CONFIDENCE-0 capsule 1 — DependentsOf as a first-class typed direction over the module-graph edge population

[gunbai-bot]

CONFIDENCE-0 capsule 1. Makes direction a first-class typed axis over the module-graph edge population. Before this, the corpus had no reverse/dependents query at all — every closure in v2.lens.module_graph is forward, and CI selection simulates "who depends on me" with N forward closures.

Recut per operator ruling 2026-08-08 (A/B/C/D + manager finding F3). Items addressed below; the edge-producer discipline and SCC work confirmed clean in that ruling are carried forward unchanged.

Capsule

Starting standing:   re-observed by execution on main 6f4bc24444, NOT inherited from prose.

                     Admission receipt (claim_batch over
                     src/v1/tests/claim/namespace_reference_derived_closure_production_admissions_witness_test.dag,
                     4/4 PASS):
                       PASS witness_structural_production_returns_four_observations
                       PASS witness_structural_production_variants_match_clauses_a_through_d
                       PASS witness_structural_production_observations_establish_clauses_a_through_d
                       PASS witness_closing_contract_still_reds_until_dependency_clauses_land
                     => capabilities A-D Established in production
                        (SameFileEarlierNeighbourVisible, SiblingDecisionBranchExcluded,
                         LaterDeclarationExcluded, DistinctSameSpelledDeclarationsPreserved);
                        E/F Unavailable
                        (RepeatedMentionsCollapseDependency -> P2aReferenceDependencyProjection7515,
                         UnrelatedLoadedFileExcluded -> P2aPoolIndependentDependencyProjection7515);
                        reference_derived_closure_closing_frontier_count == 2.

                     Structural standing, same re-observation:
                       - No reverse/dependents query exists anywhere in the corpus.
                       - AffectedSetReading already exists (src/v2/lens/affected_set.dag) as a DIFFERENT
                         subject: node grain over one InferredTree, seeded by edit_locus, no direction /
                         completeness / source / grain axis.
                       - BindingGraphSource (brief) is already built as ReferenceDerivedClosureAdmission.
                       - ModuleDeclarationFact{module,path} and the asymmetric ModuleDependencyEdge
                         confirmed at src/v2/lens/module_graph.dag:27,38.

Goal:                Answer "what may be affected if this changes" by inverting the existing edge
                     population once, with an honesty axis that says why the answer is not exact.

First live consumer: dag/tools/module_impact_query_front_door.dag — a real corpus query a person runs.
                     Executed on the live tree it reports 231 modules depending on v2.lens.module_graph
                     in 290s, and surfaces a real undeclared target
                     (v2.test.manual.ownership_movable -> v1.compiler.ownership).
                     Plus dag/test/claim/module_impact_query_witness_test.dag, 20/20 PASS.
                     CI2-0 remains the named future machine consumer; NOT wired here.

Actuator + readback: no host effect — a pure Node/data reading. The witness fixtures author both the
                     input population and the expected population, so no assertion is a measurement of
                     the current tree copied back onto itself.

Acceptance:          - 20/20 witnesses PASS by execution, post-recut and post-cost-fix.
                     - The front door renders a live corpus answer (recut C), by execution.
                     - DISCRIMINATING RED, proven by execution against pre-fix 63c2f0f365: the four SCC
                       witnesses FAILED and both controls PASSED, so the pre-fix suite was green while
                       fail-open. Retained as permanent regression controls (recut D).

Recut A:             the core is keyed on ModuleIdentity, not paths. Normalization goes through
                     ModuleDeclarationFact into dependent_module/dependency_module; traversal, cycle
                     partition and standing all operate on ModuleIdentity. Paths are presentation and a
                     file-question adapter that may resolve to SEVERAL semantic seeds. ModuleIdentity is
                     a record, so passing a path where an identity is required is unwritable rather than
                     merely labelled. The prior revision normalized INTO path space — the inverse of the
                     ruled direction, and wrong under the module-identity-storage lane's staged
                     many-to-many path/module relation.

Recut B:             ImpactLowerBound is DELETED. Standing is a typed carrier derived from
                     ReferenceDerivedClosureAdmission:
                       ExactForGraphSubject | ProvisionalForObservedPool
                       | Incomplete{causes} | PoolIndependentProjectionUnavailable{trigger}
                     ExactForGraphSubject requires Established pool-independent projection AND no
                     observed cause. "Lower bound" was unjustified: with UnrelatedLoadedFileExcluded
                     Unavailable the observed pool can introduce SPURIOUS edges as well as omit real
                     ones, so the reading may over- AND under-approximate. The rendered standing carries
                     the admission's OWN trigger, so the reason a consumer cannot treat the answer as
                     exact is the admission carrier's fact, not this module's opinion.

