Type-resolution fail-closed (b), staged: pool-coincidence mask + probe witnesses; corpus-wide flip gated on extdeps burndown

dag/extdeps/languages/rust/emit.dag

@@ -225,6 +225,7 @@ data rt_function_registry: List<RuntimeFunction> = [
   { name: "record_source_chars_index_lookup", bridge_name: "record_source_chars_index_lookup", passes_by_ref: false, wraps_result: false },
   { name: "resolution_silent_pick_is_enabled", bridge_name: "resolution_silent_pick_is_enabled", passes_by_ref: false, wraps_result: false },
   { name: "name_resolution_policy_is_namespace_only", bridge_name: "name_resolution_policy_is_namespace_only", passes_by_ref: false, wraps_result: false },
+  { name: "type_ref_pool_coincidence_mask_is_enabled", bridge_name: "type_ref_pool_coincidence_mask_is_enabled", passes_by_ref: false, wraps_result: false },
   { name: "resolution_silent_pick_record_global_bare_lcp_pick", bridge_name: "resolution_silent_pick_record_global_bare_lcp_pick", passes_by_ref: false, wraps_result: false },
   { name: "resolution_silent_pick_record_global_bare_lcp_tie", bridge_name: "resolution_silent_pick_record_global_bare_lcp_tie", passes_by_ref: false, wraps_result: false },
   { name: "resolution_silent_pick_record_fn_parent_first_hit", bridge_name: "resolution_silent_pick_record_fn_parent_first_hit", passes_by_ref: false, wraps_result: false },

dag/gunbc/ci_gate.dag

@@ -10,3 +10,4 @@ type Gate
   | RegenVerifyGate
   | SelfHostReadsRealBytesGate
   | SelfHostStalenessGate
+  | HandImportGate

dag/gunbc/ci_layer_roots.dag

@@ -982,6 +982,12 @@ data falsifier_substrate_long_lane_rows: List<SubstrateLongLaneRow> = [
     function: "fallback_arm_census_self_applies_holds",
     reason: "same W2 census corpus grain as sibling reconciliation_holds (lens self-application: zero AnswersOnOpen on fallback_arm_census.dag)",
     dissolve_on: "eval lands under gunbc_ci_fast_lane_witness_eval_budget on a measured run and re-enrolls per-PR discovery, or the host seam dissolves when #5364 exposes MatchPattern to .dag"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/long/type_resolution_pool_coincidence_test.dag",
+    function: "pool_coincidence_transport_witness_holds",
+    reason: "21481ms measured eval on run 30215350084 (4.3x per-PR 5s fast-lane budget): four mask-on compile_dag_dag_fixture_witness_check passes over pool-coincidence probes — fixture-shaped compile transport, not corpus breadth; per-PR discovery correctly excludes test/claim/long/ at dir grain",
+    dissolve_on: "fixture compile transport drops under gunbc_ci_fast_lane_witness_eval_budget on a measured run and re-enrolls per-PR discovery, or deletes when modeled substrate transport dissolves pool_coincidence_fixture_witness_check scaffold"
   }
 ]
 

dag/gunbc/ci_spec.dag

@@ -7,6 +7,7 @@ import gunbc.ci_gate {
   Gate,
   EmitHostGate, CheapClaimPoolGate,
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate,
+  HandImportGate,
   SourceRootIngestGate, RegenVerifyGate,
   SelfHostReadsRealBytesGate, SelfHostStalenessGate
 }

