CENSUS-0B: exact coverage receipt, method capability, and the derived inference ceiling

[gunbai-bot]

CENSUS-0B — exact coverage, method capability, and the derived inference ceiling

Recut per operator ruling. Second of the three-stage split. CENSUS-0A has merged, so this now targets main directly and the diff here is 0B alone. Draft until the technical items are green.

What the first cut got wrong, and the one rule that fixes all of it

The ceiling must be a function of ONE COHERENT EVIDENCE PACKAGE, not of several independently supplied values that merely sit near each other. Independently supplied evidence must join on exact identity before it can raise a conclusion.

Five blockers, one class:

#	The hole	The join that closes it
1	Reconciliation compared subject-key spellings and never the two sides' population or revision — so two different repositories at two different revisions reconciled if their keys happened to be spelled alike, and the receipt then recorded both identities beside an exhaustive status. Recording a mismatch is not refusing it.	census_resolve_coverage_subjects runs first; only CoverageSubjectsAligned reaches the key join, carrying the identities alignment established rather than either side's copy.
2	Duplicates were detected on the observed side only, so a denominator of A, A against an observation of A reconciled cleanly — an exhaustive receipt over a population one of whose entries was never measured because it was never two entries.	census_resolve_duplicate_subjects resolves both sides: NoDuplicateSubjects / DenominatorDuplicated / ObservationDuplicated / BothDuplicated.
3	The ceiling took capability, observation and coverage as three arguments and never checked the receipt was about the supplied observation, so a receipt for observation A beside observation B produced an exhaustive ceiling for B.	There is no observation parameter. The observation identity is derived from the coverage outcome on both arms — which is why CoverageRefused now carries it. The one remaining join refuses: the capability receipt's method_run_identity must equal the coverage's classification run.
4	CensusMethodCapability was authorable with no tie to anything, and ClassifiesDeclaredStructure mapped automatically to semantic fidelity.	CensusMethodCapabilityReceipt exists only when its contract is the observation's classifier (identity grain) and any conformance control names the same classifier at the same revision under a different invocation. Until conformance is established the semantic ceiling stays a floor.
6	(found in review) Conformance itself was author-supplied: census_conformance_observation took discriminating_input_refused / positive_control_accepted as Bool, so any caller could pass true, true and raise a semantic ceiling. The domain consumer computed them honestly — which is precisely what hid it, since the carrier never required it.	The carrier consumes a CensusControlPair of two real CensusCoverageOutcome values and derives the verdict: discriminating must be CoverageRefused, positive CoverageEstablished, both must carry the declared control run's identity, and the control must differ from the measurement invocation. The receipt records the method run it was derived against, and the capability receipt re-joins on it — so conformance earned against run A cannot be attached to an observation from run B.
5	census_receipt_is_self_join made the shared-run condition visible and nothing acted on it. Visibility is not enforcement.	DenominatorIndependence is three-valued and the ceiling reads it: SharedRun, IndependenceUnestablished (two invocations of one declaration — a repeat, not a cross-check), DistinctProcedureDenominatorEstablished. Only the last permits exhaustive; the other two still permit a floor.

This is the move the carrier already makes one level down — 0A derives rows_identity inside the constructor so no authored copy can disagree with the rows. 0B does it one level up.

Limits are enumerated rather than collapsed (CoverageNotEstablished, DenominatorNotIndependent, MethodConformanceUnobserved), so a floor says which condition failed and a degradation stays countable rather than absorbed.

The domain consumer, and its controls now execute

gunbc.realization_vocab_confinement_census censuses the four declared rosters of v2.lens.realization_vocabulary_containment — real data on main, substrate-only. Enumeration and classification are different procedures, which is what earns DistinctProcedureDenominatorEstablished rather than asserting it.

The conformance controls are ordinary functions this module evaluates, reached by enrolled witnesses: the discriminating input is the classifier output with one whole axis dropped, and conformance requires the census to refuse it; the positive control requires the real output to reconcile. Both are needed — a classifier that refuses everything passes the first alone, one that accepts everything passes the second.

