namespace wave 1: containment-tree resolution — layered census + name-derived loader (salvage)

[gunbai-bot]

Merge candidate state (2026-07-19, final round)

Branch-caused CI failures are at zero known root-causes; candidate e9bd22e82e is the green-candidate CI round. What landed since the salvage summary below:

• Stale-drift mass revert (~520 files re-taken from main + 1 branch-new file deleted): the branch's merge history had auto-resolved to strip-era bodies after main's Revert #6640 Wave-1 namespace strip — restore main to green #6847 revert, silently shadowing newer main work. A 3-step classifier (byte-equal to revert-parent / body-vs-main modulo imports / qualify-normalizer) partitioned keep-vs-retake; it re-runs after every main merge.
• Floor burn-down to zero aborts: ~200 fully-stripped files got main's import blocks restored (bare kernel/variant names die on the executor's census surface; strip coverage is a metric, not a correctness constraint — re-strip rides the kernel-as-root-namespace follow-up). Discovery-abort classes fixed: Unit/Cardinality/Named unresolvables, 5 orphaned strip-era producer fixtures deleted, spice fixture pair, systemd witness (sweep-qualified refs made SystemdUnitStatus a stale inert-carrier roster entry).
• §3 homonym de-fork: import_closure was double-defined with different signatures (module_graph vs witness_cost_locality); the flat interpreter registry's last-insert-wins dispatch made the winner load-order-dependent — the branch's name-derived loader re-rolled that dice and 8 effect_reach rows died on the losing signature. Renamed to witness_import_closure (6 sites). The class-level fix (dispatch keyed on containment identity, ambiguous bare name = typed refusal) is handed to the operator's dispatch lane with a full inventory (fn emit( is triple-defined; builtin resolution is resolve-group-composition-dependent).
• Executor-surface resolution class: falsifier + live_deploy witnesses failed only under the floor executor's shared-pool census (per-conjunct probe rows localized to artifact_path-on-bare-variant and the two committed-golden script comparisons) — import-block restores fixed both, proven on both surfaces.
• Stale-binary phantom (post-mortem): after the automerge brought main's witness-realization wave (seed Rust + emit_host_run_transport_cached builtin), the pre-merge local binary red-ed the gate on a builtin it didn't have. Rebuild cleared it — and cleared the 3 rust-emit "slow eval" rows, whose 8–12s FAILs proved environmental (the failing window moves between runs; CI and main's falsifier pass every one of them at ~100–170ms).
• Advisory rendering: UnlistedImportUse spam is now one counted line per closure (GUNBC_ADVISORY_ROWS=1 restores rows); ~9.8k-row ledger stays the burndown backlog.
• Design doc: §10 (namespace scope is syntactic — header declares position, not extent; staged steps) and §11 (module→namespace terminology ruling) folded into namespace-resolution-design.md per operator direction; step-1 implementation is the first follow-up PR.

Reviews waived by operator for this PR (2026-07-19); merge on green CI.

---

Summary

Namespace wave 1: the containment tree starts serving as the naming authority. Import lists are stripped across the witness corpus (83% of dag/test/claim and of src/v2 now carry no import lines) and resolution moves to the SymbolIndex census — nearest-ancestor containment walk for bare names, dotted projection for qualified names (namespace-resolution-design.md).

The branch spun for ~a week trapped in a big-bang corpus strategy; this is the salvage (operator-approved, session nimble-owl-658 took ownership from quiet-gull-833). The capability work was kept, the corpus strategy was replaced with a layered census that changes no compiled module's baseline meaning:

• Fill = whole tree; policy gates lookup, never fill (§7.5): every compile carries the whole pool in the census, but in layers —

  • the closure census is byte-identical to the no-fill build (bare visibility, variant-alias corpus gating, services all closure-scoped), so a pool homonym cannot shift what a compiled module's bare names mean (measured failure of the single whole-pool census: bare GET/Persistent/JsonValue vanished across 28 witness rows);
  • census-only fill is parse-grade (never resolved — resolving fill against a fill-only pool fabricated 797 unresolved-import diagnostics about the view) and enters a qualified-only entries underlay;
  • each typechecked module additionally gets its own tree-closure bare census (root modules + import-reached pool modules — gate parity by construction).

