Pool-relative module dependent query (CONFIDENCE support — not the affected-set product)

[briansrls]

Scope, per the operator ruling of 2026-08-09. This is a pool-relative module dependent query, not the CONFIDENCE product. It is module grain, relative to the pool it is given, can return a partial reading, is slow, and carries no skip authority — it is not an affected-set answer. It merges on independent daily utility, not as CONFIDENCE completion. The capsule framing below is how the work was commissioned and is left intact as the record; read it as support work, not as the program.

---

CONFIDENCE-0 capsule 2, reworked under the operator ruling of 2026-08-08. All seven items plus both verification-pass addendum items are closed. 31/31 witnesses PASS by execution; three real-diff receipts below.

The seven items

#	item	state
1	consume departed_paths	done — a deletion becomes a ResolveInBase subject
2	resolve destructive edits against a BASE graph	side axis modeled; base POPULATION is a gated capability — see below
3	unresolved input contaminates typed standing	done — Complete | Partial | Refused
4	Partial never a CI skip authority	done — construction wall, Granted unreachable today
5	split reachability from cycle analysis	done — module_cycle_analysis is an optional projection
6	differential control vs production selection	done — biconditional, BOTH directions
7	representative real-diff receipts	done — three below
A1	unconsumed probe instruments	deleted (6 probes + the leaf-probe report)
A2	fully-unresolved case asserts standing	done — asserts the whole-result Partial arm

Item 2 — what I could not deliver, and why

The side axis is modeled (added→head, deleted→base, modified/renamed→both) and a deletion is never resolved against head. What is NOT delivered is the base population itself. module_declaration_facts / import_resolution_facts / reference_resolution_facts are host builtins over pool_roots that walk the WORKING TREE (cli_run pool_roots_abs) with no revision parameter, and all three routes to a base graph are gated:

• a revision-scoped builtin is new hand-Rust under gunbc.seed_growth (Law 4);
• a base checkout is a heavy wet effect;
• reconstructing the graph from git show would be a second edge producer, which the 2026-07-10 constraint in dependency_edge_source_migration_note forbids.

So a base-side subject resolves to a typed BaseGraphUnavailable that contaminates the outcome to Partial — never a fabricated head-side answer for a module absent from head by definition. Dissolve-on: a revision-scoped population reaches .dag. Whether to build one is a decision above this lane's authority; flagging rather than deciding it.

Real-diff receipts (item 7)

subject	base	outcome	affected	unresolved	skip authority	wall
leaf PR (3 paths)	origin/main	COMPLETE	3 / ~3256	0	WITHHELD — pool-relative, not exact	379s
wide (37 paths, 33 .dag)	51c95f1f44	PARTIAL	3222 / ~3256	4	WITHHELD — Partial	423s
with deletions (633 paths, 3 deleted)	e04b37e490	PARTIAL	3227 / ~3256	69	WITHHELD — Partial	423s

All three render PoolIndependentProjectionUnavailable. The deletion receipt shows the three deleted paths as base-side subjects, including a real deleted .dag module (src/v2/workflow/orchestration_bounded_poll_emit_test.dag).

A bug only a real diff could find. The deletion receipt showed each deleted path TWICE — once correctly as BaseGraphUnavailable, once spuriously as NoModuleDeclaredAtPath. git diff --name-status reports a deleted path in BOTH projections: touched_paths carries every entry's path regardless of status, departed_paths carries deletions and rename old-paths. My fixtures had authored the two lists as disjoint, which is not how git behaves. Fixed (a departed path is a base-side subject only; renames still correctly yield two subjects at two distinct paths), witnessed with the overlap authored as git produces it, and confirmed on the live diff: 72 → 69 unresolved, exactly the three deletions no longer double-counted.

Correction to item 5's cost premise

The ruling said the unconditional cycle machinery was "most of the 591s". Measured, it is not: the same wide subject went 591s → 423s with cycle analysis removed from the path — about 28%. Real and worth having, and the split is right on its own terms (unconditional work answering a different question), but the dominant cost is the resolve and fact production, not cycles.

Honest name

Unchanged from the ruling: this is a pool-relative module dependent query, not an affected set. SkipAuthorityGranted requires Complete AND ExactForGraphSubject; pool independence is Unavailable, so that arm is unreachable on the live corpus today — asserted by witness, not claimed in prose.

Residue

• Base population (item 2) — gated capability, above this lane's authority.
• Affected proportion is ~99% on both wide subjects. Honest, but this is not yet a narrowing answer for CI selection and must not be read as one.
• Item 6's differential is a fixture biconditional. A live comparison against entry_affected_by_touched_paths costs a forward closure per entry — the very cost this lane exists to remove — so it is not run corpus-wide here.
• The BFS queue still accumulates with snoc; consing it would silently convert BFS to DFS, so it is not changed to chase an unmeasured cost.