dag/gunbc/commit_workflow.dag

@@ -4,6 +4,7 @@ import gunbc.ci_gate {
   Gate,
   EmitHostGate, CheapClaimPoolGate,
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate,
+  HandImportGate,
   SourceRootIngestGate, RegenVerifyGate,
   SelfHostReadsRealBytesGate, SelfHostStalenessGate
 }
@@ -83,6 +84,10 @@ data commit_gate_roster: List<CommitCheckEnrollment> = [
     check: CommitSpecGate { gate: GeneratedArtifactDriftGate },
     surfaces: [GithubActionsCiJob]
   },
+  CommitCheckEnrollment {
+    check: CommitSpecGate { gate: HandImportGate },
+    surfaces: [GithubActionsCiJob]
+  },
   CommitCheckEnrollment {
     check: CommitSpecGate { gate: SourceRootIngestGate },
     surfaces: [FalsifierCadenceJob]
@@ -619,6 +624,7 @@ fn gate_eq(a: Gate, b: Gate) -> Bool {
     ExtdepsExternalAuthorityGate => match b { ExtdepsExternalAuthorityGate => true  _ => false }
     DagCompileCleanGate => match b { DagCompileCleanGate => true  _ => false }
     GeneratedArtifactDriftGate => match b { GeneratedArtifactDriftGate => true  _ => false }
+    HandImportGate => match b { HandImportGate => true  _ => false }
     SourceRootIngestGate => match b { SourceRootIngestGate => true  _ => false }
     RegenVerifyGate => match b { RegenVerifyGate => true  _ => false }
     SelfHostReadsRealBytesGate => match b { SelfHostReadsRealBytesGate => true  _ => false }

dag/gunbc/floor_materialization.dag

@@ -31,6 +31,7 @@ fn gate_consumer_site(g: Gate) -> String {
     ExtdepsExternalAuthorityGate => "gate:ExtdepsExternalAuthorityGate"
     DagCompileCleanGate => "gate:DagCompileCleanGate"
     GeneratedArtifactDriftGate => "gate:GeneratedArtifactDriftGate"
+    HandImportGate => "gate:HandImportGate"
     SourceRootIngestGate => "gate:SourceRootIngestGate"
     RegenVerifyGate => "gate:RegenVerifyGate"
     SelfHostReadsRealBytesGate => "gate:SelfHostReadsRealBytesGate"

dag/gunbc/merge_admission.dag

@@ -19,6 +19,7 @@ import gunbc.ci_gate {
   Gate,
   EmitHostGate, CheapClaimPoolGate,
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate,
+  HandImportGate,
   SourceRootIngestGate, RegenVerifyGate,
   SelfHostReadsRealBytesGate, SelfHostStalenessGate,
 }
@@ -77,6 +78,7 @@ fn gate_content_hash(g: Gate) -> ContentHash {
     ExtdepsExternalAuthorityGate => content_hash_atom(value: "ExtdepsExternalAuthorityGate")
     DagCompileCleanGate => content_hash_atom(value: "DagCompileCleanGate")
     GeneratedArtifactDriftGate => content_hash_atom(value: "GeneratedArtifactDriftGate")
+    HandImportGate => content_hash_atom(value: "HandImportGate")
     SourceRootIngestGate => content_hash_atom(value: "SourceRootIngestGate")
     RegenVerifyGate => content_hash_atom(value: "RegenVerifyGate")
     SelfHostReadsRealBytesGate => content_hash_atom(value: "SelfHostReadsRealBytesGate")

dag/std/os/invocation.dag

@@ -1,5 +1,7 @@
 module std.os.invocation
 
+import std.types { NonEmptyStr }
+import std.abi { CallingConvention }
 
 type SyscallEntry {
   number: Int

dag/test/claim/hand_import_gate_witness_test.dag

@@ -0,0 +1,21 @@
+module test.claim.hand_import_gate_witness
+
+import tools.hand_import_gate {
+  hand_import_gate_passes_for_pr,
+  hand_import_gate_shell_runner_scaffold,
+}
+import std.disposition { Scaffold, Terminal }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+test fn hand_import_gate_passes_on_branch() -> Bool {
+  hand_import_gate_passes_for_pr()
+}
+
+test fn hand_import_gate_shell_runner_carries_dissolution_trigger() -> Bool {
+  match hand_import_gate_shell_runner_scaffold {
+    Scaffold { dissolves_to: _, bind: _ } => true
+    Terminal { reason: _ } => false
+  }
+}

