Repair three main-floor regressions, and isolate the partition-closure cost defect

[briansrls]

Main has been red for at least three consecutive ci runs. Two of the four failing clusters trace to #8116 (itself a heal PR), one to #8114, and the fourth has no established onset.

Exact-head evidence (workflow_dispatch run on 1bc18147, since the pull_request runs sit at action_required): failures went 11 → 9, with the edge-witness and brief-budget repairs confirmed cleared. The doc-graph repair was incomplete at that head and is completed by the following commit, verified locally.

cluster	witnesses	cause	fixed here
roadmap edge	witness_five_minute_ci_gate_program_chain_is_explicit	witness left at the superseded 08-07 state	yes
brief budget	witness_ticket_brief_budget_holds_and_reds	two briefs at 177w / 203w vs 100w	yes
doc graph	doc_graph_has_no_orphan_docs ×2, doc_graph_is_clean	two unbound docs — one from #8116, one from #8114	yes
witness cost	5 × stage0_partition_closure	live-fact construction far over budget	no — see below

1. The edge — the witness was stale, not the graph

This PR does not re-add any edge. An intermediate commit did, and ea802c3ce8 reverted it; review 51020 caught it. The wording is corrected here because the earlier body described that intermediate state.

The sequence is three states, which is why the stale clause looked like an anomaly rather than an obsolete assertion:

1. originally native-selected-witness-bundle depended on the gate and on warm-merge-admission
2. 2026-08-07 asserted both absent and required the reverse edge (gate → bundle)
3. 2026-08-10 superseded that reversal and deleted the reverse edge too, on a measurement: a 3,290s floor carries 97s of witness evaluation, so an infinitely fast evaluator leaves ~97% of the floor standing and native execution cannot be this gate's prerequisite in either direction

#8116 applied (3) to the graph. The witness and native_cutover_edge_direction_note stayed at (2) — its two negative clauses still passed, so only the now-obsolete positive clause failed. That graph-vs-prose disagreement is what reddened main.

The fix aligns the witness with the ruling: the clause is flipped from requiring that edge to asserting its absence rather than being dropped, so a re-added dependency in either direction still reds — the note's own stated principle, applied to the direction it hadn't covered. The note is rewritten to carry all three pinned absences plus the supersession, since it has now been wrong in both directions.

2. The over-budget briefs

ticket_brief_word_budget is 100, counted as split(s, " "). #8116 authored native-selected-witness-bundle at 177 words and v2-lens-suite-execution at 203. Trimmed to 98 and 93, keeping every load-bearing claim and dropping only elaboration the linked plan docs already carry. Load-bearing roadmap semantics stay in displaced_cost / first_slice / red_control. Headroom is deliberate so an ordinary later edit doesn't red main again. The witness's planted 101-word fixture control is untouched and still reds.

3. The orphan docs — there were two, and only one is #8116's

#8116 added docs/plans/four-lane-closeout-and-root.md with no plan registration and no bind. Binding it was not sufficient: exact-head CI still reported doc_graph_has_no_orphan_docs red. The witness answers Bool, so it could not distinguish "the bind failed" from "a second orphan exists" — a probe against doc_graph_orphan_count showed exactly 1 remaining, establishing the first bind worked and a distinct second orphan was present.

That second orphan is docs/plans/v2-frontend-std-ingestion-frontier.md, and it corrects an attribution this PR carried earlier: it landed in #8114, not #8116, so the doc graph was already dirty before #8116. The only prose naming it sits inside a code span rather than a markdown link, so binding its neighbour did not reach it and nothing else does.

Bound to v2.compiler.normalize normalize at subject grain — the terminal stage of the tokenize → parse → normalize chain the document measures, and where the majority of its recorded rejections land.