That closes a gap in the previous cut which I had flagged and not fixed: a mutation probe in a disposable worktree demonstrates discrimination and then vanishes with the worktree. These controls re-run on every affected change.

The grain is a string prefix, not namespace containment, witnessed against the real roster: v2.workflow.bash matches v2.workflow.bash_command_fold_serialize as a string prefix while being no namespace descendant of it.

Why a workflow file is in a census PR

.github/workflows/falsifier.yml carries one added line (id: release_bins). It is inherited from main's generator via the merge, not authored here: this branch merged main's 17 commits, which include the generator change (#7812/#7813), and once main is absorbed the branch must be self-consistent with main's generator. Regen was clean at the pre-merge head and produces this line only after the merge. It lands as an author commit because the heal job's GitHub App lacks workflows:write and cannot push workflow paths itself.

Cost shape: linear, with an execution receipt

The reconciliation originally built its subject sets by pairwise list scans — quadratic in the subject count, invisible at the live 24-subject population. It now builds one Map keyed on the subject spelling in a single pass, using the std.occurrence_binding_candidates pattern (map_get / map_insert with typed duplicate evidence) rather than minting a set authority. Order lists accumulate by prepend-then-reverse, so the write side is linear too; authored order is preserved and no map_keys / map_values call is introduced.

It deliberately does not call std.keyed_roster. keyed_roster_build is itself quadratic — a linear keyed_row_find plus a growing concat per element — and the cause is its signature: key_eq is an arbitrary caller-supplied predicate, and an arbitrary predicate cannot be indexed. Measured on the real function at 256 / 512 / 1024 keys: 85ms, 318ms, 1273ms — 3.74x then 4.00x per doubling, against quadratic 4.00 and linear 2.00. A dissolve-on names the regrounding that would let this module consume it directly; that is its own work item, since it changes a std interface with six production consumers.

The receipt is operation counts, not wall-clock. Counters are incremented by the production fold itself — not by a mirror of it — so they cannot drift from the code they measure, and they reproduce exactly on any machine. Populations are 24 (the live roster size) and 240. Assertions are on the ratio, never on an absolute count copied out of a current run. The RED control performs the old pairwise scan and is asserted to breach the same band: at n=24 it visits 576 pairs (24 matched, 552 passed over).

A structural cost witness via v2.lens.cost was written and deliberately not landed: cost_coverage_file_receipt yields zero function rows for both this module and for dag/std/keyed_roster.dag, so the headline assertion passed vacuously while "any class was derived" failed. That is the general-body-producer frontier, and an inert check is a lie.

Test plan

claim_batch --source-root dag --source-root src/v2 --entry <file> --functions <all>:

• dag/test/claim/repository_census_coverage_witness_test.dag
• dag/test/claim/repository_census_observation_witness_test.dag
• dag/test/claim/realization_vocab_confinement_census_test.dag

94/94 PASS, run with a compiler built from this tree (cargo build --release --bin claim_batch). That last point is not incidental: the pinned /usr/local/bin/gunbc in a restarted container can be stale enough to fail on origin/main, so a local red from the shimmed binary is not evidence until it is reproduced against a tree-built one.

Two kinds of evidence, not interchangeable. The witnesses are CI-enrolled (dag/test/claim is in witness_discovery_scan_dirs) and are standing regression evidence. This PR now targets main, so CI does fire — the earlier note that checks_state was structurally none while stacked no longer applies, and the CI run on the current head is the merge evidence rather than the local green. Any timing probes were run in disposable worktrees that were destroyed; nothing re-runs them, so they license design decisions and do not guard them.