dag/test/claim/long/type_resolution_pool_coincidence_test.dag

@@ -0,0 +1,12 @@
+module test.claim.long.type_resolution_pool_coincidence
+
+import tools.type_resolution_pool_coincidence_transport { type_resolution_pool_coincidence_witness_holds }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+data type_resolution_pool_coincidence_note: String = "Discriminating witness for type-resolution fail-closed (b): pool-present-but-not-import-reachable type refs must refuse as located UnresolvedType, never fabricate Product(<anon>) that unifies silently downstream. Fixtures: dag/test/fixtures/type_resolution_pool_coincidence/. Execution: tools.type_resolution_pool_coincidence_transport compiles each probe via compile_dag_dag_fixture_witness_check (mask-on host bridge). LONG home: measured ~21s eval (run 30215350084) exceeds per-PR 5s fast-lane budget — discovery excludes test/claim/long/ at dir grain; enrolled on falsifier_substrate_long_lane_rows. Wrapper uses pool_coincidence_transport_witness_holds (NOT the imported fn name — same-name wrapper self-recurses; edit_locus_source_provenance_wrapper_shadowing_note). Local recipe: claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/long/type_resolution_pool_coincidence_test.dag --function pool_coincidence_transport_witness_holds. Rust suite src/v1/tests/src/type_resolution_pool_coincidence_test.rs remains local discriminating control."
+
+test fn pool_coincidence_transport_witness_holds() -> Bool {
+  type_resolution_pool_coincidence_witness_holds()
+}

dag/test/claim/uri_witness_test.dag

@@ -1,5 +1,7 @@
 module test.claim.uri_witness
 
+import extdeps.uri { Uri, Https, File, uri_scheme_is_http, uri_is_url }
+
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
 test fn uri_scheme_is_http_matches_https_holds() -> Bool {

dag/test/fixtures/type_resolution_pool_coincidence/irrelevant.dag

@@ -0,0 +1,3 @@
+module repro.irrelevant
+
+fn irrelevant_marker(x: Int) -> Int { x }

dag/test/fixtures/type_resolution_pool_coincidence/probe_crossboundary.dag

@@ -0,0 +1,9 @@
+module repro.probe_crossboundary
+
+import repro.irrelevant { irrelevant_marker }
+
+fn local_hash(x: ContentHash) -> ContentHash { x }
+
+fn feed_real_consumer(x: ContentHash) -> std.types.ContentHash {
+  std.content_hash.content_hash_combine(left: local_hash(x: x), right: local_hash(x: x))
+}

dag/test/fixtures/type_resolution_pool_coincidence/probe_green.dag

@@ -0,0 +1,10 @@
+module repro.probe_green
+
+import std.types { ContentHash }
+import std.content_hash { content_hash_atom }
+
+fn local_hash(x: ContentHash) -> ContentHash { x }
+
+fn probe_imported_return(flag: Bool, x: ContentHash) -> ContentHash {
+  if flag { content_hash_atom(value: "a") } else { local_hash(x: x) }
+}

dag/test/fixtures/type_resolution_pool_coincidence/probe_one_import.dag

@@ -0,0 +1,9 @@
+module repro.probe_one_import
+
+import repro.irrelevant { irrelevant_marker }
+
+fn local_hash(x: ContentHash) -> ContentHash { x }
+
+fn probe_bare_type(x: ContentHash) -> ContentHash {
+  local_hash(x: x)
+}

dag/test/fixtures/type_resolution_pool_coincidence/probe_silent.dag

@@ -0,0 +1,5 @@
+module repro.probe_silent
+
+fn local_hash(x: ContentHash) -> ContentHash { x }
+
+fn passthrough(x: ContentHash) -> ContentHash { local_hash(x: x) }

