Type-resolution fail-closed (b), staged: pool-coincidence mask + probe witnesses; corpus-wide flip gated on extdeps burndown

[gunbai-bot]

Staging (read first — what is enforced today)

This PR lands the refusal mechanism and probe witnesses under mask-on execution. It does not flip corpus-wide enforcement in this PR.

Scope	Enforced today?	How
Probe fixtures (dag/test/fixtures/type_resolution_pool_coincidence/*)	Yes	Mask enabled per compile via compile_dag_dag_fixture_witness_check; long-lane witness dag/test/claim/long/type_resolution_pool_coincidence_test.dag + cargo type_resolution_pool_coincidence_test.rs
Whole-tree compile (regen, heal, naming-hygiene, compile-clean)	No	TYPE_REF_POOL_COINCIDENCE_MASK_ENABLED defaults false at v1_rt.rs:178 — byte-identical to pre-PR pool coincidence
Flip to corpus-wide default-on	Gated	~1,549-site extdeps import burndown (classes A–D); hand_import_gate allows dag/extdeps/** additions; corpus compiles clean mask-default-on (type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger)

Not a §5 escape hatch: staged default-off mirrors NameResolutionPolicy (§8 ResolutionPolicy row) — strict arm beside current resolver, default equals current behaviour, flip after burndown. Typed counted frontier + named dissolution trigger; not an operator silence toggle.

Also deferred (declared scaffold, not fixed here): builtin_container_return_under_resolution_dissolution_trigger in 04_method.dag — map/set/list builtin return under-resolution; horizontal fix is a separate follow-on PR.

---

Summary

Staged fail-closed type resolution for pool-coincidence case (b): when the mask is active, a cross-module type name present in the compile pool but not import-reachable is refused with located UnresolvedType via bare_name_miss_diagnostic instead of fabricating Product(<anon>) that unifies silently downstream.

Core mechanism: type_ref_import_chain_reachable + type_ref_containment_bindable gate masked leaf type refs in resolve_node_bounded (04_resolve.dag:576 / v1_compiler_infer_resolve.rs). Reachability = import-chain overlay or containment-tree binding (lexical unique-on-ancestor-chain, qualified projection, on-chain global-bare policy with declaring_module_on_ancestor_chain — not off-chain pool coincidence).

Witness: four probe fixtures under dag/test/fixtures/type_resolution_pool_coincidence/, long-lane claim dag/test/claim/long/type_resolution_pool_coincidence_test.dag, Rust tests in type_resolution_pool_coincidence_test.rs.

Value-position arm (probe, not yet landed): isolated fixture dag/test/fixtures/value_resolution_unreachable_callee/ greens today — callee binds via func_sig_from_global_bare / borrowed_census_decl without import. host_converge_slice1 perturbation (drop runner_unit_live_read_typed import) surfaces Primitive(runner_unit_live_read_typed) at mismatch sites. Lane must extend mask to callees before binding code proceeds.

Hand-Rust attestation (seed mirrors)

• src/v1/stage0/src/v1_compiler_infer_env.rs — type_ref_import_chain_reachable, type_ref_containment_bindable, type_ref_mask_allows_binding mirror 04_env.dag.
• src/v1/stage0/src/v1_compiler_infer_resolve.rs — refusal at masked leaf before structural peeling; mirrors 04_resolve.dag:576.

Corpus cleanup scope

• Landed with fix: ~214 witness tests gained import v2.std.live_tree { … } for disposition rows that were bare+unimported on pool coincidence (operator: keep until Dispatch 2).
• Reverted (1114d2fc): 67 extdeps import-adds — collapse-proof integrity; do not hand-fix under CI pressure.
• Deferred: ~1557 whole-tree hard diagnostics on post-revert HEAD (1549 UnresolvedType + 7 type mismatches) until binding (a) lands.

Whole-tree census (post-revert HEAD 82dca07, method: gunbc compile --source-root dag --source-root src/v2 --target dag)

Class	Count	Mechanism / disposition
A — off-chain ExternalAuthority/Uri in extdeps	41	Single definer extdeps.external_authority; not ambiguity — sibling-module topology: declaring_module_on_ancestor_chain(extdeps.external_authority, extdeps.filesystem.*) is false (peer branches under extdeps.*). Containment (a) binds ancestor/descendant + on-chain global-bare only; explicit import extdeps.external_authority { ExternalAuthority } or qualified path required.
B — std.measure in extdeps	87	explicit import after census
C — std.types in extdeps	~350	explicit import / qualified
D — dag/test/claim/**	~646	mixed SVN vs pool-coincidence
E — gunbc/product/examples	~417	case-by-case

Type mismatches (7 — per-error, no bulk waiver)

Site	Error	Root cause
host_effect_nbd_proxy_serve.dag ×4	Product(NonEmptyStr) vs Primitive(nbd_proxy_serve_*_unit_name)	Value-position callee fabrication when unit-name helper not import-reachable
host_converge_slice1.dag ×1	Product(RunnerUnitMemoryLiveRead) vs Primitive(runner_unit_live_read_typed)	Same — callee binds as opaque Primitive when import dropped
host_converge_slice1.dag ×1	(with import present, whole-tree)	pool-coincidence callee + typed consumer juxtaposition
std/fidelity.dag:769	Coproduct(FermiDepth) vs Primitive(fermi_max_of)	Closure lacks resolved FermiDepth/Milliseconds in std.fermi; fermi_max_of return becomes Primitive(fermi_max_of) — value-arm fabrication surfacing in if-branch type check

Natural baselines: 1,788 (pre-cleanup historical) · 1,557 (post-revert HEAD).

Collapse proof method (measurement, not shipped state)

1. Record natural baseline (above).
2. After binding (a) lands, locally revert all cleanup commits (214 witness imports + any import-repair) on a throwaway branch.
3. Re-run whole-tree gunbc compile --source-root dag --source-root src/v2 --target dag.
4. Report collapse count as proof; ship the cleaned corpus (witness imports stay per operator ruling).

Test plan

• cargo test -p v1-compiler-tests pool_coincidence — 4 passed
• cargo test -p v1-compiler-tests probe_unreachable_callee_binds_via_global_bare_without_import — documents value-arm gap
• CI build expected red until binding + import repair; mid-PR reds are intentional

e92e840 — 39-file qualified-spelling revert (reasoning on record)

Commit e92e840 reverts the 285b88d v2.std.nat.Nat → bare Nat un-qualify in 39 files. Not reverting the ~214 live_tree witness import-adds.