Verified by execution locally:

doc_graph_orphan_count                        1 -> 0
doc_graph_has_no_orphan_docs   (both copies)  PASS
doc_graph_has_no_dangling_links               PASS
doc_graph_universe_is_nonempty                PASS
doc_graph_is_clean                            PASS
documentary_refs, all 5 incl. renamed- and
  ambiguous-system refusal controls           PASS

The last is the load-bearing one for a new DeclarationRef: a bind whose ref did not resolve would surface there, not in the orphan count.

4. What is NOT fixed here

The five stage0_partition_closure witnesses are interrupted by the fast-lane budget after ~5s. That interruption point is not their cost — an earlier revision of this body reported "5016–5232ms vs 5000ms" as though it were, which is wrong in the way the budget diagnostic itself warns about: BudgetExceeded is an interruption plus a measured lower bound, never a duration.

Measured directly, with the budget out of the way:

w_live_corpus_partition_closure_holds    181,278 ms
w_verdict_carries_its_extent             195,621 ms
red_missing_roster_row_refuses           did not finish inside a 600s containing run
remaining two RED controls               not independently measured

So two complete evaluations are ~181s and ~196s. Do not extrapolate a five-witness total from that — three of the five have no complete measurement.

The cost is localised, by execution, to live corpus fact construction beneath partition_closure_verdict, not to the module's reachability or emitted-reference logic: the two witnesses that touch only the static roster (w_transitive_reexport_is_reachable, w_reachability_is_not_universal) evaluate in 0ms, and exactly the witnesses calling partition_closure_verdict() are expensive. A hypothesis that the inner-fold filesystem_read was the cost was implemented, measured (181,278 → 184,295ms — no change), and reverted; the || short-circuits past that read whenever a target is reachable.

What the next investigation must separate, before any remedy is chosen. There are two distinct duplication levels and only the second has been reasoned about:

• within one verdict — dependency_resolution_facts_live is called twice (module_target_index, and again purely to count extent.edges_considered), and module_declaration_facts_live backs two separate index builders
• across witnesses — five independent verdict evaluations over the same repository subject

An earlier revision of this body asserted "the remedy is shared computation". That is one rung too strong and is withdrawn: the within-verdict duplication has not been eliminated or measured. Persistent or shared materialization is the ruled remedy only if a single, de-duplicated fact construction still exceeds the envelope.

This PR deliberately contains none of that work — no change to stage0_partition_closure.dag, no cache, no materialization integration, no witness relocation.

A fifth failure, not fixed here and not the cost cluster

non_fold_residue_no_unrostered_or_stale (src/v2/lens/non_fold_residue_test.dag) was in main's original eleven. This PR does not address it, and an earlier revision of this body wrongly implied the only residue was the partition-closure population.

Measured locally: unrostered = 1, stale = 0, with both RED controls (..._synthetic_unrostered_red_holds, ..._wildcard_red_fixture_holds) passing — so the mechanism is sound and one live site genuinely has no roster row. Because stale is zero it is a new site, not a roster row orphaned by the #8110/#8120 revert.

It is left out deliberately rather than overlooked: the counters are host builtins whose roster lives in the Rust host layer (cli_run.rs), which is another session's active lane, and the roster contract requires a reason plus a dissolution trigger per row rather than a silent enrollment.

So this PR does not turn main green. It removes three stale red clusters that were obscuring the real defects. Expected residue on this head: the five stage0_partition_closure witnesses plus this one.

ROADMAP.md

Generated from roadmap_authority.dag and not hand-edited here. The CI auto-heal job regenerated it onto this branch (35c8eaeec3), which was merged rather than force-pushed; with the edge change reverted the emitted tree nesting is untouched and only the two trimmed briefs differ.

Test plan

No local execution: the remote build uploaded 0 artifacts, so no binary was available in-session. Verified statically against the exact rules — brief word counts re-checked with split(" ") after the edit (98 and 93, none remaining over 100), and a corpus-wide grep confirming the only remaining mention of the edge is the negative assertion. CI is the executing check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VFdBSKQNfe4dzDQX97RrJR

[gunbai-bot]

review 51020 was correct on the central point, and the fix reverses this PR's original decision rather than defending it.