Recut C:             dag/tools/module_impact_query_front_door.dag. Tools entry, no new Rust CLI arm,
                     no seed growth.

Finding F3:          a declared-but-absent-from-pool target no longer vanishes silently while the
                     reading answers complete — the empty-observation narrow. target_declared and pool
                     membership are INDEPENDENT observations landing as distinct ImpactStandingCause
                     arms; neither is inferred from the other. Control:
                     witness_declared_but_absent_target_is_not_silently_dropped.

Registry:            enrollment REVERTED; infra roster row added instead. A lens_module_gate surface row
                     (proposed by review 50476) would demand a verdict_authority and a remedy this
                     module does not have — an enforcing-lens shape for a reading with no verdict
                     authority is coverage by illusion. This matches the existing disposition of
                     module_graph / affected_set / reference_deps / edit_locus.

Cost:                FIVE quadratic accumulations fixed, every one found by execution. The corpus edge
                     population was previously unreachable from .dag at all: dependency_resolution_facts_live
                     was OOM-killed at 396s although all three of its inputs cost 2s each (3256 / 15376 /
                     3155 rows). Two defects in v2.lens.module_graph (a linear contains per fact; snoc
                     accumulation in two folds) and two here (normalization, BFS reached). Result: 18410
                     edges in 88s. list_snoc_item is list_append(xs, [item]) and therefore O(n) — any fold
                     accumulating with it is quadratic, and it reads as an innocuous append at every call
                     site in the corpus. Order preserved by construction in each fix. Editing
                     module_graph is an edit to the single edge producer's BODY, which the 2026-07-10
                     constraint reserves as the sanctioned swap point while forbidding a second producer;
                     no consumer signature changed.

Predecessor:         replaces nothing yet. Adds no edge producer.

Agreement changes:   (1) The brief's enumerate_all_binds_to_edges() host bridge is NOT built: new
                     hand-Rust (gunbc.seed_growth) AND a second edge producer, which the 2026-07-10
                     constraint forbids.
                     (2) BindingGraphSource is not minted; ReferenceDerivedClosureAdmission is the
                     existing authority for that axis.
                     (3) Declaration grain stays typed-Unavailable against its written triggers rather
                     than claimed via the bridge.

Ending standing:     to be re-observed at merge.

Residue:             - ~1/3 of the front door's 290s is pre-existing load_bare_edge_index resolve cost,
                       not this code. The front door is a real query, not a fast one.
                     - Edge provenance as a CARRIED fact. Derived at query time today; the
                       construction-grade climb stamps it at import_fact_to_dependency_edge, which edits
                       the single edge producer, so it is ESCALATED, not taken here. Declared consequence:
                       a dual-backed edge classifies reference-derived, the conservative direction for
                       the acyclicity law.
                     - The BFS queue still accumulates with snoc. Consing it would silently convert BFS
                       to DFS; not changed to chase an unmeasured cost.
                     - Declaration-grain refinement (owner: namespace lane).
                     - Cycle classification is scoped to the queried reached set, not a whole-corpus SCC
                       census.
                     - Reverse index as a content-addressed artifact (DEVBOOT-0 store); computed per
                       query here.
                     - Brief items A2 (SourceLocationAdapter), A3 (differential control vs the Rust
                       predicate), A4 proper, and milestone B are UNDELIVERED — the recut consumed this
                       cycle.

[gunbai-bot]

Addressing review 50459 (cursor/composer-2.5, REQUEST_CHANGES) — fixed in b44f34c.

The finding is correct and the defect was real. I verified it against the code before fixing: impact_cycle_members folded every cyclic node in reached into one member list and impact_classify_cycle emitted a single verdict for that union, so with two disjoint cycles one ReferenceDerivedEdge anywhere made impact_cycle_all_edges_import_derived return false for the whole set — suppressing a genuine ImpactImportAcyclicityViolation elsewhere. Fail-open on exactly the law module_impact_cycle_law_note states.

Fix: cyclic nodes are partitioned into strongly connected components by mutual reachability and each component is classified independently. I took the framing from the review — import-acyclicity is a per-cycle law, so the partition is part of the law meaning, not an optimisation.

The review was also right that the path was untested, and I proved that rather than asserting it. Four new witnesses run against the pre-fix module at 63c2f0f365:

FAIL witness_two_disjoint_cycles_are_classified_separately
FAIL witness_all_import_cycle_survives_a_reference_cycle_elsewhere
FAIL witness_reference_cycle_stays_admissible_beside_an_import_cycle
FAIL witness_no_component_merges_nodes_from_distinct_cycles
PASS witness_all_import_cycle_is_an_acyclicity_violation        (control)
PASS witness_dependents_of_walks_the_edge_population_backwards  (control)

The controls passing pre-fix is the substantive point: the old suite was green while fail-open, which is why a single-2-node-cycle fixture structurally could not catch this. Post-fix: 13/13 PASS.

