Affected-set and schedule-retention receipts: name the states they actually witness (empty-observation narrow; release ≠ eviction)

[gunbai-bot]

Two receipts asserted facts their mechanisms cannot support, and one counter measured the wrong quantity. Both cost real diagnosis time this week. This PR fixes the honesty; the baseline defect underneath (1) gets its own PR, deliberately.

1. The empty-observation narrow (affected-set)

A zero-changed-path observation was rendered as the verdict N unaffected (import-closure, skipped without resolve). Those are different states: one says the diff proves these rows unaffected, the other says the comparison could not express what changed.

This is the exact mirror of DESIGN §5's absorbing fallback. There, a mechanism that cannot compute the affected set substitutes the superset — ⊤-as-answer conflated with ⊤-as-ignorance. Here it substitutes the empty set — ⊥-as-answer conflated with ⊥-as-ignorance. It does not widen, it narrows to nothing, which is strictly worse than the case §5 already forbids: a widen is merely expensive, a narrow is silently uncovered.

It is not hypothetical. A push whose baseline ref is the pushed ref diffs the commit against itself.

• Constant-skip receipt: main-push runs 30774223741 (eb3dd3c) and 30773369033 (bd3968a) both report an identical 4118 unaffected on two different commits. A skip count cannot be a function of a diff it does not depend on.
• Coverage receipt: Lane D: legacy test migration — one behavior family fully dispositioned #7687 added four witnesses to src/v2/test/claim/round_trip/dag_comment_wall_test.dag. All four executed on its own PR run 30761160726; none executed on the main-push run 30764935708 that merged them. No line named the entry either way — skips are counted, not narrated.
• Same run, compile-clean says the quiet part out loud: compile-clean scope: empty touched-path set — whole-tree baseline (diff observed nothing, or could not observe).

One observation, three consumers, three different copings — compile-clean widens to whole-tree (fail-closed, correct), regen gates on GITHUB_EVENT_NAME (a workaround, and its own comment admits the empty diff), the witness floor skips (fail-open). Three behaviors from one fact is not three reasonable local choices; it is the signature of an observation that is wrong, and §6 says root-cause to the layer rather than patch the subsystem.

What changed here: the Applied report renders that state as its own sentence, located by the baseline it compared against and carrying its own frequency (rows skipped under it). The baseline is read back through a projection of the existing resolve_diff_baseline authority (v2.workflow.floor_diff_observe floor_observe_diff_baseline_readout_for_ci) — a diagnostic read, never a second derivation.

What did NOT change: the run disposition. The empty diff still has no special run arm (operator ruling 2026-07-05, PR-A dissolved it into the general disposition and it must not be resurrected). What was missing was not an arm but the state's visibility — this line neither widens nor narrows the run.

2. Release is not eviction (schedule retention)

decrement_closure counted an eviction for every closure name reaching refcount zero, whether or not it had cache keys to drop. Arming spans the whole discovered roster while the affected set resolves a subset, so the counter over-reported by the entire unresolved population: a live receipt read schedule_evictions=2200 against modules_refcounted=2200 and typed_cache_peak=883 — a claim to have evicted every module it had ever heard of, ~2.5× the modules ever cached. A counter that equals the arm count by construction carries no information at all.

Release (refcount → 0) and eviction (cached state actually dropped) are now separate facts, counted apart: released_modules / evicted_modules, schedule_releases / schedule_evictions.

3. The per-entry drain label

entry='…' was read as proof the entry had been scheduled and executed — independently, by two readers, hours apart — and sent the diagnosis of (1) down a false path. index_arm_schedule_retention walks every discovered row before any predict-skip, so the line appears for entries the affected set never resolved. It witnesses one thing: the schedule moved past that entry. It is now schedule_passed_entry='…', with a legend on the ARMED receipt. That two independent readers misread it is a property of the label, not of the readers.

