Guarantee ladder follow-up: climb plan in the canonical roadmap graph, derived rung state, construction-walled doc binds

[gunbai-bot]

Follow-up to #7486 (merged), doing the two things the operator asked: correct (the post-merge review verdict, all 8 items, each verified against main before adoption) and add (the guarantee-ladder climb plan as roadmap work) — then restructured per the operator's second verdict: the climb plan lives inside the canonical roadmap graph, not beside it.

Disclosure: this PR changes the design and roadmap authorities

gunbc.design_document (→ regenerated DESIGN.md) and gunbc.roadmap_authority (→ regenerated ROADMAP.md). Both projections regenerated via main_wet on dag/tools/generated_artifact_gate.dag, never hand-edited.

The climb plan, in the canonical graph (operator verdict, all 10 merge-bar items)

1. No second roadmap universe: guarantee_ladder_section() deleted; 16 nodes + 23 edges enter declared_roadmap_nodes()/declared_roadmap_edges() via guarantee_ladder_nodes()/guarantee_ladder_edges(), so they are counted, receipt-checkable, and covered by the identity/endpoint/acyclicity/active-set witnesses like every other lane. Page visibility is the typed focus policy (roadmap_focus_selection gains the lane), not an out-of-mechanism placement.
2. Lane owner compiler-guarantee on every node (owner = lane identity, not an assignee; nodes are unbound until dispatch binds a session and closing contract) — also resolves review 45356's REQUEST_CHANGES on the owner-less rows.
3. Graph corrections: probe corpus → claims carrier → baseline prevalence → the floor walls; prevalence split into baseline (before any wall) and residual (after all climbs, diffed against baseline); new nodes floor-generic-field-constraint-wall (field_of_type_var fabrication) and floor-method-ambiguity-wall (>1 resolution, after the join defines sameness); cardinality ← sole_constructor audit edge; capability-audit node repointed off the parked visibility-grants doc.
4. Sequencing corrected by measurement (tidy-deer-730, gunbc#7484): primitive-identity-join is a prerequisite of the general method-existence wall, not a follow-on — the kernel algebra profiles disagree with interpreter dispatch (length/count/size fork), which is what forces per-receiver walls narrow. Census records the landed narrow kernel wall at its honest subject grain.
5. No rung state in tickets: every current-rung transcription removed; headlines name target transitions; the census/carrier own measured state.
6. Rung state is derived, never stored (also review 45367): the Stage-1 carrier is a four-way split — GuaranteeRequirement / GuaranteePath (per in-scope path, population derived or completeness-witnessed) / GuaranteeMeasurement (executed receipts) / GuaranteeDisposition derived per path (Unmeasured | BelowFloor | OnLadder | OutsideModeledGuarantee, folded to minimum-across-paths). No stored current_rung field exists, so a transcribed rung is unrepresentable. Reconciled across §12 Stage 1, DESIGN §4b tail, and the roadmap node; the five recovered vocabularies stay orthogonal (joined by class identity, never consolidated onto one axis).
7. rendered ⊆ declared ∪ derived is witnessed: containment predicate green over both real documents, plus a synthetic-ghost RED proving the predicate counts exactly the undeclared node.
8. HandAuthoredDocBind nonempty by construction: primary_work: DeclarationRef + additional_works: List — the zero-anchor bind is unwritable; the empty-works RED deleted with the validation it backed (residue named on the carrier note: the compile-refusal probe belongs to the probe corpus's record-completeness class); the two remaining duplicate (home, slug) pairs merged; bind-identity uniqueness witnessed with a synthetic-duplicate RED.

Corrections carried from the first verdict (all verified against main)

sole_constructor exists → §4b corrected to audited-status; subject grain = minimum across paths; seed rungs demoted to UnknownUnmeasured (census specimen-denominated); dissolution-on-climb keeps RED evidence; fold-test relabeled manual value-level; §8c recast; wording fixes. New this round: parser silent-separator below-floor census row + §11 items 6–8 (both parser defects + the two receiver-type resolution defects, from the gunbc#7484 lane's measured receipts).

Verified by execution

main_wet regen (ROADMAP.md byte-stable against the auto-heal regen; DESIGN.md §4b tail re-projected) · roadmap authority 37/37 (2 new containment witnesses) · identity 9/9 · focus 12/12 · model 9/9 · drift 8/8 · doc-graph 11/11 (uniqueness + duplicate RED + two-anchor pin).

🤖 Generated with Claude Code

[gunbai-bot]

review 45336: confirmed and fixed in aa06080. The finding was exact — works had a typed carrier and zero readers, which is representation without a consumer: specification-without-execution (DESIGN §5 / E-10), reproduced inside the very fix that was answering the previous review's structural-representation finding.

Executing consumers now enrolled in dag/test/claim/doc_reachability_witness_test (ReadsLiveTree, never predict-skips): doc_graph_binds_works_all_nonempty (an emptied list reds), doc_graph_works_refs_carry_symbols (a ref stripped of its module_path/decl_name reds), guarantee_recovery_bind_pins_both_anchors (deleting or renaming either anchor reds; row multiplicity pinned to one), and doc_graph_works_empty_red_control (a synthetic empty-works bind fails the predicate — the discriminating control). Predicates live on the authority so the witnesses consume the carrier's own definition.

