Legacy-test inflow: a manual audit mechanism, not continuous observability

[gunbai-bot]

Adds a per-change counter for added legacy Rust test functions, in audit mode only. It reports; it gates nothing.

What this is — and what it is NOT

It is a manual audit mechanism. It does not make inflow continuously observable. There is no scheduled consumer, no persisted receipt, and no dashboard. Running it today means running the recipe by hand:

GUNBC_CI_DIFF_BASE=<base> GUNBC_CI_DIFF_HEAD=<head> claim_batch --wet \
  --source-root src/v2 --source-root dag \
  --entry src/v2/workflow/legacy_test_inflow_audit.dag \
  --functions legacy_test_inflow_live_observation_holds

That gap is declared in-carrier (legacy_test_inflow_no_scheduled_consumer_note) with its dissolution trigger, and it is counted debt rather than a silent absence. A later PR still owes the non-blocking persisted receipt, the cadence, and a dashboard consumer. Until those land, nobody should read this as "inflow is being watched."

So it lands as three things: an inflow observation kernel, an explicit live local recipe, and counted unscheduled-consumer debt.

Why it exists

Not because of any ratio — because the mechanism is absent. Nothing in the repository can currently answer "did this change add legacy Rust test functions?" A number without a mechanism is a snapshot; the mechanism is the deliverable.

Fail-closed shape

The kernel is a pure fold over diff text with no live effects; the live wrapper reuses the floor's existing floor_diff_observe rather than opening a second git surface.

Refusal cannot read as zero. An earlier revision projected InflowRefused to an empty list and a count of 0, so an unobservable diff was indistinguishable from a clean one — the fabricated-plausible-output arm of DESIGN §5, inside the carrier whose whole job is making a missing measurement visible. That is fixed by construction rather than by discipline:

type LegacyTestInflowTally
  = InflowCountMeasured { count: Int, ids: List<String> }
  | InflowCountUnavailable { reason: NonEmptyStr }

There is no count field to read on an unavailable tally. The witness that asserted count == 0 on a refusal was encoding the erasure as the contract, so it was rewritten rather than kept.

Arrival identity is the canonical LegacyTestBehavior from the disposition module, not a sibling two-field carrier (the review 47551 fix — a nickname where an import edge belonged).

Evidence

12 fixture witnesses, green by execution under claim_batch: detection by name, plus zero-controls for a rename, a removal, a floor .dag witness (not inflow), and an out-of-population seed test, plus both refusal controls including one asserting a refusal and a measured zero are not the same value.

Validated against this exact head with current main merged, not against the original base.

---

Session state (deep-swift-442, end of day 2026-08-03)

Recorded here rather than in a message thread, so it survives the session.

DONE, green by execution

The diff-grain inflow kernel, the manual wet recipe, and the explicit unscheduled-consumer debt. 12/12 witnesses green under claim_batch locally, and the CI run (claim_executor — the only path that gates a merge) covering head e857c5132ff with current main merged in is SUCCESS on every check.

The structural point, which is construction rather than validation: InflowRefused cannot project to numeric zero, because InflowCountUnavailable has no count field. The fail-open is unwritable, not checked for.

IN FLIGHT

Nothing. Full merge criteria on the exact post-main-merge head: 2/2 distinct approving providers (claude, cursor) on e857c5132ff, zero REQUEST_CHANGES, zero active reviews, mergeable=CLEAN, checks passing.

BLOCKED

Only on the operator's manual merge and on sequencing (#7688 first, then #7693 and this). I do not run gh pr merge.

What this PR is NOT — read this before treating inflow as observable

This is a manual audit mechanism. It does not make legacy-test inflow continuously observable. There is no scheduled consumer, no persisted receipt, and no dashboard surface. Running it is a deliberate act someone has to perform.

Still owed by a later slice, carried and not forgotten: the persisted receipt, the cadence, and the dashboard consumer. The scaffold note states this in-code with a concrete dissolution trigger, and audit-mode-not-a-gate is stated with its promotion trigger — so the debt is countable in the carrier, not only in this body.

The duplicated extraction, and why it is a fork rather than two authorities

Two readers extract legacy-test identity: one observes a live Rust tree, the other unified diff text. Both produce the canonical LegacyTestBehavior identity and carry a convergence trigger. That makes it realization duplication — one concept, two handlers — not two domain authorities. The distinction is the line between an acceptable temporary fork and a §3 nicknaming violation, and it is why this one carries a dissolve-on rather than needing to be undone.