• Loader derives deps from names (Rule-1 direction): with imports stripped there are no edges to follow, so witness closures = imports + dotted refs + bare refs resolved exactly as typecheck will (unique → that module; ambiguous → nearest-ancestor; tie → load nothing, the typecheck refusal stays the loud authority). Pull discipline: callable-shaped references only (call position / census sig with params); test-claim modules never serve as providers.

• Seed fixes en route: qualified payload-variant construction (infer: qualified payload-variant construction (roster items 1+8) — stamp parent_enum for dotted spellings #6869, merged separately), the same class in the discovery roster, M.mid type-param stamping at field extraction, lookup_variant_parent_enum dotted fallback.

• Precedence + loader hardening (root-caused off the first CI round's reds, all reproduced and re-verified locally):

  • the ExprCall sig lookup now gates on body-grain binders (InferScope.body_locals: let / match pattern / params) so a census-unique corpus homonym can never out-precede a let callee (a v2 lens test's fn classify -> Optional<Finding> was typing refinement.dag's match scrutinee);
  • census bare variant aliases never claim kernel names (overlay_skips_kernel_name is the single authority; a lone closure enum declaring Absent was hijacking the kernel Optional variant on shrunk closures — qualified module.Vname aliases stay);
  • the loader pulls service providers via dotted-chain prefixes against the services census (cron.Tab.List() → extdeps.cron — the stripped import's only remaining edge), scans only import-stripped files (unstripped files are main-parity; scanning them manufactured over-pull), and skips binder/key positions (let repo, repo:) when collecting candidates.

• CI-vs-local alignment (rounds 2–4): source_tree_root_of now normalizes source roots — CI passes absolute --source-root paths, so the bare loader and the census underlay had been silently no-oping in CI while working locally (the core divergence). The loader also gained a whole-pool census fallback for cross-tree bare refs (same-tree keeps priority) and dotted-head data-const pulls (gunbc_ci_spec.diff_policy). Deletion-only diff hunks attribute to the following line, so import-block strips no longer false-fire the affected-set diff before first declaration refusal (module-line deletion still refuses). The original strip-sweep had also deleted the match: MatchInterpreter field (not just imports) from 11 InterpretationAlgebra literals across 10 files, and stripped the floor_skip frontier fixtures — both restored to main's shape.

• Frontier + selection hardening (rounds 5–9):

  • diff-to-declaration attribution is parse-grade (decl line maps from the parsed module node, never a full typecheck) — one latent-red batch-2 module no longer dead-ends the whole discovery batch at one entry per CI cycle; declaration-less touched modules attribute file-grain; all 27 node-frontier controls stay green;
  • shared never-skip rule on both decision sides (entry_without_declared_edges_never_skips_note): an entry that declares no import/dependency edges is never selection-skippable — with imports stripped its real dependencies are name-derived and invisible to the import-edge model, so a precise "unaffected" answer would false-skip (fail-open cache impurity). Implemented in entry_file_touched_via_import_closure (host) and entry_affected_by_touched_paths (module_graph.dag authority); the module-grain equivalence receipts + wiring-perturbation control (re-anchored on an import-carrying entry) and all 9 dag_compile_clean_scope disposition witnesses are green. Dissolves when the edge producer swaps to reference-derived resolution facts (the dependency_edge_source_migration_note swap);
  • resolve_entry_graph (uncached fixed-entry resolve: floor runner, executor plan entries, probes) now routes through the same shared-index loader engine as resolve_entry_graph_shared — the old import-edge walk could not resolve stripped fixed entries at all;
  • corpus qualify-now rows where a bare name is a genuine cross-module homonym the census cannot decide (CoreNode at 03_ingest, None/Rejected payload rows in inhabitant_neutralization, extdeps.github.github.User in roadmap_status + 2 more sites — items out-precede variant aliases in the bare census, so the wrong provider pulled);
  • census precedence law: the pool census never serves an algebra method-template name (filter/any/contains/…) as a bare fn sig — a census entry for the never-loaded v2.std.algebra was preempting infer's known-method bridge, typing filter(xs, f) as a plain call that died NoSuchFunction at runtime where main rewrites to the builtin method (proven by main-built claim_batch controls: main bridges the list form, refuses the Int form at typecheck). Single authority = the std_algebra template rows (algebra_method_template_names()), guarded in func_sig_from_global_bare + global_bare_callable_node, mirrored in 04_lookup.dag; loaded providers are unaffected (lookup_resolved_sig runs first). This greened the budget/keyed-delta/membership/gunbhub-keystone witness family;
  • two §3 fn-homonym renames in ci_budget_tree.dag (ci_host_overhead_claim, ci_session_pool_bytes): the flat interpreter fn registry is last-insert-wins, so when the name-derived loader put both carriers of the deliberate budget split in one closure, 0-arg callers ran the params-bearing bodies (undefined variable: overhead/active_sessions). Module-keyed dispatch is the namespace lane's terminal wall; the rename is the honest interim.

