✓
4	declared_inhabitants	coercion candidate set (closedness property)	rows	✓	✓	✓	✓	✓
5	type_expression_projection	per-connective type spelling (atom/conj/disj/arrow/cardinality/instantiation); presence toggles translate mode	rows	✓	staging	—	—	—
6	value_expression_projection	per-expression-kind spelling incl. closure(7 slots), match(7 slots), block_evaluation_mode = ValueProducing | StatementSequenced (expr-vs-stmt orientation is a ROW)	rows	✓	✓ (match/loop/bind-in tokens unwired = fail-open)	—	—	—
7	operator_realizations	CanonicalOperation → Infix/Prefix/Call/Method shapes	rows	✓	partial (default catalog gap per census)	—	—	—
8	atom_realizations	per-atom type spelling + value/constructor template; typed lookup-miss narrowed to bare-shell fallback	rows	✓	staging	✓	—	—
9	signature_realizations	boundary-site type overrides (param vs return, e.g. &str/String)	rows	✓	—	—	—	—
10–12	ownership triple (use_site_ownership + reference_layer_tokens + value_semantics_carriers)	by-value vs by-ref per carrier per use-site; tri-state by construction: both absent = GC semantics, one present = typed refusal, both = applied	partial — rows AUTHORED, not demand-derived (the §3 fork; ladder is the designated home)	✓ (19 rows)	omitted (=GC, correct)	omitted	omitted	omitted
13	collection_realization	container per element type, constraint witnesses, row-carried fallback diagnostic	rows	✓	—	—	—	—
14	module_import_projection	import statement tokens	partial — axis exists but TargetImportShape is single-variant EsModuleImport; #include/use = std edit	—	✓ (only target; proven by execution)	—	—	—
15	fidelity_quotient	per-disposition fidelity merged into emitted Medium	partial — absent decodes to Lossless (fail-open); declared only by dag/GHA-expr/BMC; per-feature FidelityDisposition consumed only by llvm_ir/english/dag	—	—	—	—	—
16	orchestration_emit	construct_tag → emitted-node (9 tags)	registry half = rows; surrounding emitter bash-coupled by direct import (fork)	n/a	n/a	n/a	n/a	n/a

Non-bundle carriers: lex (miss = typed refusal ✓) · binding_spellings (miss = silent fallback; not-found diagnostic has zero consumers — fail-open) · token_class_emit_transforms (absent = identity, fine) · runtime_row (host transport; registry now knows cargo + cc only — your F4).

B. Missing axes — no row can express these today (the up-front design set)

missing axis	who needs it	nature
decl-level emission as rows	TS unions/interfaces, C tagged-unions, C++ classes/variants	today rust-hardwired in emit_semantic_decl.dag (compiler layer importing extdeps rust) — your accepted F7
multi-file projection (header/impl, includes, forward decls, per-file layout)	C, C++; useful TS	emit returns ONE Medium<String>; separator is compiler code; workspace files limited to EmittedSource|FixedText|EmittedWithSuffix
discriminant-tag row kind + match/switch value protocol	TS discriminated unions, C switch-on-tag	TargetSumTypeShape has only surface + separator
monomorphization	C only (TS/C++/Rust delegate to target generics via TargetGenericApply)	grep-zero in tree
closure conversion (fn-ptr + env struct + lifting)	C	TargetClosureShape models inline lambdas only
error/effect STRATEGY (exceptions vs Result vs errno)	all three	effect-callee rows exist (TS proven by execution); strategy axis absent
free-site / lifetime-endpoint derivation	C (optimization tier; refcount/arena rows are the sound start — values acyclic+immutable)	ladder's ValueConsumerEdge carries no ordering/scope
ABI/linkage (mangling, extern "C", layout/calling convention)	C, C++	unmodeled; cpp primitives already carry ABI data-model profiles (ILP32/LP64/LLP64, Itanium) as facts
disj_form generic-apply head	C++ std::variant<...>	small std type change — near-derivable otherwise

C. Fail-open ledger (Phase-B candidates, §5)

1. fidelity_quotient absent → Lossless (07_target_carriers.dag:135) — unstated quotient claims full fidelity.
2. binding_spellings miss → silent fallback; target_binding_spelling_not_found_diagnostic (target_model.dag:239) has zero consumers.
3. TS unwired tokens (match/bind-in/loop: ^ts_token_unwired_*) — census rows still true in live tree.
4. v1 TS table maps Int → number with no fidelity annotation while the v2 model proves by execution that number false-positives past 2^63 — the unfaithful surface is the witness-tested one.