Eight mutation probes, one per blocker conjunct, each landing on its own witnesses:

Probe	Mutation	Reds
B1a	population mismatch ignored	population-mismatch-refuses, population-mismatch-yields-no-receipt
B1b	revision mismatch ignored	revision-mismatch-refuses, revision-mismatch-yields-no-receipt
B2	denominator duplicates blinded	denominator-duplicate-located, duplicated-denominator-yields-no-receipt, both-sides-reported-separately
B3	ceiling skips the run join	capability-receipt-for-another-run-yields-no-ceiling
B4a	capability accepts any contract	contract-naming-another-declaration, control-at-another-revision, control-reusing-the-measured-invocation
B4b	conformance limit dropped	unobserved-conformance-holds-a-floor, unobserved-conformance-names-its-limit
B5	independence limit dropped	self-joined-cannot-reach-exhaustive, self-joined-names-the-independence-limit
C	the discriminating control made non-discriminating	discriminating-control-is-refused, defective-rows-are-a-proper-subset, capability-receipt-carries-established-conformance, ceiling-is-not-a-floor, ceiling-carries-no-conformance-limit, claim-supports-undeclared-key-absence

Probe C is the one worth reading twice. Restoring the dropped axis to the control input makes the discriminating control non-discriminating — it no longer plants a defect — and six witnesses red in a chain: the control stops being refused, conformance stops being established, the capability receipt loses it, the ceiling falls to a floor, and the domain claim loses its absence support. A conformance receipt that cannot fail would have propagated an exhaustive ceiling silently; this is that path executed.

Honest limits

• Independence is procedural, not correctness. Two different classifier declarations can still share a defect. IndependentDenominatorEstablished establishes that two procedures ran, which is the most this module can decide from declared structure, and it says so in repository_census_independence_note.
• Conformance records that a control pair was observed. It cannot establish that the discriminating input was well chosen — that judgement is the author's, and it is the honest frontier of the receipt.
• The domain join's independence is at the procedure level and no further. Both sides read the same four declared rosters, so it detects an error in how a census walks them, not an error inside them.
• census_inference_ceiling answers none, and none is not a typed located refusal. One cause today (the capability receipt naming a different classification run), so not yet a conflation — but the signature tolerates a silent none, so a second cause would join the first indistinguishably. Declared on the carrier as repository_census_ceiling_refusal_frontier_note with its dissolution trigger: the next edit to that function replaces the Optional with a refusal arm carrying both run identities. Recorded rather than fixed here so the repair lands as one change instead of a second shape beside the first.
• sole_constructor completeness is a declared wall. DESIGN §4b records it as unverified for generic carriers; these are concrete records, the covered case, but the audit finding stands and this PR does not discharge it.

No head SHA appears in this body by design: GitHub owns the live head, and a present-tense SHA here would be a second representation that goes stale silently on the next push. Verified runs belong in dated revision-scoped receipts — see gunbc.census_representability_receipt for the shape.

🤖 Generated with Claude Code

[gunbai-bot]

GUARD: NOT MERGE-AUTHORIZED, and the approvals on this PR do not cover its current head.

The operator held this PR in draft pending their own read. It is now showing ready — I did not flip it, and per the standing guidance on idle-draft auto-flip I am leaving it READY rather than re-flipping, since flipping churns review and CI state. Treat the ready flag as a dashboard artifact, not as a request to merge.

STALE APPROVAL SURFACE. The three dashboard approvals sit on a61dded and 2964947. Head is 4211f28, two commits later: 3c123e3 (the CENSUS-0B recut into one identity-joined evidence package) and 4211f28 (declaring the untyped ceiling-refusal arm as a frontier with its dissolution trigger). Neither has been reviewed. Do not read 3/3 approve as covering the recut.

NO CI RUNS HERE. Base is the session branch session/sharp-tern-144, and the ci.yml trigger does not fire for stacked PRs, so the checks column is empty by construction rather than passing. The witness evidence for this branch is the local green-by-execution run recorded in the receipt, plus the enrolled conformance controls; CI coverage arrives when this rebases onto main after 7800 lands.