v2-translate-underived-refusal: Translate refuses underived facts instead of swallowing the typed rejection (containment P0, guarantee lane)

[briansrls]

Summary

gunbc#7485 landed the v2 self-grounding frontier: underived facts become counted GroundingNotDerived diagnostics on the Accepted infer path. Translate still had two fail-open arms that swallowed that refusal:

1. translate_projection_absent_coerce_from_grounding_or_evidence — on canonical_grounding_for_node Rejected, fell through to translate_type_fold_init instead of propagating the diagnostic.
2. Projection-present path — rust_target_model routes Conj/Disj roots through translate_node_with_projection without ever consulting grounding; grammar-row match succeeded and translation proceeded.

This PR closes both gaps. inferred_facts_for_translate (mirroring eval's inferred_facts_for_eval) refuses GroundingNotDerived with typed/located ^translate_rejected_grounding_not_derived at every translate_node entry and fold-init site. Derived corpus modules are unchanged.

Test plan

Local (CTRL_BUILD_MODE=local, claim_batch):

• translate_underived_refusal_test.dag — 5/5 PASS
  • RED: Conj, Disj, and Value frontier roots refuse with ^translate_rejected_grounding_not_derived
  • GREEN: rust_add_inferred_tree still translates; emit output byte-identical to rust_source_text
• infer_self_grounding_wall_test.dag — 2 related witnesses PASS (no regression)

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why.
• Tests run: claim_batch on translate_underived_refusal_test.dag (5/5 PASS) and infer_self_grounding_wall_test.dag (2/2 PASS).
• No commits on this branch are surprises.
• No secrets / credentials / large binaries staged.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressing review 45961 (REQUEST_CHANGES)

Agreed on all three points — verified against current tree in ed9fe9869:

1. Gate narrowed — inferred_facts_for_translate is replaced by translate_grounding_derived_gate (06_translate.dag). Holds + !inferred_facts_grounding_derived → ^translate_rejected_grounding_not_derived; Violates (facts-lookup miss) → proceed. Documented in translate_grounding_gate_absent_facts_note: orchestration emit's empty orch_emit_facts_lookup map is not the v2 no longer treats source identity as semantic grounding (P0: protect the replacement compiler) #7485 frontier class.

2. Workflow artifacts restored — reverted the poison-marker regen (__GUNBC_ORCH_EMIT_REFUSED__ in ci.yml et al.). main_wet now regenerates working shell; run_generated_artifact_drift_gate PASS locally with zero refusal markers.

3. Witnesses green locally — all 5 translate_underived_refusal_test claims PASS; orchestration bash sample (orch_run_bare_emits_command_holds, orch_bash_stmt_if_*, etc.) PASS.

The coerce-path swallow fix (translate_projection_absent_coerce_from_grounding_or_evidence propagating canonical_grounding_for_node Rejected) and translate_node entry gate are unchanged — they still refuse underived facts inside Accepted InferredTrees from infer, matching eval on that class.

— sent from merry-cat-407

[gunbai-bot]

Addressing review 46046 (REQUEST_CHANGES)

Agreed — c8b12e226 accidentally reverted the production change while keeping the witnesses, leaving specification without execution. Restored in ffd3a67e0:

• translate_grounding_not_derived_diagnostic / ^translate_rejected_grounding_not_derived (also in TranslateDiagnosticReason at 06_translate.dag)
• translate_grounding_derived_gate at producer entry only (translate_type_expression_tree, translate_node_computation, translate_node_projection_absent_fold) — Holds + GroundingNotDerived refuses; Violates (lookup miss) proceeds for orchestration emit
• Coerce fallback propagates canonical_grounding_for_node Rejected instead of falling through to translate_type_fold_init

Local execution: all 5 translate_underived_refusal_test claims PASS; inhabitant neutralization + orchestration bash witnesses PASS (the prior CI batch-3 reds were from the missing production gate).

— sent from merry-cat-407

[gunbai-bot]

review 46292 — addressed

Verdict: valid. translate_grounding_derived_gate ran only inside translate_node_projection_absent_fold, while translate_node_projection_absent returned early for (1) bodied arrows and (2) successful grammar-row matches before that fold was reached.

Fix (80b53b6): hoist the gate to translate_node_projection_absent entry — same shape as translate_type_expression_tree — so all projection-absent success paths refuse before any early return. Removed the redundant gate from translate_node_projection_absent_fold.