• .dag authority mirrors land with the Rust (04_infer node-base census + layer fns + census-extra twins; compile.dag census_only_sources + parse-grade fill front end). cli_run.rs loader/index work is inside the existing HAND-RUST scaffold. The tests-crate helper missed the new CompilePipelineOptions.census_only_sources field (workspace build red) — fixed via functional-update from the default options.

• Stale-witness-content restores: the strip era froze some witness files at pre-main-landing content (host_standup_spine at eleven steps vs main's twelve with BuildCacheProvision) — re-took main's content with imports stripped, qualifying genuinely ambiguous bare variants the newer content introduced (std.upsert_decision.Converged; three std enums declare Converged). All 16 standup witnesses green.

• Stale-drift mass revert (the dominant red class, ~25 of 32 counted CI reds, one root): main REVERTED the Namespace integration branch: collapse strip PRs #6603 #6600 #6607 #6610 #6611 #6612 #6613 #6622 into one draft integration branch/PR on main; atomic Wave-1 landing target; close/supersede individual strip PRs; hold draft until G1+(c) then single rebase+merge #6640 strip-integration branch (Revert #6640 Wave-1 namespace strip — restore main to green #6847, f355b134c3, 1633 files) and this branch's merge of that revert auto-resolved to the branch side — silently keeping Namespace integration branch: collapse strip PRs #6603 #6600 #6607 #6610 #6611 #6612 #6613 #6622 into one draft integration branch/PR on main; atomic Wave-1 landing target; close/supersede individual strip PRs; hold draft until G1+(c) then single rebase+merge #6640's frozen file bodies wherever the strip era had touched a file (pre-TargetText 06_translate char-exploding the emit serializer; pre-Body-emit Track B next slice: continue #6840 (general body producer, Stage B cross-decl) toward the 12 emit-shape-gated tail modules; re-probe after the slice converts refusals to flips #6859 rust.dag/dag.dag emit rows; the node_content_hash split main had re-inlined; stale commit_workflow enrollment rows; ...). Mechanical classification: (1) byte-equal to the pre-revert state where the revert changed the file; (2) body-vs-main modulo imports — body-identical = strip-only (KEPT, 864 files, the deliverable); body-drifted = stale (re-taken from main, 479 + 38 layered files); (3) qualify-normalized diff direction separated sweep-qualify layers (kept) from true staleness. node_content_hash.dag deleted (main homes content_hash in v2.std.node; 12 importers reverted with it). Post-revert: whole-tree gate exit 0 / 0 hard rows (advisories 2206 → 1977 as ~500 files regained imports), and the entire serializer red family (orch emit goldens, fleet_converge, ci_yaml keystone, ci_deploy, floor_materialization ×6, live_deploy, bmc, host_standup ×16, falsifier, artifact-drift, gunbhub) went green by execution.

