Spine A Stage 0: the guarantee measurement schema (ladder-measurement-schema)

[gunbai-bot]

The first spine increment per the operator verdict (2026-08-01): the evidence protocol probes and claims meet through, and nothing else — no probe executes, no class population, no disposition, no rung, no claims about the compiler. This breaks the probes⇄carrier protocol cycle so ladder-probe-corpus (child work item, dispatching now) and ladder-claims-carrier consume one vocabulary instead of each minting temporary string keys.

dag/gunbc/guarantee_measurement.dag

• Identity brands: GuaranteeClassId, GuaranteePathId, GuaranteeProbeId (NonEmptyStr where brand, the std.claim_evidence/roadmap-identity idiom).
• GuaranteePath over four closed, minimal axes — every variant grounded on a path a real measurement exercises, per the in-module discipline note (an earlier draft's speculative PhaseCarrierAcceptance arm was deleted for exactly that reason):
  • subject_grain: SyntheticProgram | CorpusModule | WholeCorpus
  • acceptance_boundary: CompileAccept | InterpreterRun | InferToEval (the v2 no longer treats source identity as semantic grounding (P0: protect the replacement compiler) #7485-landed boundary) | InferToTranslate (the boundary v2-translate-underived-refusal: Translate refuses underived facts instead of swallowing the typed rejection (containment P0, guarantee lane) #7555 closes — the fact stays "grounding was not derived"; the consuming phase is named by the path, never by a second diagnostic)
  • compile_mode: V1Pipeline | V2SelfCompile
  • realization_target: InterpreterRealization | EmittedTarget{language: GuaranteeTargetName} — the target brand is receipt vocabulary with declared deferred grounding (dissolve-on the identity join reaching target-realization rows)
• GuaranteeMeasurementReceipt — all fields required, no Optional arms: class × path × probe × subject_revision × harness_revision × probe_set_digest × observed. The three revisions answer the baseline stage's three-way ambiguity (whose compiler, whose harness, which probe set). Reuses std.types.CommitSha and std.content_hash (§3 — no new revision or hash nicknames).
• ProbeObservation — the raw executed outcome, never the judgment (dispositions stay carrier-derived): RefusedTyped | AcceptedClean | AcceptedCounted | ExecutionDiverged | ProbeNotRunnable, with observed_is_verdict making could-not-measure structurally non-readable as pass/fail (§5's ⊤-as-ignorance split, executable).
• Refusing joins: exactly-one path resolution (unknown/duplicate refuse — never first-pick) and the receipt→path join; uniqueness folds for class and path ids; probe_set_digest folding in caller order with the canonicalization obligation explicitly assigned to the probe stage (no host-order sort smuggled in).

Witnesses (dag/test/claim/guarantee_measurement_witness_test.dag, synthetic rows only)

8/8 green by execution: round-trip join resolves exactly its path · receipt naming an absent path refuses Unknown · duplicate registry refuses with match count (never a plausible first row) · exactly-one resolution across all four boundary variants · duplicate class-id and path-id uniqueness REDs · digest input-determinism including order sensitivity · verdict/ignorance separation. The scope note states what synthetic witnesses can and cannot prove, and where the construction-by-required-fields half of the node's red_control gets its corpus-wide measurement (the record-construction census class — stated, not faked).

Receipts

• 8/8 witnesses PASS via claim_batch (fresh post-merge seed, verified by binary content per the circular-verify lesson).
• Whole-tree compile census: 0 blocking — which also caught a real §3 collision during development: the first draft named the outcome sum ObservedOutcome, which gunbc.output_policy already owns for process outcomes, breaking that module's witness by ambiguity; renamed to ProbeObservation, census restored to 0 blocking. (The 23 pre-existing occurrence-lane ambiguities reported earlier are gone from main.)
• regen_stage0 --verify: divergence 0. Generated artifacts: zero drift (main_wet clean — no ROADMAP/DESIGN change; the roadmap node stays active until its acceptance receipt).

Handback per the node: schema module path gunbc.guarantee_measurement; identity-registry witness receipt = the 8-PASS run above.

🤖 Generated with Claude Code

[gunbai-bot]

review 46075 (codex REQUEST_CHANGES) — verified against the rule's two sources, and the finding conflates their trigger conditions; addressed with the note-recorded trigger in the latest commit rather than new machinery.

What the rule actually says: docs/plans/nat-grounding-unification-design.md (row A′) forbids a manual coproduct match where a canonical fold already exists — is_zero is forbidden because nat_cata is already the canonical fold, and migration re-expresses through it. docs/plans/e0599-implementation-proposal.md §3.0 prohibits extending hand-matched substrate walks (Node-tree/type-repr walkers). Neither trigger holds here: ProbeObservation is a freshly declared five-variant domain sum in its own module — not the substrate — and observed_is_verdict is its only query, so there is no canonical fold to route through. The same-module Bool projection over an owned sum is the merged corpus idiom (gunbc.roadmap_identity record_is_active is byte-for-byte this shape, witness-guarded). Minting a one-consumer cata to route one predicate would be the §6 purity trap — machinery priced in elegance, not displaced cost.

What I did take from the review (its disposition alternative): the module note now records the named re-grounding trigger — the claims carrier's disposition derivation is this sum's expected second consumer, and when it lands, a probe_observation fold becomes the canonical surface, observed_is_verdict re-expresses through it, and the note sentence deletes with the migration. The hand-match cannot silently accumulate siblings; the discriminating witness (not_runnable_is_ignorance_never_a_verdict) stays enrolled either way.