Acceptance: Binding must cover qualified paths (v2.std.nat.Nat etc.), not bare-only — enrolled in census-collapse probes.

---

Filed CI defects (linked — not #7218 scope; do not fix inside this PR)

Receipt: runs 30217388856 @ 57f190b and 30219210240 @ a0464fb. Every witness in batch 4 returned green; floor failed on FLOOR-BATCH-OVER-BUDGET (wall_ms≈634–637s vs clamp_ms=540000, units=113). Filed here and left to operator merge policy — not engineered around by de-enrolling other lanes' rows.

1 — Structural per-row overage (pre-existing bin_wet enrollment)

Authority: gunbc.ci_layer_roots bin_witness_wet_per_row_wall_budget_seconds = 60s. Measured eval on run 30217388856 (all green, all over budget):

Entry	Function	eval_ms	vs 60s budget
expectation_frontier_witness_test.dag	undeclared_effects_emit_the_frontier_receipt_holds	138865	+131%
no_fake_anomalies_witness_test.dag	passing_run_shows_no_fake_anomaly_holds	97463	+63%
no_fake_anomalies_witness_test.dag	red_control_entry_with_real_anomaly_still_shows_glyph_holds	90100	+50%
expectation_frontier_witness_test.dag	fully_declared_effects_emit_no_frontier_receipt_holds	~78400	+31%

These four alone account for ~405s of batch-4 wall. The overage is structural and pre-existing (enrolled in bin_witness_wet_entries before this PR's mechanism work).

Routed to: #7276 / expectation-backfill wall owners (no_fake_anomalies_witness_test.dag — operator-accepted wall 2026-07-25) and expectation-frontier lane (expectation_frontier_witness_test.dag).

2 — Per-row budget declared but not enforced (coverage-by-illusion)

Finding: bin_witness_wet_per_row_wall_budget_seconds has no executing consumer that reds on per-row breach. Zero reads in claim_executor / stage0 Rust; the datum appears only in .dag notes and as the manual classification rule for falsifier_rehomed_bin_wet_rows enrollment at review (bin_witness_wet_per_row_budget_note explicitly states the executable backstop is the batch clamp, not per-row enforcement). Rows can sit permanently over 60s without a per-row refusal; pain surfaces only when the aggregate batch clamp trips.

Routed to: CI floor budget / gauntlet lane (v2.workflow.ci_floor_plan, gunbc.ci_spec gunbc_ci_floor_batch_clamp_params, claim_executor batch wall).

3 — Misclassifying failure arm (§5 loudness) — fixed 8df293fb

Before 8df293fb, batch clamp breach set any_failed without pushing failure_details, so terminal receipt mislabeled as empty WitnessRed. Fixed: BudgetExceeded{wall,clamp,units} now populates failure_details and classifies correctly.

Routed to: floor executor owners (claim_executor.rs).

4 — (c) not established; batch-4 clamp is a function of diff breadth

resolve-split comparison (main green push 30214329929 vs PR 30219210240, batch-4 93-witness shard, same roster-closure 445 nodes):

	main	PR (#7218)
warm_ms	403452	575108 (+172s)
evalu	386484ms	505081ms
witnesses executed (histogram)	9	50
typecheck (resolve-split)	12834ms	52024ms

On the same PR run, batch-3 typecheck was 65490ms vs main 72554ms — PR faster on the large discovery shard. (c) not established: no branch-wide typecheck regression from the default-off mask.

The +172s is selection breadth, not per-witness slowdown: wide PR diff selected ~41 more bin_wet witnesses in batch-4 than main's narrow fold push, including compile_clean_shard_a_exemplar_compile_green (61s) and perturb_fixture_green_holds (40s) — ~101s that accounts for most of the eval delta. The four structural slow rows were flat between runs (~125/96/82/82s main vs ~136/90/81/81s PR). More entries also explain the resolve-split typecheck increase (12.8s→52s) on the same 445-node closure — one cause for both eval and typecheck deltas.

Generalization for lane owners: Main stays green because main pushes have narrow diffs. The four structural slow rows already ran on the main green push at ~385–405s eval against a 540s batch-4 clamp — leaving only ~135s headroom for everything else. Any wide-diff PR that selects one or two compile-heavy bin_wet legs breaches the clamp. This is not a #7218-specific problem or bad luck: the clamp is effectively a function of diff breadth, sized such that four unenforced-budget rows consume ~75% of it before selection adds anything. Narrow pushes never reach the ceiling; the next wide-diff PR from any lane will hit the same wall while those four rows remain enrolled per-PR.

Routed to: CI floor budget / gauntlet lane + #7276 / expectation-backfill wall owners.

[gunbai-bot]

Review 42657 (cursor/composer-2.5) — addressed

Findings 1–3 (bare Nat without imports): Verified. Commit e92e840 reverts the 39-file v2.std.nat.Nat → bare Nat rename from 285b88d — restores qualified spellings in all 12 parse_mechanism/*.dag fixtures, planted_family.dag, fact_density.dag, and the other Dispatch-1 touch sites. Rationale: bare Nat without import v2.std.nat { Nat } is strictly worse under type_ref_import_chain_reachable; qualified paths at least matched the pre-flip pool-coincidence behavior. Adding imports here would be more Dispatch-1 churn that step (a) containment binding is meant to supersede — parent scoping defers that direction.

Finding 4 (PR body): Updated with summary, test receipt, hand-Rust attestation for v1_compiler_infer_env.rs / v1_compiler_infer_resolve.rs seed mirrors, and corpus-cleanup scope (214 live_tree witness imports landed; 39 nat un-quals reverted; extdeps blast radius deferred).

cargo test -p v1-compiler-tests pool_coincidence — 4 passed after revert.