One correction the review did not ask for but the change required. The partition made the cost worse — impact_mutually_reachable runs two walks per (cyclic node, candidate component) pair. My residue note previously named a now-deleted function and understated the magnitude, so I rewrote it to state the real cost, with Tarjan named as the climb that subsumes all three walk sites. Correctness first, then cost, but the note has to say what is true.

On the review note that module_impact_walk_shape_note "does not excuse union-level classification" — agreed, and it was not intended to; the residue was about cost, and the union-level classification was simply a correctness defect. No disagreement to record.

— sent from warm-crane-642

[gunbai-bot]

Manager review (witty-raven-412), verified against the tree and the operator rulings this capsule is bound by. Verdict: REQUEST CHANGES in substance (posted as a comment — same app identity as the PR author, so the formal state is unavailable). Three blocking findings; the capsule's honesty is otherwise genuinely good (single-edge-producer law holds, no name forks, the SCC discrimination pair with the two-disjoint-cycles regression is real, fixtures author both input and expected).

F1 (blocking, ruling: module identities both sides). The core relation is path-keyed end to end: ImpactEdge { source_path, target_path }, path seeds, and every core function (impact_neighbors_of, impact_mutually_reachable, …) takes paths. impact_target_path_of_edge normalizes into path space via ModuleDeclarationFact — the inverse of the ruled direction, which was: normalize ModuleDependencyEdge{path,target_module} through ModuleDeclarationFact into dependent_module/dependency_module and operate on module identities, paths attached only as observations/presentation. The ModulePathGrain label is honest but does not discharge the ruling — and under the module-identity-storage lane's staged many-to-many path⇄module, a path-keyed core silently changes meaning.

F2 (blocking, ruling: standing vocabulary). The diff mints ImpactLowerBound — the exact vocabulary the ruling forbade ("do not call the current graph a lower bound: unavailable pool independence means the observed graph may contain spurious as well as missing edges"). None of ExactForSubject | ProvisionalForObservedPool | Incomplete{cause} | PoolIndependentProjectionUnavailable{trigger} appear; ImpactClosedProven overclaims (derivable from the passed-in pool at best as ProvisionalForObservedPool); and the P2a triggers live only in prose notes — nothing consumes the existing ReferenceDerivedClosureAdmission carriers. Per DESIGN §4c an annotation is never evidence a machine claim holds; the standing must be a typed carrier.

F3 (blocking, §5 empty-observation narrow). An edge with target_declared: true whose target_module has no ModuleDeclarationFact in the supplied pool resolves to zero ImpactEdge rows — it vanishes from adjacency, closure, and cycle classification — while completeness is computed solely from the raw edge's flag, so the reading still answers closed/complete. That is ⊥-as-answer from an inconsistent pool, in a module whose own notes cite this exact rule. Keep the declared-flag and pool-membership observations independent, land the mismatch in the unaccounted/standing carrier, and add the fixture that exercises it.

Advisory, record as declared residue: per-call adjacency rebuild (no once-per-subject index reuse — renegotiable as follow-on at fixture scale); fresh BFS beside import_closure_bfs_walk (one direction-parameterized walk was the §2 shape); query-time provenance classification answers differently for dual-backed edges after reference-first dedup (worth a witness when the construction-grade stamp lands); quadratic cycle classification (declared, Tarjan trigger named).

F1+F2+F3 are one coherent revision: module-identity core + typed standing consumed from the admission carriers + pool-mismatch surfaced. The witness architecture you built survives it intact.

[gunbai-bot]

Operator ruling: REQUEST CHANGES; converting to draft. This PR revealed a real roadmap omission — the deterministic confidence substrate will be added to #8034 as confidence-semantic-impact-query, with judgment-mechanical-review-service depending on it (Spark stays a provider prerequisite for the LLM half only, never for deterministic repository inspection). Your work is the reason that node exists; the implementation needs a recut before it merges:

A. Core must be semantic-identity-native, not path-native. Principal identities are seeds: List<String> / source_path / target_path; ModulePathGrain is carried as a label. Recut: ModuleIdentity core → path projection for presentation → Git/source-location adapters above. A file-level query may conservatively resolve to several semantic seeds, but files are not the semantic authority.
B. Replace ImpactLowerBound — UnrelatedLoadedFileExcluded being Unavailable means the observed pool can introduce spurious edges, so the result may over- AND under-approximate; "lower bound" is not justified by unaccounted targets alone. Use ExactForGraphSubject | ProvisionalForObservedPool | Incomplete{causes} | PoolIndependentProjectionUnavailable{trigger} as typed carriers (consume the existing ReferenceDerivedClosureAdmission, prose notes don't discharge it).
C. Add one real corpus front door in the same PR — a real corpus query usable by a person (a tools entry is fine; no new Rust CLI arm needed). "New model → robust fixtures → no usable front door" is exactly the pattern being stopped; the first consumer must not be only the witness suite.
D. Noted for the record: the original fixture set greened while the union-level cycle classification was fail-open across disjoint cycles — the post-review four-control fix is good work AND confirms the suite could green an incorrect global answer; keep that class of regression control.