dag/test/fixtures/value_resolution_unreachable_callee/callee_definer.dag

@@ -0,0 +1,11 @@
+module repro.callee_definer
+
+type Row { unit: String }
+
+type Typed { unit: String }
+
+data fixture: Row = Row { unit: "actions-runner@srv1-01.service" }
+
+fn fixture_callee_read_typed(row: Row) -> Typed {
+  Typed { unit: row.unit }
+}

dag/test/fixtures/value_resolution_unreachable_callee/probe_value_arm.dag

@@ -0,0 +1,7 @@
+module repro.probe_value_arm
+
+import repro.callee_definer { fixture }
+
+fn probe_unreachable_return() -> ContentHash {
+  fixture_callee_read_typed(row: fixture)
+}

dag/test/retirement/value_resolution_unreachable_callee_retained.dag

@@ -0,0 +1,9 @@
+module test.retirement.value_resolution_unreachable_callee_retained
+
+
+data value_resolution_unreachable_callee_retention: TestModuleRetirement = TestModuleRetirement {
+  module: "value_resolution_unreachable_callee_test.rs",
+  disposition: RetainedNonMigratable {
+    reason: "Value-arm discriminating control for type-ref mask fail-closed (b): compiles probe_value_arm.dag with mask enabled and asserts pool-present ContentHash return type without import refuses via type_ref_mask_allows_binding (not global_bare fabrication). Mirrors the pool-coincidence fixture transport pattern but has no dag/test/claim floor witness yet — the floor counterpart will land when value-resolution transport is modeled beside tools.type_resolution_pool_coincidence_transport. Retained as cargo-only local control until then; not migration debt and not a delete candidate."
+  }
+}

dag/tools/ci_gates.dag

@@ -1,7 +1,7 @@
 module tools.ci_gates
 
 import std.process { ProcessExit, ExitSuccess, exit_failure }
-import gunbc.ci_gate { EmitHostGate, Gate, CheapClaimPoolGate }
+import gunbc.ci_gate { EmitHostGate, Gate, CheapClaimPoolGate, HandImportGate }
 import gunbc.ci_spec {
   gunbc_ci_gates, CiSpec,
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate,
@@ -13,6 +13,7 @@ import tools.cheap_claim_pool_gate { run_cheap_claim_pool_ci_gate }
 import tools.extdeps_external_authority_gate { run_extdeps_external_authority_ci_gate }
 import tools.dag_compile_clean_gate { run_dag_compile_clean_gate }
 import tools.generated_artifact_gate { run_generated_artifact_drift_gate }
+import tools.hand_import_ci_gate { run_hand_import_ci_gate }
 import tools.regen_verify_gate { run_regen_verify_gate }
 
 fn exit_ok(e: ProcessExit) -> Bool {
@@ -26,6 +27,7 @@ fn run_spec_gate(g: Gate) -> ProcessExit {
     ExtdepsExternalAuthorityGate => run_extdeps_external_authority_ci_gate()
     DagCompileCleanGate => run_dag_compile_clean_gate()
     GeneratedArtifactDriftGate => run_generated_artifact_drift_gate()
+    HandImportGate => run_hand_import_ci_gate()
     SourceRootIngestGate => exit_failure(
       reason: "SourceRootIngestGate: run via ci_floor_plan v2.workflow.source_root_ingest_gate (slice 3)"
     )

dag/tools/floor_effect_gate_witness.dag

@@ -1,6 +1,6 @@
 module tools.floor_effect_gate_witness
 
-import gunbc.ci_gate { EmitHostGate, CheapClaimPoolGate }
+import gunbc.ci_gate { EmitHostGate, CheapClaimPoolGate, HandImportGate }
 import gunbc.ci_spec {
   ExtdepsExternalAuthorityGate, DagCompileCleanGate, GeneratedArtifactDriftGate,
   RegenVerifyGate
@@ -27,6 +27,10 @@ func generated_artifact_drift_gate_passes() -> Bool {
   tools.ci_gates.exit_ok(e: run_spec_gate(g: GeneratedArtifactDriftGate))
 }
 