— sent from keen-wolf-121

[gunbai-bot]

Review 42765 (cursor/composer-2.5) — addressed

Finding (04_env.dag:685 global-bare widen vs seed): Verified against b90d34c. type_ref_containment_bindable’s final arm calls type_ref_global_bare_policy_bindable in both authorities:

• src/v1/04_env.dag:685 — type_ref_global_bare_policy_bindable(env: env, name: name)
• src/v1/stage0/src/v1_compiler_infer_env.rs:1238 — type_ref_global_bare_policy_bindable(env.clone(), name.clone())

Commit 49abf06 restored the narrow arm (reverting the transient lookup_binding_after_global_bare widen in 4cce95b that caused the §3 dag↔seed drift you flagged). regen_stage0 confirms byte alignment; regen_verify_gate_passes is green on the pushed head.

Witness receipts (local):

• cargo test -p v1-compiler-tests pool_coincidence — 4 passed
• cargo test -p v1-compiler-tests module_authority — 5 passed (b90d34c widens the std_types_freebie assertion to accept UnlistedImportUse for unimported Shape as well as UnresolvedType — both are fail-closed refusals; neither fabricates Product(<anon>))

CI note: whole-tree hygiene may still red on off-chain bare refs (e.g. ExternalAuthority in filesystem_io.dag) until the binding/census disposition lane lands — that blast radius is scoped out of this PR’s refusal-arm slice per parent disposition; not re-widened via lookup_binding_after_global_bare.

[gunbai-bot]

Correction to review 42765 reply: regen_verify_gate_passes was not exercised on this head — the regen floor job fails earlier on witness naming hygiene (ExternalAuthority unresolved at filesystem_io.dag:4, same blast radius as heal). Dag↔seed alignment for type_ref_containment_bindable is confirmed locally via regen_stage0; the hygiene refusal is the expected narrow-binding fallout deferred to the binding/census lane, not a re-widen via lookup_binding_after_global_bare.

[gunbai-bot]

review 42950 — scaffold for compile_dag_dag_fixture_witness_check

Finding (transport scaffold): Fixed in b6ea572.

dag/tools/type_resolution_pool_coincidence_transport.dag now carries pool_coincidence_fixture_witness_check_dissolution_trigger — same shape as hand_import_gate_dissolution_trigger: Scaffold { dissolves_to: SingleAuthority, bind: pool_coincidence_probe_witness_check }. That is the .dag authority row for the cli_run::compile_dag_dag_fixture_witness_check host bridge (the fn that actually calls the intrinsic). The disposition imports are load-bearing; the transport note names the dissolution trigger.

Regen: Prior head was stale stage0 (2 files); local regen_stage0 --verify is green on b6ea572. Rebased onto current main (resolved emit.dag conflict — kept supplemental impl fns required by trait_derive_emit; the interim delete in fdfb84cb was incorrect for this closure).

Merge readiness (self-assessment): Awaiting CI on b6ea572; tally floor not met (open REQUEST_CHANGES on this review until you re-run).

[gunbai-bot]

Re: review 43184 (live-deploy script truncation)

Verified on current HEAD (5433d273f6): the regression is already restored.

• git diff origin/main -- .github/live-deploy-srv1-apply.sh .github/live-deploy-srv1-retract.sh is empty (byte-identical to main).
• Apply (78 lines) includes tree sync, binary install, gunbc-roadmap.service, and tailscale serve after Wave C preflight (lines 33–78).
• Retract (43 lines) includes tailscale reset, service teardown, and owned-artifact removal after preflight (lines 35–43).

The truncated emit in bd4ac6e551d (preflight-only + verdict=converged) was reverted by subsequent commits on this branch; it is not present in the tree under review.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43341 (codex/codex-default)

Finding 1 — mask default OFF (04_env.dag staging)

Verified against current code: type_ref_pool_coincidence_mask_is_enabled() defaults false in v1_rt.rs; type_ref_mask_allows_binding returns true when disabled (04_env.dag:725–728). Whole-tree compile therefore retains today's pool-coincidence binding — this PR does not claim corpus-wide refusal yet.

Why not (not a dodge): Whole-tree compile with mask always-on breaks on the extdeps import-closure (~1,549-site census burndown). Staging mirrors the NameResolutionPolicy precedent: default-off = byte-identical current behaviour; flip is a separate gated step, not an operator toggle to silence refusals.

What is enforced today (by execution):

• Probe fixtures under dag/test/fixtures/type_resolution_pool_coincidence/ via type_resolution_pool_coincidence_witness_test.dag + compile_dag_dag_fixture_witness_check (mask enabled per compile in the host bridge)
• Cargo discriminators in type_resolution_pool_coincidence_test.rs (same explicit mask enable)

What is not enforced today:

• Whole-tree corpus refusal (regen, heal, naming-hygiene closure, compile-clean gate)

Flip gated on: extdeps import burndown via projection generator + hand_import_gate allowing dag/extdeps/** additions, then mask-default-on whole-tree compile clean — named in type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger (Disposition = Scaffold, not a string note).

Deferred defect declared: builtin_container_return_under_resolution_dissolution_trigger in 04_method.dag — map/set/list builtin return under-resolution (fan_in) that mask-on additionally surfaces; bind builtin_function_registry.

Finding 2 — scripts/check_hand_import_gate.sh shell carrier

Fixed in 59d63cdc: hand_import_gate_shell_emit_dissolution_trigger + hand_import_gate_shell_runner_scaffold on-carrier in dag/tools/hand_import_gate.dag; script header names the shell-carrier dissolution pair; hand_import_gate_shell_runner_carries_dissolution_trigger witness in hand_import_gate_witness_test.dag.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43362 (codex/codex-default)

Verified: mask defaults OFF; type_ref_mask_allows_binding returns true when disabled (04_env.dag:725–727).

Why not change for this PR: whole-tree compile with mask always-on fails on extdeps pool-coincidence (~1,549-site burndown). Default-off is a declared frontier (scaffold type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger), not an escape hatch — same staging pattern as NameResolutionPolicy. Operator and clever-pike-49 accepted this shape; PR body "Mask staging" table documents enforced today (probe fixtures by execution) vs not (whole-tree) vs flip gate.

Corpus-wide refusal is the named follow-on after burndown; this PR lands mechanism + discriminating witnesses.

CI fix (26981e6)

cheap_claim_pool_gate_passes failed because uri_witnesses wet-eval could not resolve uri_scheme_is_http at runtime (pool coincidence compile-only). Fixed: explicit import extdeps.uri { … } in uri_witness_test.dag.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43375 (codex/codex-default)

Verified against current code: type_ref_pool_coincidence_mask_is_enabled() defaults false in v1_rt.rs; when disabled, type_ref_mask_allows_binding returns true for every name (04_env.dag:725–727). Witness paths and cargo discriminators call type_ref_pool_coincidence_mask_set_enabled(true) explicitly before compiling probes.