— sent from cool-badger-514

[gunbai-bot]

The second publication-gate failure was not this branch either — it is a live breakage on main's tip: #7544 merged after the P-B wall landed via #7560, but its CI run raced the wall, so its eight new files (the heal-revalidation family, dag/extdeps/github/workflows.dag, dag/tools/ci_heal_dispatch.dag, and the two v2 preflight-emit files) carry no PublicFilePublishGrant rows. Every PR that merges current main inherits the red — reproduced locally by running the gate's own computation (git diff --diff-filter=ACR from the pinned cutover 7ead65c against the roster; eight UNGRANTED paths, none mine).

This PR now carries the mechanical fix: grant rows for all eight (placement declarations for files already public on main — exactly the rows #7544 would have added had the wall been in its merge ref), alongside the two rows for this PR's own files. Cutover-to-HEAD coverage verified complete locally; gate witnesses green.

— sent from cool-badger-514

[gunbai-bot]

review 46159 addressed in da81298 — the canonical fold is introduced and the predicate derives through it.

• probe_observation_fold<R> + ProbeObservationFold<R> now own the ONLY match over ProbeObservation, mirroring the in-tree canonical-elimination idiom (std.change KeyedLeafVerdictFold / keyed_leaf_verdict_fold; the Bool-projection-through-fold shape is byte-for-byte gunbc.host_identity_converge host_identity_precondition_allows_mutation). observed_is_verdict is now a ProbeObservationFold row, so a per-query hand-match over this sum has no form to accumulate.
• This executes the dissolution trigger review 46075's note had already recorded ("a probe_observation fold becomes the canonical surface, observed_is_verdict re-expresses through it") — a catamorphism's shape is sum-determined, so waiting for the carrier's second consumer bought nothing; the carrier's disposition derivation consumes this same fold when it lands. The note now carries the receipt instead of the interim.
• Discriminating control added and mutation-verified by execution: fold_discriminates_every_arm_and_carries_payloads (distinct sentinel per arm + payload counts through the refused/counted arms). Mis-routing ProbeNotRunnable to the diverged handler reds BOTH the new control and not_runnable_is_ignorance_never_a_verdict (executed locally: both FAIL under the mutation, restored, 9/9 PASS).

— sent from cool-badger-514

[gunbai-bot]

review 46179 addressed in 836cc89 — GuaranteePathId threads through the resolution seam end-to-end: resolve_guarantee_path takes the brand, both refusal variants carry it (PathUnknown/PathDuplicate, and the ReceiptJoin mirrors), and join_receipt_to_path passes receipt.path with the as String erasure deleted.

One honesty finding from verifying the fix by execution rather than assuming it (DESIGN §4b: a brand is cosmetic until construction and acceptance enforce the distinction): two executed controls show today's checker ACCEPTING a bare String at a branded parameter and at a branded record field. So the threading is model-correctness and erasure-removal today, not yet a wall — the registry-mechanism note records exactly that, and brand acceptance-enforcement goes to the probe corpus as its own measured guarantee class (below floor; its discriminating probes are precisely those two controls). The seam hardens for free when that class climbs. 9/9 witnesses green post-threading.

— sent from cool-badger-514

[gunbai-bot]

review 46287 addressed in 5b54ba1 — RefusedTyped.count and AcceptedCounted.count are now Nat (the corpus's canonical cardinal carrier: std.nat, the same idiom as monitoring_sample_count/entry_total in the gunbc layer), and ProbeObservationFold's arm signatures follow.

One honesty bound, measured the same way as the brand seam last round: an executed control (count: 0 - 7 at the Nat field) shows today's checker still ACCEPTING a negative inhabitant — no refusal fires. So the swap is the correct model and the right §5 direction, but "negative counts unwritable" is not yet true of the substrate; the module note records the cardinal claim together with that gap, and the numeric-refinement acceptance class joins the probe corpus alongside brand acceptance-enforcement (both measured below floor with executed discriminating controls). 9/9 witnesses green.

— sent from cool-badger-514

[gunbai-bot]

review 46308 addressed in c447f53 — both named contradictions are now unconstructible, but by axis orthogonalization rather than the family coproduct the verdict proposed, and the distinction is grounded in the authority docs:

• InterpreterRun × EmittedTarget was a naming defect, not a product defect. The boundary renames to RuntimeRun: run-level acceptance happens IN the path's realization, so WHICH runtime (interpreter arm or emitted binary) is the realization axis's fact. Under that reading RuntimeRun × EmittedTarget is not contradictory — it is a real path, the exact subject of the emit-divergence probes (DESIGN §4b's mislabeled-call example: the interpreter refuses what the emitter reorders; measuring the emitted side IS a run-boundary observation on an emitted realization).
• InferToEval × V1Pipeline dies by deleting the axis. Every landed control determines its pipeline from its boundary (the v1 walls' seams are v1; the phase boundaries are v2), so the stored compile_mode was a second representation of a derivable fact (DESIGN §2) whose only writable novelty was the contradiction. Deleted; it returns as a stored axis WITH the first real path measured under two pipelines at one boundary — the axis-discipline note's land-with-first-row rule, now applied to itself.
• Why not the family coproduct: family rows restate the orthogonal axes per combination — the N×M enumeration DESIGN §2 folds into axes (Compose<Int, MachineWidth<N>>: one axis, not ten types). After the two moves above, the remaining product (grain × boundary × realization) contains no semantically contradictory cell, so there is no family structure left for a coproduct to encode.

The axis-discipline note records the ruling with the review citation. 9/9 witnesses green (the synthetic paths now exercise RuntimeRun and modeless construction).

— sent from cool-badger-514