+func hand_import_gate_passes() -> Bool {
+  tools.ci_gates.exit_ok(e: run_spec_gate(g: HandImportGate))
+}
+
 func regen_verify_gate_passes() -> Bool {
   tools.ci_gates.exit_ok(e: run_spec_gate(g: RegenVerifyGate))
 }

dag/tools/hand_import_ci_gate.dag

@@ -0,0 +1,24 @@
+module tools.hand_import_ci_gate
+
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import tools.hand_import_gate { hand_import_gate_passes_for_pr }
+
+data hand_import_ci_gate_note: String = "CI floor gate body for HandImportGate: branch-wide dag/** import-churn check vs origin/main (tools.hand_import_gate.hand_import_gate_passes_for_pr). Enrolled on GithubActionsCiJob as RunnableSingleClaim — not discovery/affected-set selection (review 43609)."
+
+func run_hand_import_ci_gate_body() -> ProcessExit {
+  if hand_import_gate_passes_for_pr() {
+    ExitSuccess
+  } else {
+    exit_failure(
+      reason: "hand-import gate failed: import additions detected outside hand_import_allowed_path_prefixes vs origin/main (authority: tools.hand_import_gate)"
+    )
+  }
+}
+
+func main() -> ProcessExit {
+  run_hand_import_ci_gate_body()
+}
+
+func run_hand_import_ci_gate() -> ProcessExit {
+  run_hand_import_ci_gate_body()
+}

