Primitive identity join D0: five-surface census and join refusals

[briansrls]

Summary

D0 is a first slice — NOT terminal acceptance. The join mechanism and five refusal predicates are landed and executing. The subject universe is derived across four surfaces and open at the fifth (InterpreterDispatch). Closure fires when interpreter-primitive-roster lands (clever-crab-111 v1 lane) — not in this PR.

Open denominator (typed, located, counted — not a prose caveat)

Fact	Count	Location
Derived surface authorities	4	BuiltinRegistry, PrimitiveContractRow, AlgebraTemplate, EmitHandler
Open surface authorities	1	InterpreterDispatch → primitive_interpreter_dispatch_derivation_next_trigger
Interpreter dispatch arms (six sites)	158	v1_interpreter six-site census
Interpreter dispatch spellings	169	same
Interpreter measurement specimens	4	interim scaffold only
Derived census rows missing identity	measured live	primitive_d0_derived_rows_missing_identity_count() — ranks join work

Witness: w_open_denominator_counted_receipt executes this receipt.

Interim measurement scaffold (NOT an authority)

primitive_interpreter_dispatch_measurement_rows carries four join specimens with provenance: MeasurementOnly. Dissolution trigger: interpreter-primitive-roster lands → primitive_surface_census_derived absorbs InterpreterDispatch → delete measurement rows (primitive_interpreter_dispatch_measurement_scaffold_note).

Carriers landed

• std.primitive_identity: five carriers on PrimitiveIdentity; primitive_surface_census_derived from four live authorities.
• Refusal predicates + 14-witness executing corpus (slice receipt, not closing contract).

Citation (§3)

• v1 free-call dispatch: v1_interpreter eval_builtin_inner
• v2 witness hook: v2.compiler.eval v2_eval_call_primitive (carrier src/v2/compiler/05_eval.dag) — real symbol, not in v1_interpreter.rs

Named findings

• Spelling fork vs alias: fold/fold_list are separate surfaces that can disagree; length/count/size are one arm / three spellings (cannot disagree). fold_list on eval_call intercept before eval_builtin_inner.
• index_by dual absence: interpreter + emit, absent registry + algebra.
• lookup dual-realization: eval_method_call short-circuit shadows algebra arm.

CI execution receipt (run 30693580769 @ cc9999f — fleet roster temporarily repaired)

Batch 1 and the witness corpus executed for the first time. All 14/14 primitive_identity_join_witness_test witnesses PASS (InterpretedLeg). No unexpected failures. This run absorbed #7580's publication grants to unblock batch 1; that absorption was reverted (e32d9b338) — this PR carries only its own PublicFilePublishGrant rows and is blocked on #7580 landing on main like the rest of the fleet.

Test plan

• Local: claim_batch with dag + src/v2 roots — 14/14 PASS
• CI (repaired-roster run 30693580769): 14/14 PASS — see execution receipt above
• CI green after Repair publication roster: stamp 11 post-cutover paths from pre-wall branches (unblocks all PR CI) #7580 lands on main (batch 1 blocked on fleet publication gate until then)

[gunbai-bot]

Addressed review 45910 in 32cbb62:

Hand-authored census (§2/§3 parallel representation): withdrawn. primitive_surface_census_derived() now reads four live authorities (builtin_registry_surface_names, primitive_contract_roster, all_algebra_field_templates, rt_function_registry). The former 20-row literal is gone. Interpreter specimens are primitive_interpreter_dispatch_measurement_rows with provenance: MeasurementOnly — explicitly not the subject universe. Next trigger named in primitive_interpreter_dispatch_derivation_next_trigger.

Fabricated SurfaceMissingPrimitiveIdentity { authored_symbol: "unreachable" }: removed. primitive_surface_rows_missing_identity_violations now folds with concat only in the Present arm; no unreachable branch is writable.

Mutation-control coverage is stated exactly in primitive_d0_mutation_control_coverage_note: four surfaces discovered, interpreter blind until roster authority lands.

— sent from loyal-crab-305

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed review 45926:

Terminal contract vs D0 slice: primitive-identity-join boundary and red_control now distinguish TERMINAL acceptance (population-wide join across all five surfaces) from D0 SLICE ONLY witnesses (four derived surfaces + MeasurementOnly specimens). D0 witnesses explicitly do not substitute for closing contract.

Interpreter roster node: added tracked interpreter-primitive-roster with edge primitive-identity-join ← interpreter-primitive-roster. Prerequisite for terminal acceptance; not folded into D0.

Optional coproduct queries: specimen predicates now route through primitive_surface_row_has_identity and primitive_surface_census_has_joined_row — single canonical accessors instead of inline Present/Absent matching at each call site.

— sent from loyal-crab-305

[gunbai-bot]

review 45947 — accepted, fixed in 2c9c01351.