I restored the edge because #8116 dropped it without updating its witness, and I read that as accidental. The finding is right that it was deliberate: five_minute_ci_gate_program_note says "THE NATIVE ROW NO LONGER PRECEDES THIS GATE. That edge is deleted, on a measurement rather than a preference", and the five-minute-ci-gate boundary says the same. Dispatch follows edges, so the restore would have blocked the gate on a self-host frontier while every authority carrier said it no longer waits. The method error: I inferred intent from the ABSENCE of a witness update when the carriers state it directly — absence of a corresponding edit is not evidence of accident.

Fixed in ea802c3ce8, taking the finding's own recommendation ("the witness [...] need to change instead of re-adding the edge"):

• edge restoration reverted — roadmap_authority.dag's graph is exactly as the 2026-08-10 ruling left it
• the witness clause flipped from requiring that edge to asserting its ABSENCE, not merely dropped, so a re-added dependency in either direction still reds. That is native_cutover_edge_direction_note's own stated principle applied to the direction it had not yet covered — and it would have caught my restore
• that note rewritten to carry all three pinned absences plus the supersession, since the clause has now been wrong in both directions and one describing only one of them invites the next restoration

One correction to the finding's framing, offered as a detail rather than a disagreement: the sequence is three states, not two. The bundle originally depended on the gate AND on warm-merge-admission; 2026-08-07 asserted both absent and required the REVERSE edge; 2026-08-10 superseded that reversal and deleted the reverse edge too. So the witness was stale at the 08-07 state rather than at the original one, which is why the two negative clauses in it still passed and made the missing third look like the anomaly.

The brief trims and orphan-doc bind were not part of the finding and are unchanged.

— sent from sunny-crane-27

[gunbai-bot]

Closing as superseded by #8122, which landed all three of this PR's repairs independently. Verified against current main rather than assumed:

• dag/test/claim/roadmap_authority_test.dag:563-565 already pins !edge_exists in both directions between five-minute-ci-gate and native-selected-witness-bundle, identical to this PR's clause, and roadmap_authority.dag carries zero such edges
• zero boundary briefs on main exceed the 100-word budget
• doc_graph_roots.dag already binds BOTH orphan slugs, including v2-frontend-std-ingestion-frontier

Every claim this PR's body makes is already true on main, so merging it would resolve conflicts to produce no net change. Nothing here is worth salvaging into a follow-up.

Two findings from this lane that are NOT in #8122 and are worth keeping, since they cost real measurement to establish:

1. The five stage0_partition_closure witnesses do not cost ~5s. That figure is the fast-lane INTERRUPTION POINT, a lower bound, not a duration. Measured directly with the budget out of the way: w_live_corpus_partition_closure_holds 181,278ms and w_verdict_carries_its_extent 195,621ms; a third did not finish inside a 600s containing run; the remaining two are unmeasured. The cost sits in live corpus fact construction beneath partition_closure_verdict — the two witnesses touching only the static roster evaluate in 0ms. A hypothesis that the inner-fold filesystem_read was responsible was implemented, measured (181,278 -> 184,295ms, no change) and reverted; the || short-circuits past that read whenever a target is reachable. Before anyone reaches for materialization: one verdict still calls dependency_resolution_facts_live twice (once for the target index, once purely to count extent.edges_considered) and module_declaration_facts_live backs two index builders. That local duplication has not been eliminated or measured.

2. non_fold_residue_no_unrostered_or_stale fails with unrostered=1, stale=0, both RED controls passing — a NEW live site with no roster row, not a row orphaned by the Re-land #8055 with data-initializer roots: classify test data declarations instead of refusing selection #8110/Revert #8110: it is a draft whose test-data root repair was never done #8120 revert. Its roster is host-side.

— sent from sunny-crane-27