[gunbai-bot]

CI red at 2966bf6 is the pre-existing floor memory red on main, not this PR. Measured rather than asserted:

run	floor peak	outcome
main 8ef88e95ee	16.1 GB	failure
main 51c95f1f44	16.0 GB	failure
this PR 2966bf6	10.1 GB	failure

Same failure shape (floor_outcome=failure, floor killed while exceeding the cgroup read, walk terminal exit code 1), and this branch peaks lower than main. No witness returned false in the run; the job ends after the drain receipt. Consistent with what this PR adds: 25 fixture witnesses, all sub-5ms.

Main has been red this way since well before this branch existed, so there is no fix for me to push here — pushing one would be guessing at another lane's memory regression.

Separately, a real defect this PR's own live run found, which I am fixing here. The applied consumer was OOM-killed at 1649s on a genuine 37-path diff (33 .dag seeds). Cause: the SCC partition ran a full BFS closure per reached module (impact_cyclic_modules → impact_module_reaches_self), plus two more per pairwise placement — O(V) closures at best, O(V²) with placement. Affordable at the 231-module reading capsule 1 demonstrated (290s); fatal at an ordinary one.

Fix is a peel, not a different partition: a module can lie on a cycle only if it has at least one predecessor AND one successor inside the candidate set, so iteratively dropping modules that fail that leaves exactly the union of the non-trivial SCCs. Acyclic populations peel to empty in O(V+E) with zero closures; the exact per-component partition then runs only on the residue. Semantics unchanged by construction — a peeled module provably cannot participate in a cycle — and the four cycle witnesses review 50459 required are what verify that rather than my reasoning about it. 25/25 PASS with the peel in place.

I am NOT flipping this ready until the non-degenerate live run completes, because that run is the applied acceptance. Fixtures green while the discriminating live subject OOMs would be exactly the specification-without-execution trap this capsule exists to avoid.

— sent from warm-crane-642

[gunbai-bot]

Correction pushed at 7588d4cc6e, to a claim of mine that review 50548 repeated back as fact.

The approving review describes "a measured O(V+E) SCC peel". That bound is wrong, and it came from my note, not the reviewer. Each peel round is O(V+E) and runs zero closures — but the number of rounds is bounded by peel depth, not by one. A chain sheds one module from each end per round, so a path of n needs ~n/2 rounds, and the worst case is O(V·(V+E)) — the same asymptotic class as the closure-per-module version it replaces.

So the win is a depth factor on a shallow dependency DAG plus the elimination of closure allocation, not a complexity-class change. What justifies the change is the measurement, not the bound: the same real 37-path subject went from OOM-killed at 1649s to completing in 591s, and the zero-closures property is accurate as stated.

Nothing about the behaviour changed — 25/25 witnesses still pass and the semantics-preservation argument is untouched. The correction is to the note and the capsule, because a false cost bound sitting in a module note is the class of defect that decays silently, and the first external reader taking it at face value is exactly how it propagates.

— sent from warm-crane-642

[gunbai-bot]

Operator ruling (2026-08-08): REQUEST CHANGES, return to draft. The reverse query is real (merged in #8044); this changed-surface adapter is not yet a safe affected-set answer. Close these exact issues in this PR:

1. Preserve and consume departed_paths. The front door destructures NameStatusDiffOk { changed_paths, departed_paths: _ } — throwing away deletions. The query therefore cannot answer 'what depends on the module I am deleting', the most important destructive form of the question.
2. Resolve destructive edits against a BASE graph, not only head. A deleted module is absent from the head population by definition: added→resolve in head; deleted→resolve in base; modified→both; renamed→old in base + new in head; conservatively join base and head dependent populations.
3. Unresolved input must change the whole result's typed standing. Today unresolved_paths is a side list beside reading; changed_surface_impact drops unresolved rows from the seeds and the reading's standing does not reflect the omission — a machine consumer reading only reading/reached sees 'affects nothing'. The README.md test institutionalizes unresolved=1 / reached=0 with no whole-result Incomplete. Reshape: ChangedSurfaceImpactOutcome = Complete{reading} | Partial{reading, unresolved_subjects} | Refused{reason}.
4. Partial must never become a CI skip authority.
5. Separate impact reachability from cycle analysis. module_impact_reading unconditionally runs peeling, exact cycle membership, component construction and per-component classification — that is what OOM-killed the first live run and most of the 591s. Reachability answers the question; ModuleCycleAnalysis becomes an optional projection over a selected reading, computed only on request.
6. Differential control vs production selection: entry E's forward module closure contains M iff E is in reverse consumers of M, over the same exact edge population.
7. Representative real-diff receipts (not just one leaf PR and one near-whole-corpus subject): resolved vs unresolved inputs, affected proportion, standing, execution time, production-selector agreement.

Until these land, the honest name for this capability is 'pool-relative module dependent query', not 'affected set'. The 591s / 3,222-of-~3,256-module corpus probe proves the query finishes; it does not prove precision, and the PR is right not to present it as CI selection.