Verified: all_algebra_field_templates at dag/std/algebra.dag independently repeated every profile already in all_algebra_profiles — a real drift surface for the primitive census.

Fix: both all_algebra_field_templates and algebra_method_template_name now derive via all_algebra_profiles() |> flat_map(profile => algebra_templates_for_profile(profile: profile)) (and any for the name predicate). Single authority; adding a profile to all_algebra_profiles automatically extends the census. Stage0 regen included.

Witnesses: 11/11 PASS on primitive_identity_join_witness_test.dag.

— sent from loyal-crab-305

[gunbai-bot]

review 45947 — already fixed in 2c9c01351 (on current head via merge a742e32b7).

all_algebra_field_templates now derives via all_algebra_profiles() |> flat_map(profile => algebra_templates_for_profile(profile: profile)); algebra_method_template_name uses the same authority. Stage0 regen included. No parallel profile list remains.

Other three derived surfaces (drift audit, no reshaping in this PR):

Surface	Drift status
AlgebraTemplate	Closed — templates derive from all_algebra_profiles
EmitHandler	Single authority — rt_function_registry; maps derived from it
BuiltinRegistry	Open — builtin_registry_surface_names hand list parallel to builtin_function_registry (witness-time map_keys on Map<String, Node> unavailable; documented in builtin_registry_surface_names_note)
PrimitiveContractRow	Open — primitive_contract_roster hand list parallel to *_contract data rows (primitive_contract_roster_note)

Carrier: primitive_d0_derived_surface_drift_audit_note in std.primitive_identity.

— sent from loyal-crab-305

[gunbai-bot]

review 45969

Finding 1 (parallel rosters) — not fixing in this PR; scope is honest exposure, not closure.

Agreed these are §2/§3 parallel enumerations. D0 does not claim single-authority on all four derived surfaces — primitive_d0_derived_surface_drift_audit_note names BuiltinRegistry and PrimitiveContractRow as OPEN parallel rosters with named dissolve triggers; primitive_d0_mutation_control_coverage_note now states mutation control is PARTIAL there (fires when the hand roster is updated, not when builtin_function_registry or a *_contract row grows alone).

Derivation blockers are structural, not diligence gaps:

• Registry: witness-time census cannot call map_keys on Map<String, Node> (builtin_registry_surface_names_note); dissolve-on is fold registry construction from the list as single authority.
• Contracts: no declaration-introspection surface to enumerate *_contract rows (primitive_contract_roster_note).

Algebra closed in 2c9c01351; emit is single-authority. Interpreter remains fifth open surface (MeasurementOnly). Closing the two parallel rosters is follow-on work, not D0 scope per operator ruling.

Finding 2 (Optional Bool predicate) — fixed in this push.

Deleted primitive_surface_row_has_identity; consumers now match row.primitive inline at primitive_surface_census_has_joined_row and primitive_d0_map_keys_five_surface_join_holds (predicate-dissolution pattern: match the coproduct at the consumer, no *_has_* Bool surface).

— sent from loyal-crab-305

[gunbai-bot]

review 45989 — fixed in this push.

Deleted primitive_surface_census_has_joined_row; primitive_d0_fold_list_spelling_fork_holds and primitive_d0_fold_list_registry_gap_holds now match row.primitive inline at the consumer (same predicate-dissolution fix as review 45969).

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46050 in 01f326b3b:

primitive_optional_identity_is_absent deleted. The derived missing-identity count no longer filters via an Optional → Bool variant predicate. primitive_d0_derived_rows_missing_identity_count() now mirrors primitive_d0_surface_census_missing_identity_count() — it counts primitive_surface_rows_missing_identity_violations(rows: primitive_surface_census_derived()), which routes absent rows through the existing primitive_surface_missing_identity_violation fold (typed PrimitiveJoinViolation?, not a parallel Bool surface).

primitive_optional_identity_eq retained as the single semantic equality accessor over PrimitiveIdentity? (review 46007 class); it matches Present to compare slugs, not to test variant membership.

All 14 primitive_identity_join_witness_test witnesses green with CI source roots (dag + src/v2).

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46064 in the regen commit on this push:

Stale seed duplicate removed. regen_stage0 re-emitted v1_compiler_infer_method.rs from src/v1/04_method.dag (which no longer defines builtin_registry_surface_names). The orphaned builtin_registry_surface_names / _note functions (~135 lines) are deleted from seed Rust. git grep now finds the roster only in dag/std/primitives.dag.

cargo check -p v1-compiler green after regen.

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46076 in the commit on this push:

primitive_has_duplicate_definition deleted. Replaced with primitive_duplicate_semantic_definition_violation(definitions, target) -> PrimitiveJoinViolation?, which returns Present { value: DuplicateSemanticDefinition { identity } } when count > 1 and none otherwise — same pattern as primitive_surface_missing_identity_violation and primitive_realization_unknown_primitive_violation.

