Repository navigation
Delete the 27-row self-host frontier roster and the machinery that only served it - #8344
Conversation
gunbai-bot
Bot
commented
Aug 16, 2026
…ly served it
Operator ruling: the frontier roster is either derived from live state or it
does not exist. It was neither -- 27 hand-authored rows whose measurement
fields were ordinary parameters, so a row that claimed execution measurement
was indistinguishable from one that asserted it. It attracted readers, it
misrouted them, and it produced nothing. This deletes it at the root rather
than pruning it row by row.
WHAT THE DELETION PROVED, which is the part worth reading. Every consumer that
looked load-bearing turned out to consume an empty projection:
crate layout appended compiler_frontier_emitter_produced_stage0_mod_basenames(),
a fold admitting only EmitterProduced rows. All 27 were
SeedRetained, so the term was [] at every call and no
emitted byte changes.
wet enrollment appended a roster fold whose own gate,
falsifier_self_host_wet_template_only_holds, asserted that
term had length zero.
crate partition named the roster as a dissolution target for module
exports the roster could not have supplied -- rows carried
a path and a disposition and nothing else.
So the roster's real dependents were its own census tests. Those, the promotion
and authorization machinery, and the per-module probe survey go with it.
WHAT SURVIVES AND WHERE IT WENT. Crate layout is a separate concept that was
squatting in the frontier module; it moves to v2.compiler.self_host.stage0_crate_layout
with the registration rows and projections that actually produced bytes. The
producer/qualification vocabulary in emitter_producer_provenance survives at
half its size -- the EmitterProducer x EmissionQualification axes, the realized
closure carriers, the receipt and its single mint -- because its live consumers
(candidate_generation, the direct rust door contract, the production
qualification lens) never read a roster row.
EVIDENCE, PER DESIGN 4b. Deleted witnesses fall in two classes and both are
stated in the carriers rather than here. Green-by-construction: seven crate
layout witnesses guarded by a disposition match whose EmitterProduced arm was
unreachable, or comparing zero to zero. Subject-retired: the authorization
forgery controls proved an unauthorized EmitterProduced disposition was
unwritable, and that disposition no longer has a representation to forge.
Two claims survived and keep their controls: a V2Emitter receipt cannot be
minted with the seed emitter in its realized closure, and the generated crate
layout artifact must match its registration rows.
ONE CLAIM IS GENUINELY RETIRED RATHER THAN CLIMBED, said plainly.
transition_parity_host_index_agrees_with_hand_rows redded when the derived
module index and the hand-authored qualified-module rows disagreed. Deleting
one side of a duality retires the parity claim; it does not discharge it. The
surviving authority is the path-module binding index, and the crate-partition
dissolve target now points there instead of at the roster.
The frontier_probe_survey bin is removed with its .dag surface and transport.
Justified per bin, not by a class sentence, because an earlier change deleted
four bins on one blanket justification and was reverted for exactly that --
see the second-removal paragraph in gunbc.ci_release_bins.
NOT DONE HERE, named rather than left to be found: the frontier_probe subsystem
(frontier_probe, frontier_probe_types, assemble_detail and their tests) still
stands. It is the adjacent weed -- its subject was per-module roster
measurement -- but it has independent test consumers and deserves its own cut.
The plan carriers written in the roster's vocabulary (wave2_prep_design,
v2_self_hosting) are quarry now, not authority, and are not rewritten here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
The build failed in 39s because deleting src/bin/frontier_probe_survey.rs left two references to it standing: build.rs still declared a rerun-if-changed on the file, and .github/workflows/ci.yml still passed --bin frontier_probe_survey to the release build and then asserted the resulting artifact existed at four verify sites and one tar site. ci.yml is a generated artifact and the honest way to update it is to regenerate it from gunbc.ci_release_bins, which is where the pack row was already removed. `gunbc ci` cannot run in this container -- the shim panics reading ci_layer_roots.dag out of a temp workspace -- so the eight occurrences are removed by hand and the drift gate is the check: it compares ci.yml against `gunbc ci` output byte for byte, so if this hand edit is not exactly what the generator produces, CI says so. That is the intended instrument for this rather than a local claim I cannot make. Stated because it is the kind of thing worth noticing rather than routing around: a hand-edited generated artifact is only acceptable here because a byte-exact gate independently checks it in the same run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… .dag string The retained-kernel test gate failed with four panics, all the same: for_each_parsed_module_binding could not parse dag/gunbc/ci_release_bins.dag. The per-bin justification I added there quoted the earlier blanket sentence verbatim -- not "a probe bin whose subject was cli_run" -- inside a double-quoted string, which terminated the string mid-prose and left the remainder as garbage tokens. Worth noticing rather than just fixing. The failure surfaced four modules away from its cause, in a materialization-provider test whose subject is disk cache probes, because the whole-corpus module-path index parses every .dag file before anything else runs. So a prose edit in a bin roster reds a cache test, and the panic names the parse site rather than the reader. That is the same ordering property this program spent the afternoon on: what breaks first is not what is wrong, it is what runs first. The sentence now paraphrases instead of quoting. Checked the other nine multi-paragraph notes this change adds: each opens and closes exactly once, with the odd per-line quote counts expected of a string spanning blank lines. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
…ration The frontier cut deleted the frontier_probe_survey bin and its row in the release pack, and I removed its eight occurrences from ci.yml by hand. fleet-converge.yml and falsifier.yml build the same pack from the same authority and still named it, so heal regenerated them and could not push workflow paths itself. These are its bytes, not mine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… not program data DESIGN 4c, enforced by prose_row_introduction_gate: this path's prose is already migrated, so a new data NAME_note: String row is refused. The note explains what the frontier cut removed from this module and what survived, which is exactly irreducible rationale about a construction's shape -- it belongs above the declaration it explains, not in a String the compiler must carry. Six sibling rows on out-of-scope paths were reported and not enforced; left as they are rather than widening the diff past the refusal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
…removed The floor refused with StaleFrozenPathDeferral: two gunbc.witness_deferral_freeze rows named test decls the entry no longer declares. A freeze row left behind is not inert -- it becomes a standing exemption the next witness to take that name inherits, which is the refusal's own wording and the reason it is loud. Same two names were still enrolled as ClaimRun rows in the supply transport, and its note explained why one of them was there. Removed both and rewrote the note to say what happened to their subjects: the parity witness had the duality between the derived index and the hand rows as its subject, and the cut removed one side, so the claim is retired rather than dropped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… pool coincidence emitter_producer_provenance_witness_test imported schedule_witness_entries_structurally_equal from wet_receipt_enrollment, which neither defines it nor imports it. It is defined in seed_emitter_behavioral_wet_known_red_entries, a module this file already imports. The reference resolved on main only because some other member of the assembled closure had dragged the definer into the pool; the cut changed the closure and it stopped resolving, refusing the whole discovery corpus. This is the Class B accidental-coverage shape DESIGN records as an open thread — a bare cross-module reference binding by pool membership rather than by the importing file's own closure. Importing from the definer is the fix that does not depend on who else is in the pool. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
The cut deleted the two HandAuthoredDocBind rows for the frontier probe
receipts but left the documents in the tree, so three files lost their only
inbound reachability and became orphans. Deleting the bind rows was correct
— every declaration they cite (frontier_probe_exact_head_closeout_note,
frontier_probe_run_interruption_note, frontier_roster_provenance_constructor_inflation_note,
compiler_frontier_receipt_totality_wall_holds) is deleted by this PR, so the
binds would otherwise dangle. What was missing is the other half: a document
whose entire subject is retired is retired with it, never left standing.
Deleted with the rows:
docs/probes/frontier_probe_exact_head_survey_2026-08-03.{md,tsv}
docs/probes/frontier_probe_run_interrupted_2026-08-06.md
docs/probes/diff_frontier_declared_vs_survey.sh (only input was the TSV above)
docs/probes/run_frontier_probe_survey_per_module.sh
The two scripts are frontier-probe transport and served nothing else. Two
unrelated STR-RC-0 scaffolds cited the second one as a class exemplar; their
comments now state the class without the pointer, so the deletion leaves no
stale citation behind.
This is the branch's own doc-graph defect, distinct from the five inherited
rows main is currently red on (the root_b probe orphan, fixed by #8333).