dag/tools/hand_import_gate.dag

@@ -0,0 +1,84 @@
+module tools.hand_import_gate
+
+import std.types { List, String }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import std.disposition { Disposition, Scaffold, SingleAuthority }
+
+data hand_import_gate_scope_note: String = "Gate scans only dag/** paths changed vs base_ref — compiler src/v1/*.dag edits are out of scope (not corpus import churn)."
+
+data hand_import_allowed_path_prefixes: List<String> = [
+  "dag/test/claim/",
+  "dag/test/fixtures/type_resolution_pool_coincidence/",
+  "dag/test/fixtures/value_resolution_unreachable_callee/",
+  "dag/tools/hand_import_gate.dag",
+  "dag/tools/type_resolution_pool_coincidence_transport.dag",
+  "dag/std/os/invocation.dag",
+]
+
+data hand_import_gate_enrollment_bootstrap_paths: List<String> = [
+  "dag/tools/hand_import_ci_gate.dag",
+]
+
+data hand_import_gate_enrollment_symbol_carve_outs: List<String> = [
+  "gunbc.ci_gate:HandImportGate",
+  "tools.hand_import_ci_gate:run_hand_import_ci_gate",
+]
+
+data hand_import_gate_ci_retry_capture_symbol_carve_outs: List<String> = [
+  "v2.std.orchestration:StdoutAndStderr",
+  "v2.std.orchestration:TeeTo",
+]
+
+data hand_import_gate_enrollment_carve_out_note: String = "HandImportGate CI enrollment must not self-reject (review 43619): outside hand_import_allowed_path_prefixes, additions of gunbc.ci_gate { HandImportGate }, tools.hand_import_ci_gate { run_hand_import_ci_gate }, and bootstrap imports in hand_import_gate_enrollment_bootstrap_paths are exempt. Same-file cross-module import moves (symbol removed from one import block and added to another) are exempt. hand_import_gate_ci_retry_capture_symbol_carve_outs exempts ci_spec ci_retry_body_run BUILD_LOG capture imports bundled with batch-0 enrollment. Host mirror: cli_run::hand_import_gate_passes enrollment carve-out (hand_import_gate_enrollment_carve_out_mirror_dissolution_trigger)."
+
+data hand_import_gate_note: String = "Pre-corpus-wide gate: zero import additions vs origin/main outside operator-allowed witness roster and type-resolution / value-resolution probe fixture dirs (hand_import_allowed_path_prefixes). Host realization: hand_import_gate_passes (git diff + per-file import-block compare). Operator ruling (clever-pike-49, keen-wolf-121): blocks hand-import churn before projection-generator corpus-wide runs. HAND-RUST receipt authority: tools.hand_import_gate (hand_import_gate_hand_rust_scaffold + hand_import_gate_receipt_plan_anchor — shell→intent Phase 3 lane). Counted fail-open residue: allowed-prefix mirror (§3 parallel representation until on-carrier roster) — hand_import_allowed_prefixes_mirror_dissolution_trigger."
+
+data hand_import_gate_hand_rust_scaffold: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "v1_compiler.cli_run",
+    decl_name: "hand_import_gate_passes",
+    field: WholeDeclaration
+  }
+}
+
+data hand_import_gate_dissolve_trigger: String = "🟡 dissolve-on: cli_run::hand_import_gate_passes — git diff + single-line import-block compare host realization (mirrors tools.hand_import_gate roster). DISSOLVES WHEN hand_import_gate_passes_for_pr is enrolled as a CI floor witness without a hand-written shell carrier (gunbc orchestration emit / host_effect_apply routes gate eval — shell→intent lane ROADMAP shell→intent Phase 3, docs/plans/shell-intent-emit-realization-design.md)."
+
+data hand_import_gate_receipt_plan_anchor: String = "docs/plans/shell-intent-emit-realization-design.md Phase 3 · docs/plans/cli-run-hollowing-plan.md §2 Corpus discovery · ROADMAP §7 ts-seed-interim (hand-Rust review bar: named lane + concrete plan row — operator ruling clever-pike-49 keen-wolf-121 pre-corpus-wide import gate)."
+
+data hand_import_gate_equivalence_witness: String = "dag/test/claim/hand_import_gate_witness_test.dag"
+
+data hand_import_allowed_prefixes_mirror_note: String = "ALLOWED_PREFIXES in cli_run.rs host realization mirrors hand_import_allowed_path_prefixes (§3 parallel representation until the gate reads the on-carrier roster at eval time)."
+
+data hand_import_allowed_prefixes_mirror_dissolution_trigger: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "tools.hand_import_gate",
+    decl_name: "hand_import_allowed_path_prefixes",
+    field: WholeDeclaration
+  }
+}
+
+data hand_import_gate_enrollment_carve_out_mirror_dissolution_trigger: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "tools.hand_import_gate",
+    decl_name: "hand_import_gate_enrollment_symbol_carve_outs",
+    field: WholeDeclaration
+  }
+}
+
+data hand_import_gate_shell_emit_dissolution_trigger: String = "🟡 dissolve-on: scripts/check_hand_import_gate.sh — foreign-executor claim_batch argv scaffold (set -euo pipefail + target/release/claim_batch --claim-run). DISSOLVES WHEN hand_import_gate_passes runs as HandImportGate RunnableSingleClaim on the CI floor without a hand-written shell carrier (LANDED enrollment: gunbc.commit_workflow CommitSpecGate { gate: HandImportGate } surfaces: [GithubActionsCiJob], review 43609) — shell→intent lane, ROADMAP shell→intent Phase 3)."
+
+data hand_import_gate_shell_runner_scaffold: Disposition = Scaffold {
+  dissolves_to: SingleAuthority,
+  bind: DeclarationRef {
+    module_path: "tools.hand_import_gate",
+    decl_name: "hand_import_gate_shell_emit_dissolution_trigger",
+    field: WholeDeclaration
+  }
+}
+
+fn hand_import_gate_passes_for_pr() -> Bool {
+  hand_import_gate_passes(base_ref: "origin/main")
+}