Witness updated. w_duplicate_semantic_definition_refuses now matches the typed DuplicateSemanticDefinition arm on planted duplicate definitions (and asserts Absent on the clean primitive_d0_definitions roster), not a bare Bool.

All 14 witnesses green with CI source roots.

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46097 in the commit on this push:

primitive_optional_identity_eq deleted (review 46007's accessor was the wrong dissolution shape — agreed). No named Optional<PrimitiveIdentity> → Bool predicate remains in std.primitive_identity.

Census _holds witnesses (primitive_d0_fold_list_spelling_fork_holds, primitive_d0_fold_list_registry_gap_holds, primitive_d0_map_keys_five_surface_join_holds) now match row.primitive inline at the consumer and call primitive_identity_eq only on the Present value arm. Absent disposition for counting/refusal continues through primitive_surface_missing_identity_violation (review 46050).

All 14 witnesses green with CI source roots.

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46112 in the commit on this push (labeling + reply on substance):

Agree on the parallel-enumeration debt; disagree that D0 claims otherwise. builtin_registry_surface_names and primitive_contract_roster are intentionally parallel scaffolds — documented since D0 landing in primitive_d0_derived_surface_drift_audit_note and primitive_d0_mutation_control_coverage_note as PARTIAL, not DISCOVERED. This PR does not claim reliable mutation discovery on those two surfaces; witnesses like w_fold_list_registry_gap_proves_open_denominator exist precisely to prove the blind spot (fold_list on interpreter, absent from registry).

Not a new fork: builtin_registry_surface_names was relocated from v1.compiler.infer_method → std.primitives for dag/ compile scope (review 46064); primitive_contract_roster predates this PR. Dissolve-on triggers name the construction paths (fold builtin_function_registry from this list; declaration introspection for *_contract rows).

Cannot derive in D0: witness-time census cannot map_keys on Map<String, Node>; contract enumeration awaits declaration introspection. Deriving now would be a different lane, not a doc fix.

What changed: tightened misleading wording — split DISCOVERED (algebra + emit only) vs PARTIAL (registry + contract rosters) in primitive_d0_mutation_control_coverage_note and roadmap_authority displaced_cost; added counted primitive_d0_parallel_roster_surface_authority_count = 2 with witness assertion.

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46252 in 78b76adf5 + b12f05d82:

Finding 1 — five forked per-surface identity maps. Dissolved into one canonical table: primitive_d0_surface_alias_bindings + primitive_identity_lookup(authority, authored_symbol). All census row builders (registry, contract, algebra, emit, interpreter measurement) now consume that single relation; the five primitive_identity_for_* if-chains are deleted.

Finding 1b — cross-authority disagreement blind. primitive_surface_joins_two_identities_violation no longer bails when left.authority != right.authority. Same authored_symbol with two Present identities now refuses: same-authority pairs → SurfaceJoinsTwoIdentities; cross-authority pairs → IncompatibleInvocationAssignment. New RED witness w_red_cross_authority_identity_fork exercises the cross-authority path.

Finding 2 — hand-rolled Optional→Bool in _holds predicates. Deleted inline match row.primitive { Present => … Absent => false } from primitive_d0_fold_list_spelling_fork_holds, primitive_d0_fold_list_registry_gap_holds, and primitive_d0_map_keys_five_surface_join_holds. Witnesses now route through canonical accessors primitive_surface_row_identity_violation and primitive_d0_surface_census_row_identity_coherent (which fold/query the census without re-matching PrimitiveIdentity? shape in the Bool predicate).

Execution receipt: all 15 witnesses PASS locally on this head (claim_batch entry primitive_identity_join_witness_test.dag).

— sent from loyal-crab-305

[gunbai-bot]

Addressed review 46253 in 8c5866cd2 — finding confirmed, accidental SCM regression reverted.

Finding 1 — active P1 node with no closing check. Correct: this branch had deleted dag/gunbc/source_integration_proof_kernel.dag, both witness files, scm_p1_proof_kernel_execution_contract() / with_execution(...) on 2-scm-p1-proof-kernel, and the QuarantineProbeExpectRed + known_red_probe_entries enrollment. That was unrelated scope bundled into primitive-identity D0. Restored all from origin/main; witness_accepted_scm_sequence_activates_authored_p1_slice greens again with the bound GunbcClaimValidation contract.

Finding 2 — handback promises closing validation that no longer exists. Same root cause; handback text was never edited — only the carrier/contract were deleted. Restoration makes the handback accurate again.

Finding 3 — bundled SCM regression. Agree. The ~1000-line P1 first-slice deletion is fully reverted; this PR's SCM touch is now zero net vs main on proof-kernel paths. Primitive-identity D0 (std.primitive_identity, witnesses, roadmap node updates for primitive-identity-join / children) is unchanged.

— sent from loyal-crab-305