Layering-imports gate: repoint fact producer onto reference-derived edges (Phase 1) by gunbai-bot[bot] · Pull Request #7060 · gunb-ai/gunbc

gunbai-bot · 2026-07-22T13:54:55Z

Summary

Adds design doc docs/plans/layering-imports-reference-repoint-design.md (cross-linked from namespace-resolution-design.md §PR-5b) scoping the gate's survival past namespace terminal step (import deletion).
Phase 1 implementation: layer_import_facts() now uses a transitional union — import-syntax facts for import-bearing files in std/extdeps scan roots, plus reference_edges_as_import_facts(..., strict=true) for import-less files. Importer layer is derived from the module qualified name (layer_prefix_from_dotted_module), not scan-root placement. Reference resolution uses witness_layer_roots as pool and std+extdeps as importer scope (same split as module-graph selection).
Lens verdict (layering_imports_clean_holds) unchanged. New reference-only RED witness enrolled in LayeringImportsGate.

Test plan

cargo test -p v1-compiler layer_import_facts_reference (discriminating reference-only control)
pre-push hook green (fmt + doc reachability witness)
CI LayeringImportsGate (clean tree + 5 scanner perturb receipts + reference-only receipt)

Sequencing note

Phase 1 must land before PR-5b import-line strip reaches std/extdeps scan roots (tracked dependency edge in namespace-lane map).

…s the la

Record Phase 1 status and the witness_layer_roots pool / std+extdeps importer split required for qualified reference resolution. Co-authored-by: Cursor <cursoragent@cursor.com>

…ure WallNow. Name CLI_RUN_LAYER_PREFIX_FROM_DOTTED_MODULE_SCAFFOLD_MARKER with dissolve-on on the Rust copy of layer_prefix_from_dotted_qualified_name; restore WallAfterGrounding on the lens while the producer remains transitional dual-arm. Co-authored-by: Cursor <cursoragent@cursor.com>

…acts. Skip the reference arm when every file in the scan roots still has import lines; move full-corpus clean-tree witnesses to test/claim/long/ (layering and meta_exec). Gate transport points at the long-lane layering receipt. Co-authored-by: Cursor <cursoragent@cursor.com>

…-red) generated_artifact_drift_gate_passes has not executed on main since #7060 merged (every floor died at batch 2 on the phantom witness before batch 4), letting two stale artifacts through: - ROADMAP.md: #7071 hand-added an in-flight lane snapshot paragraph directly to the generated file; it exists in no authority carrier (roadmap_authority/ roadmap_document grep: 0 hits), so regen drops it. If the snapshot is wanted, it re-lands as an authority-side row (silent-ibex-417 notified). - ci.yml: trailing blank line vs regenerated output (the known trailing-newline drift class). Both files are byte-identical to generated_artifact_gate main_wet output on this head, run locally by execution (ExitSuccess, receipts above). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…losure resolves The gate transport (run_clean_tree_gate, 13-source scoped run over witness_layer_roots) red with 'unresolved type LayerPrefix' — layering_imports.dag referenced LayerPrefix and its variants bare, and nothing in the scoped closure pulls v2.std.layer (the whole-tree pool masks this everywhere else). Explicit import completes the closure by construction; the gate now executes. NOTE: the gate then returns false on 7 violations that are all FALSE EDGES from the #7060 reference-derived producer (import-less std files' prelude bare names — List/fold/concat/Present class — misattributed to extdeps.color.srgb / extdeps.gitignore / v2.compiler.discovery_enumeration; zero textual imports in any flagged file). That defect is routed separately; it is main-side, not introduced by this PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d fields. The #7060 reference producer treated every parsed node.name as a cross-module bare reference, so param binders (items), match bindings (r), and record-literal field labels (decl_name) resolved to unrelated extdeps modules. Narrow collection to actual value/type reference sites and stop exporting Conj record field names from the decl index. Co-authored-by: Cursor <cursoragent@cursor.com>

…port orphaned by #7064 (#7079) * Main-red hotfix: drop stale roster reference to witness moved by #7060 #7060 moved scanner_clean_tree_meta_exec_holds_on_rostered_corpus from scanner/planted_leak_test.dag to test/claim/long/meta_exec_confinement_clean_tree_test.dag (excluded from per-PR discovery by dir grain, per its long-lane note), and deleted the fn from the old file — but the explicit CommitWitnessClaim roster row in gunbc.commit_workflow still enrolled it against the old entry on the GithubActionsCiJob surface. Every main ci run since #7060 merged (16:33Z) fails: 'runtime error: no main function found' on that witness (e.g. run 29940402396), and the 17:23Z affected-set-falsifier red is the same root. Fix: the roster row keeps only the fixture-scan witness that still lives in the entry file (scanner_planted_meta_exec_leak_detected_holds), completing #7060's stated fast-lane/long-lane split. No other roster row references a moved fn (layering long-lane test checked clean). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Second latent main-red: re-ground memory-cap verify read on typed ShowProperty (#7064 deleted its script module) #7079's own ci run exposed the second latent break: #7000 (merged 15:59Z) added host_runner_memory_cap_verify consuming fleet_runner_unit_memory_props_read_script; #7064 (16:33Z, branch predating #7000) deleted that script module without seeing the new consumer. Main pushes skip the compile-clean gate ('no touched paths in diff observation'), so the unresolved import is latent on main and reds any PR whose affected shard closure reaches this file — including this hotfix (run 29943428156: 'module gunbc.fleet_show_effective_read_script not found'). Fix follows #7064's own dissolution: the three memory-prop reads route through gunbc.systemctl_show_read.systemctl_show_property_read_local (MemoryMax / MemorySwapMax / MemoryHigh, slice1 precedent — LocalShell on-host semantics preserved), constructing RunnerUnitLiveReadRow directly and typing via runner_unit_live_read_typed — mirror of fleet_runner_unit_memory_live_read with the local transport (one shape, N transports). Absent reads still fold to none → the existing typed Refused arm. Verified by execution: the entry closure compiles with zero unresolved-import hard diagnostics (the class the gate reds on). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Regen stale generated artifacts (drift latent behind the batch-2 main-red) generated_artifact_drift_gate_passes has not executed on main since #7060 merged (every floor died at batch 2 on the phantom witness before batch 4), letting two stale artifacts through: - ROADMAP.md: #7071 hand-added an in-flight lane snapshot paragraph directly to the generated file; it exists in no authority carrier (roadmap_authority/ roadmap_document grep: 0 hits), so regen drops it. If the snapshot is wanted, it re-lands as an authority-side row (silent-ibex-417 notified). - ci.yml: trailing blank line vs regenerated output (the known trailing-newline drift class). Both files are byte-identical to generated_artifact_gate main_wet output on this head, run locally by execution (ExitSuccess, receipts above). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * layering gate: explicit v2.std.layer import so the scoped transport closure resolves The gate transport (run_clean_tree_gate, 13-source scoped run over witness_layer_roots) red with 'unresolved type LayerPrefix' — layering_imports.dag referenced LayerPrefix and its variants bare, and nothing in the scoped closure pulls v2.std.layer (the whole-tree pool masks this everywhere else). Explicit import completes the closure by construction; the gate now executes. NOTE: the gate then returns false on 7 violations that are all FALSE EDGES from the #7060 reference-derived producer (import-less std files' prelude bare names — List/fold/concat/Present class — misattributed to extdeps.color.srgb / extdeps.gitignore / v2.compiler.discovery_enumeration; zero textual imports in any flagged file). That defect is routed separately; it is main-side, not introduced by this PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…ipts in the operator TODO #7079's branch predated #7081, so its drift cleanup hand-deleted the silent-ibex-417 paragraph from the generated ROADMAP.md while #7081 had just re-homed that paragraph into roadmap_authority.dag - post-merge main drifts the opposite way (authority has it, committed md does not) and the drift gate reds the next main run that reaches batch 4. This regenerates ROADMAP.md from the authority, closing the drift. Sheet updates: wave-red receipts row (drift-gate red healed by #7081; stale CommitWitnessClaim roster row from #7060 hotfixed by #7079 incl. the #7064 orphan; the third collision above), the stale-roster stabilization-loop instance, and #7076/#7008 marked merged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fdkaGGLUKpLRwwqxp5sLg

