Record the native-at-small-scale status once, in one typed receipt

DESIGN.md

@@ -127,7 +127,7 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/`
 - **§3 residue — ContentHash family grounding — Phase A LANDED (#7480).** `std.content_hash` grounds `ContentHash` as a family coproduct (`Fnv1a64 | Sha256Hash | Sha1Hash`) with where-refined digest carriers; union-level `content_hash_eq`/`combine` deleted; `compare_content_hash` returns `ContentHashCrossFamilyIncomparable` (third state, not Bool collapse). Carrier walls: `OciDescriptor.digest` → `OciContentDigest`; `GateRosterHash` / `v2.std.node.Hash` → `Fnv1a64Structural`; Git tree hashes → `GitObjectId` (Sha1, cited via `extdeps.git.object_store`). `extdeps.crypto.hash` `sha256_digest_content_hash` is the VALIDATING PARTIAL bridge `Digest`→`ContentHash?` (invalid hex refuses via `Absent`, never absorbs a fallback), and `std.content_hash` `as_content_hash_cryptographic` is the TOTAL injection from an already-validated `Sha256Digest` — the distinction matters because only the second is unconditional (corrected 2026-08-01: this row previously called the partial bridge total, and its positive-path witness was named `..._is_total` while a sibling test proved the same function refuses invalid hex); `sha256:` prefix is wire serialization (`serialize_content_hash`), not a discriminant. `Pin.expected_identity` retains the union (subject-generic); `admit_pin_integrity` routes cross-family to `CrossFamilyIdentityIncomparable`. R0 backstop refuses bare union `==`/`!=` on family mismatch (`content_hash_cross_family_eq_v1_seed_bridge_note`; witness `cross_representation_equality_test`). **Remaining Phase B (dissolve-on — this row deletes when landed):** substrate typecheck refuses union-level `ContentHash == ContentHash` so cross-family comparison is structurally unwritable; Phase A closes carrier construction walls + R0 eval only. Authority: `std.content_hash` `content_hash_family_grounding_note`. Witness: `dag/test/claim/content_hash_family_grounded_witness_test.dag`, `where_refinement_enforcement_witness_test.dag` (hex refinement at literal sites).
 - the remaining deleted-`docs/` references in `.dag` comments — provenance / `bind:` pointers into the bankrupted `docs/` tree (e.g. `docs/planning/*`, `design-*.md`) — fold into the dep-graph reform, not a blind repoint. (The named-corpus ledger marks — `Practice N`, and `INVARIANTS` / `THESIS` / `MODELING` / `RELEASE_TODO` / … citations — were swept: dropped, or re-homed to DESIGN.md §-anchors.)
 - floor shared-computation memoization — M1 entry-closure memo LANDED (#6999, merge dc2aa25684); post-merge validation (msg_1879f052) shows ~0% batch-wall recovery on capped hosts — fixes are mechanism-correct but discovery loads each entry once/worker; residual ~18min owed to #6848 once-per-entry bare-reference fixpoint + cap-saturation throttle (§1.4). Receipts: [floor-time namespace-walk diagnosis](docs/plans/floor-time-namespace-walk-regression-diagnosis.md) §5. **BANKED:** slice-1 measurement (lane `ci-cost`, subject `entry-graph-union-construction`) merged as #7483 (b5191426479ddec5f9a80b60dc6264ca168b42b6), landed a partition mechanism and one corrected finding, and RETRACTED three claims an earlier draft of this row asserted. What stands: the `[resolve-split]` rows were never quotable as shares because children were summed over every resolve a thread runs while the receipt's parent covered only witness-entry resolves — two denominators, not a nesting — and an exclusive partition over a parent that contains its children now reconciles at 0ns tolerance, refusing (`OverAttributed`/`NestedSpanAttribution`/`NoSpans`) rather than clamping; and the production-selected closures repeat module membership at a 35.9-38.4x duplication factor across narrow/typical/broad subjects (module-count weighted; byte-weighted the same three subjects give 43.0/47.9/49.3, so the count figure is the conservative one and, unlike the count reading, the byte reading rises monotonically with diff breadth). What was RETRACTED, by execution: (a) that `load` is dominated by `referenced_module_paths_in_text`, an unmemoized per-(entry,module) content scan — measured at 4-23ms, ~0% of `load`; (b) that `load` is the dominant cost generally — NOT established either way: it is 67.7-68.1% on a 159-module closure, but on two runs of the SAME 504-module