Same lens, same five row names, two different causes — which is why "those
are the known inherited rows" had to be checked rather than assumed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
|
The The five failing rows are the doc-graph pair asserted from two files plus the conjunction — one defect pair, five row names. That shape is usually main's, and half of it is: main gained But the row name identifies the lens, not the defect, so "those are the known inherited rows" is cover rather than a diagnosis. Checking the diff for edge-forming content rather than for …while deleting no documents. Three files kept their place in the tree and lost their only inbound reachability, with zero markdown links pointing at them. Two new orphans of my own, sitting behind main's. Deleting the rows was right — every declaration they cite (
Two unrelated STR-RC-0 scaffolds cited the second script as a class exemplar; their comments now state the class without the pointer, so this leaves no stale citation. Residual references to any deleted path: 0. Executed receipt for the branch tree is running now and I will post it rather than leaving the argument to stand on its own. Expect — sent from smart-ram-730 |
|
Executed receipt, as promised — the branch tree is clean. Run on (The trailing So the two orphans this branch created are closed, verified by running the lens rather than by reading the diff. The arm is the right one: the SHA is the pushed head and One check of mine did not report, and I would rather say so than let it pass as a pass: the Remaining red on this PR is main's single orphan, cleared by #8333. — sent from smart-ram-730 |
Two conflicts, both resolved by rule rather than by hand. src/v2/compiler/self_host/frontier_probe_survey.dag: modify/delete. Main's change (#8333) is a prose edit inside one note in a file this PR deletes whole — it rewords a citation to the very TSV this branch retires. Keeping the deletion loses nothing. .github/workflows/ci.yml: generated. The merge driver refused it as designed — ours side left in the worktree, path marked unmerged, no markers. This commit carries the provisional ours side ONLY to get a tree that builds; it is regenerated in the next commit and overwritten by construction. Main changed the AUTHORED_CONFLICTS exclude list, this branch changed the bin lists; both derive from .dag authorities, so the generator produces the union and neither side is picked. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52817 on #8344 named six stale citations to symbols and files this cut deletes. All six verified against the tree and fixed per site — a mechanical substitution across them produces sentences that parse and say nothing, which I did once already tonight and am not repeating. stage0_crate_layout_emit.dag the generated-artifact template still embedded 'Authority: v2.compiler.self_host.frontier' in both the .dag and .rs emit paths after the import was repointed, so the next regen would bake a deleted module name into two generated artifacts. Now names the real authority, v2.compiler.self_host.stage0_crate_layout. ci_layer_roots.dag witness_admission_offline_note dropped the deleted exclusion note from the paired list. ci_layer_roots.dag long_lane_exclusion_note dropped the 'Named consumer with file-grain exclusion row' sentence; both things it named are gone. ci_layer_roots.dag falsifier_self_host_wet_note the frontier-row flip no longer gates wet enrollment; says so, and points at the note recording that the term it fed was already empty. ci_release_bins_witness_test.dag note claimed two positive gap bins while the tests assert one. witness_deferral_freeze.dag the terminating-survey specimen is rewritten rather than removed: it did terminate, but by its subject being deleted rather than by reaching 27 of 27 receipts, and that is the disposition the freeze cannot express. Two more of the same class the review did not reach, found by sweeping every deleted symbol rather than fixing the six named: doc_graph_roots.dag the bind for this cut's own coordination document had primary_work pointing at v2.compiler.self_host.frontier_band_a_emit_readiness, a module this PR deletes. Repointed to the door-contract note already in its additional_works, which is the closest surviving subject. discrete_cost_derivation (.dag + .md) cited the deleted exclusion note as live evidence for the 'green CI implies coverage' claim. The claim stands; the specimen is now stated as one that has since been deleted with its subject, which is an instance of the pattern rather than a loss of it. Census after: every decl_name bound in doc_graph_roots resolves in the tree. An earlier run of that census reported two missing — both were my grep omitting 'func' declarations, not defects. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
|
Pushed Fixed per site rather than by one substitution across them: a mechanical sweep over prose like this produces sentences that parse and say nothing, which I did once already tonight and am not repeating.
Two the review did not reach, found by sweeping every symbol the cut deletes rather than fixing only the named six:
Census after: every Also on this head: main merged in ( — sent from smart-ram-730 |
cursor review 52826. Two of its four findings were already fixed in 5921f90 (the emit template, the release-bins note); it ran on the older head. The other two are real, and they show the first sweep was keyed on the wrong thing: I swept deleted SYMBOLS, and a DeclarationRef names a MODULE PATH independently of whether the symbol it cites still exists somewhere. Sweeping module paths instead found three sites, one more than the review. stage0_rust_source_lifecycle_scaffold.dag hand_maintained_stage0_filenames_authority_ref still named v2.compiler.self_host.frontier while the import three hundred lines above had been repointed to stage0_crate_layout. Repointed. dissolution_migration_census.dag a NarrativeOnly residue row for a note in the deleted probe-survey module. Removed; the partition witness asserts sum-of-parts against the total rather than a literal count, so it stays true by construction. self_host_promotion_obligations.dag RE-HOMED rather than retired, and the distinction is the point. Both refs named the deleted frontier module, which made the bound trigger one that can NEVER fire — DeclarationAppears waiting on a module nobody will re-create is a permanently pending obligation wearing a checkable trigger, which is worse than an honest unbound one. The obligation itself survives the roster because it was never about the roster: the hazard is that a self-host promotion can be granted on evidence the v1 seed produced, and EmitterProducer still carries a V1SeedEmitter arm in v2.compiler.self_host.emitter_producer_provenance. So the subject moves there, the trigger keeps its declaration name and moves with it, and the 'n/27' framing — which really was roster-specific — is gone from the claim. Its witness needs no change: it asserts the bound and unbound arms stay distinguishable, and both still are. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52843. Both name it as a LIVE authority, unlike the several
prose sites that correctly say 'was carved out of' or 'was deleted with' —
those stay, because a historical reference to a deleted thing is accurate.
language_target_registry.dag Rust's TargetGovernedByContracts named the
deleted module as its governing contract id. Repointed to
v2.compiler.self_host.emit_coverage_frontier. Note that the row's own
governing_contract_id_resolution_note explains this field carries a module
name only because the real strategy authority lives in a private overlay
and cannot be resolved from here — so the field is a stand-in either way,
but a stand-in naming something that exists is strictly better than one
naming something deleted.
stage0_emit_plan.dag the disposition-authority note said the projection
derives from the deleted roster's seed-retained facts. It derives from
stage0_crate_layout's hand-maintained filename facts, which is where the
carve-out put them.
Deliberately NOT changed: cli_run.rs uses the string as a synthetic submodule
name in a prefix-matching unit test. It tests string logic and never resolves
the module, so it is not a stale citation — any name would do.