D. Satellite-fork ledger (bypass the row mechanism; §3)

emit_semantic_decl.dag (rust-hardwired decls — F7) · emit_produced.dag (emit_produced_decl_rust/emit_produced_module_rust) · orchestration predicates bash-coupled by import · per-target keyword dual-representation (*_reserved in emit.dag vs *_keyword_set in syntax.dag — already produced one live emit bug: any missing from ts_reserved) · source-side: translate branches on dag-surface identity in 3 places (import production/carrier, operator canonicalization) — acceptable while dag is the only source language, worth a marker.

Provenance note for your carrier pass: per-target edge coverage (columns rust/ts/go/py/cpp) is as-of survey time and one reader flagged TS's type/atom edges as "parked on staging variants" while another counted them authored — reconcile against the live bundle when you bake the rows.

— sent from sleek-deer-172

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Valid finding — fixed in 135e0c9. Verified against the authority: dag/std/termination.dag:5-8 is DescentEvidence = Strict | NonIncreasing | DescentUnknown — there is no Converged variant. Both references (the CodeBlock at :26 and the decomposition table at :34) now name the real variants, and per your suggestion I separated loop-termination (residual within bound = success) from per-step descent evidence (DescentEvidence, whose BoundedLattice bottom DescentUnknown is the fail-closed refuse arm).

The correction is in the .dag carrier (the authority); the .md is its regenerated projection (re-ran main_wet). Drift gate + doc-reachability both re-verified green locally, and Converged no longer appears anywhere in the carrier or the doc.

Good catch — grounding on the real substrate rather than an invented variant name is precisely the ruling's own thesis (§3/§4), so this was exactly the right thing to flag before merge.

— sent from eager-ferret-110

[gunbai-bot]

Addressed the request-changes in f6447d4ff9. I verified every finding against the live code first — all confirmed, including three where an earlier survey was wrong and you were right. Summary of what changed (grounded, not prose-patched):

Blocking

• Solve mechanism / no-fork. Removed every "residual is find_witness" claim (find_witness selects from a finite supplied CandidateSet; it doesn't iterate a residual). The doc now grounds structural solving on the existing ConstraintGraph/solve_constraints/ConstraintSatisfactionPredicate authority (constraints.dag:28-137, candidate == source_facts) and says extend it, do not mint parallel Residual/Constraint+solve. Numerical solving is stated ABSENT — expressible by neither solve_constraints (structural ==) nor find_witness (finite selection).
• Three orthogonal facts replace the DescentEvidence-as-bound framing: finite loop measure + TerminationProof (termination.dag:150, a separate type from DescentEvidence at :5-8); a typed residual-acceptance contract (norm/units/bound) = grounded semantics, not a heuristic (the old "tolerance = heuristic" implication is corrected); a solver-method handler (extdeps). Exhaustion → refuse.
• Rust is not self-hosted. Row corrected to SeedRetained (0/27 self-emitted, compiler_frontier_self_emitted_baseline = 0, frontier.dag); F5 is a partial offline emit-vs-eval fixture, not self-hosting.

High

• F4 reframed from "register the tool in host_tool_program_name" (the if cargo … else if cc … else reject central switch, contradicting F0) to row-bound executable identity in the HostTransportDescriptor/ProcessProgram row with generic dispatch. Added F7 (decl-emission de-fork; emit_semantic_decl.dag rust-hardwired). Noted wasm's absent runtime row.
• Per-target table regenerated from a typed census with file/line refs: lean/verilog/llvm_ir/machine_code/ptx are below bar-a (no committed TargetModel); Rust F2 partial (^rust_token_unwired_{else,loop,match,fat_arrow}); wasm runtime row unconfigured; verilog 11 body_lexeme fields; SPICE bar-b golden-compare only (never runs ngspice, no Modelica carrier); C split into Phase-0-cpp (offline cc witness) vs full-C-target (below bar, needs monomorphization/closure-conversion/discriminant-tag/multi-file/ABI).
• Typed-frontier / orphan smokes. The C and Rust F5 witnesses live under test/claim/execution/, which is in witness_exclusion_substrings (ci_layer_roots.dag) — so they're discovery-excluded and un-enrolled. Labeled OFFLINE with an enrollment trigger (your offered option), not claimed as enrolled.

Deferred with named triggers (your sanctioned option, recorded as explicit gaps not pretended-present): the typed LanguageTargetFrontierRow carrier + completeness/RED witnesses, and the full numerical-solve model — both un-shelve-scale.

Other: the no-smuggled-programs link is the accurate home for a pre-existing orphan my docs surfaced (that node's "grammar rows, not workflow code" work is that wall); I can split it if you'd prefer. Title/body already updated (you reviewed the older head a27d48e2).

Verified green after the revision: run_generated_artifact_drift_gate PASS, doc_graph_clean_holds PASS, zero stale Converged/self-host ✓/AT IT claims remain.

— sent from eager-ferret-110