closure it is 38.93% then 49.52%, with typecheck_compute leading the first and `load` the second, so the share ordering flips between repeats of one entry and no share in the partition is a reproducible quantity on this host; (c) that the membership duplication factor multiplies the dominant cost, and the per-source content-hash memo that followed from it. What `load` actually is, measured: ~100% `build_both_closure_edge_index`, a CORPUS-wide edge index that is memoized per `MultiEntryIndex` and costs the same whatever the entry's closure size (51.24s on a 159-module closure vs 50.98s on a 504-module one) though its magnitude is host-noise-dominated (44.96-77.11s across four runs at 2 spans each), so size-independence is the durable claim and the per-index figure is not — so it is fixed per index, not per entry and not per membership. The single-entry `claim_batch` harness pays it twice only because two indices exist on that path (its own, plus `process_shared_index` for machinery). THE BOUND ON ALL OF IT: those shares therefore characterize a fixed-cost-dominated harness, NOT the floor, where one index amortizes across hundreds of entries. The amortization was then MEASURED rather than assumed: on the explicit-entry path (N entries against one shared index), going from 2 spans to 7 grows `load` 1.08x while typecheck_compute grows 2.86x, parse 3.21x and resolve_modules 4.40x, collapsing `load`'s share 67.79% -> 44.97% with no code change — so `load` is paid once per INDEX, not once per entry, and the existing per-index memo already amortizes it. THE REDIRECTION THAT FOLLOWS: a union graph cannot displace a cost that is already paid once, so the program's apparent target is eliminated; the only measured row that scales with BOTH entry count and closure size is typecheck_compute, whose unit of work is module membership — the quantity B measures repeating 38x by count and 48x byte-weighted. Slice 2 CLOSED that candidate as a no-go: three disjoint N<=50 windows and the post-merge representative/reorder receipt found zero repeated typecheck misses and an order-stable distinct-computation set inside one shared typed-cache authority. The durable law remains once-per-content-key; the one-shot ratio instrument was deleted after the merged-SHA provenance receipt. No union construction and no larger-host confirmation run follow from this hypothesis. The separate #7597 successor measures assembly on a new denominator: its exclusive, refusal-based split reproduces symbol-index merge, root symbol-index composition, import-string rewiring, closure symbol-index construction, root variant-base construction, emit-info, pool fill, and services as the priced terms, with the derived other row at 0.32% in both runs. Receipts: [slice 2 closeout](docs/plans/entry-graph-union-slice2-typecheck-attribution.md) and [per-entry assembly decomposition](docs/plans/per-entry-assembly-decomposition-measurement.md). M2: RunnableCompile node gated on v2.std.determinism #5941): [design sketch](docs/plans/floor-shared-compute-memoization.md)
-- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale settled and banked** — #7599 merged 2026-08-02 (merge `1ebff27f1e`; 25/25 witness PASS executed 2026-08-01 at pre-merge head `2f9e780e6`); timing ratio claimed-not-verified per design note. Open question is operational migration rate. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`
+- **five-minute CI gate — central CI program boundary (operator dispatch K, 2026-08-01; sequence revision eager-boar-610, 2026-08-01; contract re-anchored by operator ruling 2026-08-02).** Product contract: every required operation performs the bare minimum computation needed to serve it — no recomputation of any semantic fact whose inputs did not change; wall-clock falls out of the realization/materialization goals rather than defining them. Five minutes is NOT the contract (operator, 2026-08-02: the earlier contract sentence presenting it as such was a mistake) — it is the distress ceiling, 'this is hard / not working well', retained only as the Stage C checkpoint bound; reaching 5:00 does not complete the program while redundant computation remains on a required path. Six sub-lanes plus explicit operator sequence in roadmap authority: (1) #7522 warm-merge net receipt; (2) merge #7599 native bundle slice; (3) bounded production cutover to native execution kind; (4) #7534 materialization substrate (module→entry→bundle hierarchy); (5) union closed → per-entry assembly; (6) this registration. **Native-at-small-scale evidence has landed; operational migration rate remains open.