Evidence (executed, not asserted)

• 4/4 .dag witnesses PASS in dag/test/claim/executor_schedule_retention_test.dag (2 new rows), via claim_batch.
• unreconciled_module_releases_without_evicting — new discriminating control. Re-fusing the two counters was executed and reds it (1 → 2).
• no_observed_change_is_reported_as_its_own_state_not_as_unaffected — both directions asserted against identical counts, so the observation state is the only discriminator.
• diff_baseline_readout_answers_or_refuses_but_never_fabricates — executes the new .dag projection live: answers for a push, and carries the model's refusal for a pull_request with no base ref rather than fabricating a base.
• schedule_retention_policy_matches_modeled_authority extended — the two new modeled facts are pinned in lockstep with the Rust realization, so a policy edit that forgets either side reds.
• cargo fmt --all --check clean. Two failures in witness_layer_roots_compile_clean_tests (source root does not exist: dag) reproduce identically on a stashed tree — pre-existing, not from this change.

DESIGN.md

Adds one entry to the recurring-failure-modes list: empty-observation narrow, with the receipt. §4b requires every newly discovered error class to file a row; this is that row. Called out explicitly so review can reject it cheaply if the class belongs elsewhere.

Follow-up (separate PR, by decision)

The push baseline itself: a push's predecessor is its own before-SHA (the GitHub push webhook before field), not the default branch, and an absent/zero SHA must refuse — never self-compare, never fall back to the default branch. It changes what every main push runs, which touches the five-minute-CI-gate lane, so it gets its own review and receipt — including an explicit statement of where regen's cold control lives once it no longer rides on a broken baseline, and whether the 4-hourly falsifier remains the declared cold lane. A cold control that survives only as an accident of a bug is not a control.

---

Session state (sleek-dove-87, recorded 2026-08-03 for the wind-down)

DONE and green by execution. Everything in this PR. All 4 .dag witnesses in executor_schedule_retention_test.dag PASS; the three new Rust tests pass; cargo fmt --all --check clean. The discriminating control was falsified, not assumed: re-fusing schedule_releases/schedule_evictions was executed and reds unreconciled_module_releases_without_evicting (1 → 2). The DESIGN.md change was made through its carrier dag/gunbc/design_document.dag — witness_committed_is_fixed_point and its red control both PASS, so the projection is byte-identical.

Merge readiness. 2 distinct approving providers (claude, cursor), no REQUEST_CHANGES, mergeable=MERGEABLE. All five checks on run 30781107628 are COMPLETED: build, regen, heal_generated_artifacts and the floor ci (41m49s) are SUCCESS; deploy_dashboard_srv1 is SKIPPED. One caveat for whoever merges from this body: the dashboard summary reports checks: pending, which is the skipped deploy job being read as pending — gh pr view --json statusCheckRollup shows every check COMPLETED and nothing failing. Nothing is blocked on me. Per standing policy I have not merged.

Not code, worth keeping — the merge hazard on design_document.dag. Two sessions editing that file both rewrite the same long single-line string literals, and a direct two-way comparison against main gives false alarms. The check that works is a three-dot diff, plus a pure-insertion oracle: strip the common prefix and suffix from the -/+ pair; if deleting the inserted middle from the + line reconstructs the - line byte-for-byte, the edit is a pure insertion and cannot have silently dropped prior text. My change was a pure insertion of 935 of 939 characters. grep -c on a long single-line literal counts lines containing the match, never occurrences — it will report 1 for a doubled insertion.

What I would do next if I continued. Nothing on this PR. It is finished; it needs a merge decision, not more work.

[gunbai-bot]

Fixed in b0d7460 — the nit was correct, and the cause is worth naming rather than just correcting.

Those three strings were authored through a heredoc, which ate the Rust \-newline continuations, so what shipped was a single-line literal with ~18-space runs from source indentation embedded mid-sentence. Real continuations are restored on all three arms.

I also made it a property instead of a one-time fix: the test now renders all three arms and reds on any run of two or more spaces. This particular receipt exists to stop a misreading, so its legibility is part of what it does — and the same heredoc mistake would otherwise be one edit away from returning.

— sent from sleek-dove-87