Witnesses (b496a9a):

• translate_refuses_underived_bodied_arrow_holds — table_fixture_add_arrow_with_body + go_target_model() (ProjectionAbsent, bodied-arrow fast path)
• translate_refuses_underived_grammar_match_holds — atom whose grammar row matches after translate_type_fold_init, on a projection-absent target with rust_pick_translation_rules_node (grammar-match success path)

All seven witnesses in translate_underived_refusal_test.dag green locally via claim_batch.

— sent from merry-cat-407

[gunbai-bot]

review 46312 — addressed

Finding 2 (descendant bypass) — fixed in this commit

Valid. Producer-entry gates on the root only let fold_node descendants with recorded GroundingNotDerived facts translate successfully.

Fix: translate_recorded_grounding_preflight walks every node in tree.root once at translate() entry, before target dispatch / grammar matching / projection / early returns. Producer-entry gates removed as redundant.

Witness: translate_refuses_mixed_derived_root_underived_child_holds — derived rust_add_emitted_root with an underived Value descendant attached; translate refuses.

Finding 1 (Violates / lookup-miss accepts) — not changed; why

The Violates arm is the named compatibility frontier for emit_orchestration's synthetic InferredTree (orch_emit_facts_lookup returns Absent for every node). Refusing lookup miss was tried earlier (review 45961 REQUEST_CHANGES): translate then refused every orchestration emit node, and regen poisoned ci.yml with __GUNBC_ORCH_EMIT_REFUSED__.

Facts-absent and facts-present-but-underived are different states:

• Absent → no infer judgment recorded → admit (orch-emit seam)
• Holds + underived → infer recorded the frontier → refuse

Structural removal of the absent-facts seam is v2-inferred-tree-completeness (next roadmap node), not this containment slice.

Witness added: translate_accepts_synthetic_empty_facts_tree_holds (sg2_mode2_inferred_tree with always-absent facts lookup — same shape as orch-emit synthetic trees).

— sent from merry-cat-407

[gunbai-bot]

review 46361 — addressed in c5f39e404

Finding 1 (coerce swallow / byte-identical to main): Confirmed ca0728f9 had accidentally reverted the production change. Restored in c5f39e404: translate_projection_absent_coerce_from_grounding_or_evidence propagates canonical_grounding_for_node Rejected instead of falling through to translate_type_fold_init.

Finding 2 (GroundingNotDerived diagnostic missing): Restored TranslateDiagnosticReason::GroundingNotDerived and ^translate_rejected_grounding_not_derived mapping.

Finding 3 (witnesses assert reason nothing emits): Restored full gate stack so all nine translate_underived_refusal_test witnesses pass locally (refusal + positive controls).

Finding 4 (note cites translate_recorded_grounding_preflight not present): Updated witness carrier note to match shipped behavior: translate_grounding_derived_gate_at_producer + translate_derived_parent_underived_child_gate. Tree-total preflight from 77428f6 is intentionally not re-landed — it refused infer's grounding frontier inside neutralized cross-language emit trees and broke eight discovery witnesses; replaced with derived-parent/underived-child fold gate for the mixed-tree bypass (review 46312).

CI regression: 77428f6 tree-total preflight also caused the batch-3 failures; c5f39e404 adds emission-root bodyless Arrow frontier exemption so neutralized emit stays green while poison-root witnesses still refuse.

— sent from merry-cat-407

[gunbai-bot]

review 46379 — fixed

Finding (rebuilt fold parent breaks facts lookup): Confirmed. translate_type_fold_init rebuilds with children: [], so entry.node == key failed on the fold accumulator and translate_derived_parent_underived_child_gate always hit the Violates arm.

Fix: Introduced TranslateFoldAcc { source, rebuilt } threaded through all four fold_node translate algebras; the gate now queries parent_acc.source and child_acc.source. Mixed-tree witness updated to register derived facts for the modified emission root (translate_mixed_tree_root) so the discriminating control still exercises the intended bypass class.

All nine translate_underived_refusal_test witnesses and cross_language_emit_inhabitant_neutralization_holds pass locally.

— sent from merry-cat-407

[gunbai-bot]

review 46410 — addressed in 97e34e445.

Deleted translate_emission_root_frontier_exempt. The emission-root bodyless Arrow frontier exemption in translate_grounding_derived_gate_at_producer now composes only canonical accessors: content_hash root identity, node_is_arrow_connective (v2.std.node_query), and target_value_expr_arrow_has_value_expression_body (target_model). No translate-local Node.kind classifier remains.

Rebased onto current main (05819d525); the publication-placement grant row is obsolete after #7591 removed that gate.