My earlier sweeps missed both because they keyed on 'module_path:' fields and
import lines. These are a contract_ids list element and prose. Third sweep
form, and the one that should have been first: grep the bare module name in
any syntactic position, then decide per site whether the reference is live or
historical.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52843's first finding, and the one with teeth: I changed the emit template's authority string without regenerating what it stamps, so the committed artifacts and the template disagreed and generated_artifact_drift_gate would have refused. Ran the real generator rather than hand-editing generated files: gunbc run --entry dag/tools/generated_artifact_gate.dag --function main_wet It rewrote two artifacts with the new authority — and .github/workflows/ci.yml, which is the part worth recording. The merge earlier took the ours side of ci.yml purely to obtain a tree that builds, on the stated plan that regen would overwrite it by construction. It did: the generator produced MAIN's AUTHORED_CONFLICTS line, not mine. So the hand-picked side was wrong and would have shipped a workflow that silently dropped main's change. That is exactly the failure the generated-artifact merge driver refuses in order to prevent, and the reason the rule is regenerate rather than resolve. Still owed and dispatched separately: gunbc_stage0_crate_layout_generated.rs carries the same string but is emitted by regen_stage0 rather than by this gate, so it needs the stage0 regeneration, not this one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
gunbc_stage0_crate_layout_generated.rs is the emitted Rust OF the .dag row this PR changed, so it is owned by regen_stage0 rather than by the generated_artifact_gate that produced the previous commit. Ran regen_stage0: 144 files written, exactly one changed, and it is this one. That single-file result is the receipt that the earlier gate run had already covered everything else it owns. Both regeneration paths now agree with the template, so the drift gate and the regen job have nothing left to refuse on this string. Instrument note, recorded because it is the fourth of its kind tonight: the subject-presence greps I printed beside this run were mangled by nested quoting — the pattern's second word was taken as a filename, so both reported 0 with a 'No such file' line above them. The numbers were garbage. The run is still trustworthy, but on the strength of what regen CHANGED, not on the checks I attached to it. A broken check that prints a plausible 0 is worse than no check, and this is the same family as reading a truncated tail: absence manufactured by the instrument, read as a measurement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52854, both real. MY REPOINT WAS WRONG AND THE REASON IS THE ERROR I HAVE BEEN WARNING OTHERS ABOUT ALL NIGHT. I moved Rust's TargetGovernedByContracts to v2.compiler.self_host.emit_coverage_frontier because the name resembled the deleted module. It does not answer the same question: that carrier's own two-axis note says it answers axis (a), whether a witness body runs native, and explicitly disclaims axis (b), module self-emission. Picking it on name resemblance is precisely 18.2's finding — a name says the carrier was involved, not how — applied by me while citing it to someone else. Repointed to v2.compiler.self_host.emitter_producer_provenance, the surviving producer authority, which is also where the promotion obligation re-homed earlier in this PR. And the field's own note is updated: its stated purpose is a resolvable module a reader can open, so the note naming the deleted one made it false on its face while the field beside it had already moved. The note now records the wrong first choice rather than quietly showing the second — a reader deciding whether this field means anything is better served by knowing it was mis-picked once. seed_emitter_behavioral_wet_module_bindings carried two dissolution triggers whose subjects the cut removed: authorization waiting on 'witness-realization + frontier_probe_survey', and 'Frontier rows stay SeedRetained'. Both rewritten to name what actually remains — witness-realization alone, and the binding's own absence. A trigger naming a deleted subject cannot fire, which makes it strictly worse than honest prose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
|
Both findings from review 52854 verified and fixed in I repointed to the wrong authority, by name resemblance. I moved Rust's That is §18.2's finding — a type name in a diagnostic says the carrier was involved, it does not say how — committed by me, in the same hours I sent it to two other lanes as a correction. The lesson generalizes past type names to any citation picked on resemblance. Repointed to And the note beside it was false on its face. Second finding — two dissolution triggers whose subjects the cut removed, in
A trigger naming a deleted subject is worse than honest prose: it cannot fire, so it reads as checkable while being permanently pending. That is the same defect this PR already fixed once in — sent from smart-ram-730 |
claude review 52858. The first finding is the serious one: STRUCTURED fields,
not prose.
THREE LIVE ROADMAP NODES pointed path: at the deleted file — v2-emitter-
producer-provenance, v2-emitter-first-behavioral-module, v2-emitter-native-
bootstrap, all active in gunbc.roadmap_authority. Repointed PER NODE from what
each node says it does, not uniformly:
producer-provenance -> emitter_producer_provenance.dag
(its handback wants a result refused without a
receipt from the run that made it — that module's
mint wall)
first-behavioral-module-> wet_receipt_enrollment.dag
(handback is test results plus the updated list
entry; the list entry was a roster row, and wet
enrollment is what survived carrying per-module
receipts)
native-bootstrap -> v2_emitter_direct_rust_door_contract.dag
(handback is two builds and the old compiler taken
away)
Picking one target for all three would have repeated the mistake in the commit
before this one, where I chose emit_coverage_frontier because the name
resembled the deleted module. Swept afterward: every path: in the roadmap now
resolves on disk, the sole non-file being a dotted module reference.
WAVE2_PREP_DESIGN IS MARKED SUPERSEDED RATHER THAN REPOINTED, and that is a
disposition rather than a shortcut. Its entire mechanism section names the
roster, its count, its baseline, its census attribution, its sweep order and
its gate — all deleted. There is no mapping from a roster row to a replacement,
so repointing eight symbols would fabricate an authority the document never
had. DESIGN §3 rules that a plan authored while the deleted structure lived is
re-read as quarry: its findings may be evidence, its sequencing is the old
structure's gravity written down. The header now says so and tells the reader
every symbol below names something gone.
The other two plan carriers had specific enough claims to repoint per site.
Residual live citations of the deleted module across all .dag: zero, counting
only live references — the several prose sites that say 'was carved out of' or
'was deleted with' stay, because a historical reference to a deleted thing is
accurate and sweeping those would be the mechanical substitution this PR has
already had to undo once.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… refill it review 52867 caught v2_self_hosting.dag still presenting the deleted frontier.dag as the live roster carrier -- seven citations across the status line, the state-of-play census, two Wave 1 residual lists, the Wave 3 exit gate and the retirement condition. The claude review on the same head credited this file with quarry annotation it does not have, so the finding is real and the approval was wrong about it. Quarry-bannering it would be the wrong repair. wave2_prep_design earned that treatment because its whole mechanism section named deleted roster symbols with no surviving mapping; this file is the live sequencer for a program whose Wave 1 is still in flight. It is not superseded by the cut -- it merely cited what the cut removed. So: repoint to the surviving authorities, and where a claim was denominated by the roster, retire the fraction rather than re-author it. 0/27 and 27/27 both came from the same hand-authored row list, so both measured the roster's opinion of how many compiler modules exist. The substance survives (no module is self-emitted with a green equivalence receipt; every module must flip or be declared pinned-kernel) and is now stated qualitatively, with the derived denominator named as the first Wave 3 obligation. Restoring a count here would rebuild the weed inside the replacement, which is the failure DESIGN section 3 warns about by name. The frontier probe residuals are marked retired rather than outstanding: the survey never produced a receipt on any host including a dedicated runner, so its deletion costs machinery, not evidence. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
|
Fixed in I did not take the suggested repair as offered, and the reason is the interesting part. Quarry-bannering it would be wrong. So: repoint, and where a claim was denominated by the roster, retire the fraction rather than re-author it.