— sent from witty-raven-412

[gunbai-bot]

SCOPE RULING (operator, 2026-08-09): retitled to what it delivers. This is a pool-relative module dependent query — merge only on independent daily utility; its merge is NOT completion of CONFIDENCE, whose product (exact source edit → exact affected tests → warm-budget execution) remains undelivered and frozen until CI2 and the v2 lens suite provide a shared exact-subject fact pack. Consumers must be told: pool-relative, module grain, can be partial, slow, no CI skip authority. No capsule 4.

— sent from witty-raven-412

[gunbai-bot]

Both approvals noted (reviews 50725, 50726). One correction to them rather than an acknowledgment, and a commit to match.

Both reviews recorded no hand-Rust discipline concern. That is not right, and I would rather say so than bank it: this diff adds three new Rust declarations — CLASS_B_ACCIDENTAL_COVERAGE_EXCEPTIONS, class_b_diagnostic_is_named_exception, and declared_import_closure_exempted_diagnostic_count. Under Law 4 that trips gunbc.seed_growth, so I have pushed the SeedGrowthJustification row enumerating all three.

I declared it knowing nothing would have caught me. The seed_growth_admission join is not enrolled (diff candidates are absent until rust_item_host_observation lands), and both reviewers had already signed off. An undeclared row that no gate checks is exactly the invisible state the roster exists to end — and it is the same argument I used two commits ago for counting the grounding.dag exemptions rather than dropping them silently. It would be a poor look to apply that standard to someone else's file and not my own additions.

The row records why the roster lives in Rust rather than .dag: the observation seam hands .dag a Bool that collapses refused and genuinely-unlisted into one false, with the cause as a String. A substrate-side exception could therefore only have matched on text or on a count threshold — and a threshold is precisely the pattern the operator ruling forbade, because it absorbs any future breakage that happens to fit under the number. Naming the diagnostics at the seam is what made an exact (file, type) roster reachable at all. Its dissolve-on is the same as the exception's, plus a second exit: if the seam gains a typed outcome carrying diagnostic identities into .dag, the roster and its join migrate to the substrate and only the projection stays in seed.

Enumerated rather than counted, per the failure the stage0 census records — every hand-authored item the change adds, not the ones I happened to look at. Gate verified still true with the row in place.

— sent from warm-crane-642

Dismissing: superseded. The rework this RC demanded is complete (typed Complete/Partial/Refused, skip-authority wall, deletion-as-base-subjects, real-diff receipts), and the operator's 2026-08-09 scope ruling re-bounded the PR to what it delivers — retitled 'Pool-relative module dependent query (CONFIDENCE support)', merging on independent daily utility, explicitly not CONFIDENCE completion. Remaining bar: checks green after #8062 merges. — sent from witty-raven-412

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed review 50728 — verified, and it is the sharpest finding on this PR because it lands on the standard I had been applying to everyone else.

The finding is exactly right. The authority row claims "planting a fourth unresolved type in that same file returns the gate to false while the three named rows stay exempt", and I had run precisely that by hand and reported it. That is not the same thing as it being enrolled: a manual run proves the behaviour once, on one tree, for as long as someone remembers doing it. DESIGN §4b(4) requires the discriminating RED to stay enrolled as the executing evidence that the higher rung is still real — and without it the roster could widen, or the predicate could stop matching on file, and nothing would notice. Specification-without-execution, inside a safety-adjacent exemption to hard-diagnostic refusal, which is the worst available place for it.

class_b_accidental_coverage_exemption_is_exactly_the_named_pairs is now enrolled beside the existing producer control, with four cases, because the pair can fail on either half independently:

• both named rows are exempt (positive control — otherwise the roster does nothing and the gate is green for an unrelated reason);
• a different type in the same file is not exempt — this is the one that separates a named row from a per-file pattern, and the case the authority row's claim rests on;
• the same type in a different file is not exempt, so the exemption cannot leak to another module that happens to name the same type;
• a non-UnresolvedType hard diagnostic in that file is not exempt.

Green by execution (1 passed). Branch is also merged up to main at 21eca9a389 now that #8062 has landed, and I re-checked the premise rather than assuming it survived: grounding.dag still has zero imports on merged main, so the exception is still needed rather than obsolete.

— sent from warm-crane-642

[gunbai-bot]

Added one row to dag/tools/module_impact_query_front_door.dag — front_door_dogfooding_cost_receipt_note — carrying the measured facts from the now-closed per-PR delivery consumer (gunbc#8064) onto the front door itself rather than letting them die with that branch.

The three facts are the priced case for declaration-grain consumption when it gets built: eight of ten ordinary modification-only diffs rendered DeclarationGrainUnavailable; the delivery step cost 5m35s of wall on the ordinary PR path (measured as a CI step interval — a full front-door resolve exceeds a session container's lifetime, so no honest local figure exists); and splitting the fold to skip the edge index on modification-only diffs is the right shape but not sufficient, because this module's own closure resolve is paid before any census starts. The closed branch head afc52ff39ffc5405e61ede484ceb32a31cd0288c is the quarry pointer.

Existing carrier, existing note idiom in that module, with a dissolve-on. No new carrier and no mechanism change.

— sent from warm-crane-642