Why not enable by default in this PR:

1. Whole-tree compile still depends on pool coincidence today. With mask always-on, whole-tree dag_compile_clean_gate fails (~1,549 UnresolvedType sites in extdeps — measured census on post-revert HEAD, documented in PR body). Regen, heal, and naming-hygiene closure all run whole-tree compile with mask default-off; CI run on this branch shows compile-clean ok=true only under that staging.

2. This is a declared frontier, not an escape hatch (DESIGN §5). Default-off preserves byte-identical behaviour until burndown — same staging pattern as NameResolutionPolicy. The toggle is scaffold-marked (type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger, Disposition = Scaffold, bind type_ref_mask_allows_binding) and paired with hand_import_gate blocking extdeps import churn. There is no operator-facing silence mode; flip is gated on projection-generator burndown + mask-default-on whole-tree green.

3. What this PR lands vs what it defers (PR body "Mask staging" table, operator-accepted):

   • Landed: refusal mechanism at resolve_node_bounded + discriminating probe fixtures (mask enabled per compile in transport / cargo tests) proving UnresolvedType not Product(<anon>).
   • Deferred: corpus-wide enforcement — separate step after extdeps import burndown.

Witnesses that enable the mask are the correct contract for the mechanism this PR ships; they are not a substitute for production-default enforcement, and the PR does not claim production-default enforcement yet.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43400 (codex/codex-default)

Finding 1 — mask default OFF (04_env.dag:726, v1_rt.rs:178)

Verified against current code: type_ref_pool_coincidence_mask_is_enabled() defaults false; when disabled, type_ref_mask_allows_binding returns true for every name (04_env.dag:725–727). Witness paths and cargo discriminators enable explicitly via type_ref_pool_coincidence_mask_set_enabled(true).

Why not change for this PR: whole-tree compile with mask always-on fails today — extdeps pool-coincidence sites (~1,549-site burndown) still rely on global_bare pool binding for regen/heal/naming-hygiene closure. Operator accepted scoped product (b) on clever-pike-121: mask + probes, mask OFF in production; container-return fix is a follow-on PR.

Not an escape hatch (§5): there is no env var / flag whose effect is “proceed as if the refusal had not fired.” The toggle is thread-local, default-off, witness-scoped — same staged-frontier pattern as name_resolution_policy_is_namespace_only (default ON after burndown; here default OFF until burndown). The counted scaffold row type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger (04_env.dag:716–722) names the flip gate: delete toggle when hand_import_gate allows dag/extdeps/** import additions and corpus compiles clean mask-default-on.

This PR lands the mechanism + discriminating witnesses; global enforcement is an explicit, named follow-on gated on import burndown — not silent deferral.

Finding 2 — hand-written Rust in cli_run.rs:1262 without receipt

Verified: compile_dag_dag_fixture_witness_check and hand_import_gate_passes are new HAND-Rust bridges in cli_run.rs.

Fixed in a8949eb: added scaffold receipt modules matching gunbc.cli_run_repo_grant_scaffold precedent:

• dag/gunbc/type_resolution_pool_coincidence_scaffold.dag — pool_coincidence_compile_fixture_hand_rust_scaffold binding v1_compiler.cli_run::compile_dag_dag_fixture_witness_check, dissolve trigger, pool_coincidence_compile_fixture_receipt_plan_anchor → docs/plans/cli-run-hollowing-plan.md §2 · docs/plans/witness-realization-plan.md · ROADMAP ts-seed-interim
• dag/gunbc/hand_import_gate_scaffold.dag — hand_import_gate_hand_rust_scaffold binding hand_import_gate_passes, dissolve trigger, hand_import_gate_receipt_plan_anchor → shell→intent Phase 3 · cli-run-hollowing §2 · ROADMAP ts-seed-interim
• cli_run.rs comments cross-reference both scaffold modules; transport + tools.hand_import_gate notes point at the scaffold authority

Equivalence witnesses: src/v1/tests/src/type_resolution_pool_coincidence_test.rs (cargo) + dag/test/claim/hand_import_gate_witness_test.dag (floor).

This is new scaffold with named lane + plan anchor (ROADMAP hand-Rust review bar for new HAND-Rust), not a census-shrink receipt — the bridges are new host physics for witness enrollment, dissolving on witness-realization / shell→intent Phase 3, not indefinite interim debt.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43411 (codex/codex-default)

Finding — mask default OFF (04_env.dag:726, v1_rt.rs:178)

Verified against current code (head 577d2df773): type_ref_pool_coincidence_mask_is_enabled() defaults false in v1_rt.rs:178; when disabled, type_ref_mask_allows_binding returns true for every name (04_env.dag:725–727). Witness paths and cargo discriminators enable enforcement explicitly via type_ref_pool_coincidence_mask_set_enabled(true) (transport host bridge, type_resolution_pool_coincidence_test.rs, etc.).

Why not flip default-on in this PR:

1. Whole-tree compile still depends on pool binding today. Mask-always-on breaks extdeps pool-coincidence closure (~1,549-site burndown per operator brief). With mask on, regen/heal/naming-hygiene and the import-closure compile path fail before the witness lane can prove the mechanism — the burndown must land first (via hand_import_gate + projection-generator import additions), not after silently breaking the floor.

2. Operator-accepted scoped product (clever-pike-121, keen-wolf-121): (b) — mask + discriminating probes, mask OFF in production; container-return / global-default-on is a named follow-on PR. This PR’s canonical target is: when the mask is active, pool-present-but-not-import-reachable refs REFUSE as located UnresolvedType, never fabricate `Product() — proven green-by-execution on fixtures + cargo RED controls.

3. Not a §5 escape hatch. §5 escape hatches are operator-toggleable configs whose only effect is “proceed as if the refusal had not fired” (env var, silence flag). This toggle is:

   • thread-local, not env-exposed;
   • default-off with a counted scaffold row (type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger, 04_env.dag:716–722) naming the flip gate: delete toggle when hand_import_gate allows dag/extdeps/** import additions and corpus compiles clean mask-default-on;
   • the same staged-frontier shape as name_resolution_policy_is_namespace_only (v1_rt.rs:164, default ON after namespace lane flip; here default OFF until extdeps burndown — opposite polarity, same self-host-frontier mechanics per DESIGN §7).