… + wave-red receipts and CI-ergonomics lane on the operator TODO (#7083) * roadmap: heal the #7079-reopened ROADMAP drift + record wave-red receipts in the operator TODO #7079's branch predated #7081, so its drift cleanup hand-deleted the silent-ibex-417 paragraph from the generated ROADMAP.md while #7081 had just re-homed that paragraph into roadmap_authority.dag - post-merge main drifts the opposite way (authority has it, committed md does not) and the drift gate reds the next main run that reaches batch 4. This regenerates ROADMAP.md from the authority, closing the drift. Sheet updates: wave-red receipts row (drift-gate red healed by #7081; stale CommitWitnessClaim roster row from #7060 hotfixed by #7079 incl. the #7064 orphan; the third collision above), the stale-roster stabilization-loop instance, and #7076/#7008 marked merged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fdkaGGLUKpLRwwqxp5sLg * falsifier green: nfr roster burn-down (3 rows) + CI-ergonomics lane on the operator TODO Rosters the 3 unrostered non-fold-residue sites that have kept the scheduled cold falsifier red since 2026-07-16 (alert #7032), each with its class reason and dissolution trigger per the #6691 shape: host_converge_slice1 host_result_all_valid / host_result_applied_count (legacy-result-bridge projections, #7009) and host_hygiene_reaper action_kills_build_cache_server (two-axis discriminating predicate, #7026). Receipts: nfr_roster_receipt unrostered=0 stale=0 (was red with exactly these 3 sites before the edit - the discriminating control), non_fold_residue_clean_holds evaluates true by execution, fmt clean. Sheet: falsifier row marked landed, wave-reds row credits #7082 for the drift close, new CI-ergonomics lane row (operator ask 2026-07-22) under item 2. ROADMAP.md regenerated via main_wet at the fixed point. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fdkaGGLUKpLRwwqxp5sLg --------- Co-authored-by: Claude <noreply@anthropic.com>

…es prelude bare names (main-red) (#7080) * WIP: Fix layering gate false edges: reference-derived producer misattributes * WIP: Fix layering gate false edges: reference-derived producer misattributes * Fix reference-derived layering edges misattributing binders and record fields. The #7060 reference producer treated every parsed node.name as a cross-module bare reference, so param binders (items), match bindings (r), and record-literal field labels (decl_name) resolved to unrelated extdeps modules. Narrow collection to actual value/type reference sites and stop exporting Conj record field names from the decl index. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: Fix layering gate false edges: reference-derived producer misattributes --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>

…enceJob) Batch 4 breaches its clamp on every run of this PR — 571556ms (srv3-01) / 613864ms (srv2-02) against clamp_ms=420000 at units=74, authority gunbc.ci_spec gunbc_ci_floor_batch_clamp_params[3]. Both batch-4 groups PASS; it is the wall, not a witness. Per the operator ruling, six declared rows move off the per-PR floor to the 4-hour falsifier cadence: the three wave1_gate1_d_* rows (141s + 29s + 27s) and the three affected-set provenance walls (14s + 13s + 13s), measured in the run-30148859947 slow-witness tables. That removes ~237s of eval, landing batch 4 near 334-377s under the unchanged 420s clamp. The vehicle is NOT gunbc.ci_layer_roots falsifier_rehomed_bin_wet_rows. That roster is specifically the bin_witness_wet_entries per-row-budget overflow (constructor bin_wet, budget datum bin_witness_wet_per_row_wall_budget_seconds) and does not model CommitWitnessClaim rows; re-homing through it would mint a second re-home authority. Instead this extends the axis that already answers "where does this check run" — the enrollment surface — with a fourth variant, FalsifierCadenceJob, plus the batch that reads it. The batch lands in the SAME change as the surface deliberately: a surface tag with no consumer is enrollment-by-illusion, which is the state ~54 files under test/claim/long/ are already in (excluded from discovery at dir grain, not walked by the falsifier, enrolled nowhere) and it would present as a clean green diff. gauntlet_lane_enrollment_witness_test reds per-PR if a row ever sits on the surface without reaching a batch. Two entries split at the check_fn rather than moving whole, so each concern keeps per-PR coverage at the cheap grain and loses only the wet grain: affected_set_provenance_producer keeps its four <=161ms fns on the floor, parse_binding_fidelity keeps witness_resolve_distinct_param_bindings_holds. FOUND BY THE WALL, first execution: the doc-reachability witness (doc_graph_has_no_orphan_docs, doc_graph_has_no_dangling_links) rode surfaces: [GitPrePushHook] alone — enforced only by a mechanism this repo has already ruled is not an enforcement authority (opt-in per clone, bypassable with --no-verify, absent in container worktrees, proven ineffective by #6658). Orphaned docs and dangling links had no wall on any CI path. Fixed by adding the cadence surface, NOT by widening witness_enrollment_is_scheduled to accept the hook — widening the predicate until the failure disappears is the absorbing fallback, and would have re-buried the finding that surfaced it. Placement (PrTier | Gauntlet) is the intended end-state authority and is recorded as the dissolve-on, not wired here: PrTier is unwritable without a WarmCostReceipt whose measured_ms is within the 5s fast-lane budget, so wiring it onto all 36 CommitWitnessClaim rows needs a per-row measured receipt and the D2 warm-cost probe has not run. Fabricating those receipts is the fail-open the placement law exists to forbid; defaulting the unmeasured rows to Gauntlet would de-enroll all 36 at once. Encouraging convergence: the 5s law selects exactly the twelve rows measured over 5s and admits every other batch-4 row at <=1s, so placement and this surface agree on today's roster. dag_compile_clean_perturb_receipts_holds is deliberately NOT re-homed. It was retained by the 2026-07-23 ruling by name because it measured 53s, under the 60s per-row budget; it now measures 141s. Re-homing a row that got 2.7x slower answers the wrong question and would zero the deficit's frequency by construction. Its growth is diagnosed separately. Proven by execution: all three files compile clean (0 blocking errors); gauntlet_lane_enrollment_witness_test 3/3 green in 3ms, inside the fast lane. Both claims proven live by perturbation — reverting one re-home reds _rehomed_rows_are_cadence_enrolled_holds, and _is_never_bare_deenrollment_holds was RED against the live roster before the doc-reachability fix and green after. The RED control discriminates a synthetic bare de-enrollment. commit_witness_claim_roster_holds (the #7060 stale-pair class, live) PASS. No generated-artifact drift: the ymls invoke plan functions, so batches compute at run time and the falsifier picks up the new batch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk

…s debugging it surfaced (supersedes #7162) (#7216) * D0 retention-truth close-out: unpin compile-clean memo, register all-hit keys, arm from loader closure The three post-merge retention defects from the ci-two-tier-placement-redesign §5 review (routed to the #7129 worker) plus the two §7 acceptance controls. Sequenced first: the falsifier cannot go green — and no downstream placement row can cite true retention receipts — until these hold. D0.1 — compile-clean aggregate memo unpin. The whole-tree gate resolved through resolved_graph_from_sources_with_index, pinning the aggregate ResolvedGraph (hence every TypedModule) in resolved_graph_memo for the process lifetime — a large slice of the measured 9.2GB resident floor. Thread a ResolvedGraphMemoShare::{Memoize,Ephemeral} flag: the gate resolves Ephemeral (no aggregate pin); per-entry discovery keeps memoizing. The per-module typed-cache warming that IS the gate's purpose is unaffected. D0.2 — prewarm all-hit registration. try_reconcile_all_cache_hits assembled and returned on all-hit WITHOUT index_record_schedule_module, so a prewarmed run armed retention referencing nothing (completion reported evictions while removing nothing). Record each confirmed hit in the probe, same key forms as the slow path. D0.3 — arm from the loader's exact closure (the #6985 Class-B root, third appearance). Arming used selection_adjacency; the discovery loader load_sources_for_entry_with_pool reaches wider via qualified-projection references from import-bearing files, so those modules were re-cached after eviction and never re-evicted or counted — an invisible resident leak. Arm from the loader itself (not a re-derived BFS that could become a fourth divergence); cost-neutral because the loader memoizes into entry_closure_sources, which discovery reuses. Removed the now-dead selection_closure_live_paths_with_facts. D0.4 — the two §7 acceptance controls. index_schedule_entry_completed dropped the resolved-graph pin unconditionally, so the eviction-disabled retain-all baseline understated peak retention; gate it on evict_enabled. The E2E control armed BEFORE prewarming (the order-blindness that let D0.2 pass green), so it never exercised the all-hit probe; restructure to prewarm -> clear graph memo -> arm -> re-resolve through the probe, and add a real-index retain-all RED. Verified green by execution: 7/7 schedule_retention tests, incl. the two restructured REDs (E2E arm-after-prewarm; real-index retain-all). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * D3 mechanism: two-tier CI placement axis (PrTier | Gauntlet) with fail-closed admission The placement-axis half of ci-two-tier-placement-redesign.md D3, buildable ahead of the D2 srv warm-cost probe. Placement is modeled as DATA (Placement = PrTier | Gauntlet), never per-site prose, with a FAIL-CLOSED admission law: a check is admissible as PrTier only with (a) a measured warm-cost receipt within the fast-lane budget AND (b) a hermetic/ephemeral classification; unmeasured or unclassified => inadmissible as PrTier, so its only valid placement is Gauntlet. No row rides the fast path by taste. The 5s threshold is REUSED from the single fast-lane authority (gunbc_ci_fast_lane_eval_budget_ms, v2.workflow.ci_floor_plan) — never a second 5s definition (DESIGN §3). Verified green by execution (claim_batch, 4 witnesses): - Gauntlet always admissible - a within-budget hermetic PrTier admissible - RED control: an over-budget (6000ms > 5s) PrTier is refused - RED control: an unclassified PrTier is refused The controls pin the threshold discriminatingly (1600ms admits, 6000ms refuses) and the classification gate (Hermetic admits, Unclassified refuses). Deferred to PR-1 (D2-gated): filling the roster of real checks with measured receipts (flipping rows to PrTier as srv warm-cost lands), wiring the law onto the live check rows, and the Gauntlet workflow split (D3b). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * D5 DiffBaseline: dissolve the origin/main literal into a typed single authority Per ci-two-tier-placement-redesign.md §11. Introduces DiffBaseline (MergeTarget | PushParent | OperatorOverride{ref}) as the single authority for "which git ref a diff/merge selects against", grounded on the extdeps.git atoms (GitRef, git_remote_ref_parts). resolve_diff_baseline is a pure, fail-closed fold over injected env values — a PushParent with no parent ref REFUSES rather than fabricating a ref. Live consequence fixed (site 1, floor selection): a stacked PR now selects against its real merge target (origin/$GITHUB_BASE_REF), not origin/main. DiffPolicy.base becomes a DiffBaseline; floor_diff_observe.floor_resolved_base resolves it at eval time from GITHUB_BASE_REF, fail-closed to UnifiedDiffFail (the floor widens to the full corpus) on an unresolvable base — never a silent wrong selection. Fork dissolution (no behavior change) — sites 2/3/4 re-ground the same literal onto the authority: merge_admission_produce (merges into main), roadmap_dispatch_actuator (branches from main), ci_workflow Push/PR triggers (main). The ci_merge_base_ref alias and the dead ci_merge_base_diff_range are deleted. Also carries the parked miscite fix (rust_tests_removed_disposition -> commit_gate_rust_suite_removed_disposition) in DESIGN.md / design_document.dag / ci_spec.dag, per plan §3.3. Verified by execution: ci_diff_baseline_witness_test (6/6, incl. the discriminating stacked-PR pair and the PushParent-refuses fail-closed control); ci_spec_witnesses (fetch renders "origin $GITHUB_BASE_REF"; single authority); roadmap_dispatch_actuator_witnesses. ci.yml + DESIGN.md regenerated via main_wet (drift clean; the two floor/regen fetch lines now expand $GITHUB_BASE_REF). floor_diff_observe_witness_test runs green in the floor's wet mode; its eval-time env reads are unmockable under claim_batch strict-hermetic, a PRE-EXISTING harness limitation confirmed by a clean-tree stash run of the same witness (this change adds no new hermetic red). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Progress/observation P0: the event model, five laws, one glyph authority P0 of the progress-and-observation lane (docs/plans/progress-observation-design.md, operator-signed 2026-07-23; §6b/§6c doctrine from #7169 folded in). Model only — no renderer, no emit site touched. ObservationEvent = subject (a typed containment path: run ⊃ batch ⊃ entry ⊃ module ⊃ phase) × Begin | Step{k,n} | Concluded{outcome} × measured facts. Outcomes are a closed sum with Refused DISTINCT from Failed — the reference implementation conflates them, which is how a deliberate refusal reads as a crash. Grounded on existing authorities rather than minted: - ancestry reuses std.effect_grant.path_is_prefix (one prefix relation, not a second walk) - over-budget arithmetic calls std.temporal_effect.stall_budget_verdict - change kind projects from std.change.KeyedDiffHunk — no second added/modified/removed enum - glyphs extend std.symbols + extdeps.render.glyphs rows (the one table), never a fork - module_path/source_path carry std's existing representation (std.decl_ref's), with convergence to QualifiedName/SourceRef declared, not assumed Derived, never hand-set: AttentionLevel from a supplied basis (the signed clamp constants — no threshold is invented in this module); BlockedOn from SchedulerHold, which is held in lockstep with the seed governor's HoldReason by execution; T from the heartbeat period the seed actually sleeps, declared a Scaffold with the measured quiet-time distribution as its dissolve-on. Construction over validation: the no-op sum is closed (docs-policy | uncovered | no-decls-touched | generated-artifact | departed-path), so a bare unlabelled "nothing" is unwritable rather than censused after the fact; uncovered derives a visible nudge, departed-path is typed as a widen and not a no-op. Green by execution, with discriminating REDs proven by perturbation: - 28 model conjuncts + 6 lockstep conjuncts PASS - orphaned law row (enforced_by names a missing declaration) → RED - Refused/Failed collapsed onto one glyph → RED (both distinctness and collapse laws) - glyph-table row perturbed → presentation moves → RED (single authority, by execution) Compile-clean attributed: the closure's 47 errors are pre-existing in std/measure.dag (46) and std/effect_grant.dag (1) — identical counts compiling those entries alone; zero attributable to this change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Review 42157: collapse the duplicate display tables into one authority Addresses the blocking finding on the three coproduct predicates, taking its stronger alternative (dissolve into the canonical surface) rather than only its weaker one (add a disposition receipt). The finding was right about the real defect: observation_class_is_intrinsic_anomaly was a second hand-written table beside observation_presentation, and a witness asserted the two agreed. That witness was validation standing exactly where construction was available — it conceded the tables could disagree and promised to notice. Fix: ObservationDensity (RoutineCollapsible | SummaryAlwaysShown | AnomalyExpanded) is now the one table. collapsible, expands_fully and intrinsic-anomaly are all derived projections of it, so disagreement is unwritable rather than detected. The three display states stay distinct — the run summary is neither routine nor an anomaly, which a single boolean would have forced it to borrow. Disposition receipts added for the remaining structural readers, matching the cited materialization_ladder pattern: outcome/class, subject/grain/hold, and selection no-op. Each states why it is Terminal and names its discriminating corpus rather than asserting terminality. Witness roles now separated and both proven by execution: - w_density_is_the_single_display_authority — the content check; reds when a class's density changes (verified: ClassRefused → RoutineCollapsible reds it, and reds ONLY it, since the projections cannot disagree) - w_presentation_projects_density_rather_than_restating_it plus the two collapse witnesses — construction guards; red when the presentation stops projecting density (verified: hardcoding collapsible: true reds all three) Full suite green: 30 model conjuncts, 6 lockstep conjuncts. Compile-clean unchanged — 47 errors, all pre-existing in std/measure.dag (46) and std/effect_grant.dag (1), zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Review 42166: ground PSI avg10 on std.measure.BasisPoint The finding is correct and the hard-blocker applies: avg10_centi was a percentage magnitude with a scale carried on bare Nat, and the note beside it self-justified the conflation rather than tracking it. Fix consumes an EXISTING carrier rather than minting one, which the corpus had already asked for in advance. std.measure.basis_point_dissolve_on warns: "else a third dimensionless-ratio use-case mints a third nickname" — this module is exactly that third use-case, so minting PerMille or a Percentage quantity would have walked into the failure the row names. BasisPoint's own note declares its semantic axis as utilization ratios, which is what a PSI stall share is. Resolution is exact rather than truncated: the governor reads one decimal of a percentage and a basis point is a hundredth of a percentage point, so 37.5 percent is 3750 with nothing lost. Percent (Dimensionless, One) would have truncated it. Note rewritten to state the grounding and the deliberate non-mint, replacing the self-justification. When the Ratio<Scale> unification that dissolve-on calls for lands, this field follows Percent and BasisPoint onto it with no change of meaning. Suite green: 31 model conjuncts, 6 lockstep conjuncts. Compile-clean unchanged — 47 pre-existing errors in std/measure.dag (46) and std/effect_grant.dag (1), zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Piece 3: derived per-batch floor clamp — delete the static wall-budget list Per ci-two-tier-placement-redesign.md §9.8 (operator 2026-07-24). Replaces the hand-set gunbc_ci_floor_batch_wall_budget_seconds list — a scalar wall budget that conflated workload size (diff-proportional selection), host speed, and per-unit cost creep — with a per-batch clamp computed at run time: clamp_ms = overhead_seconds*1000 + runtime_unit_count * per_unit_ms. The load-bearing row is the discovery witness batch (index 2): 300s + 1000ms per witness, so a full corpus of ~2316 witnesses clamps at ~44min (under the 55-min step cap, with headroom