DESIGN §3 standing rule: replacement migrations cut over at the root, plus the gunbc.replacement_cut planning carrier

[gunbai-bot]

What

Encodes the migration doctrine the operator developed across the 2026-08-15 design threads as a §3 standing rule in gunbc.design_document (DESIGN.md regenerated in the same change), plus the contract-grain planning carrier gunbc.replacement_cut the rule cites, so cuts become a referencable roadmap concept rather than per-conversation prose.

The rule (DESIGN §3, after the single-authority argument)

• Replacement vs refinement. When two structures answer the same semantic question and one is intended to disappear, the change is a replacement migration. Development may be incremental; production authority may not — one accepted transition moves the root and deletes X's route in the same motion.
• Consumer-relative roots, supersession before translation. Root = exact consumer × subject × contract. Descendants covered by a higher Y root are a deletion population; no c1/d1 is owed. Deletion licensed only when the new root intercepts every remaining production path.
• Consumers must earn survival. The census runs over dispositions, not raw edges; the envelope expands upward through workarounds whose only justification was X; reliance establishes migration cost, never correctness. Admission is two zeros: undispositioned = 0 AND uncovered surviving = 0.
• Greedy root-first search. Attempt the maximal cut; descend only on an exact refusal (Y-incomplete → fix Y and retry · escaping consumer → disposition it · opaque → bisect to localize). Deep cuts are the fallback decomposition of a refused root cut, never the default.
• Evidence follows its claim. Witnesses for surviving claims re-enroll against Y; a witness whose only subject is retired behavior retires with a receipt — tests must not grant obsolete behavior immortality. Stated as consistent with, and distinct from, §4b dissolution-on-climb.
• Receipts cited in both directions: CI2-0 completion: execute the complete exact-head test population through v2 and delete ordinary v1 test execution #8080/QUARRY: import-deletion semantics, binding controls and migration oracle (superseded by the clean namespaced-subject cutover) #8115/FLOOR2 cutover: every SelectionOff floor batch runs against one prepared subject #8244 by measured state; Retire the non-executing v1 Rust test suite and execute the retained kernel #8146/V1-CONSUMER-DRAIN-1: delete the ratchet and delete-guard builtin family #8182 as positive controls.

The carrier (gunbc.replacement_cut)

ReplacementCut (with why_not_higher: HigherBoundaryAnswer required by construction — a cut cannot be authored without stating its boundary is outermost or naming the higher refusal that pushed it down), ConsumerDisposition (retain-same / retain-changed / replaced-by-Y / evidence-only / retire / undecided), EvidenceDisposition (re-enroll / replace / retire-with-receipt / parked), and admit_replacement_cut — refusing typed, per-row, all causes counted on any undecided consumer or evidence row, any uncovered surviving consumer, and an empty covered region (a cut that deletes nothing is not a cut).

Rung honesty, stated in the module note: the fold judges the plan, not the world. Derived cut standing, attempt-layer refusal causes (backedge, missing refusal), the cut-outcome ledger, and the roadmap projection (contract/shadow/parity/cutover+deletion derived from one cut row; unregistered migration work red) are the named next layer — the migration-cut authority program — deliberately not pre-built here.

Verification

• dag/test/claim/replacement_cut_witness_test.dag: 8 witnesses green by execution on synthetic fixtures, including RED controls (undecided consumer blocks; uncovered surviving refuses; undecided evidence blocks; empty region refuses; multi-defect cut reports every cause, not first-wins; retired consumer needs no coverage).
• Compile-clean on the witness entry: 0 blocking, 3 advisory (the corpus-standard deferred where-refinement class).
• main_wet regen green; DESIGN.md byte-matches its authority.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 52276 (cursor REQUEST_CHANGES) in 5ca62af, taking the review's second offered resolution — reconcile the documents — rather than adding an arm.

Verified: the mismatch was real, and it was in the DESIGN wording, not the carrier. "…or visibly parked" listed beside the three terminal dispositions read as a fourth completed disposition that admission would accept; the carrier's fourth arm is EvidenceUndecided, which always refuses. The carrier is the intended contract. An admitted EvidenceParked arm would be wrong under the rule this same PR introduces: a deliberate deferral is still not a disposition against the terminal design, and admitting it re-opens the "undecided silently treated as retained" hole under a politer name — the two-zeros admission condition (undispositioned = 0) is only real if every parked row counts against it. Parking is therefore deliberately visible-and-blocking on both axes, symmetric with the consumer Undecided arm.

The DESIGN sentence now names the symbol and states this explicitly: three terminal dispositions plus EvidenceUndecided, "the visible parking state which, exactly like a consumer's Undecided, blocks admission rather than counting as dispositioned." Wording + regen only; no carrier or witness change (the witness's "parked witness" fixture now reads consistently — parked is the blocking state it tests).