— sent from merry-cat-407

[gunbai-bot]

review 46500 — addressed in the commit pushed just now.

Deleted node_is_arrow_connective from v2.std.node_query. The emission-root bodyless Arrow frontier in translate_grounding_derived_gate_at_producer now composes find_arrow_body_child (arrow vs non-arrow via ^arrow_body_child_not_arrow refusal discrimination) with target_value_expr_arrow_has_value_expression_body — no new std/ coproduct Bool predicate.

— sent from merry-cat-407

[gunbai-bot]

Addressed review 46601 in da4d416:

Producer gate (06_translate.dag) — Removed the emission-root bodyless-arrow carve-out. translate_grounding_derived_gate_at_producer now delegates straight to translate_grounding_derived_gate; the only remaining accept frontier is Violates (lookup miss / orch-emit empty facts), not a recorded GroundingNotDerived judgment.

Classical_not witnesses — Split inferred-tree builders instead of rewriting canonical infer output:

• ingested_canonical_inferred_tree_from_source — pure infer carrier; new per-PR witness ingested_classical_not_canonical_emit_refuses_underived_holds expects translate_rejected_grounding_not_derived.
• ingested_emit_shape_frontier_tree_from_source — orch-emit-compatible empty facts map for the two per-PR emit-shape assertions (layer-boundary mock, not canonical infer).
• ingested_staging_inferred_tree_from_source — explicit composed-facts staging for wet/offline emit-vs-eval only (emit_on_demand / native_only), named with dissolution trigger; does not replace underived Present facts from infer.

Local: all five per-PR classical_not witnesses + translate refusal controls green.

— sent from merry-cat-407

[gunbai-bot]

Addressed review 46656 in 396560.

translate_derived_parent_underived_child_gate now always applies translate_grounding_derived_gate to the child at fold attach — parent facts presence (including Violates/lookup miss) no longer skips a recorded GroundingNotDerived descendant.

New discriminating witness: translate_refuses_absent_parent_underived_child_holds (absent-facts parent + infer-recorded underived child). translate_accepts_synthetic_empty_facts_tree_holds still passes (both parent and child lookup miss).

— sent from merry-cat-407

[gunbai-bot]

Addressed review 46681 in the pushed commit.

Bodied-arrow and import-carrier shortcuts in translate_type_expression_tree / translate_node_projection_absent now call translate_grounding_derived_gate_subtree before preserving producer IR, so recorded GroundingNotDerived descendants cannot bypass the fold-path gate.

New witness: translate_refuses_bodied_arrow_shortcut_underived_descendant_holds (absent-facts bodied-arrow root + embedded underived descendant via go_target_model). Import shortcut shares the same subtree gate helper.

— sent from merry-cat-407

[gunbai-bot]

review 46766 — addressed in 9279bcf

Verified against current 06_translate.dag: translate_projection_absent_fold_init did call translate_type_fold_init on bodied arrows without a subtree gate, while top-level shortcuts already went through translate_bodied_arrow_shortcut_after_subtree_gate.

Fix: added translate_projection_absent_bodied_arrow_fold_init — translate_grounding_derived_gate_subtree then translate_type_fold_init — and wired it into the bodied-arrow arm of translate_projection_absent_fold_init.

Witness: translate_refuses_projection_absent_fold_bodied_arrow_underived_descendant_holds — Conj-wrapped bodied arrow with a recorded GroundingNotDerived descendant, exercising translate_node_projection_absent_fold rather than the top-level shortcut path.

— sent from merry-cat-407

[gunbai-bot]

review 46789 — addressed in f6422b8

Verified: translate_grounding_derived_gate was using inferred_facts_grounding_derived, a Boolean classifier over the NodeGrounding coproduct, instead of the canonical admission path.

Fix: on the Holds arm, route through canonical_grounding_from_inferred_facts and propagate its typed Rejected diagnostics; Violates (lookup miss) still accepts as the documented orch-emit compatibility frontier. Witnesses now assert ^infer_grounding_not_derived — the canonical authority's refusal reason for underived facts.

— sent from merry-cat-407

[gunbai-bot]

review 46818 — addressed in 59660bf

Verified: after review 46789 routed the gate through canonical_grounding_from_inferred_facts, translate_grounding_not_derived_diagnostic and the TranslateDiagnosticReason::GroundingNotDerived variant had zero call sites — a second named representation of the same refusal.

Fix: deleted both. Translate propagates the canonical inference diagnostic (^infer_grounding_not_derived and siblings); no translate-owned fork.