** Which change landed it, at which merge commit, at which evaluated head, and under which executing witness are *execution evidence*, carried in one typed receipt (`gunbc.native_witness_transition_receipt` `native_at_small_scale_transition_receipt`) that this document cites rather than restates — a design criterion embedding a SHA or a pass count has to be edited every time the world moves, and a second hand-maintained copy of one advancing status goes stale silently (operator ruling on #7710, 2026-08-02). Timing ratio remains claimed-not-verified per the design note. **Staged expectations** (not flat wall-clock): Stage A modest admission saving only; Stage B first order-of-magnitude witness reduction after production native cutover; Stage C five-minute gate when all conjunction holds (native majority, materialization hits, no redundant parse/typecheck, pre-index lookup, shared substrate, counted fallback→0). Do not raise CI step cap first — cap lives in `gunbc.ci_spec`. → [five-minute CI gate design](docs/plans/five-minute-ci-gate-design.md) · [witness realization plan](docs/plans/witness-realization-plan.md) · `dag/gunbc/plans/cli_run_hollowing_plan.dag`
 - **#6985 witness-discovery cascade — diagnosis-complete, two confirmed failure classes, both block further stripping.** The initial `pullable()`-never-pulls-arity-zero read was refuted by execution on the `parallelism.dag` restore (DESIGN §5). Two real classes were then confirmed by execution: **Class A** — a re-export-through-partial-strip (qualified-import/re-export mismatch), closed by import-from-definer wave ordering or PR-4 (namespace-resolution-design.md §8). **Class B** — a stripped file's own bare cross-module references resolve only by **pool-membership coincidence**: `resolve_in` finds the target module exactly when some *unrelated* unstripped import elsewhere in the currently-assembled closure has already dragged it into the pool, never from the bare-reference closure itself binding it. A reconciliation probe on an already-stripped `dag/extdeps` file (`bmc/types.dag`) reproduced the identical failure under a narrower closure, confirming this is corpus-wide accidental coverage, not a per-file property — batch-1's ~74 files are green today only because enough unrelated files elsewhere still happen to import the same targets. **This blocks all further `dag/**` import-stripping** until a closure-independent binding fix or a provable-coverage construction check lands. Named side findings, not yet fixed: a LOUDNESS gap (an opaque unlocatable diagnostic for some but not all Class B failure shapes) and an untested zero-arity fn/data-by-value claim. → [import-strip witness-discovery cascade diagnosis](docs/plans/import-strip-witness-discovery-cascade-diagnosis.md)
 - **v1 whole-corpus run stability — the floor's failure axis is retention, not footprint.** The adaptive governor packs width to the memory envelope by construction, so the honest metric is completion-within-step-budget at width > 1; the root cause was a §6 cost-shape defect in typecheck-env construction (multiplicative inductive-field duplication along the import DAG), not corpus size. M1 construction fixes landed fingerprint-identical (#6528). M2's schedule-derived per-module retention landed in #7129 (bd5afd6bc3e8f3e4bc9ded40bcf3b79cdfee536d) and proved the memory thesis at width 1 (9.24 GB executor RSS / 10.7 GB cgroup peak, zero swap, throttle, or pressure); it did not deliver the lane's width > 1 exit bar. Remaining work is the plural-worker outer ring, exact resident-accounting split/reservations, and the width > 1 fleet receipts; v2-eval-as-realization remains the terminal M3 exit. Decision tree, receipts, non-goals: [v1 run-stability throughline](docs/plans/v1-run-stability-throughline.md)
 - **emitted crate partition** — derive the Rust crate layout from the module graph (builds on #6677 derived registration; dissolves the hand-drawn 2-crate split in `stage0_crates.dag`). Shared `CompilationUnit` home with the language-consolidation lane; Rust workflow realization here. → [emitted crate partition design](docs/plans/emitted-crate-partition-design.md)