over the observed 1344-1629s walls) while a runaway reds proportionally, instead of the fixed 1320s that redded legitimate hub-file PRs. Fixed-count gate batches carry rate 0 at their measured basis; index 3 (wet corpora) stays a declared fixed overhead pending the D2 probe's wet-per-witness rate. Authority: gunbc.ci_spec FloorBatchClamp + gunbc_ci_floor_batch_clamp_params (index-aligned to the 7 batches; the cover-schedule witness pins the alignment) + gunbc_ci_floor_batch_clamp_note (carries the raise discipline from the kept static-era note). The 5s per-WITNESS max is unchanged — still the single gunbc_ci_fast_lane_eval_budget_ms authority, never redefined here. claim_executor reads the two index-aligned param lists fail-closed, derives the per-batch unit count from batch_results (corpus_witnesses for discovery aggregates, 1 per gate row — the runtime datum the static list ignored), computes the clamp at enforcement, and refuses over-clamp as a typed FLOOR-BATCH-OVER-BUDGET (never a widen). The GUNBC_FLOOR_BATCH_BUDGET_TIGHTEN_MS RED-control hook now lowers the COMPUTED clamp. The receipt emits batch_N_units / batch_N_clamp_ms / verdict; its unit test is updated. Both run_walk call sites carry the new param. Verified by execution: build clean; ci_floor_plan_witnesses green (the three new clamp witnesses + cover-schedule). The receipt verdict unit test and the fixture RED control (budget_red_control_plan; TIGHTEN_MS=0 -> clamp 0 -> the FLOOR-BATCH-OVER-BUDGET refusal) are the e2e enforcement confirmations; the fixture's control witness triggers a whole-tree emit that OOMs alongside a compile in this container, so both run as a clean post-commit confirmation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Finish #7146 adoption: regen ci.yml from merged authority, drop orphaned D5 witness The merge that adopted #7146's landed gunbc.diff_baseline (and dropped my redundant D5 gunbc.ci_diff_defaults) left two remnants: - .github/workflows/ci.yml carried an auto-merge artifact — the regen step and floor step fetched `origin $GITHUB_BASE_REF` (my dropped D5's bare-var form) instead of `origin main` (#7146's authority, which resolves the diff baseline at floor eval-time via resolve_diff_baseline, not at fetch time). Re-running `gunbc ci` regen re-derives ci.yml from the merged ci_workflow.dag, restoring the `origin main` fetch. - src/v2/test/claim/ci_diff_baseline_witness_test.dag imported the deleted gunbc.ci_diff_defaults module (my D5 authority), which would break the corpus compile. Its 6 witnesses are strictly superseded by #7146's landed dag/test/claim/diff_baseline_witness_test.dag (11 witnesses, with stronger fail-closed semantics on PR absent-base). Deleted as dead weight. Co-Authored-By: Claude <noreply@anthropic.com> * P1: the CI-log renderer, with the captured crawl window as its acceptance Second phase of the atomic P0-P3 observation PR (operator ruling: only finished work merges; a landed event model with no renderer is vocabulary nobody can see). gunbc.observation_ci_render projects the std.observation stream into append-only log lines. It computes nothing and holds no telemetry source — every number it prints arrives in an event or a heartbeat sample the process already had — which is precisely what makes replaying a real captured run possible rather than a synthetic fixture. FLAGSHIP ACCEPTANCE, green by execution: the fixture is run 30044816605's actual log, not a reconstruction. Its heartbeat at t=33m carried current=16107200512 swap=34359738368 psi_some_avg10=9.01 and named no subject at all, while the process sat inside v2.compiler.normalized_tree for 606984ms and disclosed that only at walk end. Re-rendered through the escalation law the same window produces named activity: identity-first heartbeats in human units (15.0 GiB, not the raw byte dump), the quiet module surfaced at T, and the memory-reclaim cause surfaced at 2T. Contracts from section 6b in force: plain-sentence tone, real emojis from the one glyph authority with the clock pulse, identity before vitals, durations on every outcome line, refusals restated at the end so log truncation cannot hide them, and relayed subject text neutralized through the existing GitHub guard so a child's stderr cannot mint workflow commands in the parent run. Law 4 made structural: line placement is DERIVED from attention, so a refusal cannot be written into a collapsed group — the group is exactly where a reader will not look. Escalation has two rates: reveal depth grows linearly (one tree level per threshold) while emission points double (T, 2T, 4T), so a window that stays quiet escalates without becoming a per-minute drumbeat, bounded by construction. Three REDs proven by perturbation, as the ruling requires: - planted silent phase (escalation never emits) reds responsiveness - an orphaned Begin reds the watchdog - a Refused placed inside a collapsed group reds Review 42203 (three findings, all correct, all fixed): - ci_gibibyte_tenths respelled the GiB scale factor as a literal; it now consumes std.measure.gibibyte_scale_factor_bytes, and the duration helper consumes seconds_per_minute plus a new milliseconds_per_second added beside its siblings in that authority. A unit authority forked inside a formatting helper is easy to miss because it looks like arithmetic. - the run summary picked the refused glyph whenever refusals+failures>0, so a failures-only run rendered as refused — collapsing at the last line exactly what the outcome sum exists to establish. Failures now dominate the glyph, refusals keep their own, both counts stay in the text. - an unavailable duration silently vanished from concluded lines, breaking the model's own rule that an absent measurement names its cause. It now says so. Each fix carries a witness; the summary fix carries its own RED. Suite green: 31 model, 6 lockstep, 18 renderer conjuncts. Compile-clean unchanged at 47 pre-existing errors, zero attributable here. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * P2: the interactive TTY renderer, a sibling projection of the same carriers Third phase of the atomic P0-P3 observation PR. gunbc.observation_tty_render projects the SAME std.observation stream the CI renderer projects — a sibling, not a successor and not a second model. The two differ only where the medium differs: a terminal can be repainted, so routine progress overwrites one line in place and stays quiet; a CI log cannot, so it appends. Everything they share — the event vocabulary, the density authority, the glyph table, the duration/byte/percent projections, the hold-cause text — is imported from the CI renderer or the model, never re-derived. A witness proves the sibling property by execution: the same event drives both surfaces and moves together. The three upgrades over the reference implementation are INHERITED from the shared carriers, not re-earned: outcome lines carry durations, Refused is distinct from Failed, and dwell escalation is recursive. The reference has none of the three; the TTY renderer gets them for free by projecting the same model. Law 4's asymmetry, expressed here as cursor action rather than group placement: repaint-vs-scroll is DERIVED from attention, so a refusal cannot be repainted away — overwriting it would erase it the instant the next line arrived, the terminal form of burying it in a collapsed group. Required preamble (no anonymous process), BlockedOn inline with named remaining (a bounded estimate prints the time; an unknown one prints why, never a fabricated ETA), and the reward animal on Final drawn deterministically from the one glyph authority so replay is preserved and a non-emoji terminal degrades to a word. Also in this commit: the self-host regen of the seed. P1 added milliseconds_per_second to dag/std/measure.dag, a seed-emitted module, so src/v1/stage0/src/std_measure.rs is regenerated to match — the required same-PR regen for a generated-artifact source edit. Fixed point verified by rebuilding regen_stage0 from the new seed and re-running to zero drift. Suite green: 31 model, 6 lockstep, 18 CI-renderer, 10 TTY-renderer conjuncts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * P3: the emit-site census wall Fourth and final phase of the atomic P0-P3 observation PR. gunbc.observation_emit_census is the census authority. Every place the floor emits a progress line is either a projection of the observation event stream or a counted frontier row with a reason and a dissolve-on — the same discipline the site lane uses for unthemed colours. EmitSiteDisposition is a closed sum, so a site cannot be half-classified, and there is no third arm for a site the census has not looked at: the roster's completeness is what the witness checks against the seed. The roster carries the structured-tag emit families that exist regardless of the CI rework: [floor-memory], [typecheck-attribution], [gantt], [governor], [measurement]. The named negative example the operator called out — the [floor-memory] raw byte dump — is a rostered frontier row, so the census already carries the very site it exists to kill, with its dissolve-on naming the P1 heartbeat projection that replaces it. Sequencing per the ruling and design section 6b: the CI two-tier rework rewrites the floor's emit sites, so the exhaustive per-print wall over the ~75 raw eprintlns in claim_executor is a declared frontier gated on this PR rebasing over that rework and re-censusing. Censusing sites about to be rewritten is the double-churn the operator ruled out. What lands now is the census model, the roster, and the executable hygiene witness — never a hidden zero: five families migrated-pending, the raw-print residue counted, and the witness holding the roster against the seed so it cannot rot into a lie. Executable, not inert: the witness reads the live seed and reds when a rostered marker has vanished (staleness — proven by a RED control) or when a frontier row lacks a real dissolve-on. The [floor-memory] shape is checked positively — still present, still classified frontier — so the census cannot quietly drop it. This completes P0-P3. Full suite green by execution: 31 model, 6 lockstep, 18 CI-renderer, 10 TTY-renderer, 6 census conjuncts, each with discriminating REDs proven by perturbation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Piece 3: name the clamp coefficient's measurement basis (operator addition, 2026-07-24) The 1000ms aggregate coefficient now records its basis in gunbc_ci_floor_batch_clamp_note: host class (srv arm64 self-hosted, capped) x the adaptive governor's realized worker width, denominated against the observed 0.58-0.70 s/witness (the 1344-1629s full-corpus fleet envelope over ~2316 witnesses). Naming the basis makes a future width or fleet change a deliberate re-sign of the constant, never a rediscovered fleet-wide red; the ~1.4-1.7x headroom over the observed top rate is exactly the >=~1.6x runaway the clamp catches, with sub-threshold creep owned by the gauntlet's per-cadence s/unit receipt. Co-Authored-By: Claude <noreply@anthropic.com> * Probe (①/②): emit a per-gate warm-cost TSV from the floor's existing timings Instruments claim_executor with write_gate_warm_cost_receipt — one row per gate/claim (eval wall + resolve + combined warm_ms) and a discovery row carrying the per-witness rate — derived from the ClaimResult timings the walk already records (operator ruling 2026-07-24: instrument the existing floor, no throwaway probe workflow). Written to target/floor-gate-warm-cost-receipt.tsv and mirrored to the log as [gate-warm-cost] rows so the placement probe lifts it from get_job_logs on a fleet run. This is the placement roster's measurement basis: a gate rides PrTier only if its measured warm cost is within the 5s fast-lane budget, else fail-closed to Gauntlet (v2.workflow.ci_placement). Every floor run now auto-emits it; run cold-then-warm on >=2 hosts and the roster records value + host basis. Verified green-by-execution locally (single-claim row); the discovery-row path verifies in the next full-corpus CI floor. Fail-closed on a write error, consistent with the other floor receipts; never a verdict term. Co-Authored-By: Claude <noreply@anthropic.com> * Flagship replay as a green witness — the before/after made executable The operator's "show me": proven-by-witness without a visible sample is the fluent-but-unseen trap. dag/test/claim/observation_crawl_replay_test.dag renders the captured crawl window of run 30044816605 through the P1 CI renderer as one assembled block and asserts it by execution: - names the module where the capture was silent ("still in witness discovery: entry 214 of 602, now typecheck v2.compiler.normalized_tree", surfaced at T, the memory-reclaim cause at 2T) - uses human units, never the raw byte dump (15.0 GiB, not 16107200512) - ends in a named refusal summary, not a silent 55-minute timeout observation_crawl_after_block() is the exact function the PR body's after-sample is produced from, so the pasted before/after is a projection of a green run rather than prose. Every input number is read off the real log. The earlier gunbc/observation_crawl_demo.dag (a run-entry that returned a String and so errored on the ProcessExit contract) is replaced by this witness — a green check is worth more than a run-entry that prints then fails. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Wiring flip (1/n): install the output policy BEFORE the naming walk — kill the [file] firehose The floor's [file] read firehose (2265 lines / ~99% of the log, measured by execution) was the pre-plan naming-hygiene walk reading the whole source tree at the OutputDecision Full default, because install_output_policy ran AFTER the walk (claim_executor.rs order). gunbc.output_policy already models Instrumentation => Suppressed at Normal (CI's default verbosity) and ShellTrace => Condensed — the walk just never saw the policy. Fix: install the policy (and group syntax) FIRST, before the naming walk and every subsequent corpus read, so all host-effect traces are funnelled per the .dag authority. Verified by execution on the minimal smoke plan: [file] read 2265 -> 0, total log 2613 -> 24 lines, claim still PASS (exit 0). The Ambient semantics hold — the policy's divergence rule (ExpectedOutcome/ObservedOutcome) still expands a captured stream on failure, so a red effect is never silenced; only the green firehose is. This is the highest-leverage lever of the observation-emit census flip (the echo class the census targets). Follow-on commits route the display families ([floor-memory], [gantt], [governor], [measurement], [t+..]) through the observation stream as Ambient projections (the ✅/🕐/🚫 format matching #7168's "after" block). Co-Authored-By: Claude <noreply@anthropic.com> * Wiring flip (2/n): render floor phase marks through the observation authority Step 2 of the flip (format), after step 1 (the [file] firehose, volume). The prelude phase marks are the visible display class in the short regen job's log; they now render through the single-authority observation renderer instead of a raw [t+…] byte string the seed would fork the format into. before: claim_executor: [t+86.1s] naming-hygiene walk complete after: ✅ naming-hygiene walk done in 48 seconds - New seed→.dag boundary gunbc.observation_seed_render: primitive args in, a rendered line out — exactly as cli_run.install_output_policy calls output_policy.resolve_channel_policy. A phase concluding is modelled as a Concluded event on a PhaseSegment subject, projected by ci_event_line ∘ ci_render_line, so the FORMAT stays single-authority in gunbc.observation_ci_render and the seed constructs no format of its own. - The raw [t+{:.1}s] eprintln is DELETED, not suppressed (grep-clean for the print). §5: on a renderer-unreachable failure the arm names the degradation loudly and never reproduces the old marker. - Per-phase walls (delta since the last mark), not a running t+, so the log itemizes which prelude phase is slow — the step toward the per-phase receipt keys the ci_spec prelude-coverage-hole follow-up (row a) calls for. - Green by execution: phase_mark_renders_through_the_observation_render_authority resolves the adapter through a real interpreter and asserts human units + the completed glyph + NO [t+ marker (the discriminating RED). The seed→.dag resolve is memoized, so the renderer resolves once and later marks are cache hits. Rust-called-.dag-unimported has precedent (output_policy.dag). Next in the series: the rostered census families. floor-memory (the flagship byte dump) needs its subject feed plumbed first so it renders honestly (entry X of Y, never a fabricated 0 of 0), then gantt/governor/typecheck-attribution, each flipping its census row (CountedFrontierSite → MigratedToObservation) with the witness restructured to assert the raw marker is gone — the "witness fixes" step of flip → witness fixes → roster. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Witness fix: roster the observation stack's one wildcard site (non_fold_residue) The progress-and-observation merge (#7168) added observation_ci_render.dag, whose ci_hold_cause_text names the two memory-pressure SchedulerHold variants specifically and gives the other five a generic cause via a top-level wildcard arm — a non_fold_residue site. It landed unrostered because per-PR affected-set selection predict-skips the corpus-read nfr witness (the masking class the roster's dated rows document), so it reds only on a cold whole-corpus sweep (falsifier / merge-to-main), not on the selected PR floor. That is the census wall doing its job on its own author. Roster it (gunbc.non_fold_residue, one FrontierRow, reason + dissolution trigger toward a total match), matching the established masking-class fix and preserving the observation author's design. Green by execution: observation_hold_cause_wildcard_is_rostered asserts the live roster now carries dag/gunbc/observation_ci_render.dag::ci_hold_cause_text via the same host reader the corpus scan uses — reds if the row's key drifts from the scan's {rel}::{fn} key or the hand edit malformed the 126-row list. design_register_lift_parity (the other cold-red thought to be surfaced by the merge) is NOT touched: this branch's gunbc.site.* inputs are byte-identical to main and recent main-push runs are green cold, so it is green here too — not attributable to this PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (4a/n): the floor-memory heartbeat's seed oracle + golden strings Foundation for migrating the [floor-memory] byte dump to the observation heartbeat. Adds gunbc.observation_seed_render.seed_heartbeat_line: the seed→.dag boundary that takes the primitives the heartbeat thread has (elapsed, batch label, entry position, memory vitals) and projects them through the one renderer (ci_heartbeat_line ∘ ci_render_line) — identity first, human units, no raw byte dump. The subject is batch-grain by construction: the floor walks entries in parallel, so there is no single active module to name, and the primitive interface carries none — never a fabricated per-module "now typecheck X". Green by execution: seed_heartbeat_line_renders_identity_first_in_human_units pins the exact bytes for two samples through the real interpreter: 🕐 33 minutes in — still in witness discovery: entry 214 of 602. memory 15.0 GiB, swap 32.0 GiB, pressure 9.0% 🕐 500ms in — still in self-host fixed-point: entry 0 of 2. memory unreadable (cgroup field unreadable), swap 0.0 GiB, pressure unreadable (cgroup field unreadable) The first is the captured crawl window re-rendered from the seed's own vitals (raw byte value absent); the second proves an unreadable cgroup field names its cause, never a fabricated zero (observation law 2 / §5). These golden strings are the oracle the Rust mirror is proven byte-equal to in 4b. Why a Rust mirror next, not an interpreter call: the heartbeat runs on a detached liveness thread in a memory-constrained context — resolving the renderer there would build a duplicate module index, consuming the very memory it watches (§2), and the thread exists to stay alive when the main interpreter is busy. 4b adds that mirror (proven == this oracle), plumbs the subject feed, wires it, deletes the byte dump, and flips the census row. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * File finding: shell.Env.Get realized as a printenv subprocess (transport-decomposition lane) Operator-directed finding (2026-07-24), do-not-fix-here. Records in the residual-shell census (§0b) a class distinct from that doc's shell-EMISSION axis: modeled ops whose interface shape is right but whose single hardwired transport is a shell escape where a NATIVE in-process handler is correct — the verbatim §3(b) N×M-adapter tell. shell.Env.Get (extdeps/shell/shell.dag:42) reads an env var the process already holds in its own environment by spawning `printenv` (wet_env_var, v1_interpreter.rs:5096). Reading your own environment is not a host effect; std::env::var is the native handler, chosen when locality is OnTarget, with shell/ssh reserved for a var on another host. Sibling: shell.Which.Check (`command -v`), already in the census. One root, three lanes. Not a floor-time lever (~ms/spawn); filed so the deficit is counted and prioritizable (§6), never absorbed into "it's only a few ms." Its native read is the lane's cheapest first consumer (a pure in-process read, no host_effect_apply even). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (5/n): shell-echo §5 split — routine Ambient, failure Anomaly self-describing The [shell]/$ echo class still printed at Normal after the firehose fix: it is the ShellTrace channel at Condensed, not the Instrumentation channel that [file] read rode. But naive "suppress ShellTrace at Normal" is a §5 fail-open — the failure stderr block rides the SAME channel via trace_emit(), so Suppressed would silence failures too. That Condensed was load-bearing. Root (operator's naming): one channel carrying two content classes with OPPOSITE attention — routine scaffolding (Ambient) and failure evidence (Anomaly) — a state-space conflation at the channel grain, exactly what the observation model dissolves by deriving attention per event, not per channel (law 4: routine collapses, anomaly expands). The fix uses the two EXISTING mechanisms, each governing its class — no third decision mechanism: - Routine ($ argv pre-spawn echo + [shell] done exit=… count) → the ShellTrace CHANNEL → Suppressed at Normal (Instrumentation's debug-only shape), Full at Verbose. - Failure evidence (stderr block) → the effect_stream DISPOSITION (SurfaceContent) ALONE, not the channel, so suppressing the routine echo cannot silence a failure. Two upgrades the disposition-gated block gains, both §5-correct now that the count is silent at Normal: 1. SELF-DESCRIBING — the block carries its own `$ <argv>`, so the failing command never scrolls away from its stderr (the pre-spawn echo it used to borrow from is gone at Normal). Strictly better than what suppression would have taken away. 2. SURFACES ON EMPTY STDERR — the block names the exit even when the command wrote nothing, because the routine count that used to carry the exit is now silent. Proven by execution: four-corner effect-stream suite kept; new discriminating RED at_normal_a_failing_effect_surfaces_its_command_a_passing_one_is_silent (passing → None; failing → `$ <argv>` + stderr) + stderr_block_surfaces_on_surface_content_even_with_empty_stderr. Channel witness updated (w_shell_trace_routine_is_debug_only: Suppressed at Normal). Convergence named in output_policy.dag: when shell effects become observation events, trace_emit(channel) stops being the gate and derived attention replaces this split. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Revert "Wiring flip (5/n): shell-echo §5 split" — approach was wrong, unbreak the branch This reverts commit 60a4496. Two defects, the second fatal to the approach: 1. Parse break (caught late): the witness carried `//` comments, but daglang has NO line-comment syntax — documentation is `data …_note: String` only. build_module_path_index scans every .dag at install_output_policy startup, so the parse error panicked the whole floor, not just that witness. LESSON: verify .dag by execution before pushing; a Rust-lib test does not exercise the .dag parse/resolve path. 2. The approach itself was wrong (the real reason for the full revert). Making ShellTrace Suppressed at Normal does not just silence the routine echo — effect_stream_disposition is GATED BY channel_decision: match channel_decision(channel, verbosity) { Suppressed => StreamSuppressed // failures silenced Condensed => divergence_disposition(…) // divergence surfaces, agreement counts Full => SurfaceContent } So Condensed-at-Normal is load-bearing TWICE (trace_emit AND the divergence disposition), and host-effect grouping keys on the same channel. Suppressing it is a §5 fail-open (a real failing effect's stderr goes silent at Normal); the Rust test passed only because it read the hardcoded EFFECT_STREAM_POLICY_FALLBACK, masking the installed-policy break. The alternative (route routine → Instrumentation, keep ShellTrace Condensed) leaves empty `##[group]` brackets and buries the failure block inside the collapsed section. FINDING for the redo: the channel↔disposition↔grouping coupling IS the "one channel, two content classes" conflation the operator named — and there is no clean immediate fix that does not touch it. The correct fix decouples the failure disposition from the routine channel verbosity (the "bigger lift" flagged as needing a design steer), which lands back at the operator's "Hold — I'll steer". The self-describing failure-block design (carries its own argv, surfaces on empty stderr) is sound and preserved in 60a4496's history for reuse. Branch returns to the green b35a4b3 state. Shell-echo goes back to HELD pending the disposition-decoupling design decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUqWZP4HTVyUfW4qRqWya1 * Wiring flip (4b/n): floor-memory heartbeat via render_heartbeat_line_mirror Flagship of the observation wiring flip: replace the [floor-memory] raw byte dump with the identity-first 🕐 heartbeat, proven byte-equal to the 4a seed oracle (seed_heartbeat_line). - render_heartbeat_line_mirror: pure Rust mirror of ci_heartbeat_line ∘ ci_render_line — the heartbeat thread cannot call the interpreter (duplicate module index under the memory envelope it watches). Discriminating RED render_heartbeat_line_mirror_matches_seed_oracle pins byte-equality on the crawl-window and unreadable-field goldens. - HeartbeatFeed (cli_run): process-global batch label + entries done/total, armed only when entry_total is known and non-zero (never a fabricated 0-of-0). Updated at batch-enter and at the existing index_schedule_entry_completed per-entry point (SingleClaim path increments per claim result). Discovery fills the total once the roster's entry-group count is known. - Delete the byte dump; keep the regime-disclosure line (marker stays for census hygiene). Flip floor_memory_site → MigratedToObservation; restructure census/lockstep witnesses (frontier 5→4, dump shape asserted gone). - Also: strip invalid // comments from output_policy_witness_test.dag that the shell-echo §5 commit left (dag has no // comments — parse Slash). Co-Authored-By: Cursor <cursoragent@cursor.com> Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * cargo fmt: claim_executor + cli_run after floor-memory 4b / main merge CI build failed at the fmt --all --check gate (assert_eq! wrapping + HeartbeatFeed Mutex.lock() chain). No behavior change. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [gantt] → Begin/Concluded PhaseSegment observation projection Compile-path trace_mark and GUNBC_FLOOR_GANTT emit through phase_begin_line / phase_concluded_line mirrors (byte-equal to the seed oracle; interpreter render from inside compile would recurse). Census row MigratedToObservation; raw t_ms/rss_mib shapes gone. Frontier 4→3. Verified via claim_batch on observation_emit_census_witnesses. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [governor] → ci_hold_cause_text / StatusBlocked observation projection HoldReason emits through seed_governor_hold_line (mirror render_governor_hold_line_mirror); hard/creep/receipt/startup lines lose the raw [governor] key=value shape. Census MigratedToObservation; frontier 3→2. Mirror↔oracle byte equality for PsiPressure and CurrentHighWater. Verified via claim_batch + memory_governor unit tests. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * cargo fmt: claim_executor after governor hold oracle RED Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Fix runtime_rust.dag: escape Rust format braces for daglang parse daglang treats {ident} inside string literals as interpolation; the gantt mirror's format!("{glyph}…") (and use std::sync::{Mutex,…}) panicked the regen self-compile. Escape as \{…\} so the emitted Rust keeps real braces. Emitter twin resynced; byte-equal to v1_rt.rs. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [typecheck-attribution] → ModuleSegment+PhaseSegment observation Per-module typecheck Begin/Concluded via typecheck_*_line mirrors (render_typecheck_*_line_mirror); 2s pathology threshold preserved. Census MigratedToObservation; frontier 2→1. Mirror↔oracle RED for the captured crawl fixture module. Verified via claim_batch. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Wiring flip: [measurement] + shell-echo → ObservationEvents (one pass) Measurement peak-RSS/cgroup dumps project through ci_measurement_rss_line (seed_peak_rss_line ↔ render_peak_rss_line_mirror; identity-first, human GiB). Shell host-effects become ObservationEvents: Ambient Begin/Done still gated by ShellTrace; Anomaly Failed gated by effect_stream disposition alone (never silenced by ShellTrace Suppressed), with law-4 idempotent group_end, self- describing `$ argv (exit=N)`, and empty-stderr surfacing. ShellTrace/ disposition tables left unread for the interim Condensed-at-Normal split. Census: measurement + shell MigratedToObservation; tagged frontier count 0; 76 raw eprintln residue recounted. Standing check: claim_batch census witnesses PASS before push. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Fix GeneratedArtifact name collision in observation_model witnesses Whole-tree compile-clean failed: bare SelectionNoOp.GeneratedArtifact collided with v2.std.artifact.GeneratedArtifact and gunbc.generated_artifact.GeneratedArtifact. Mint via selection_noop_generated_artifact in the defining module so the variant resolves unambiguously. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * Observation aesthetics: named-intent shell, glyph discipline, census bidir, failure-receipt miss Operator live-log review (run 30142403230) — four pieces in one pass: - Shell subjects are typed service.op intents; argv only in Failed.error. Ambient ShellTrace is Suppressed at Normal (silent scaffolding); Anomaly still surfaces via divergence alone (Quiet no longer forces StreamSuppressed). - Governor receipt uses StatusPulse (not Done glyph); peak RSS / governor / cgroup wrap in one "floor receipts" group. - Census roster grows four CountedFrontierSite rows ([floor-drain], [gate-warm-cost], [receipt], [file]) with a bidirectional hygiene witness. - Undeclared *_failure_receipt companions (NoMainFunction) treat as empty detail instead of stuffing failure_receipt_refused onto ordinary Bool(false) reds. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * Silence Ambient shell on gunbc run; roster #7205 resolve/assembly split tags Merge-admission stamp is `gunbc run`, which never installed output_policy — so ShellTrace fell back to Full and every Ambient Begin/Done still printed despite named-intent subjects. Install policy + group syntax at handle_run startup (same as claim_executor). Census grows [resolve-split]/[assembly-split] frontier rows so #7205's new tags stay bidirectional. Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * WIP: Floor #6848: memoize the per-entry bare-reference fixpoint so post-flip * Re-merge #7205 tip + native shell.Env.Get (kill printenv Anomaly clutter) Pull the two new #7205 commits (export_index canonical = fold element — kills the O(|bindings|^2) rescan). Route OnTarget shell.Env.Get through wet_env_var instead of printenv so optional floor_diff injections (GUNBC_CI_DIFF_*) no longer paint ❌ Anomaly Failed when unset — reading this process's env is not a host effect (§3(b) / shell-to-dag census 0b). Co-authored-by: Brian Searls <briansrls@users.noreply.github.com> * infer_semantics: unstale the slice control after #7196 admitted list slicing #7196 (bb4347d, on main) deliberately extended `check_slice_access_node` to admit ordered element collections — adding `base_is_list`, widening the refusal arm to `base_is_string || base_is_list`, and returning the base type rather than String on the list arm. `invalid_slice_returns_compiler_error_type` still pinned the withdrawn refusal, so it asserted one diagnostic where the compiler now correctly produces none: assertion `left == right` failed left: 0 right: 1 The witness went stale; the compiler did not. Repointed the negative control at a `Map` base — `ordered_element_collections()` (std_types.rs) holds `List` alone, so a Map is neither String nor an ordered element collection and must still refuse — and added the positive control #7196 admitted but never witnessed: a `List<Int>` slice yields no diagnostic and preserves `List`. Reproduced locally before the change (identical left 0 / right 1) and green after. Both controls proven live by perturbation: restoring the `List` base reds the negative control, expecting `String` reds the positive one. Note on how this reached main green: the witness never ran there. It is a binary witness whose transport (dag/tools/infer_semantics_witness_transport.dag) declares no dependency on v1_compiler_infer_access.rs, so the affected set cannot see the edge; main's run at bb4347d observed an empty diff and skipped 1761 of 2373 witnesses, this one among them. That selection escape is a separate defect and is not addressed here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * gunbc run: add --arg name=value, the missing parameter channel at the .dag seam `Commands::Run` was zero-arity by construction: `run_in_context` (v1_interpreter.rs:1543) ends in `call_function(ctx, &item_node, &[], &env)` — an empty argument slice — while `run_in_context_with_args` has sat twenty lines below at :1564 the whole time, already used internally by claim_executor.rs:166. Only the CLI flag was missing. The consequence is repo-wide and stated in the corpus itself (dag/gunbc/roadmap_belt_actuate.dag:689): "gunbc run --function cannot pass an argument (there is no --arg flag), so the node id enters through the environment". Every value that must reach a `.dag` entry crosses as an environment variable instead — 34 live GUNBC_* names across 77 read sites, including intra-process uses where sender and receiver share a PID (floor_skip_discovery_witness.rs:112-127 set_vars a synthetic diff and reads it back in the same process). The environment wins by economics, not design: adding a modeled parameter costs an edit to `cli_run`'s 29,626 lines of SeedRetained hand-Rust, adding an env var costs one line on each side, and `NamespaceTree` (dag/std/effect_grant.dag:26-31) has no environment arm, so no grant bounds it and no lens counts it. Named-only by construction: a `.dag` entry's parameters are named, so positional order across the CLI boundary would be an unchecked coincidence. A missing `=` or an empty name refuses with exit 2 before the compile runs (§5) rather than guessing a position, and one malformed spec refuses the whole list — a partial parse would silently drop a caller's argument. Values enter as `Value::Str`; no coercion is fabricated here. One path, not two: with an empty --arg list `run_in_context_with_args` passes the same empty slice `run_in_context` did, so the zero-arity path is unchanged rather than branched around. Threaded through the emission authority (src/v1/05_emit_rust.dag:10270 variant, :10495 match arm) and its seed mirror in v1_compiler_emit_rust.rs so regen stays a fixed point. Proven by execution against the built binary, not by typecheck: --arg node_id=roadmap-7 -> ExitSuccess, exit 0 --arg node_id=wrong-node -> callee received "wrong-node" (the value transports, not merely the flag parses), exit 1 --arg node_id -> exit 2, "expected `name=value`" --arg =orphan -> exit 2, "empty parameter name before `=`" --arg ok=1 broken also=2 -> exit 2, whole list refused no --arg -> zero-arity path unchanged Plus six unit tests (three of them RED controls) and `05_emit_rust.dag` compiled through the real pipeline: 0 blocking errors. Known gap, not papered over: the unit tests run under `cargo test`, which left CI on 2026-07-11 (gunbc.commit_workflow rust_tests_removed_disposition). An enrolled floor witness for this channel is a follow-on. Retiring the parameter-shaped env vars onto this flag — GUNBC_BELT_NODE_ID, GUNBC_CI_DIFF_*, CI_FLOOR_EXIT — is also follow-on; this commit adds the channel, it does not yet migrate the callers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * CI floor: give re-homed witnesses a real scheduled lane (FalsifierCadenceJob) Batch 4 breaches its clamp on every run of this PR — 571556ms (srv3-01) / 613864ms (srv2-02) against clamp_ms=420000 