Receipt, remote ( — sent from smart-ram-730 |
Three classes of resolution, each decided rather than defaulted. MAIN-DELETED FILES (14, accept the deletion). #8344 deleted the 27-row self-host frontier roster and the machinery that only served it. Verified my side of each was import-strip-only before accepting: the one apparent exception in frontier.dag was 82 lines of import-block CONTINUATION, and the one genuine addition -- my SeedRetainedIntrinsicRegistration for the new source_closure seed module -- is salvaged below rather than lost with the file. CONTENT CONFLICTS (7). Every hunk but one was main re-adding an import block this branch deletes, so those take the HEAD side. The exception is real and main is right: it deleted a witness that opened `if compiler_frontier_emitter_produced_count() == 0 { true }` where the count was zero at every commit it ever ran under, so its three assertions had never been evaluated -- green by construction, not by evidence. Took main's content throughout and re-applied the strip, which also preserves main's correction of the generated-artifact authority string from the now-deleted v2.compiler.self_host.frontier to v2.compiler.self_host.stage0_crate_layout. SALVAGE. source_closure is registered in stage0_crate_layout.dag, which is where that fact lives now (`pub mod source_closure;` in lib.rs confirms has_pub_mod), and threaded into the generated artifact's pub-mod block, basename list and filename list at the registration-order position. Two hazards handled explicitly. stage0_crate_layout_generated.dag came back UNMERGED WITH ZERO CONFLICT MARKERS -- the generated-artifact merge driver refusing -- so `git add -A` over it would have silently committed the ours side; it was reconstructed instead. And main's imports also arrive through CLEAN auto-merges, not just conflicts: stage0_crate_layout.dag carried five, which the parser panics on. Corpus now greps zero import statements. The generated artifact is a hand-reconstructed merge, not an emitter run -- regen is suspended on this branch. The drift gate is the check on it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Six conflicts. Five resolved by what the cut decides, one by what MAIN decides, and one class checked for that git structurally cannot report. STAY DELETED, because this branch removes their subject: .github/workflows/ci.yml and falsifier.yml (the cut deletes those workflows), and the witnesses ci_release_bins_witness_test.dag and ci_spec_witness_test.dag -- both deleted here by the CI wipe and the re-add, and touched on main only incidentally while it removed frontier-roster references. A witness whose subject is gone cannot be re-enrolled against anything. MAIN'S DELETION WINS on src/v2/compiler/self_host/frontier_probe_survey.dag, which is the reverse direction from every other conflict and so worth stating rather than letting modify/delete default. Main deleted the file wholesale with the 27-row self-host frontier roster (#8344). This branch's only edit to it was removing an affected-set selection reference -- an edit to a file main then removed entirely, so there is nothing left for the edit to be owed against. .github/workflows/fleet-converge.yml is GENERATED, and picking a side would have dropped one side's authority-derived content with no marker. Both sides changed one binary roster in opposite directions, and the merged authority settles it: `gunbc.ci_release_bins` enrolls none of the three disputed bins. frontier_probe_survey was removed on main with the roster that gave it a census to read; floor_skip_discovery_witness and selection_control_skip_witness were removed here with the selection machinery they controlled. The projection therefore excludes all three, which is this branch's list minus frontier_probe_survey -- derived from the merged authority rather than chosen between two stale projections. CHECKED EXPLICITLY, because git cannot report it: a file ADDED on one side inside a region the other side DELETES satisfies git's "changed incompatibly on both sides" relation and violates this cut's "no new member enters the deleted region", so it lands silently with no marker. Enumerated main's additions since the merge base against the affected-set, ci.yml, falsifier, ci_spec and selection regions: none. The check is recorded because its value is in having been run, and a null result is invisible otherwise. Merged tree builds clean. Merge commit, not rebase, per branch policy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Resolving the origin/main merge needed a self-consistent seed to build a regen binary with: taking main's side of the one conflicted generated file left v1_compiler_emit_rust.rs calling the derive functions without map_key_required while its unconflicted sibling required it, so the crate did not compile (8 x E0061). I restored the whole src/v1/stage0/src/ tree from the pre-merge head to bootstrap, and that restore also resurrected a file main had deleted and reverted a generated header main had corrected. src/v1/stage0/src/bin/frontier_probe_survey.rs — deleted again. main cut it in #8344 with the self-host frontier roster it surveyed; gunbc.ci_release_bins records that removal per-bin. It read compiler_frontier_sweep_order from the now-deleted frontier.dag, is unregistered in Cargo.toml, and carries no scaffold receipt. bootstrap_stage0_crate_layout_generated.rs — header restored to cite v2.compiler.self_host.stage0_crate_layout. v2.compiler.self_host.frontier is deleted; stage0_crate_layout.dag is the module carved out of it. Generated file, and nothing in this branch feeds its generator, so main's output is correct here; the file list was never affected, only the citation. Swept the class rather than the two cited sites: exactly one resurrected file and zero files missing versus main, and no other stage0 file cites the deleted authority. regen_stage0 --verify remains at regen_divergence_count=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…weep meant to fix dead citations review 52919 caught it. The F5 row and the rust end-state row in gunbc.plans.language_target_self_host_frontier cite emitter_produced_baseline as the surviving count authority after the roster cut. That symbol does not exist. Verified: it appears three times in the tree and all three are prose -- two notes in interpreter_replacement_cut and stage0_crate_layout, and my own two cells. seed_emitter_behavioral_green_count and its baseline appear exactly once each, in the same cell I wrote. Neither has a declaration anywhere. So the repoint in #8344 replaced a citation to a deleted symbol with a citation to a symbol that was never declared, which is worse than what it fixed: the old one at least named something that had existed and would fail a grep against history. This is the class I have been quoting at other lanes all night, committed by me, in the diff whose entire purpose was clearing it. The root is that I searched for the FORM of the old citation rather than resolving the NEW one. A repoint is two obligations, not one -- remove the dead name, and prove the replacement resolves -- and I performed only the first. DESIGN section 3 says a stale name is decidable and grep-checkable, which is exactly why there is no excuse for it. Fixed by stating the bar qualitatively where no symbol survives to carry it, rather than by finding a third name to point at. After the roster cut nothing counts producer-qualified emissions, and the honest sentence is that no module carries a producer-qualified promotion -- not a fabricated tally. Where a real symbol does carry the fact, the cells now name it: EmitterProducer x EmissionQualification, mint_producer_emission_receipt as the only route to a receipt, the realized-closure wall seed_emit_rust_reachable, and BehavioralProbeUnbound as the honest standing for a receipt that has produced source and nothing more. The rust end-state cell also still read "SeedRetained roster", which contradicted the roster deletion this same PR documents. It now says there is no denominator and declines to invent one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
Fresh seed rebuild + regen_stage0 --verify (divergence 0); removes stale Witness coercion/is_copy assertions dropped when frontier probe witnesses were deleted on main. Co-authored-by: Cursor <cursoragent@cursor.com>
… its declaration node (#8376) * Infer a bare variant's instantiated owner from the expected type, not its declaration node A bare variant reference inferred as its OWNER COPRODUCT'S DECLARATION NODE, whose children are the coproduct's ARMS rather than type arguments. `type Optional<T> = Absent | Present { value: T }` declares Absent as child 0, so a generic owner reaching the renderer uninstantiated rendered `Option<Absent>` -- a constructor in type position, not a Rust type. The emitter was rendering faithfully what inference gave it. When the context supplies an expected type that owns the variant, that expected node IS the instantiated owner, so it is adopted in place of the declaration node. The same lookup already existed in the unresolved-name arm; it is hoisted to one authority so a variant that RESOLVES gets it too, rather than only one that does not. Adoption is deliberately narrow on two axes, both earned by a failure: IDENTITY -- only when the expected type's own head names the coproduct resolution already bound, so this instantiates the owner the binder chose rather than re-targeting to a different coproduct declaring an arm of the same name (Absent is an arm of Optional, ObservationVerdict and ConvergeVerdict alike). CARDINALITY -- only when the expected node is Required. Optionality is not a wrapper type here: `BinOp?` is a BinOp node whose return_cardinality is CardOptional, so a head comparison cannot see it. For `binop: Mod` against `BinOp?` the head IS BinOp and the arm IS found, but the constructor's type is BinOp and the optionality is a coercion the emitter performs by wrapping; adopting there made the value look already-optional and emitted `binop: BinOp::Mod` where `Some(BinOp::Mod)` is owed. Two successive drafts shipped that wrapper loss across four extdeps.languages.