— sent from tidy-pike-117

[gunbai-bot]

Addressed the 2026-08-15 planning-thread review (the REQUEST_CHANGES relayed from the operator's design thread) in c39d5cb, finding by finding:

1. Forgeable/unbound verdict — fixed. AdmittedReplacementCutPlan is a sole_constructor record minted only by the admission fold, carrying the cut identity and a criteria digest over every plan field; admitted_matches_plan is the recompute check. Cross-module construction or cast refuses at compile time (the seal is the wall — a witness attempting the forgery would red the tree, which is control 16 working). The fold is renamed admit_replacement_cut_plan: it judges the plan, and the vocabulary now says so. Witness: admitted_verdict_is_bound_to_the_plan_it_judged (same plan matches; mutated plan does not).

2. No independent denominator — the checkable half fixed, the join deferred by the review's own principle. Duplicate consumers, duplicate evidence subjects, and duplicate region members now refuse (one subject, one disposition — duplicates are a fork whether or not the copies agree); an enumerated-but-empty census refuses as the ⊥-conflation while a genuinely consumer-free boundary declares BoundaryDeclaredEmpty with a basis. The omitted-observed-consumer control cannot be built honestly today: no independently produced consumer population exists to join against, and an author-supplied "ExactConsumerPopulation" would be the same authored subset under a grander name — the string-shaped promise finding 3 itself forbids. The two-way identity joins are named in the module note as the migration-cut authority program's exact obligations.

3. Authored claims — typed where a referent exists, deferred where none does. The descended arm is now DescendedFromRefusedCut { parent_cut: ReplacementCutId, refusal_summary } — a joinable typed parent reference, with self-referential descent refusing. OutermostBoundary remains an authored claim pending a boundary-census receipt authority, per the same no-fabricated-referents principle. The checkable fallback cases now refuse: Covered { by: old_root } and ReplacedByY { new_authority: old_root } are fallback wearing a disposition.

4. Fixed. RetireEvidence carries retirement_reason (the receipt authority is deferred — it does not exist to name). ExternalXRole is the closed vocabulary from the DESIGN rule — fallback/internal-resolver/second-opinion have no constructor (control 12 by construction) — and NoExternalOracleRequired { justification } makes absence unambiguous.

5. Multi-root cut sets — deferred. One-root v1 with populations generalizing at the program layer; pre-building Exact*Population shells with no producer is uninhabited generality.

6. Fixed. DFS/BFS wording removed: "consumer-backward design of one complete semantic vertical, never implementation-forward conversion of X's internal layers," with a note that traversal vocabulary is deliberately absent.

7. Fixed in 5b62bff (predates this pass): the receipts clause is date-pinned as a dated reading of then-open branches, never live status. SHA-pinning wasn't adopted because the measurements came from the planning thread's read, not from a SHA I can truthfully name; a typed receipts module remains an option if the operator wants the stronger form.

8. Fixed. Both the module note and the DESIGN sentence now state plainly: no roadmap node is structurally registered to a cut yet; the typed projection is the program's future obligation, not a present fact.

Witness delta: 17 green by execution, including 9 new adversarial plan-grain controls (duplicates ×3, both fallback-naming cases, root-identity, self-descent, census both arms, digest binding). Controls requiring observed populations or executed receipts travel with the deferred joins. Compile-clean 0 blocking; DESIGN.md regenerated byte-matched.

Also folded in from the live floor session: the frozen-X carve-out now states that frozen includes growth surfaces — a builtin registry or escape-hatch arm inside a frozen X accepts no new rows (receipt: 38 of the interpreter's 125 host builtins accreted into one driver file because the surface accepted them).

— sent from tidy-pike-117

[gunbai-bot]

Both findings from review 52304 verified real and fixed in 13939b7:

1. Ungated mint — admitted_from was indeed an exported bypass: sole_constructor blocked cross-module literals and casts but not the helper route. Replaced by mint_admitted, admit_callers-sealed to admit_replacement_cut_plan alone, so the verdict is sealed twice over (record seal against construction/cast, caller seal against the in-module helper route) and no importer reaches a PlanAdmitted except through the checks. The module note now describes both seals.

2. Uninspected external_x — admission never read it, so ExternalXRoles { roles: [] } admitted while the DESIGN sentence claimed otherwise. ExternalRolesEnumeratedEmpty now refuses (same ⊥-conflation class as EnumeratedCensusEmpty), wired into the cause chain, with the paired witness empty_external_role_list_refuses_but_justified_no_oracle_admits proving both directions: empty list refuses with exactly that cause; NoExternalOracleRequired { justification } admits.

18 witnesses green, compile-clean 0 blocking, DESIGN.md regenerated byte-matched.

— sent from tidy-pike-117