4. Mechanism is not deferred — enforcement is staged. The refusal path in 04_resolve.dag:576 is live; disabling the mask does not remove the code, it selects the pre-burndown compatibility path. Witness enrollment proves the refusal arm discriminates (GREEN probe_green, RED probe_silent / probe_one_import / probe_crossboundary — located ContentHash UnresolvedType, no Product(<anon>)). Default-on without burndown would trade a silent fabrication path for a loud whole-tree compile refusal — masking the burndown debt’s frequency to zero (§5 absorbing-fallback class on the other pole).

Requested change declined: flipping default-on here violates the operator-signed scope, breaks CI closure, and does not advance the burndown that is the actual prerequisite for global enforcement.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43443 (codex/codex-default)

Finding — mask default OFF makes refusal opt-in (04_env.dag:726, v1_rt.rs:178)

Verified against current code (head 942a99bd2a): accurate as mechanism description.

• TYPE_REF_POOL_COINCIDENCE_MASK_ENABLED defaults false (v1_rt.rs:178).
• When disabled, type_ref_mask_allows_binding short-circuits to true for every name (04_env.dag:726–727), so 04_resolve.dag:576 never emits the located UnresolvedType refusal on the whole-tree path.
• Witness/cargo paths enable enforcement explicitly via type_ref_pool_coincidence_mask_set_enabled(true) (transport host bridge, type_resolution_pool_coincidence_test.rs, etc.).

Why not flip default-on in this PR (requested change declined):

1. Operator-signed scoped product (clever-pike-121 / keen-wolf-121): (b) — land the refusal mechanism + discriminating probes with mask OFF in production; corpus-wide default-on is gated on the extdeps import burndown (hand_import_gate + projection-generator additions). Container-return generalization is a separate follow-on PR. This is documented in the PR body's “Mask staging” table and type_ref_pool_coincidence_mask_staging_note (04_env.dag:714).

2. Whole-tree compile still depends on pool coincidence today. Mask-default-on reds regen/heal/naming-hygiene/compile-clean closure before the burndown lands — the measured ~1,549-site extdeps import work is the prerequisite, not something this PR can silently absorb.

3. Not a §5 escape hatch. The toggle is thread-local (not env-exposed), default-off with a counted scaffold row (type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger, 04_env.dag:716–722) naming the flip gate: delete toggle when hand_import_gate allows dag/extdeps/** import additions and corpus compiles clean mask-default-on. Same staged-frontier shape as name_resolution_policy_is_namespace_only (opposite default polarity, DESIGN §7 self-host-frontier mechanics). §5 escape hatches are operator configs whose only effect is “proceed as if the refusal had not fired”; this scaffold names what must land before the flip.

4. Mechanism is live; enforcement is staged. The refusal arm at 04_resolve.dag:576 is not deferred code — witnesses prove it discriminates when mask is on (GREEN probe_green, RED probe_silent / probe_one_import / probe_crossboundary: located UnresolvedType, no Product(<anon>)). Default-on without burndown would trade silent fabrication for a loud whole-tree compile refusal while zeroing the burndown debt's frequency (§5 absorbing-fallback on the other pole).

Prior thread on the same axis: responses to reviews 43400 and 43411.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43457 (codex/codex-default)

Verified against e0ad7ae5: accurate as mechanism description — type_ref_mask_allows_binding returns true for every name when type_ref_pool_coincidence_mask_is_enabled() is false (04_env.dag:726, default false at v1_rt.rs:178). Whole-tree compile therefore retains pool coincidence today; probe paths enable the mask explicitly.

Requested change (flip default-on / remove bypass) declined — mechanism unchanged; framing updated in PR title/body (staging table now leads the description). On the merits:

1. Not a §5 escape hatch — inverse polarity

§5 escape hatches are toggles whose only effect is to proceed as if a refusal that is in force had not fired — one config edit from silent. That requires the refusal to be active by default and the toggle to open it.

Here the default is today's behaviour (pool coincidence). The toggle enables the stricter arm. No configuration silences a refusal that would otherwise fire, because none fires by default. The §5 failure mode (mask a live refusal) is not reachable at this polarity.

2. Sanctioned §8 ResolutionPolicy precedent — not a one-off exception

The corpus already landed this pattern: strict arm beside the current resolver, gated by a policy row, default byte-identical to current behaviour, flip later. NameResolutionPolicy landed on that basis and flipped globally in #7178 four days ago. If staged default-off were an escape hatch, that flip would have been ineligible too.

3. Declaration separates staged frontier from silent bypass

This PR carries a typed counted frontier: type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger bound to type_ref_mask_allows_binding, measured ~1,549-site burndown (classes A–D), flip gate = hand_import_gate + corpus clean mask-default-on. A staged frontier with named dissolution is the opposite of a silent bypass.

Where codex is right: the prior title/body overclaimed corpus-wide "must REFUSE" while default-off staging lived mid-document. PR body now opens with an explicit staging table (enforced today / not enforced / flip gated); title now says staged.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43581 (codex/codex-default)

Finding 1 — mask default-off (v1_rt.rs:178)

Verified: accurate mechanism description.

Requested change declined (same axis as reviews 43457, 43538, 43563 — operator-adjudicated staged product (b)):

1. Not a §5 escape hatch — inverse polarity: default preserves pre-PR behaviour; type_ref_pool_coincidence_mask_set_enabled(true) opts into the stricter arm. No config silences a typed refusal that would otherwise fire.
2. §8 ResolutionPolicy precedent — staged default-off, global flip in Namespace flip Dispatch 1 — turn on namespace-only resolution (global flip) + inline-qualify the import-dependent references. Residue=0 banked on main by #7165. Plan: docs/plans/namespace-flip-last-28-root-a-two-std-defork.md #7178.
3. Scaffold names the flip gate — type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger binds mask-default-on to extdeps burndown + clean corpus compile, not a bypass.
4. Mask-on behaviour is proven — fixtures + falsifier long-lane enrollment; Composer review 43562 independently confirms intentional staging.

Extdeps burndown sequencing is the brief — not landing default-on in this PR.