*_syntax modules and std.effects. Worth recording WHY it survived: the Option<Absent> count, the whole-artifact diff of the emitted eval closure, and the rustc error census all stayed green through both, because all three measure the eval closure while the damage was in v1's OWN emitted sources. regen_stage0 --verify was the only instrument whose subject included it. Measured, emitted v2.compiler.05_eval closure, before -> after: Option<Absent> sites 21 -> 0 rustc errors 494 -> 473 (-19 E0425, -2 E0573; no code increased) whole-artifact diff 24/24 lines, fully accounted: 21 broken annotations repaired, 2 improved to concrete types (Option<Rc<UriPercentEncodeRefusalCause>>, Rc<NamedEdgeTargetLookup>), 1 Verdict annotation relaxed to `_` self-host fixed point green (two generations) Witness enrolls the CARDINALITY half, which is single-source constructible and is the half both wrong drafts broke, with a required-field positive control so the repair is not satisfiable by wrapping everything or by refusing every adoption. The headline Option<Absent> case has no enrolled row and the note says so: it needs the v2 Optional coproduct as a declared generic type AND an ambiguously owned arm name, but Optional is not declared in the dag corpus (it is the built-in `T?` sugar) and two same-named arms in one module are refused outright. Its evidence is the executed corpus measurement above -- discriminating, but not recurring. Rung, honestly: mitigatable, not structural. With no expected type inference still falls back to the declaration node, so a declaration-shaped node can still reach a type position. Dissolve-on: constructor ownership and constructor value type become separate facts with a needs-context / refused arm, at which point the state is unwritable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Delete the 27-row self-host frontier roster and the machinery that only served it (#8344) * Delete the 27-row self-host frontier roster and the machinery that only served it Operator ruling: the frontier roster is either derived from live state or it does not exist. It was neither -- 27 hand-authored rows whose measurement fields were ordinary parameters, so a row that claimed execution measurement was indistinguishable from one that asserted it. It attracted readers, it misrouted them, and it produced nothing. This deletes it at the root rather than pruning it row by row. WHAT THE DELETION PROVED, which is the part worth reading. Every consumer that looked load-bearing turned out to consume an empty projection: crate layout appended compiler_frontier_emitter_produced_stage0_mod_basenames(), a fold admitting only EmitterProduced rows. All 27 were SeedRetained, so the term was [] at every call and no emitted byte changes. wet enrollment appended a roster fold whose own gate, falsifier_self_host_wet_template_only_holds, asserted that term had length zero. crate partition named the roster as a dissolution target for module exports the roster could not have supplied -- rows carried a path and a disposition and nothing else. So the roster's real dependents were its own census tests. Those, the promotion and authorization machinery, and the per-module probe survey go with it. WHAT SURVIVES AND WHERE IT WENT. Crate layout is a separate concept that was squatting in the frontier module; it moves to v2.compiler.self_host.stage0_crate_layout with the registration rows and projections that actually produced bytes. The producer/qualification vocabulary in emitter_producer_provenance survives at half its size -- the EmitterProducer x EmissionQualification axes, the realized closure carriers, the receipt and its single mint -- because its live consumers (candidate_generation, the direct rust door contract, the production qualification lens) never read a roster row. EVIDENCE, PER DESIGN 4b. Deleted witnesses fall in two classes and both are stated in the carriers rather than here. Green-by-construction: seven crate layout witnesses guarded by a disposition match whose EmitterProduced arm was unreachable, or comparing zero to zero. Subject-retired: the authorization forgery controls proved an unauthorized EmitterProduced disposition was unwritable, and that disposition no longer has a representation to forge. Two claims survived and keep their controls: a V2Emitter receipt cannot be minted with the seed emitter in its realized closure, and the generated crate layout artifact must match its registration rows. ONE CLAIM IS GENUINELY RETIRED RATHER THAN CLIMBED, said plainly. transition_parity_host_index_agrees_with_hand_rows redded when the derived module index and the hand-authored qualified-module rows disagreed. Deleting one side of a duality retires the parity claim; it does not discharge it. The surviving authority is the path-module binding index, and the crate-partition dissolve target now points there instead of at the roster. The frontier_probe_survey bin is removed with its .dag surface and transport. Justified per bin, not by a class sentence, because an earlier change deleted four bins on one blanket justification and was reverted for exactly that -- see the second-removal paragraph in gunbc.ci_release_bins. NOT DONE HERE, named rather than left to be found: the frontier_probe subsystem (frontier_probe, frontier_probe_types, assemble_detail and their tests) still stands. It is the adjacent weed -- its subject was per-module roster measurement -- but it has independent test consumers and deserves its own cut. The plan carriers written in the roster's vocabulary (wave2_prep_design, v2_self_hosting) are quarry now, not authority, and are not rewritten here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Follow the bin deletion through build.rs and the generated workflow The build failed in 39s because deleting src/bin/frontier_probe_survey.rs left two references to it standing: build.rs still declared a rerun-if-changed on the file, and .github/workflows/ci.yml still passed --bin frontier_probe_survey to the release build and then asserted the resulting artifact existed at four verify sites and one tar site. ci.yml is a generated artifact and the honest way to update it is to regenerate it from gunbc.ci_release_bins, which is where the pack row was already removed. `gunbc ci` cannot run in this container -- the shim panics reading ci_layer_roots.dag out of a temp workspace -- so the eight occurrences are removed by hand and the drift gate is the check: it compares ci.yml against `gunbc ci` output byte for byte, so if this hand edit is not exactly what the generator produces, CI says so. That is the intended instrument for this rather than a local claim I cannot make. Stated because it is the kind of thing worth noticing rather than routing around: a hand-edited generated artifact is only acceptable here because a byte-exact gate independently checks it in the same run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Fix the parse error my own note introduced: nested double quotes in a .dag string The retained-kernel test gate failed with four panics, all the same: for_each_parsed_module_binding could not parse dag/gunbc/ci_release_bins.dag. The per-bin justification I added there quoted the earlier blanket sentence verbatim -- not "a probe bin whose subject was cli_run" -- inside a double-quoted string, which terminated the string mid-prose and left the remainder as garbage tokens. Worth noticing rather than just fixing. The failure surfaced four modules away from its cause, in a materialization-provider test whose subject is disk cache probes, because the whole-corpus module-path index parses every .dag file before anything else runs. So a prose edit in a bin roster reds a cache test, and the panic names the parse site rather than the reader. That is the same ordering property this program spent the afternoon on: what breaks first is not what is wrong, it is what runs first. The sentence now paraphrases instead of quoting. Checked the other nine multi-paragraph notes this change adds: each opens and closes exactly once, with the odd per-line quote counts expected of a string spanning blank lines. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Two workflows still named the deleted probe bin: take the heal regeneration The frontier cut deleted the frontier_probe_survey bin and its row in the release pack, and I removed its eight occurrences from ci.yml by hand. fleet-converge.yml and falsifier.yml build the same pack from the same authority and still named it, so heal regenerated them and could not push workflow paths itself. These are its bytes, not mine. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Move the deletion rationale into an authored annotation: it is prose, not program data DESIGN 4c, enforced by prose_row_introduction_gate: this path's prose is already migrated, so a new data NAME_note: String row is refused. The note explains what the frontier cut removed from this module and what survived, which is exactly irreducible rationale about a construction's shape -- it belongs above the declaration it explains, not in a String the compiler must carry. Six sibling rows on out-of-scope paths were reported and not enforced; left as they are rather than widening the diff past the refusal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Delete the freeze rows and transport claims naming witnesses the cut removed The floor refused with StaleFrozenPathDeferral: two gunbc.witness_deferral_freeze rows named test decls the entry no longer declares. A freeze row left behind is not inert -- it becomes a standing exemption the next witness to take that name inherits, which is the refusal's own wording and the reason it is loud. Same two names were still enrolled as ClaimRun rows in the supply transport, and its note explained why one of them was there. Removed both and rewrote the note to say what happened to their subjects: the parity witness had the duality between the derived index and the hand rows as its subject, and the cut removed one side, so the claim is retired rather than dropped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Import the equality helper from its definer: the old path resolved by pool coincidence emitter_producer_provenance_witness_test imported schedule_witness_entries_structurally_equal from wet_receipt_enrollment, which neither defines it nor imports it. It is defined in seed_emitter_behavioral_wet_known_red_entries, a module this file already imports. The reference resolved on main only because some other member of the assembled closure had dragged the definer into the pool; the cut changed the closure and it stopped resolving, refusing the whole discovery corpus. This is the Class B accidental-coverage shape DESIGN records as an open thread — a bare cross-module reference binding by pool membership rather than by the importing file's own closure. Importing from the definer is the fix that does not depend on who else is in the pool. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Retire the frontier probe receipts with the roster they measured The cut deleted the two HandAuthoredDocBind rows for the frontier probe receipts but left the documents in the tree, so three files lost their only inbound reachability and became orphans. Deleting the bind rows was correct — every declaration they cite (frontier_probe_exact_head_closeout_note, frontier_probe_run_interruption_note, frontier_roster_provenance_constructor_inflation_note, compiler_frontier_receipt_totality_wall_holds) is deleted by this PR, so the binds would otherwise dangle. What was missing is the other half: a document whose entire subject is retired is retired with it, never left standing. Deleted with the rows: docs/probes/frontier_probe_exact_head_survey_2026-08-03.{md,tsv} docs/probes/frontier_probe_run_interrupted_2026-08-06.md docs/probes/diff_frontier_declared_vs_survey.sh (only input was the TSV above) docs/probes/run_frontier_probe_survey_per_module.sh The two scripts are frontier-probe transport and served nothing else. Two unrelated STR-RC-0 scaffolds cited the second one as a class exemplar; their comments now state the class without the pointer, so the deletion leaves no stale citation behind. This is the branch's own doc-graph defect, distinct from the five inherited rows main is currently red on (the root_b probe orphan, fixed by #8333). Same lens, same five row names, two different causes — which is why "those are the known inherited rows" had to be checked rather than assumed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Cut cleanup: the citations the deletion left pointing at nothing cursor review 52817 on #8344 named six stale citations to symbols and files this cut deletes. All six verified against the tree and fixed per site — a mechanical substitution across them produces sentences that parse and say nothing, which I did once already tonight and am not repeating. stage0_crate_layout_emit.dag the generated-artifact template still embedded 'Authority: v2.compiler.self_host.frontier' in both the .dag and .rs emit paths after the import was repointed, so the next regen would bake a deleted module name into two generated artifacts. Now names the real authority, v2.compiler.self_host.stage0_crate_layout. ci_layer_roots.dag witness_admission_offline_note dropped the deleted exclusion note from the paired list. ci_layer_roots.dag long_lane_exclusion_note dropped the 'Named consumer with file-grain exclusion row' sentence; both things it named are gone. ci_layer_roots.dag falsifier_self_host_wet_note the frontier-row flip no longer gates wet enrollment; says so, and points at the note recording that the term it fed was already empty. ci_release_bins_witness_test.dag note claimed two positive gap bins while the tests assert one. witness_deferral_freeze.dag the terminating-survey specimen is rewritten rather than removed: it did terminate, but by its subject being deleted rather than by reaching 27 of 27 receipts, and that is the disposition the freeze cannot express. Two more of the same class the review did not reach, found by sweeping every deleted symbol rather than fixing the six named: doc_graph_roots.dag the bind for this cut's own coordination document had primary_work pointing at v2.compiler.self_host.frontier_band_a_emit_readiness, a module this PR deletes. Repointed to the door-contract note already in its additional_works, which is the closest surviving subject. discrete_cost_derivation (.dag + .md) cited the deleted exclusion note as live evidence for the 'green CI implies coverage' claim. The claim stands; the specimen is now stated as one that has since been deleted with its subject, which is an instance of the pattern rather than a loss of it. Census after: every decl_name bound in doc_graph_roots resolves in the tree. An earlier run of that census reported two missing — both were my grep omitting 'func' declarations, not defects. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Cut cleanup 2: the deleted-MODULE citations the symbol sweep missed cursor review 52826. Two of its four findings were already fixed in 5921f90 (the emit template, the release-bins note); it ran on the older head. The other two are real, and they show the first sweep was keyed on the wrong thing: I swept deleted SYMBOLS, and a DeclarationRef names a MODULE PATH independently of whether the symbol it cites still exists somewhere. Sweeping module paths instead found three sites, one more than the review. stage0_rust_source_lifecycle_scaffold.dag hand_maintained_stage0_filenames_authority_ref still named v2.compiler.self_host.frontier while the import three hundred lines above had been repointed to stage0_crate_layout. Repointed. dissolution_migration_census.dag a NarrativeOnly residue row for a note in the deleted probe-survey module. Removed; the partition witness asserts sum-of-parts against the total rather than a literal count, so it stays true by construction. self_host_promotion_obligations.dag RE-HOMED rather than retired, and the distinction is the point. Both refs named the deleted frontier module, which made the bound trigger one that can NEVER fire — DeclarationAppears waiting on a module nobody will re-create is a permanently pending obligation wearing a checkable trigger, which is worse than an honest unbound one. The obligation itself survives the roster because it was never about the roster: the hazard is that a self-host promotion can be granted on evidence the v1 seed produced, and EmitterProducer still carries a V1SeedEmitter arm in v2.compiler.self_host.emitter_producer_provenance. So the subject moves there, the trigger keeps its declaration name and moves with it, and the 'n/27' framing — which really was roster-specific — is gone from the claim. Its witness needs no change: it asserts the bound and unbound arms stay distinguishable, and both still are. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Repoint two live references to the deleted frontier module cursor review 52843. Both name it as a LIVE authority, unlike the several prose sites that correctly say 'was carved out of' or 'was deleted with' — those stay, because a historical reference to a deleted thing is accurate. language_target_registry.dag Rust's TargetGovernedByContracts named the deleted module as its governing contract id. Repointed to v2.compiler.self_host.emit_coverage_frontier. Note that the row's own governing_contract_id_resolution_note explains this field carries a module name only because the real strategy authority lives in a private overlay and cannot be resolved from here — so the field is a stand-in either way, but a stand-in naming something that exists is strictly better than one naming something deleted. stage0_emit_plan.dag the disposition-authority note said the projection derives from the deleted roster's seed-retained facts. It derives from stage0_crate_layout's hand-maintained filename facts, which is where the carve-out put them. Deliberately NOT changed: cli_run.rs uses the string as a synthetic submodule name in a prefix-matching unit test. It tests string logic and never resolves the module, so it is not a stale citation — any name would do. My earlier sweeps missed both because they keyed on 'module_path:' fields and import lines. These are a contract_ids list element and prose. Third sweep form, and the one that should have been first: grep the bare module name in any syntactic position, then decide per site whether the reference is live or historical. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Regenerate the artifacts the authority-string change restamps cursor review 52843's first finding, and the one with teeth: I changed the emit template's authority string without regenerating what it stamps, so the committed artifacts and the template disagreed and generated_artifact_drift_gate would have refused. Ran the real generator rather than hand-editing generated files: gunbc run --entry dag/tools/generated_artifact_gate.dag --function main_wet It rewrote two artifacts with the new authority — and .github/workflows/ci.yml, which is the part worth recording. The merge earlier took the ours side of ci.yml purely to obtain a tree that builds, on the stated plan that regen would overwrite it by construction. It did: the generator produced MAIN's AUTHORED_CONFLICTS line, not mine. So the hand-picked side was wrong and would have shipped a workflow that silently dropped main's change. That is exactly the failure the generated-artifact merge driver refuses in order to prevent, and the reason the rule is regenerate rather than resolve. Still owed and dispatched separately: gunbc_stage0_crate_layout_generated.rs carries the same string but is emitted by regen_stage0 rather than by this gate, so it needs the stage0 regeneration, not this one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Regenerate the last artifact carrying the old authority string gunbc_stage0_crate_layout_generated.rs is the emitted Rust OF the .dag row this PR changed, so it is owned by regen_stage0 rather than by the generated_artifact_gate that produced the previous commit. Ran regen_stage0: 144 files written, exactly one changed, and it is this one. That single-file result is the receipt that the earlier gate run had already covered everything else it owns. Both regeneration paths now agree with the template, so the drift gate and the regen job have nothing left to refuse on this string. Instrument note, recorded because it is the fourth of its kind tonight: the subject-presence greps I printed beside this run were mangled by nested quoting — the pattern's second word was taken as a filename, so both reported 0 with a 'No such file' line above them. The numbers were garbage. The run is still trustworthy, but on the strength of what regen CHANGED, not on the checks I attached to it. A broken check that prints a plausible 0 is worse than no check, and this is the same family as reading a truncated tail: absence manufactured by the instrument, read as a measurement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Repoint to the right authority, and clear two more dissolution triggers cursor review 52854, both real. MY REPOINT WAS WRONG AND THE REASON IS THE ERROR I HAVE BEEN WARNING OTHERS ABOUT ALL NIGHT. I moved Rust's TargetGovernedByContracts to v2.compiler.self_host.emit_coverage_frontier because the name resembled the deleted module. It does not answer the same question: that carrier's own two-axis note says it answers axis (a), whether a witness body runs native, and explicitly disclaims axis (b), module self-emission. Picking it on name resemblance is precisely 18.2's finding — a name says the carrier was involved, not how — applied by me while citing it to someone else. Repointed to v2.compiler.self_host.emitter_producer_provenance, the surviving producer authority, which is also where the promotion obligation re-homed earlier in this PR. And the field's own note is updated: its stated purpose is a resolvable module a reader can open, so the note naming the deleted one made it false on its face while the field beside it had already moved. The note now records the wrong first choice rather than quietly showing the second — a reader deciding whether this field means anything is better served by knowing it was mis-picked once. seed_emitter_behavioral_wet_module_bindings carried two dissolution triggers whose subjects the cut removed: authorization waiting on 'witness-realization + frontier_probe_survey', and 'Frontier rows stay SeedRetained'. Both rewritten to name what actually remains — witness-realization alone, and the binding's own absence. A trigger naming a deleted subject cannot fire, which makes it strictly worse than honest prose. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Roadmap paths, and the plan carriers the cut decayed claude review 52858. The first finding is the serious one: STRUCTURED fields, not prose. THREE LIVE ROADMAP NODES pointed path: at the deleted file — v2-emitter- producer-provenance, v2-emitter-first-behavioral-module, v2-emitter-native- bootstrap, all active in gunbc.roadmap_authority. Repointed PER NODE from what each node says it does, not uniformly: producer-provenance -> emitter_producer_provenance.dag (its handback wants a result refused without a receipt from the run that made it — that module's mint wall) first-behavioral-module-> wet_receipt_enrollment.dag (handback is test results plus the updated list entry; the list entry was a roster row, and wet enrollment is what survived carrying per-module receipts) native-bootstrap -> v2_emitter_direct_rust_door_contract.dag (handback is two builds and the old compiler taken away) Picking one target for all three would have repeated the mistake in the commit before this one, where I chose emit_coverage_frontier because the name resembled the deleted module. Swept afterward: every path: in the roadmap now resolves on disk, the sole non-file being a dotted module reference. WAVE2_PREP_DESIGN IS MARKED SUPERSEDED RATHER THAN REPOINTED, and that is a disposition rather than a shortcut. Its entire mechanism section names the roster, its count, its baseline, its census attribution, its sweep order and its gate — all deleted. There is no mapping from a roster row to a replacement, so repointing eight symbols would fabricate an authority the document never had. DESIGN §3 rules that a plan authored while the deleted structure lived is re-read as quarry: its findings may be evidence, its sequencing is the old structure's gravity written down. The header now says so and tells the reader every symbol below names something gone. The other two plan carriers had specific enough claims to repoint per site. Residual live citations of the deleted module across all .dag: zero, counting only live references — the several prose sites that say 'was carved out of' or 'was deleted with' stay, because a historical reference to a deleted thing is accurate and sweeping those would be the mechanical substitution this PR has already had to undo once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * The self-hosting tracker outlived its roster: declare the gap, do not refill it review 52867 caught v2_self_hosting.dag still presenting the deleted frontier.dag as the live roster carrier -- seven citations across the status line, the state-of-play census, two Wave 1 residual lists, the Wave 3 exit gate and the retirement condition. The claude review on the same head credited this file with quarry annotation it does not have, so the finding is real and the approval was wrong about it. Quarry-bannering it would be the wrong repair. wave2_prep_design earned that treatment because its whole mechanism section named deleted roster symbols with no surviving mapping; this file is the live sequencer for a program whose Wave 1 is still in flight. It is not superseded by the cut -- it merely cited what the cut removed. So: repoint to the surviving authorities, and where a claim was denominated by the roster, retire the fraction rather than re-author it. 0/27 and 27/27 both came from the same hand-authored row list, so both measured the roster's opinion of how many compiler modules exist. The substance survives (no module is self-emitted with a green equivalence receipt; every module must flip or be declared pinned-kernel) and is now stated qualitatively, with the derived denominator named as the first Wave 3 obligation. Restoring a count here would rebuild the weed inside the replacement, which is the failure DESIGN section 3 warns about by name. The frontier probe residuals are marked retired rather than outstanding: the survey never produced a receipt on any host including a dedicated runner, so its deletion costs machinery, not evidence. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbc-ci-auto-heal <bts53@scarletmail.rutgers.edu> * Plan status: Root A landed, Root D half 1 has no live owner, Root B measured (#8367) * Plan status: Root A landed, Root D half 1 has no live owner, Root B measured The status table said Root A was 'unknown; under challenge' after it merged, and named vivid-wren as owner of a Root D whose halves have different owners and different states. A shared coordination document that is stale about what landed sends the next reader at finished work — which happened to me tonight: I dispatched a duplicate work item for Root D half 1 off this table before finding PR #8350 already at the merge bar with its author's session archived. A LANDED, #8347 as c4e9cc9. 12.5's challenge was RIGHT, which is why what landed is not what 12.5 proposed: a fused-map split, not the coproduct-skip edit the retracted diagnosis pointed at. The skip is still there and still deliberate. Recorded with two receipts — the stage0 regeneration the first push missed, and the two regen runs that reported a perfect fixed point while compiling a tree that never contained the fix. D split by owner: half 2 landed; half 1 is #8350, at the merge bar, no live owner, shepherded here. B 18.3 adds smart-ibex's executed flip: 211->204 errors, 203->196 sites, 195 common / 8 removed / 1 added, containment 0-of-18 disjoint. The 43-site renderer-inconsistency reading and the +18 reassignment are RETRACTED — read off a different module's artifact, never reached a carrier. What survives is sharper than the retraction: the leaf name Nat denotes two different types under two module authorities, so a census pooled across modules is keyed on a name that is not unique over the population it pools. Key on resolved type identity, not the printed name, and let a site carry more than one root. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Root D half 1 landed too — bbb5213, minutes after the row was written The row said 'at the merge bar, no live owner, shepherded here'. It merged while this PR was open. Recording it rather than letting a status document be stale about a merge inside its own review window — which is the failure the PR exists to fix, and it would be a poor look for the fix to exhibit it. Its author's session was archived before it landed, so the merge is also the receipt that an ownerless PR at the bar does not need a new session, only someone watching for it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Strike the superseded instruction, and give half 2 its receipt cursor review 52846, both findings real. 12.5 said 'treat A as unpartitioned, not as diagnosed' immediately above the RESOLVED block this PR added, so the section told a skimming reader that landed work was still open. I appended a resolution without striking the claim it supersedes, which is the plan-ledger form of rung inflation — and doing it in the very PR whose purpose is status honesty. Struck rather than deleted: the instruction was correct when written, and the paragraph above it records WHY the then-current diagnosis was refused, which still governs. The Root D row claimed both halves landed while citing only half 1. Half 2 is 7cfeb6f (PR #8341), verified an ancestor of origin/main before citing it rather than copied from the review. Receipt added. Swept my own additions for the same class afterward: every LANDED claim in this diff now names a merge commit, and all four SHAs this document cites (bbb5213, 7cfeb6f, c4e9cc9, 6a3779d) are confirmed ancestors of origin/main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Compare owner DECLARATION identity, not its name, and fix the unguarded no-binding arm Review-driven follow-up to the previous commit, both findings acted on rather than recorded. IDENTITY. The owner guard compared `authored_name_at(exp) == owner_name` -- a spelling, not an identity. It fails in both directions: one declaration reached through a qualified spelling fails it, and two DIFFERENT declarations sharing a name pass it. The dangerous arm is the second: given `a.Status = Ready | AOnly` and `b.Status = Ready | BOnly`, a `Ready` bound from a.Status could be adopted against an expected b.Status, silently retargeting the constructor and potentially masking a real type error. That hazard was introduced by the previous commit, not pre-existing. The repository already defines same-owner identity at the constructor-binding authority (insert_variant_owner_checked): authored name PLUS declaration file and source start. That triple is extracted as `same_owner_declaration` and both consumers now ask one authority instead of two. Comparing identity NAIVELY REVERTS THE REPAIR, and the measurement is the point. Requiring name+file+start put Option<Absent> straight back to its full 21-site baseline; a probe on name+file alone was also 21, which located the cause: expand_scrut_type_for_- variant_lookup returns its subject unchanged once the connective is Disj, so `exp_enum` is a USE-SITE node in the consumer module, never the owner's declaration. Comparing a use site against a declaration can never match. Both sides are now normalised through lookup_type_for before comparison, which restores 0 sites WITH identity enforced. NO-BINDING ARM. The expected-context-only branch adopted the expanded node raw, and expand returns an OPTIONAL subject unchanged -- exactly the state the cardinality rule refuses two branches over. It is fixed with with_required_cardinality rather than by extending the `Required` refusal there: that branch has no binding fallback, so refusing would convert resolving programs into hard not-founds, and a fabricated refusal is forbidden by the same rule as a fabricated