Findings not visible in this diff

Recorded in full in #7693's body, which is the lane's primary record: the refuted scan-dir discovery model, the retracted "witnesses never execute in CI" claim and the 0-byte log that produced it, the three refuted non-execution mechanisms, selection-not-discovery as the real variable, the schedule-retention over-read, the fact that the Rust suite has zero CI consumers, the silently-tolerated double-bound binding class across four grains, and the gunbc_ci_floor_batches stale citation (repaired in #7688).

On the numbers above

12/12 is witnesses passed in the named suite under claim_batch locally, not corpus coverage. Any inflow count this mechanism produces is scoped to the diff window it was handed and is a lower bound on nothing outside it — that is the whole reason InflowCountUnavailable exists as a distinct variant.

— deep-swift-442

[gunbai-bot]

Fixed in the pushed commit, not disputed — the finding is right and the note made it worse rather than better.

LegacyTestInflowAddition and its private inflow_addition_id are gone. An arrival is now a LegacyTestBehavior imported from gunbc.legacy_test_behavior_disposition and serialized by that module's legacy_test_behavior_id. The extraction-fork note previously claimed the two could be joined because the strings matched, which is precisely the nickname failure — joinable only until someone edits either serializer, with prose standing where an import edge belonged. The note now records that correction instead of the claim.

What remains forked is only the reading of Rust source text: the seed host bridge walks the working tree and cannot be pointed at a diff, and .dag cannot yet enumerate a revision's files, so neither reading can call the other. That fork keeps its declared dissolve-on, shared with the discovery scaffold it mirrors. The thing the readings produce is no longer forked.

Also dropped the unused gunbc.ci_spec import flagged in review 47547. On the Bool nit there: std.types and std.logic are both imported but Bool is taken from std.logic only, matching the surrounding workflow modules, so I left it.

11/11 fixture witnesses re-executed green after the change.

— sent from deep-swift-442

[gunbai-bot]

Both blockers fixed and pushed. Verified each against the current code rather than acknowledged.

Blocker 2 — refusal projected as count zero

You were right that this was the load-bearing one, and right that call-order discipline was doing the work. inflow_observation_count returned 0 and inflow_observation_addition_ids returned [] on the InflowRefused arm. A reader who did not first match the observation got a plausible zero back from a refusal — the fabricated-plausible-output arm of DESIGN §5, inside the very carrier whose purpose is to make a missing measurement visible.

Fixed by removing the projections that could lie, not by documenting the order to call them in:

type LegacyTestInflowTally
  = InflowCountMeasured { count: Int, ids: List<String> }
  | InflowCountUnavailable { reason: NonEmptyStr }

A count and an id list now exist only on the measured arm — there is no count field to read on an unavailable tally, so the erasure is unrepresentable rather than merely discouraged (§5 construction over validation, §4b's top rung rather than a check).

The witness that asserted inflow_observation_count(refused) == 0 was itself encoding the erasure as the contract, so it was rewritten rather than kept. Its replacement inflow_refusal_has_no_count_to_read asserts that a refusal and a measured zero are not the same value — which is precisely the distinction the old witness denied.

Blocker 1 — no durable live consumer

Applied the wall to my own audit, as you said. The honest finding is that the audit has no scheduled consumer today, so I narrowed the claim instead of papering the gap: legacy_test_inflow_no_scheduled_consumer_note is a declared scaffold naming the exact local recipe

GUNBC_CI_DIFF_BASE=<base> GUNBC_CI_DIFF_HEAD=<head> claim_batch --wet \
  --source-root src/v2 --source-root dag \
  --entry src/v2/workflow/legacy_test_inflow_audit.dag \
  --functions legacy_test_inflow_live_observation_holds

and the dissolution trigger: a non-blocking persisted receipt on a cadence. The counter is honest about being run-on-demand rather than described as continuously measuring.

The same gap in general is what #7700 walls at the disposition grain — a CoveredByWitness row citing a witness no scheduled lane executes now refuses with a typed reason, and unknown does not admit.

12/12 fixture witnesses green by execution.

— sent from deep-swift-442