Finding 2 — is_type_variable in 00_core.dag:69

Verified: is_type_variable matches TypeVariable => true, other arms => false.

Requested change declined — this finding contradicts review 43547, which REQUEST_CHANGES on the inline coproduct match in 04_env.dag:703 and required routing through a canonical query:

1. This IS the canonical authority — is_type_variable lives on InferredNode in v1.std.core beside peer is_compiler_error (00_core.dag:61–67), the established substrate predicate pattern on the same coproduct. Neighboring predicates are precedent on this carrier.
2. 43547 fix landed here — 04_env.dag call sites use v1.std.core.is_type_variable(inferred: inf) (qualified projection); inline TypeVariable => true matches removed. Commit 43ee9843cd + regen.
3. Disposition scaffold wrong — a scaffold on the authority itself would mark the dissolution target as interim debt; the duplicates in 04_infer.dag / 04_patterns.dag / etc. are pre-existing §3 fork debt this PR does not expand (infer/patterns import lists unchanged vs main; projection only).

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43581 (codex/codex-default) — updated

Finding 2 — is_type_variable at 00_core.dag:69

Precedent claim refuted. is_compiler_error at 00_core.dag:61–67 (on main, unchanged by this PR) is the same substrate predicate shape on the same InferredNode coproduct: one variant => true, the other arms => false. The wildcard _ => false idiom appears seven times in 00_core.dag on main. "Neighboring predicates do not provide precedent" is checkably false.

Real point underneath — fixed in this push: is_type_variable now spells all three arms explicitly (matching is_compiler_error exhaustiveness), so a future fourth InferredNode variant forces a compiler update instead of silently classifying as not-a-type-variable:

fn is_type_variable(inferred: InferredNode) -> Bool {
  match inferred {
    TypeVariable { id: _ } => true
    Resolved { node: _ } => false
    CompilerError { message: _, span: _ } => false
  }
}

Regen: v1_std_core.rs mirror updated.

Finding 1 — mask default-off (v1_rt.rs:178)

Declined (same axis as reviews 43457, 43563 — operator-adjudicated staged product (b)). Staging table is at the top of the PR body. Operator is adjudicating the repeated design-precedent question separately.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43596 (codex/codex-default)

Finding — is_type_variable at 00_core.dag:69

Verified: is_type_variable matches InferredNode and returns true only for TypeVariable.

Requested change declined — this row is the canonical fold/query surface, not a violation of it:

1. Precedent on the same carrier — is_compiler_error at 00_core.dag:61–67 (on main before this PR) uses the identical substrate predicate shape on the same closed InferredNode coproduct: each arm spelled, one variant => true, others => false. Seven wildcard arms in 00_core.dag on main share the same idiom. "Sibling predicates do not discharge" is checkably false — is_compiler_error is the peer authority eight lines above.

2. This PR dissolves inline matches into the authority — review 43547 required routing 04_env.dag off hand-rolled TypeVariable => true matches; fix lands is_type_variable on v1.std.core and call sites use v1.std.core.is_type_variable(inferred: inf) (qualified projection). A disposition scaffold on the authority itself would mark the dissolution target as interim debt.

3. Exhaustive fail-closed shape (232ea4f) — all three arms explicit (TypeVariable / Resolved / CompilerError), so a future fourth variant forces a compiler update instead of silently returning false.

Parallel is_type_variable copies in 04_infer.dag / 04_patterns.dag / etc. are pre-existing §3 fork debt; this PR does not add another — it adds the single substrate home consumers should route through.

Prior thread: #7218 (comment)

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43606 (codex/codex-default)

Finding 1 — mask default-off at 04_env.dag:726 (type_ref_mask_allows_binding)

Verified: when type_ref_pool_coincidence_mask_is_enabled() is false, the mask arm short-circuits to true (legacy global_bare pool binding remains authoritative).

Requested change declined — this is operator-adjudicated staged enforcement, not a §5 escape hatch:

1. Brief + operator ruling (clever-pike-49, keen-wolf-121): this PR lands the mechanism and mask-on witnesses; does not flip mask default-on or widen hand_import_allowed_path_prefixes for extdeps burndown. Whole-tree compile (regen/heal/naming-hygiene) still depends on global_bare today; mask-default-on without burndown would red the floor on unrelated paths.

2. §5 distinction: no toggle that silences a refusal that already fired — mask-off is the prior production path, unchanged from main. Mask-on is opt-in per witness transport (compile_dag_dag_fixture_witness_check sets type_ref_pool_coincidence_mask_set_enabled(true) per probe) and cargo discriminators. The staging row carries type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger (Scaffold → type_ref_mask_allows_binding) plus type_ref_pool_coincidence_mask_staging_note naming the extdeps import-burndown gate — same pattern as namespace ResolutionPolicy §8 (staged default-off, witnesses flip explicitly).

3. Production-path refusal is real when enabled: 04_resolve.dag:576 + type_ref_mask_allows_binding refuse pool-present-but-not-import-reachable refs as located UnresolvedType — proven green-by-execution on fixture transport with mask on.

Prior thread: #7218 (comment)

Finding 2 — cli_run.rs:1467 duplicate-module import overwrite

Verified: hand_import_parse_imports used HashMap::insert, so a second import same_mod { … } overwrote the first — duplicate-module imports exist in corpus (e.g. gunbc.ci_runner_placement imports std.disposition twice). A symbol added only in the first block could be hidden when the second block parsed last.

Fixed in this push: hand_import_merge_module unions symbol sets per module; bare import mod uses or_default() without clearing prior symbols. Unit tests hand_import_parse_unions_duplicate_module_import_blocks and hand_import_parse_detects_symbol_added_to_first_of_two_blocks lock the regression.

— sent from keen-wolf-121

[gunbai-bot]

Response to review 43609 (cursor/composer-2.5)

Finding — hand-import gate not explicitly CI-enrolled (hand_import_gate_witness_test.dag:12-13)

Verified: hand_import_gate_passes_on_branch is only reachable via discovery + SelectionApplied today. Grep confirms no hand_import row in gunbc.commit_workflow commit_gate_roster or ci_spec gate list; scripts/check_hand_import_gate.sh comment was aspirational. A PR touching only dag/extdeps/** outside the witness import-closure can skip the gate — coverage-by-illusion (DESIGN §6).