at units=74, authority gunbc.ci_spec gunbc_ci_floor_batch_clamp_params[3]. Both batch-4 groups PASS; it is the wall, not a witness. Per the operator ruling, six declared rows move off the per-PR floor to the 4-hour falsifier cadence: the three wave1_gate1_d_* rows (141s + 29s + 27s) and the three affected-set provenance walls (14s + 13s + 13s), measured in the run-30148859947 slow-witness tables. That removes ~237s of eval, landing batch 4 near 334-377s under the unchanged 420s clamp. The vehicle is NOT gunbc.ci_layer_roots falsifier_rehomed_bin_wet_rows. That roster is specifically the bin_witness_wet_entries per-row-budget overflow (constructor bin_wet, budget datum bin_witness_wet_per_row_wall_budget_seconds) and does not model CommitWitnessClaim rows; re-homing through it would mint a second re-home authority. Instead this extends the axis that already answers "where does this check run" — the enrollment surface — with a fourth variant, FalsifierCadenceJob, plus the batch that reads it. The batch lands in the SAME change as the surface deliberately: a surface tag with no consumer is enrollment-by-illusion, which is the state ~54 files under test/claim/long/ are already in (excluded from discovery at dir grain, not walked by the falsifier, enrolled nowhere) and it would present as a clean green diff. gauntlet_lane_enrollment_witness_test reds per-PR if a row ever sits on the surface without reaching a batch. Two entries split at the check_fn rather than moving whole, so each concern keeps per-PR coverage at the cheap grain and loses only the wet grain: affected_set_provenance_producer keeps its four <=161ms fns on the floor, parse_binding_fidelity keeps witness_resolve_distinct_param_bindings_holds. FOUND BY THE WALL, first execution: the doc-reachability witness (doc_graph_has_no_orphan_docs, doc_graph_has_no_dangling_links) rode surfaces: [GitPrePushHook] alone — enforced only by a mechanism this repo has already ruled is not an enforcement authority (opt-in per clone, bypassable with --no-verify, absent in container worktrees, proven ineffective by #6658). Orphaned docs and dangling links had no wall on any CI path. Fixed by adding the cadence surface, NOT by widening witness_enrollment_is_scheduled to accept the hook — widening the predicate until the failure disappears is the absorbing fallback, and would have re-buried the finding that surfaced it. Placement (PrTier | Gauntlet) is the intended end-state authority and is recorded as the dissolve-on, not wired here: PrTier is unwritable without a WarmCostReceipt whose measured_ms is within the 5s fast-lane budget, so wiring it onto all 36 CommitWitnessClaim rows needs a per-row measured receipt and the D2 warm-cost probe has not run. Fabricating those receipts is the fail-open the placement law exists to forbid; defaulting the unmeasured rows to Gauntlet would de-enroll all 36 at once. Encouraging convergence: the 5s law selects exactly the twelve rows measured over 5s and admits every other batch-4 row at <=1s, so placement and this surface agree on today's roster. dag_compile_clean_perturb_receipts_holds is deliberately NOT re-homed. It was retained by the 2026-07-23 ruling by name because it measured 53s, under the 60s per-row budget; it now measures 141s. Re-homing a row that got 2.7x slower answers the wrong question and would zero the deficit's frequency by construction. Its growth is diagnosed separately. Proven by execution: all three files compile clean (0 blocking errors); gauntlet_lane_enrollment_witness_test 3/3 green in 3ms, inside the fast lane. Both claims proven live by perturbation — reverting one re-home reds _rehomed_rows_are_cadence_enrolled_holds, and _is_never_bare_deenrollment_holds was RED against the live roster before the doc-reachability fix and green after. The RED control discriminates a synthetic bare de-enrollment. commit_witness_claim_roster_holds (the #7060 stale-pair class, live) PASS. No generated-artifact drift: the ymls invoke plan functions, so batches compute at run time and the falsifier picks up the new batch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * CI floor: operator-signed interim clamp raise, batch 4 420s -> 540s Signs the margin ruling for the budget family, not just this number. A clamp was doing double duty: merge-refusal threshold ("this must not merge") and growth detector ("something got slower — look"). Tight margins serve the second job and demonstrably worked — perturb's 53s -> 141s growth was caught precisely because the clamp was tight. But they make the FIRST job fire on host roulette, and a breach meaning "you landed on srv2-02" trains the on-call to rerun, which is crying-wolf wearing budget clothes. Policy signed here: clamps are sized to cover MEASURED fleet spread, so a breach means content grew, never which host answered. The growth-detector job moves to per-row trend receipts on the falsifier cadence — that piece is what makes a wider clamp safe, and it is sequenced next behind the perturb diagnosis. Basis for 540: post-re-home projection 377s (worst observed wall 613864ms minus the ~237s the six re-homed rows carried) x 1.2 worst observed spread = ~452s, + ~20% policy margin = 540 (whole-minute grain). Run ids: 30148859947 @ 619bba5 wall_ms=613864 units=74 srv2-02; 30163496549 @ 9f87967 wall_ms=571556 units=74 srv3-01 — identical content, 7.5% apart, which is the spread this funds. Enrollment that grew the batch: NONE. Batch 4 shrank this cycle (units 74 -> 68). The raise buys spread coverage on a batch that got smaller. Not the forbidden widen: batch 4's per_unit_ms is 0, which the clamp note already calls "a declared calibration gap, not a hidden default". 540 funds that gap with a dated, dissolving interim rather than leaving a flat rate to fire on variance. It refuses exactly as before — only the threshold moved, on a stated measurement, not to make a red go away. Dissolve-on: the perturb diagnosis lands (141s = 38% of the remaining batch; returning it toward its 53s basis puts worst case near 350s, under even the retired 420) AND the D2 per-unit rate replaces the flat clamp. The wet-receipt 600s budget (the 707s falsifier red) has the same disease — ten-day-stale basis, zero spread allowance — and the policy above governs it, but its NUMBER is deliberately not moved here: it is gated on its own sccache-vs-growth attribution so the dosing lands with a measurement rather than by analogy. Host spread is not weather: srv1/srv2 still run pre-#7213 sccache units and are typed expected-latent-defective until re-provisioned, so part of the 7.5-20% collapses when the fleet lane re-converges them. Proven: ci_spec compiles clean; witness_floor_batch_clamp_params_cover_schedule, _overhead_all_positive, _rate_all_nonneg all PASS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Extend the falsifier batch-count pin for the FalsifierCadenceJob batch 779e9dc appended gunbc_falsifier_cadence_witness_batch to gunbc_falsifier_batches() without extending falsifier_plan_structure_holds, which pins the schedule's batch count: let expected_batches = 1 + wet + probe + silent_pick + rehomed (length(xs: batches) == expected_batches) && ... So length was expected_batches + 1 and the witness returned false, redding ci_floor_plan_witnesses and with it batch 3 on run 30166208268. The pin worked exactly as designed — it exists to red when a batch is added without being declared, and that is what it did. Note what this masked: batch 3 failing stopped the walk before dependent batches, so batch 4 never ran on that run and the re-home + 540 clamp are still UNMEASURED in CI. The floor-batch-wall receipt read "3 batch(es), 0 over budget" — green on the batches that ran, not evidence about batch 4. The fix is not a count bump. falsifier_cadence_witness_batch_holds mirrors the silent-pick sibling and checks the batch's actual shape: SelectionApplied, zero scan_dirs, entry count matching falsifier_cadence_witness_entries(), Wet execution mode, spawns_host_compiler, and NOT heavy_whole_tree_resolve. The rehomed sibling is only counted, never shape-checked; this one is both. Proven live by perturbation, not just by going green: flipping the cadence batch's execution_mode from Wet to Hermetic reds falsifier_plan_structure_holds. Verified green together with ci_floor_optin_roster_witnesses, ci_corpus_discovery_flip_witnesses, and all three gauntlet_lane_enrollment_witness_test claims. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Decode \xNN in .dag string literals — no authored colour had ever rendered process_escapes resolved exactly six escapes (\" \\ \n \t \{ \}) and fell through on everything else to concat("\\", next), preserving the backslash. So "\x1b" was never an ESC byte: it was the four characters backslash-x-1-b. Every ANSI code this repo authored in .dag emitted as literal text — extdeps/render/ansi.dag csi_esc, extdeps/render/terminal.dag's reset, and gunbc/ci_render.dag's red/reset. That is the `\x1b[38;5;196m🔥` seen in the TOP SLOWEST WITNESSES table of run 30167957464, which read as a renderer leaking colours onto the CI path and was neither: the raw GitHub log carries real escapes everywhere else, so the defect was the decode, not the target. Fixed at the authority (src/v1/01_tokenize.dag), not the generated seed, via the already-registered from_code_point builtin — no new builtin. The seed file is regenerated by regen_stage0; it is `// Generated by v1 compiler`. Regen produced exactly this one file's delta, so the self-host fixed point held across the change. The witness that should have caught this could not. It compared one undecoded literal against another (code == "\x1b[38;5;34m"), so both sides were equally wrong and it agreed with itself throughout — the vacuous-oracle shape DESIGN §5 names, a check satisfiable by editing the declaration while the realization lies. Its two replacements test properties of the DECODE rather than of the spelling: the first character's code point is 27, and the decoded string contains no backslash. Neither can be satisfied by editing a literal on either side. Both were proven RED against the pre-fix binary before regen was paid for, and green after. Unknown-escape passthrough is knowingly RETAINED, and marked rather than left silent: 🟡 dissolve-on tokenizer_unknown_escape_strict_close. Refusing today would red 142 occurrences across 38 files — overwhelmingly regex fragments (\' 28, \. 19, \| 13, \/ 12, \B 10) that intend the backslash to survive — so the strict close needs a raw-string carrier to migrate onto first, and lands with a corpus-wide compile receipt because it changes parse semantics for every lane that compiles through this tokenizer. Not the four sites a \x-only count suggests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GELyMsZrGgZRrxte2TCsk * Layer 1: bind ExpectedOutcome from the call site, not the transport v1_interpreter.rs carried `let expected = ExpectedOutcome::ExpectSuccess` hardwired at dispatch_shell, with a comment saying where the declaration should live was still open. It is now read from the call site. The whole downstream apparatus already existed and was pinned — gunbc.output_policy's four corners, outcome_diverges, the Rust mirror in EFFECT_STREAM_POLICY_FALLBACK. Only the binding was missing, which is why output_policy.dag:105 could already describe the payoff in writing. WHERE IT LIVES, and the two homes that look right and are not: param_env is wrong because param_env IS the request: content_hash_service_inputs iterates op_node.params and looks each up there, so a service-op `input {}` would join the digest and two invocations differing only in what the caller expected would become different cache identities for the same request. The transport is wrong less obviously, and this is the trap. The nearest local precedent — transport_stdin, transport_response_format via find_property — points straight at it. But dispatch_service_wet receives the transport from op_node.transport.or(service_node.transport): the extdeps service-op DECLARATION, shared by every caller. Hanging the expectation there makes it a per-operation fact, so a red control and a genuine check both calling shell.Test.IsFile could not differ — and caller policy declared in extdeps is the DESIGN §3 layer inversion the original comment warned about. It would have compiled and read as green while being wrong twice. So it is a reserved argument on the call node, partitioned out in eval_method_call before bu…

