Design note: push-event affected-set baseline (evidence status, chaining gap, stage-1 landing condition)

[gunbai-bot]

Design note for work item adhoc-b62a4d11-6a6, written to outlive the two PRs it sequences (#7720 receipts, #7729 before-baseline). Doc-only — no code, no carrier edits.

The reason it is a note rather than a PR body: the load-bearing content is not either implementation, it is which claims are observed, which are spec-grounded, and which window each number came from. Every measurement here is short-window by construction — the events API retains a few hundred events and before is unrecoverable once a push ages out — so an unnamed window would imply a baseline nobody measured. That distinction decays fastest if it stays in a session's head.

What it records

• The self-compare defect with its receipts, and the tell that the observation is wrong rather than three local choices being reasonable: one observation, three consumers, three different copings.
• Why the payload beats a minted GUNBC_CI_PUSH_BEFORE channel on §3 grounds — that it is also the smaller diff is a consequence, not the reason.
• A per-arm evidence table, including the zero-SHA arm being unobserved and spec-grounded rather than measured. A PushEvent scan structurally cannot see branch creation.

Two claims that sound right and are not, both recorded so nobody re-derives them:

• A non-ancestor before was not shown to under-select. git diff before..head is a full tree comparison; it over-selects after a force-push, which is wasteful, not unsafe.
• "A discarded object will be missing, so git fails loudly" is false — 9 of 9 non-ancestor pushes still have their before object present in a full clone.

The deeper defect, and the measurement that flips it. Incremental selection is sound only if every prior push was covered, and that chains. Run conclusion is a bad proxy for floor coverage in both directions: 6 of 15 failure runs had a green floor job, and 10 of 10 cancelled runs had a green floor job, because cancellation lands after the floor completes. On the right predicate the walk-back to the nearest green floor is 1 for 30 of 39 and never past 6 — so a last-green baseline is affordable, not prohibitive. The run-level reading implied it reached back past 31 hours, and that reading would have driven the design the other way.

The landing condition on stage 1, which is what makes "the gap becomes observable" true rather than merely plausible: today the chaining gap is inert because main pushes select nothing. The moment before-baseline lands, selection becomes real and the gap becomes real with it — so without a counted receipt the gap does not become observable, it becomes active and silent. Declared as a §4b(3) rung regression with previous rung, temporary rung, reason, bounded population (9 of 39, walk-back never past 6) and restoration trigger.

Also named before it is discovered: a last-green baseline cannot be specified against floor job conclusion, because "the job passed" and "the corpus executed" coincide only while main pushes select nothing — i.e. the before-baseline change itself invalidates the predicate. It has to be specified against the floor having run and its selection having covered that commit.

— sent from sleek-dove-87

---

Session state (sleek-dove-87, recorded 2026-08-03 for the wind-down)

DONE. The note is complete and the doc-graph registration is verified load-bearing rather than decorative: with the HandAuthoredDocBind row removed, doc_graph_has_no_orphan_docs returns FAIL; with it, all 7 doc-reachability witnesses PASS (has_no_orphan_docs, hand_authored_slugs_not_registered, works_refs_carry_symbols, bind_identities_unique, slug_wall_reds_on_registered_slug, duplicate_identity_red_control, has_no_dangling_links). The slug was checked against 60 registered Plan.slug values and every existing bind — 0 collisions. All four cited symbols resolve on origin/main.

Review 47769 (REQUEST_CHANGES) is addressed in 4364ba06e04. All four findings confirmed by execution and fixed; see the PR comment for the per-finding verification. The class was the note's own subject turned on itself: three citations read as current repository state while naming something merely intended, and one named a deleted module. Correcting the second improved the argument — the surviving tools.merge_admission_walk merge_admission_pr_number_deferred_note has a dissolve-on that already names the typed payload projection this note proposes, so one projection discharges two consumers.

CI: all checks COMPLETED and green — build, regen, heal_generated_artifacts and the floor ci are SUCCESS; deploy_dashboard_srv1 is SKIPPED. Caveat for whoever merges from this body: the dashboard summary may report checks: pending, which is the skipped deploy job being read as pending — gh pr view --json statusCheckRollup shows every check COMPLETED and nothing failing.

NOT blocked, and NOT in flight. I am not the builder for #7729 — a duplicate worker (keen-fox-25) was auto-spawned onto the same item and had already built it, so I am the authority on the arms and the evidence status, not the implementation. #7729 stays draft pending the operator's cost call on the last-green baseline. Nothing here waits on me.

Numbers in the note, with their windows (restated because an unqualified number is the thing guaranteed to be misread): the push-event measurements come from the repo events API over 2026-08-02T22:16:00Z .. 2026-08-03T03:26:13Z, 166 push events — 21 to main, 145 to branches. The 9-of-145 force-push figure is about branch pushes, which never reach this arm; main is 0 of 21. The chaining figures (9 of 39, walk-back 1 for 30, max 6) are over floor job conclusions, not run conclusions — that distinction is the correction, and using run conclusions gives 6 of 15 and 10 of 10 false holes.

What I would do next if I continued. Nothing on this PR. If the operator green-lights the last-green baseline, the next step is #7729's stage-1 counted receipt for unverifiable predecessor coverage — that is keen-fox-25's build, and the §4b(3) declaration it must satisfy is already written in §5 of this note.

[gunbai-bot]

Review 47769: all four findings confirmed by execution against `origin/main`, and all four fixed in 4364ba0. None was a judgement call — each was decidable by a grep I had not run.

1. empty-observation narrow filed in DESIGN. git grep "empty-observation narrow" origin/main -- DESIGN.md dag/gunbc/design_document.dag returns nothing. The name is proposed by Affected-set and schedule-retention receipts: name the states they actually witness (empty-observation narrow; release ≠ eviction) #7720, which is open. Now stated as a proposal with its PR number, not as present-tense repository state.

2. dag/tools/merge_admission_stamp.dag reads GITHUB_EVENT_PATH. git ls-tree origin/main on that path is empty — the module is deleted. Correcting it improved the argument rather than weakening it: the one surviving mention on main is tools.merge_admission_walk merge_admission_pr_number_deferred_note, whose stated dissolve-on is "a typed GitHub event payload projection supplies the optional number". The repository has already declared the carrier this note proposes to be the thing it is waiting for, so one projection discharges two consumers. The note now says the read half does not exist and cites that note instead.

3 & 4. extdeps.github.push_event. No such module under dag/extdeps/github/ on main or HEAD. It is #7729's proposed carrier. Both sites now say so explicitly, including the one in §6 that would have sent an implementer to a failing grep.

Worth naming the class, because it is the note's own subject: three of these read as current repository state while naming something merely intended, and the fourth named something that used to be true. §3's cite-the-symbol rule exists precisely because a name-level claim is decidable by grep — I applied that discipline to the note's measurements and not to its citations. The intended/actual distinction is now explicit at every site.

The HandAuthoredDocBind row is separately verified load-bearing, not decorative: removing it and running doc_graph_has_no_orphan_docs gives FAIL; with it, all 7 doc-reachability witnesses PASS.

— sent from sleek-dove-87