Residue, named on the carrier rather than absorbed: staleness against the live tree — a ref naming a decl that no longer exists — is not witnessed here, because v1.compiler.* is outside the witness compile pool; that is exactly the feature:cited-symbol-resolution lens DESIGN §3 already names, and the works refs are symbolic citations inheriting that trigger. Deleted → red, emptied → red, anchors-edited → red; stale-vs-tree → named wall-after-grounding.

All 11 doc-reachability witnesses green by execution.

[gunbai-bot]

review 45349: confirmed and fixed. The census demoted these three classes and the roadmap nodes — authored before the demotion pass — kept "R0 → R2" headlines, so the canonical roadmap re-inflated them the same day they were demoted; the section's own state-vs-work note already said rung state lives in the claims carrier, never these nodes. Headlines now name only the target rung and defer current state to the census explicitly ("current rung: the census — …", with the method node carrying the path-scoped claim: R0 proven on the interpretation path only, emission path unmeasured). ROADMAP.md regenerated via main_wet; roadmap authority 35/35 and drift 4/4 green by execution.

Worth noting the pattern across this lane's three codex catches: rung inflation in the specimen table (review 45310), representation-without-consumer in the works carrier (review 45336), and now state restated at a second authority (review 45349) — each is the ladder's own honesty rule firing on the artifacts that define it. That is the intended failure mode of the discipline: the rules are catching their own author before they gate anyone else.

[gunbai-bot]

Restructure landed at 2d836ed (plus the auto-swept 93b95d2 and the auto-heal regen dceeb89), executing the operator's 10-item merge bar and the two open REQUEST_CHANGES:

The verdict's structural findings. The ladder section is gone as a rendering universe: guarantee_ladder_nodes()/guarantee_ladder_edges() concat into declared_roadmap_nodes()/declared_roadmap_edges(), so all 16 nodes sit in the one graph — counted, receipt-checkable, witnessed for identity/endpoints/acyclicity/active-set like every lane. Visibility survives focus via the typed policy (roadmap_focus_selection now selects self-host + compiler-guarantee). Containment is enforced going forward: witness_rendered_nodes_are_declared_or_derived is green over both document views, and witness_ghost_node_outside_authority_is_counted proves a synthetic undeclared node counts as exactly one ghost.

review 45356 (owner: ""): every climb node now carries owner: "compiler-guarantee" — the lane's identity, not an assignee; nodes stay unbound until dispatch binds a session and closing contract (recorded in guarantee_ladder_lane_note).

review 45367 (stored current_rung fork): all three sites reconciled to the derived model — §12 Stage 1b now specifies the four-carrier split with GuaranteeDisposition derived per path and no stored rung column; the §1b landing block and the DESIGN §4b tail (gunbc.design_document, re-projected) say the same; the correction is recorded in the §10 ledger. The stale "work field's ref" wording in the dissolution trigger is fixed.

Graph corrections beyond the verdict's list: sequencing corrected by tidy-deer-730's measured receipts on gunbc#7484 — primitive-identity-join is a declared prerequisite of the general method-existence wall (the length/count/size dispatch fork is what keeps the landed kernel-receiver wall narrow), and the parser silent-separator specimen entered the census as a measured below-floor row with §11 queue items 6–8.

Construction over validation on the binds: primary_work + additional_works makes the zero-anchor bind unwritable; the empty-works RED was deleted with the validation it backed (its discriminating role passed to the type; the compile-refusal probe is named probe-corpus work), duplicates merged, and (home, slug) uniqueness witnessed with a synthetic-duplicate RED.

Witness receipts: roadmap 37/37 · identity 9/9 · focus 12/12 · model 9/9 · drift 8/8 · doc-graph 11/11; ROADMAP.md regen byte-stable, DESIGN.md re-projected via main_wet.

— sent from cool-badger-514

[gunbai-bot]

review 45406 verified and fixed at c0ac6e8: the containment wall now checks WHOLE-VALUE membership — a rendered node must be value-equal to a declared node or a projection-derived closing-contract task, so an altered copy reusing a declared identity counts as a ghost instead of passing as sanctioned. Added the altered-copy RED the review asked for: the probe pulls the real declared ladder-claims-carrier node, rebuilds it with one field changed (derived from the canonical node, so the probe duplicates no literals), renders it in a synthetic section, and the witness asserts exactly one ghost; it returns 0 (failing loudly) if the anchor node ever disappears. Authority set 38/38 including both REDs (fresh-identity ghost + altered copy). The containment note records the identity-only first cut as the refused shape.

— sent from cool-badger-514

[gunbai-bot]

review 45412 verified and fixed at cd3d4bb: the hand-rolled document_rendered_nodes walker is deleted and the containment predicates (whole-value ghost count + both RED probes) now consume doc_all_nodes, the canonical traversal. They moved into gunbc.roadmap_spawner — the walker's own module — because the spawner already imports roadmap_authority, so importing the walker back into the authority would cycle; the test consumes the predicates from the spawner. The containment note now records both refused first cuts (identity-only membership from review 45406, and this walker fork) since each was the wall violating a law it enforces. Net diff is -6 lines. Receipts: authority 38/38, spawner 16/16, page 28/28.

— sent from cool-badger-514