briansrls and others added 3 commits July 22, 2026 13:54

WIP: Layering-imports CI gate re-derivation scoping: the gate enforce…

cf977f2

…s the la

WIP: Layering-imports CI gate re-derivation scoping: the gate enforce…

13e8ce0

…s the la

Update layering-imports repoint design doc for Phase 1 landing.

8423832

Record Phase 1 status and the witness_layer_roots pool / std+extdeps importer split required for qualified reference resolution. Co-authored-by: Cursor <cursoragent@cursor.com>

gunbai-bot Bot marked this pull request as ready for review July 22, 2026 14:32

briansrls and others added 2 commits July 22, 2026 14:43

briansrls merged commit 13fa1e8 into main Jul 22, 2026
1 check passed

briansrls deleted the session/swift-eagle-602 branch July 22, 2026 16:16

gunbai-bot Bot mentioned this pull request Jul 22, 2026

Main-red hotfix: stale roster row from #7060 + stale script-module import orphaned by #7064 #7079

Merged

briansrls mentioned this pull request Jul 22, 2026

Falsifier green: nfr roster burn-down (3 rows, receipts by execution) + wave-red receipts and CI-ergonomics lane on the operator TODO #7083

Merged

gunbai-bot Bot mentioned this pull request Jul 22, 2026

PR-time detectors: CommitWitnessClaim roster-resolvability check + always-on non-fold-residue receipt, with RED controls #7085

Merged

6 tasks

briansrls mentioned this pull request Jul 25, 2026

CI two-tier placement + progress-observation lane, and the two defects debugging it surfaced (supersedes #7162) #7216

Merged

gunbai-bot Bot mentioned this pull request Jul 25, 2026

shell→dag bucket A: last shell.Exec off host_runner_memory_cap_verify; meta-exec roster 3→0 + per-PR emptiness wall #7241

Merged

gunbai-bot Bot mentioned this pull request Jul 28, 2026

Extract unique occurrence witnesses from superseded #7383 #7391

Merged

Navigation Menu

Repository navigation

Layering-imports gate: repoint fact producer onto reference-derived edges (Phase 1) - #7060

Layering-imports gate: repoint fact producer onto reference-derived edges (Phase 1)#7060
briansrls merged 5 commits into
mainfrom
session/swift-eagle-602

gunbai-bot Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gunbai-bot Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Sequencing note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gunbai-bot Bot commented Jul 22, 2026 •

edited

Loading