Group-of-units standard representation: roster registry + lens, typed witness-exclusion frontier, lens-roster retrofits, native-routing subject re-key

[briansrls]

Group-of-units standard representation (operator ruling 2026-07-22, roadmap group 5a): a plurality of units must have a standard representation, never a nickname. One new authority, one lens, and the census retrofitted in the same PR.

The authority (net concepts +1)

• dag/gunbc/roster_registry.dag — GroupMembership = ByContainment | ByDerivation{predicate: DeclarationRef} | DeclaredFrontier{reason, dissolve_on}, RosterRegistration{roster: DeclarationRef, unit_kind, membership}, and roster_registry enrolling all 13 known unit-naming rosters. Carries the taxonomy note (POSITIONAL / DERIVED / FRONTIER / NICKNAME; mint → frontier → query), the enforcement-intent convergence note (StandingIntent/LensContract absorbs this registry later — its subject_roster IS this concept; deliberately NOT built here), the visibility honesty note (the lens sees only enrolled registrations; unregistered bare lists stay a review-bar catch until enforcement-intent lands; NON_FOLD_RESIDUE_ROSTER walled as the known un-enrollable residue — a DeclarationRef cannot name a Rust const, its re-home is the named follow-up), and the upcoming-target walls (bulk-native flip MUST land ByDerivation; long/ lane is BLESSED Form-C, registered ByContainment, not restructured; deploy lease guard needs no new group concept; machine-shape/CI-ergonomics "pool"/"class"/"lane" String keys at review = registry admission).
• dag/std/roster_frontier.dag — the shared FrontierRow{unit, reason, dissolve_on} carrier (DESIGN §7 typed-frontier pattern generalized), so std-, lens-, and workflow-layer rosters share one row shape instead of re-minting it per file.
• src/v2/lens/roster_registry.dag — every registration is ByContainment, ByDerivation, or DeclaredFrontier-with-nonempty-reason-and-trigger; enrolled in lens_registry_v0 (LensIdV0 RosterRegistry, lens_module_gate surface arm, sg_claims required-ids row).

By execution: roster_registry_test.dag — live registry green, RED control (empty dissolve_on) reds, RED control (nickname class: empty reason+trigger) reds, green control (all three standard forms) passes. lens_registry_completeness_holds_live green (the new lens is registry-bound).

Retrofit 1 — native routing frontier subject re-key (the #7069 follow-on)

family: String → subject: DeclarationRef (the construct/fixture declaration each family exercises). Membership DERIVED from the existing closure authority (v2.lens.module_graph import+reference edges): an agreement entry is a member exactly when its dependency closure reaches the subject's module — native_routing_row_membership_derived is the ByDerivation predicate the registry names. #7091's flip revert (agreement_red_on_main, 0 routed / 9 retained, routed_flip_reverted_note) is carried forward verbatim onto the subject-keyed rows. Parity receipts stay keyed by their falsifier-observation family names (observation data, not a second row key — noted on the carrier). Adjacency is built once and BFS-walked per entry (no per-(row×entry) recompute).

By execution: native_routing_derived_membership_equals_bound_entries GREEN on the live tree (~17min interpreted — the receipt derives exactly [row.agreement_entry] for all 9 rows, including both family-crate-bound rows) plus RED control (add entry does NOT reach the match subject) and green control — homed in src/v2/test/claim/long/ per the 5-second rule, run by the long-lane local recipe. native_routing_frontier_witnesses and pr_native_batch_witnesses green.

Retrofit 2 — ONE typed witness-exclusion frontier

witness_exclusion_substrings + witness_admission_offline_exclusion_substrings + witness_admission_fixture_exclusion_substrings (three parallel List<String>s reconciled by hand-written governance notes) → ONE witness_exclusion_frontier: List<WitnessExclusionRow> (71 rows: pattern, classification on the EXISTING v2.std.witness_admission.WitnessConsumerCadence authority — no minted twin — reason, dissolve_on; every prose reason preserved, per-group notes cited per row). The two admission lists are now derived classification-filter projections; witness_exclusion_substrings is the derived pattern projection under the same name. The synthetic admission RED-control path is the one honest NoConsumer row (typed, located — keeping the RED control alive). The old one-way-containment reconciliation witness dissolved with the lists it policed; its successor witnesses row well-formedness + explicit-roster consistency, with three RED controls.

Host side: witness_exclusion_rows_from_module_source parses the record-literal rows with the real front-end (tokenize+parse, the string_list_data_from_module_source sibling) — fail-closed on non-record rows, missing/non-literal pattern, or unrecognized classification (DiscoverySelection on an exclusion row refuses). Synthetic-authority + refusal unit tests added.

Equivalence receipts: discovery pattern list IDENTICAL to origin/main (71/71); across all 183 currently-excluded test files, derived offline/fixture classification matches the old lists with ZERO behavior mismatches; witness_whole_tree_resolve_exclusion_matches_concat_authority green; full cargo test --lib witness_ green; witness_admission_invariant_holds, witness_exclusion_frontier_reconciliation_holds + 3 RED controls, ci_floor_plan_witnesses, ci_corpus_discovery_flip_witnesses green.

Retrofit 3 — lens exception rosters → typed frontier rows

meta_exec_confinement_exception_roster (7 paths), realization_vocab_exception_roster (2), inert_carrier_roster (12 type names), complexity_linearity_migration_debt_roster (23 site keys), lens_registry_completeness_known_infra_roster (9) + _consolidated_roster (3, per-module reasons extracted from the aggregate note) — all List<String> → List<FrontierRow> with unit projections for consumers; existing law/aggregate notes cited per row, no information loss.

By execution: meta_exec discriminators (6/6), realization_vocab discriminators (10/10) + roster_soundness RED + long-lane live-corpus receipt (19s), inert_carrier live + RED discriminators (4/4), syntactic-audit wildcard_triage_classifies_migration_debt, completeness live + RED, sg_claims — all green.

Dropped to follow-up (allowed by brief)

• Stretch item 4 (NON_FOLD_RESIDUE_ROSTER re-home from cli_run.rs) — walled in the registry visibility note as the named un-enrollable residue.

Notes for review

• gunbc ci exits 1 identically on a clean origin/main worktree in this container (environment, pre-existing); ci.yml embeds no exclusion data and is untouched.
• lens_closure_question_zero_holds_live (enforcement, offline lane) fails identically on clean origin/main — pre-existing, not introduced here.
• The one frontier_probe_survey.rs unused-variable warning is CI onto v2: routing frontier + parity gate + consumption (P4/P2/R1/R2) #7069's code, untouched.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Review 41606's two findings addressed in bdc077f: in-Rust dissolve-on markers stamped on both hand-Rust sites — WITNESS_EXCLUSION_CLASSIFICATIONS (the hand-copied variant-name projection of the closed .dag coproduct) and witness_exclusion_rows_from_module_source (the source-parse reader) — both dissolving to a host-consumed emitted manifest of the frontier rows (the module-binding supply-carrier pattern), tracked with the NON_FOLD_RESIDUE_ROSTER re-home in gunbc.roster_registry.roster_registry_visibility_note.

— sent from fierce-ibex-519