Record the native-at-small-scale status once, in one typed receipt

[briansrls]

Rework of the #7710 defect the operator identified. #7710 merged in the 01:14Z batch, so main carries the defect today and this PR removes it.

The finding (operator ruling, relayed via still-bat-561)

#7710 wrote the same advancing observation independently into two authorities: gunbc.roadmap_authority five_minute_ci_gate_program_note, and gunbc.design_document (and therefore generated DESIGN.md). Both named the merge SHA, the pre-merge head, the date and the 25/25 result. Generated DESIGN.md projecting design_document is the carrier working correctly; the independent roadmap prose was a second authority for one mutable fact — §3 dual representation, which decays the ordinary way: someone updates one, the other goes stale silently, and both read as authoritative.

The split, which is the operator's

The durable design fact is two clauses, and it is shorter than what #7710 wrote:

• native-at-small-scale evidence has landed
• operational migration rate remains open

That stays in the design criteria. The pull request, merge commit, evaluated head and executing witness are execution evidence, and now live in exactly one typed carrier — gunbc.native_witness_transition_receipt NativeSelectedWitnessTransitionReceipt — which both documents cite by symbol rather than restate. Per the operator's "better still": no SHA and no pass count remains in either design criterion.

What is deliberately NOT stored, and why that is the point

No pass count, anywhere. #7710 recorded 25 of 25 witness receipts. That module declares 31 test functions today — less than a day later. The transcribed count was stale before the ink dried and no oracle in this repository could have caught it. The per-member verdicts already have a single authority in std.selected_witness_bundle NativeWitnessBundleExecutionReceipt member_equivalence, produced by the run itself; a hand-typed integer beside it would be a second representation of that list. executed_evidence therefore cites the witness symbol, per the §3 cite-the-symbol rule.

No stored standing. The standing is derived by transition_evidence_standing, so a transcribed standing is unrepresentable rather than lens-caught.

The derived standing is the honesty content, made structural

The head the witnesses ran at and the commit that landed them are different commits. #7710 carried that in prose — the kind of true sentence that survives only while its author is watching. The fold now returns EvidenceExecutedBeforeLanding naming both commits, so pre-merge evidence cannot be quoted as verified-at-the-merged-tree. Both arms are admissible evidence; the weaker one is simply named.

This is not an acceptance

gunbc.roadmap_model RoadmapAcceptanceReceipt remains the only fact node_accepted consults. This receipt records that one piece of evidence landed under a node that is still open — migration rate, fallback counting, artifact identity and fail-closed memory all remain open on native-selected-witness-bundle. Nothing here moves the roadmap graph.

Green by execution

Merged current origin/main first, per the overrule on pre-repair bases.

• native_at_small_scale_evidence_stands_as_executed_before_landing — PASS (real production receipt, not a planted one, so routing is proven for the real subject)
• evidence_executed_at_the_landed_commit_is_the_other_standing — PASS
• receipt_subject_joins_exactly_one_declared_roadmap_node — PASS
• a_fabricated_subject_identity_joins_no_declared_node — PASS

Discrimination is by input, not by code mutation: tests 1 and 2 assert opposite arms of the same fold, so no constant implementation survives both; test 4 is test 3's executed negative control on the same function. The subject join is not hypothetical — drafting this receipt first transcribed the node identity one character off (...Q3S5T8V0... for ...Q3R6T8V0...), and the join is what catches that class.

Regen: generated_artifact_gate main_wet run at final head, zero drift.

Compile-clean: gunbc compile --target dag reports 4 pre-existing unresolved type 'Empty' diagnostics in src/v2/compiler/06_translate.dag. Verified not mine by execution — byte-identical diagnostics reproduce on a clean origin/main worktree, and the three-dot diff touches 6 files, none of them that one.

Residue, named rather than left silent

The two-clause durable fact is still stated in prose at three altitudes: the parent node's boundary, the program note, and the DESIGN.md row. None carries execution evidence and none carries a SHA or a count, so none rots the way #7710's copies did. Collapsing the prose restatement itself would require design_document to project from roadmap_authority, which is a materially larger change to a load-bearing generated doc and is not what was ruled.

Generalization trigger, named rather than pre-built: partial evidence landing under an open node is not native-witness-specific, but it has exactly one inhabitant today. On the second subject needing this shape, the carrier generalizes and this module becomes an instantiation; minting the general shape now would be uninhabited generality.

🤖 Generated with Claude Code