• Post-revert residue, each a typed class with an executed fix: (1) Diagnostic item-out-precedes-variant (the User class) — witness qualified; (2) bandwidth_count flat-registry homonym — the local nickname deleted (§3); (3) qualification changes builtin interception (new sweep hazard): qualified contiguous_loop_elementwise_kernel calls missed the interp's bare-name builtin and executed the pure-dag seam 1/0 — de-qualified, rule recorded; (4) int/float twin eval_relu_mul_add_elem_at_index — float twin renamed after an instrumented eq-walk exposed mixed-representation output ([Int 7, Int 6, Float 0.0, Float 0.0] prints as the golden but fails == 0); (5) sweep-qualified None comparisons (dg == v2.std.diagnostic.None) construct a Variant where bare None is Value::Null — silently false; de-qualified (7 orch_if + 3 rust_add sites); (6) the CI discovery abort (no field 'expression' on type 'Holds'): the long/ bisect entry needed imports-from-the-declaring-module (strict re-export), a native is_empty interp method (bridge parity), and 02_parse's import block restored (bare Token ambiguous in the witness-closure census); (7) three strip-casualty witnesses (sol_console/string_cast/types_arch — the last one a hermetic-capability import the strip removed) reverted to main.

Measured state

• Batch-1 (whole-tree --target dag gate): GREEN — 0 hard diagnostics (was 29 v2.* cross-tree rows at salvage start, 411 at branch peak). 2206 UnlistedImportUse advisories render now that the gate passes — pre-existing non-gating burndown class, grown by design as imports strip.
• **Batch-2 (witness corpus): first counted full-corpus CI round measured 646 ✓ / 32 ✗; after the mass revert + residue fixes the local halves are dag 837 PASS / 4 FAIL and v2 671 PASS / 0 FAIL at their OOM-killed tails (floors), with every one of those tail FAILs (orch_if ×7, sol_console, string_cast, types_arch) fixed and re-verified individually after the run. The serializer char-explosion class is dead (root: stale pre-no-smuggled-programs wall: design + census + HALF A Slice A0 (row-derived source_text fold, orchestration→bash) #6589 06_translate; minimal repro orch_emit_join2 now emits clean).
• rust_tests: full v1-compiler lib suite 264 passed / 0 failed (7 tests were red at salvage start — module-grain equivalence pair, live_tree floor-runner resolve, scan-dirs expectation, NFR roster, ReadsLiveTree re-stamp, diff-attribution edge). The workspace build itself was red (tests-crate helper missing the new options field) — fixed.
• Flagship end-to-end proof: gunbhub_serve_witness_test (import-stripped; 60+ typecheck errors and a runtime no such function at salvage start) PASSES through claim_batch.

Known debt (typed, tracked)

• Typed-cache key does not yet cover the census layers (pool constant per process, so in-process soundness holds; cross-process store is opt-in/off) — re-keying rides the containment-SymbolIndex lane.
• field_of_type_var deferral (generic payload interiors never typechecked — pre-existing on main, surfaced by this work).
• Interpreter fn-registry residue: named-fn-as-value references outside call position are pulled only when their census sig carries params; 0-arg data cross-refs would surface as counted runtime rows.
• UnlistedImportUse burndown + qualify-now worklist stay the namespace lane's follow-ups.

Test plan

• gunbc compile --source-root dag --source-root src/v2 --dependency-pool-index primary-precedence --target dag → exit 0, 0 hard diagnostics
• same invocation over src/v1 + dag (mirror closure) → exit 0
• exact CI post-floor command gunbc run --source-root dag --entry dag/tools/merge_admission_stamp.dag --function main → exit 0 (was red: undefined cron/llm, PositiveInt mismatch)
• witness spot-checks through claim_batch: gunbhub flagship, refinement_ordered_iteration (the CI batch-1 red), cron_tag keystone → all PASS
• claim_batch --roster-from-discovery full corpus (two processes): 1454 PASS / 149 FAIL — both halves OOM-killed near their tails, so a floor on the true totals. FAIL histogram: 66 contains-on-Variant type errors (main's known null-RED deploy/serializer debt), 40 no such function (fn-registry residue: value-position refs the pull discipline doesn't cover), 6 undefined-variable, 2 each non-exhaustive/division-by-zero, plus orch/verdict smoke rows
• absolute-root control (--source-root $PWD/dag …, the CI-shaped invocation) → PASS
• cargo build --release green; fail_closed_edit_before_first_decl and diff-attribution unit tests green; cargo fmt --all applied