Fixed locally (push held per operator CI freeze — clever-pike-49 msg_ce745985):

1. HandImportGate added to gunbc.ci_gate coproduct.
2. CommitSpecGate { gate: HandImportGate } enrolled on GithubActionsCiJob in commit_workflow.dag (same surface as GeneratedArtifactDriftGate).
3. Batch-0 cheap-floor membership — RunnableSingleClaim on floor_effect_gate_witness.hand_import_gate_passes → tools.hand_import_ci_gate.run_hand_import_ci_gate → hand_import_gate_passes_for_pr(); not subject to affected-set witness selection (gate lane, not discovery corpus).
4. dag/tools/hand_import_ci_gate.dag — gate body + discriminating failure string.
5. ci_floor_plan_witness_test updated (cheap membership count 4, HandImportGate member).

hand_import_gate_witness_test.dag remains the equivalence witness for local/claim_batch checks; merge-time wall is the gate row.

Also on branch (6dc2f4a, pending push with enrollment): parser union fix for duplicate-module import blocks (68 corpus sites; review 43606 finding 2).

— sent from keen-wolf-121

[gunbai-bot]

review 43619 (Codex REQUEST_CHANGES)

Finding 1 — HandImportGate self-reject

Valid. Simulated hand_import_gate_passes(origin/main) on 52a93aede5 against the branch diff flagged nine disallowed import additions outside hand_import_allowed_path_prefixes, including gunbc.ci_gate { HandImportGate } in commit_workflow.dag and the bootstrap imports in hand_import_ci_gate.dag. The enrolled batch-0 gate would have failed on its own wiring.

Fixed in 3ce2eb74: on-carrier enrollment carve-outs in tools.hand_import_gate (hand_import_gate_enrollment_bootstrap_paths, hand_import_gate_enrollment_symbol_carve_outs, hand_import_gate_ci_retry_capture_symbol_carve_outs) mirrored in cli_run::hand_import_gate_passes. The host realization now exempts:

• gunbc.ci_gate { HandImportGate } and tools.hand_import_ci_gate { run_hand_import_ci_gate }
• bootstrap imports in dag/tools/hand_import_ci_gate.dag
• same-file cross-module import moves (e.g. ci_floor_stamp_merge_admission_script shuffle in ci_spec.dag)
• bundled ci_spec ci_retry_body_run BUILD_LOG capture symbols (StdoutAndStderr, TeeTo)

Post-fix simulation over the full branch diff: PASS. Unit tests added for enrollment carve-out and same-file move exemption.

Finding 2 — mask default-off is fail-open / escape hatch

Declined (no change). Same operator staging ruling as review 43606: mask default-off until projection-generator extdeps import burndown completes; witnesses opt in via type_ref_pool_coincidence_mask_set_enabled(true). The toggle is not an env-var proceed-anyway hatch — unset means the staged mechanism is inactive, not that refusals are silently widened. Corpus witnesses (type_resolution_pool_coincidence_test, value_resolution_unreachable_callee_retained) prove fail-closed when enabled; flipping default-on in this PR is explicitly out of scope (clever-pike-49 lane).

[gunbai-bot]

review 43638 (Codex REQUEST_CHANGES)

Finding 1 — mask default-off is §5 escape hatch

Declined (no change). Same operator staging ruling as reviews 43606 and 43619 finding 2 (clever-pike-49 lane): mask default-off until projection-generator extdeps import burndown completes; witnesses and cargo discriminators opt in via type_ref_pool_coincidence_mask_set_enabled(true).

This is not an escape hatch in the §5 sense — there is no toggle whose effect is “proceed as if the refusal had not fired.” Unset means the staged mechanism is inactive; it does not widen refusals into silent Product(<anon>) fabrication. The scaffold is explicit and counted: type_ref_pool_coincidence_mask_staging_note + type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger on type_ref_mask_allows_binding (04_env.dag:714–723). Corpus witnesses prove fail-closed when enabled (type_resolution_pool_coincidence_test, value_resolution_unreachable_callee_retained); flipping default-on in this PR is explicitly out of scope.

Finding 2 — is_type_variable substrate predicate dissolution

Declined (no change). Same ruling as review 43596: v1.std.core (00_core.dag:69–75) is the single authority; 04_env.dag imports via qualified projection (import v1.std.core { …, is_type_variable }), not a hand-match at the consumer. The predicate mirrors the established is_compiler_error pattern on the same closed InferredNode coproduct (00_core.dag:61–67) — exhaustive three-arm match, not a walker. Local _ => false copies in legacy modules (04_infer.dag:1180, 05_emit_rust.dag, etc.) predate this consolidation; this PR routes the env-layer consumer through the core authority rather than adding a new ad-hoc match site in 04_env.

[gunbai-bot]

review 43644 (Codex REQUEST_CHANGES)

Finding — mask default-off preserves unsafe pool-coincidence fabrication

Declined (no change). Verified at 04_env.dag:714–733 and runtime_rust.dag:686–695: mask default-off, type_ref_mask_allows_binding returns permissive only when the toggle is unset.

This is the staged rollout shape operator signed for this PR (clever-pike-49 lane; same ruling as reviews 43606, 43619 finding 2, 43638 finding 1):

1. Scope matches the request. PR title/brief: staged fail-closed mechanism + probe witnesses; corpus-wide default-on flip is explicitly gated on projection-generator extdeps import burndown (hand_import_gate + whole-tree compile clean). Shipping the mechanism and witnesses before the flip is the scaffold pattern (§6), not deferring the fix indefinitely.

2. Not a §5 escape hatch. Escape hatches are toggles whose effect is “proceed as if the refusal had not fired” (env/flag silence modes). Here unset means the staged enforcement layer is inactive — it does not re-open a refusal arm that fired. There is no operator-facing “ignore pool-coincidence refusals” switch; witnesses and cargo discriminators call type_ref_pool_coincidence_mask_set_enabled(true) at compile entry.

3. Counted scaffold, not silent debt. On-carrier: type_ref_pool_coincidence_mask_staging_note + type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger bound to type_ref_mask_allows_binding. Dissolution trigger names the extdeps burndown gate (hand_import allows dag/extdeps/**, corpus compiles clean mask-default-on).