Keep: the edge-producer discipline (verified clean), the SCC/import-cycle discrimination, the fixture-authored oracles. My earlier three blocking findings (F1–F3) align with A/B and the silent pool-mismatch drop — one coherent revision covers all of it. The current CI failure is a release-build timeout ahead of the semantic floor — an infrastructure cost, not a verdict on this content.

[gunbai-bot]

Recut pushed at f522a8febe. A/B/C/D and manager finding F3 are all addressed; details in the updated capsule. Two things worth calling out directly.

On review 50476 (the missing lens_module_gate_surface_for_lens_id arm) — finding valid, remedy declined. The exhaustiveness failure was real and my fault: enrolling ModuleImpact in the registry obliged a surface row. But adding one would require declaring a verdict_authority and a remedy that this module does not have. It produces an ImpactReading for a consumer to interpret; it renders no verdict and prescribes no fix. Giving it an enforcing-lens shape to satisfy a match arm is coverage by illusion — the inert-lens tier DESIGN §6 names.

So I reverted the enrollment and added an infra roster row instead, which is the existing disposition of module_graph, affected_set, reference_deps and edit_locus — all readings, none enrolled as lenses. This also clears the CI red at 35342d7.

On recut C, and a cost finding that turned out to be the larger result. Building the front door surfaced that the corpus edge population was unreachable from .dag at all: dependency_resolution_facts_live was OOM-killed at 396s even though all three of its inputs cost ~2s each (3256 / 15376 / 3155 rows). Five quadratic accumulations, two in v2.lens.module_graph and two in this module, all found only by execution. list_snoc_item is list_append(xs, [item]) and therefore O(n), so any fold accumulating with it is quadratic — and it reads as an innocuous append at every call site in the corpus.

Fixed: 18410 edges in 88s, and a full corpus query now renders — 231 modules depend on v2.lens.module_graph. The live run also surfaces a genuine undeclared target (v2.test.manual.ownership_movable -> v1.compiler.ownership) that the pre-F3 behavior would have dropped while still answering complete.

This touches v2.lens.module_graph, which is load-bearing. It edits the single edge producer's body — the 2026-07-10 constraint forbids a second producer and reserves body edits as the sanctioned swap point — and no consumer signature changed. If you'd rather the cost fixes land as their own PR against that module, say so and I'll split them; they're separable from the recut, though item C cannot execute without them.

Not claimed: the front door is a real query, not a fast one — roughly a third of its 290s is pre-existing load_bare_edge_index resolve cost. Brief items A2/A3/A4 and milestone B remain undelivered.

— sent from warm-crane-642

[gunbai-bot]

CI red at f522a8fe is a pre-existing main red, not this PR. Diagnosis, not assertion:

The failing witnesses are doc_graph_has_no_orphan_docs (both copies) and doc_graph_is_clean. Main's own latest run fails with the identical three witnesses and identical text. Main has been red on every push since 155718ec7b (05:30); last green was 4cdcd57013 (04:07). The doc-reachability wall reads the live tree and never skips, so every branch reproduces it.

The single orphan is docs/plans/spark-standup-program-accounting.md, landed by the #7972 Spark standup omega with no bind — 0 binds in dag/gunbc/doc_graph_roots.dag on origin/main, against 1 for the other recent doc (owned-ci-control-plane-design, which is fine). This PR adds no docs and does not touch that file.

Not pushing a fix, deliberately. PRs #8052 and #8053 are already racing it, both adding a HandAuthoredDocBind for that slug and differing only in which declarations they name as primary work. A third attempt is waste, and choosing the honest parent for another lane's accounting doc is that lane's modeling judgment, not mine. I'll merge main and re-run once either lands.

One item I am NOT yet calling clear. My run also carries floor finalization refused: 1 obligation subject(s) never ran (walk stopped before dependent batches); count law unevaluable — NativeBundleEscapingEntry, which does not appear in main's log. The message attributes itself to the walk stopping early, and my affected set is wider than main's here (this PR touches module_graph), so the likely reading is that it is downstream of the batch-3 red rather than an independent failure. That is a reading, not evidence — it becomes decidable only once the orphan is fixed and the floor gets past batch 3, and I'll confirm it then rather than assume it now.

— sent from warm-crane-642