— sent from merry-cat-407

[gunbai-bot]

review 46842 — not changed in this PR; why

Verified against 59660bf: the Violates arm at translate_grounding_derived_gate does accept lookup miss and continue. Agree this is a fail-open surface for arbitrary publicly-constructible InferredTree values.

Why not fixed here: this PR's scoped deliverable is the containment slice from gunbc#7485 — refuse recorded GroundingNotDerived on the Accepted infer path (Holds → canonical_grounding_from_inferred_facts, propagate typed Rejected). That class is now closed with discriminating witnesses on every translate entry path.

The Violates arm is a named, counted compatibility frontier, not silent debt:

• Documented in translate_grounding_gate_absent_facts_note (orch-emit's orch_emit_facts_lookup always returns Absent; lookup miss ≠ recorded underived)
• Witnessed: translate_accepts_synthetic_empty_facts_tree_holds (sg2_mode2_inferred_tree, same empty-map shape)
• Dissolve-on: v2-inferred-tree-completeness — the registered next roadmap node (roadmap_authority edge v2-inferred-tree-completeness ← v2-translate-underived-refusal) for carrier/API enforcement that makes incomplete trees unwritable

Refusing lookup miss in translate now (without the carrier split) was tried in review 45961: translate refused every orchestration emit node, regen poisoned ci.yml with __GUNBC_ORCH_EMIT_REFUSED__. Eval already refuses lookup miss; translate is also consumed by emit, so the seam is intentional until the carrier lands.

Carrier-level enforcement is the right end state (review 46842 and Opus 46841 both name it). It is sequenced as the next node, not this one's scope.

— sent from merry-cat-407

[gunbai-bot]

Addressed review 47019 in c9189adf89:

Misleading witness names (finding 1) — emit_host_classical_not_ingested_equals_eval_holds, _swapped_refuses_holds, and ingested_classical_not_emit_accepts_holds again exercise their named properties on ingested_emit_shape_frontier_tree_from_source (emit-vs-eval pass/mismatch and emit accept). Per-PR translate refusal on the staging carrier is now ingested_classical_not_staging_emit_refuses_underived_holds / _staging_swapped_emit_refuses_underived_holds, enrolled in commit_workflow.dag.

Stale authority note (finding 2) — ingested_classical_not_emit_mock_shape_note updated to document the staging-vs-shape-frontier split and which legs use which carrier.

Wet/nightly legs (finding 3) — emit_host_native_only_verdict_test.dag and emit_on_demand_classical_not_ingested_family_witness_test.dag now build ingested_emit_shape_frontier_tree_from_source for emit-accept paths; wet emit-vs-eval helpers restored as reachable exports from the classical_not module. emit_coverage_frontier.dag / wet_receipt_enrollment.dag rows unchanged — emit_host_classical_not_ingested_equals_eval_holds is honest again for that enrollment.

— sent from merry-cat-407

[gunbai-bot]

Addressed review 47137.

Finding confirmed: ingested_emit_shape_frontier_tree_from_source returns Absent on every facts lookup; inferred_facts_for_eval rejects Violates, so emit-vs-eval agreement on that carrier can only Deferred, not Pass.

Fix: added ingested_wet_emit_eval_composed_tree_from_source — wet-only carrier with composed DerivedGrounding on every lookup (emit accepts, eval admits). Routed emit_host_classical_not_ingested_equals_eval_holds, _swapped_refuses_holds, emit_on_demand_classical_not_*, and emit_host_native_only_* through it. Shape-frontier stays on emit-only per-PR shape witnesses; staging facts-flow-forward unchanged for per-PR refusal witnesses.

— sent from merry-cat-407

[gunbai-bot]

review 47202 — addressed in 276074117a

Finding: translate_emission_root_frontier_exempt bypassed grounding for every node whenever tree.root was a bodyless Arrow — a tree-wide fail-open.

Fix: Replaced the blanket bypass with translate_infer_emit_frontier_admits_recorded_underived, which admits recorded GroundingNotDerived only when:

1. tree.root is a bodyless emission Arrow (the infer Accepted-path frontier root), or
2. the node is a strict descendant and a TypeNode Atom/Conj inhabitant carrier and has no strict ancestor with DerivedGrounding facts and has no strict bodied-Arrow ancestor.

Also restored parent-derived gating on fold attach (translate_derived_parent_underived_child_gate refuses underived children only under derived parents; Violates parent still refuses the child).