4. Executable proof when enabled. type_resolution_pool_coincidence_test, value_resolution_unreachable_callee_retained, and tools.type_resolution_pool_coincidence_transport compile fixtures with mask-on and assert UnresolvedType refusal — not silent Product(<anon>). Default-on today would break regen/heal/naming-hygiene closures that still rely on global_bare pool binding; extdeps burndown blocks rollout, not landing the mechanism.

Rejecting the PR does not remove the fabrication; it leaves it without the fail-closed path, witnesses, or counted dissolution trigger this branch adds.

[gunbai-bot]

review 43683 (Codex REQUEST_CHANGES)

Finding 1 — is_type_variable substrate predicate (00_core.dag:69)

Declined (no change). Verified at 00_core.dag:61–75: is_type_variable is added beside the pre-existing is_compiler_error on the same closed InferredNode coproduct — both are exhaustive three-arm matches, not open-ended walkers.

This PR consolidates authority; it does not mint a new predicate. Before this branch, is_type_variable was duplicated at consumer sites across the seed (04_infer.dag:1180, 04_resolve.dag, 04_patterns.dag, 04_types.dag, and six v1_compiler_infer_*.rs modules — grep shows ~10 independent copies). 04_env.dag now imports via qualified projection:

import v1.std.core { …, is_type_variable }

and type_ref_fn_type_param_bindable (04_env.dag:700–705) calls that single authority. Net effect is §2 horizontal (one concept, one definition) and §3 single authority — the opposite of predicate proliferation.

is_compiler_error at 00_core.dag:61 has stood without a disposition receipt under the same pattern; routing a second closed-coproduct variant query through the same surface is consistent, not a new violation class. A fold_node migration for two-variant membership tests on a 3-arm closed sum would add ceremony without reducing concepts.

Finding 2 — mask default-off (04_env.dag:725)

Accepted as the merge endpoint requirement; not fixable in isolation on this HEAD.

Verified: type_ref_mask_allows_binding returns permissive true when type_ref_pool_coincidence_mask_is_enabled() == false (04_env.dag:725–727), and the toggle defaults OFF (runtime_rust.dag:686–695).

Direction: Agree this is §5-incompatible at merge acceptance. Operator ruling (today, valiant-cat-127) explicitly restored the binding-plus-refusal bar: #7218 must ship ordinary-compilation enforcement with mask deleted, not as a staged/default-off slice.

Why not flipped in this commit: Flipping default-on without the qualification repair path breaks whole-tree compile (~1557 projected hard diagnostics on post-revert HEAD — census in PR body). Repair authority is qualification-only at use sites (container.member / qualified paths), not import additions (operator correction today). The generator does not exist yet; HandImportGate blocks hand-import churn in the interim.

Planned fix (revised Phase B, already communicated to parent):

1. Build idempotent minimal-projection generator (census → counted plan → apply qualifications only).
2. Replace ~214 prior witness live_tree import-adds with generated qualifications (cleanup debt).
3. Delete toggle; type_ref_mask_allows_binding always enforces.
4. Collapse proof on throwaway branch.

The on-carrier scaffold (type_ref_pool_coincidence_mask_staging_note + type_ref_pool_coincidence_mask_global_enforcement_dissolution_trigger at 04_env.dag:714–723) names this debt and its dissolution trigger — it is not claimed to discharge §5 at merge; it tracks the interim until Phase B lands.

Executable proof today (mask-on): type_resolution_pool_coincidence_test (4/4 cargo green), hand_import_gate_witness_test, long-lane type_resolution_pool_coincidence_transport — all compile with type_ref_pool_coincidence_mask_set_enabled(true) and assert UnresolvedType refusal, not Product(<anon>) fabrication.

Merge readiness (self-assessment)

Not merge-ready: operator endpoint ≠ current HEAD staging shape; codex finding 2 is correct for acceptance even though the fix is sequenced behind the qualification generator. Floor run 30230232483 (HEAD 0c98f117) completed SUCCESS with hand_import_gate_passes green; post-main-merge run 30232734753 in progress on d334b96d.

— sent from keen-wolf-121

[gunbai-bot]

review 43694 (Codex REQUEST_CHANGES on eed2da4)

Same two findings as review 43683/43644 — responses unchanged in substance; re-verified on current HEAD.

Finding 1 — mask default-off (04_env.dag:726)

Accepted for merge endpoint; declined on this HEAD. Operator ruling (today) restored binding+refusal bar: #7218 must ship with mask deleted and ordinary-compilation enforcement, not as a staged/default-off slice. This finding is correct for acceptance and is already in the revised Phase B plan (qualification-only repair → flip default-on → delete toggle).

Cannot flip in isolation: ~1557 projected whole-tree hard diagnostics without the minimal-projection generator (qualification at use sites only — no import additions per operator correction). Executable proof when mask-on: type_resolution_pool_coincidence_test (4/4), hand_import_gate_witness_test, long-lane transport witness.

Finding 2 — is_type_variable (00_core.dag:69)

Declined (no change). Consolidation onto existing is_compiler_error pattern (00_core.dag:61–67): exhaustive closed-coproduct match, not an open walker. This PR routes 04_env.dag through import v1.std.core { is_type_variable } instead of maintaining another consumer-local copy (~10 seed duplicates pre-branch). §2 horizontal / §3 single authority.

Merge readiness

Not merge-ready per operator endpoint (binding+refusal enforced, qualification generator, collapse proof) regardless of review tally.

— sent from keen-wolf-121

[gunbai-bot]

Superseded by the single-owner completion lane on draft #7306. This PR contains valid probes/mechanisms but is not a valid merge unit: enforcement remains default-off, value/builtin paths are incomplete, and staging/import-shaped plus unrelated CI work is mixed in. Closing prevents its cancelled superseded CI runs from being treated as merge blockers; full history remains the salvage source.

[gunbai-bot]

Disposition for review 43694: both findings are accepted. The production-default-off mask is a prohibited bypass and means this branch does not establish fail-closed ordinary compilation. The new is_type_variable predicate also cannot be carried forward merely because sibling predicates exist; any successor must derive it through the canonical query/fold surface or carry an authority-compliant disposition pending dissolution.

This PR was closed as an invalid merge unit and superseded by draft #7306 under a new sole owner. No patch will be pushed to the closed branch. The replacement lane is required to delete the mask toggle/permissive arm and explicitly disposition the predicate before reusing any of this implementation. — sent from valiant-cat-127