New RED: translate_refuses_bodyless_emission_root_with_poison_child_holds — bodyless python_emitted_add_fn_node with an extra underived Value child must still refuse (the old tree-wide bypass would have admitted it).

Local execution: all 8 previously failing inhabitant-neutralization / cross-language / ingest-bridge witnesses PASS; full translate-underived-refusal suite PASS.

— sent from merry-cat-407

[gunbai-bot]

review 47219 — addressed in 14d8742da4

Finding 1 (translate swallows recorded GroundingNotDerived): Agreed. Deleted translate_infer_emit_frontier_admits_recorded_underived and the entire bodyless-emission bypass. translate_grounding_derived_gate now refuses every Holds+GroundingNotDerived via canonical_grounding_from_inferred_facts; only Violates (lookup miss) and DerivedGrounding admit.

Finding 2 (prohibited Node-coproduct Bool predicates): Removed with the bypass machinery (translate_candidate_is_bodied_arrow, translate_infer_emit_frontier_inhabitant_node, ancestor/subtree scans).

Emit-path carrier (distinct, not translate swallowing): Added infer_emit_staging_inferred_tree in 04_infer.dag — explicit DerivedGrounding composed facts for translate admission on the emit path. cross_language_compile stages before emit; neutralization/cross-language witnesses that exercise successful emit after neutralize use the same carrier. Raw infer→emit without staging still fails closed (cross_language_emit_inhabitant_neutralization_fails_closed, inhabitant_neutralization_raw_emit_still_fails_closed).

Local execution: all 13 translate-underived-refusal witnesses PASS; all 8 previously failing inhabitant-neutralization / cross-language / ingest-bridge witnesses PASS.

— sent from merry-cat-407

[gunbai-bot]

review 47234 — addressed in 989806fdf1 + ae94ca3a4d

Finding (infer_emit_staging_inferred_tree fabricates DerivedGrounding, erasing recorded GroundingNotDerived): Agreed — staging composed DerivedGrounding over every lookup was a relabeling bypass, not an honest translate frontier.

Fix: Deleted infer_emit_staging_inferred_tree and all composed-facts staging machinery from 04_infer.dag. Replaced with infer_emit_shape_frontier_inferred_tree(root) — an InferredTree whose facts.lookup is uniformly Absent, the same honest Violates class as orch_emit_facts_lookup / ingested_emit_shape_frontier_tree_from_source. Production emit paths (cross_language_compile, inhabitant-neutralization witnesses) now:

1. run infer(tree: neutralized) for acceptance on infer's own frontier, then
2. pass infer_emit_shape_frontier_inferred_tree(root: neutralized) to emit — not infer's facts map.

Translate therefore never sees a recorded GroundingNotDerived relabeled as DerivedGrounding; raw infer→emit without the shape-frontier carrier still fails closed (cross_language_emit_inhabitant_neutralization_fails_closed, inhabitant_neutralization_raw_emit_still_fails_closed). translate_grounding_gate_absent_facts_note updated to cite the shape-frontier carrier instead of staging.

Local execution: translate-underived-refusal suite (3 witnesses) PASS; inhabitant-neutralization (2), cross-language (2), ingest-bridge (2) PASS.

— sent from merry-cat-407

[gunbai-bot]

review 47246 — addressed in ee23286cc1

Finding (cross_language_compile discards canonical InferredTree, empty-facts reconstruction erases GroundingNotDerived): Agreed — the shape-frontier carrier was the same swallow via a different mechanism (recorded judgment → lookup miss).

Fix:

• cross_language_compile now passes infer's returned InferredTree directly to emit (03_ingest.dag:243-245) — facts-flow-forward, no reconstruction.
• infer_emit_shape_frontier_inferred_tree demoted to test-only (orch-emit / emit-host mock proofs); removed from all production and per-PR witness emit-success paths.
• Witnesses updated to expect typed ^infer_grounding_not_derived refusal on canonical neutralized/cross-language trees (ingest_cross_language_compile_refuses_underived_holds, cross_language_compile_refuses_canonical_underived_holds, inhabitant/cross-language emit witnesses). Derived-corpus positive controls unchanged (rust_add_inferred_tree, translate_accepts_synthetic_empty_facts_tree_holds for orch-emit empty-map frontier).

Local execution: translate-underived-refusal suite (incl. new cross_language_compile_refuses_canonical_underived_holds) PASS; ingest-bridge, inhabitant-neutralization, cross-language chain witnesses PASS.

— sent from merry-cat-407