success. Measured, emitted v2.compiler.05_eval closure, before -> after (unchanged headline, strictly more precise output): Option<Absent> sites 21 -> 0 rustc errors 494 -> 473 (-19 E0425, -2 E0573; no code increased) whole-artifact diff 43/43 lines, fully accounted: 21 broken annotations repaired, ~21 `acc: _` IMPROVED to concrete types, 1 Verdict annotation relaxed to `_` self-host fixed point green in one generation witness both rows green The witness note gains the sharper coverage statement, which this change PROVED rather than reasoned: both enrolled rows pass on the unrepaired baseline, so they detect the repair over-reaching and cannot detect it ceasing to work. The identity draft above silently reverted the repair while every row stayed green; only re-measuring the corpus caught it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Revert the owner-identity guard: it regressed 16 whole-corpus sites Reverts the code of ece43db, keeping its witness-note finding. The review finding that motivated it is REAL and is NOT resolved by this revert -- it is deferred with a measurement, which is more than it had before. WHAT THE FINDING WAS. The owner guard compares authored names, not declaration identity, so two DIFFERENT declarations sharing a spelling can pass it and expected context could retarget a constructor. That hazard is introduced by the first commit and is real. WHY THE FIX IS NOT SHIPPING. Comparing declaration identity requires normalising both sides -- expand_scrut_type_for_variant_lookup returns a USE-SITE node once the connective is Disj, so a raw span comparison never matches and silently reverted the repair to its full 21-site baseline. Normalising through lookup_type_for restored the repair but introduced 16 incompatible-type errors across the corpus, because resolving to declarations makes the guard match through ALIASES and QUALIFIED SPELLINGS that the authored-name comparison declines -- so it adopts in cases it must not. Bisected: the no-binding cardinality edit is innocent (reverting it alone still gave 16); the identity comparison is the cause. whole-corpus compile, dag + src/v2, one instrument, three arms: origin/main incompatible-types 0 undefined-variable 32 first commit incompatible-types 0 undefined-variable 32 identity commit incompatible-types 16 undefined-variable 32 The 32 undefined-variable rows are pre-existing on main and are the control proving the read works. WHY THIS WAS NOT CAUGHT BEFORE PUSHING, which is the transferable part: every number in the first commit was measured on the EMITTED EVAL CLOSURE, and the compile-clean gate compiles the WHOLE CORPUS. This change alters inference for every bare variant reference in the tree, so the eval closure was never the right denominator for it. The self-host fixed point is also a partial denominator -- it covers v1's own sources, which is why it caught two earlier drafts and not this one. Whole-corpus compile is now run beside the eval emission for any inference change. State restored to the verified first commit, re-measured after revert: self-host fixed point green whole-corpus incompatible-types 0 (baseline 0) whole-corpus undefined-variable 32 (baseline 32, pre-existing) Option<Absent> in emitted eval 0 (baseline 21) witness both rows green Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: regenerate drifted generated artifacts (ci auto-heal) --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: gunbc-ci-auto-heal <bts53@scarletmail.rutgers.edu>
…ts shape alone (#8353) * Root T5a: derive the trait roster from how a type is used, not from its shape alone The emitted derive roster was a function of shape only. A record's structure says what it CAN derive; it cannot say what its USE demands. So a type reaching a map-key position needed Eq + Hash that no shape classification would ever produce, and std.trait_derive_shape could not even NAME Hash -- ReprGroundingDeriveTrait had no member for it. The gap was structural, not an oversight in the table. THE REQUIREMENT IS ONE ROW. map_key_required_derive_traits is Eq + Hash, grounded on im 15.1.0 HashMap<K, V> declaring K: Hash + Eq -- the container Map lowers to, via std.types container_template_algebra PartialFunction. The subject population is a LEAST FIXPOINT over the declared-type graph, the same shape as the Clone-bound fixpoint beside it and for the same reason: derive(Hash) emits an impl requiring every field type to be Hash, so a required type propagates to every declared type its fields mention, and a recursive type saturates instead of diverging. THE UNION IS APPEND-ONLY, and that is what a wider constant roster cannot express. Two of the four types gain both traits; two gain only Hash because they already derive Eq. That asymmetry is visible in the emitted artifact, and it is the evidence that selection is per-type gated by a usage fact rather than a bigger table. MEASURED BY EXECUTION, both arms same entry, same command, same source roots, only the commit differing. Whole emitted tree for src/v2/compiler/02_parse.dag, 101 files: FIVE differ. FOUR are appended derive attributes -- std_occurrence_identity.rs OccurrenceId + Eq, std::hash::Hash v2_compiler_parse.rs ParsePositionKey + Eq, std::hash::Hash v2_std_node.rs OccurrenceId (phantom) + std::hash::Hash v2_std_runtime.rs EnvironmentBindingKey + std::hash::Hash -- and the fifth is std_trait_derive_shape.rs, the module this commit edits, appearing in its own emitted form: 11 lines, all of them the source edit round-tripping. No removals, no rewrites, no emitted form becoming another form anywhere in the tree. cargo check on the assembled crate: E0277 Hash/Eq 29 -> 0, total messages 762 -> 730, no diagnostic class introduced. On 04_infer, 0 Hash/Eq at this head; that entry's before-arm is smart-ibex-716's census, not mine, and is cited rather than merged in. TWO FORKED ROSTERS DISSOLVED ON THE WAY. The phantom-opaque struct emit carried its derive attribute as a hardcoded string literal -- a second roster the authority could not reach, which is why the phantom OccurrenceId stayed unfixed after the record path was. It now renders through rust_trait_derive_attr_from_traits over a named phantom_opaque_carrier_derive_traits, byte-identical where no requirement applies. And Eq/Hash on a payload coproduct were capability rows reading false for a roster reason: Rust derives them on an enum with payloads exactly as it derives PartialEq, which the table already allowed. Leaving them false made a key-position coproduct refuse with compile_error! at a shape that could carry the derive -- which is what 04_infer did on NodeKind, EdgeLabel and NodeOccurrenceId before this. WHAT THIS DOES NOT DO, stated rather than implied. The seed reads type-expression positions -- declared fields, fn value params, fn return types, alias right-hand sides -- not inferred types of arbitrary expressions, so a map keyed by a type that appears in no such position is not discovered. That residue is loud: the emitted crate fails the same rustc E0277 it fails today. It is a may-miss, never a may-fabricate, and the two negative controls pin that direction -- a record no one keys by, and the same type in the VALUE slot of the same container, both of which must stay silent. NOT the Ord axis. Set elements carry an Ord requirement answered today by refusing at the use site rather than by propagating to the declaration. Folding it onto this fixpoint is the obvious next step and is deliberately not taken here, because it moves emitted bytes for a population this change has not measured. Scope boundary, since the neighbouring root will be quoted at this one: T5's other half is ~44 sites of serde/Debug demanded of types holding Rc<dyn Fn>. Adding those derives is impossible -- the requirement has to go -- and it is a modeling decision, not this repair. regen_stage0 --verify: regen_divergence_count=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Drop the three import names my merge resolution duplicated The union resolution of the origin/main merge kept both sides of the trait_derive_emit import block verbatim, so v1_clone_bounded_type_params, v1_item_clone_bounded_param_names and v1_item_clone_undecided_head each appeared twice — once from each side. Only v1_clone_impl_required_type_params was genuinely new. Emitted bytes are unaffected: regen_stage0 --verify reports regen_divergence_count=0 with no stage0 file changed, measured rather than assumed. Three further duplicate imports in the same two files (a doubled `import v1.compiler.languages` line, NewlineIndex twice in one 04_infer list, and a doubled `import std.content_hash` line) carry identical counts on origin/main and are pre-existing, so they are reported rather than repaired here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Remove the merge debris my bootstrap restore resurrected Resolving the origin/main merge needed a self-consistent seed to build a regen binary with: taking main's side of the one conflicted generated file left v1_compiler_emit_rust.rs calling the derive functions without map_key_required while its unconflicted sibling required it, so the crate did not compile (8 x E0061). I restored the whole src/v1/stage0/src/ tree from the pre-merge head to bootstrap, and that restore also resurrected a file main had deleted and reverted a generated header main had corrected. src/v1/stage0/src/bin/frontier_probe_survey.rs — deleted again. main cut it in #8344 with the self-host frontier roster it surveyed; gunbc.ci_release_bins records that removal per-bin. It read compiler_frontier_sweep_order from the now-deleted frontier.dag, is unregistered in Cargo.toml, and carries no scaffold receipt. bootstrap_stage0_crate_layout_generated.rs — header restored to cite v2.compiler.self_host.stage0_crate_layout. v2.compiler.self_host.frontier is deleted; stage0_crate_layout.dag is the module carved out of it. Generated file, and nothing in this branch feeds its generator, so main's output is correct here; the file list was never affected, only the citation. Swept the class rather than the two cited sites: exactly one resurrected file and zero files missing versus main, and no other stage0 file cites the deleted authority. regen_stage0 --verify remains at regen_divergence_count=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: regenerate drifted generated artifacts (ci auto-heal) --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
… standing (#8166) * PRESS-0 step 2: bridge codex press rate-limit buckets into the standing limit axis gunbc.codex_app_server_press already decoded per-bucket rate limits, and gunbc.provider_standing already modelled the limit axis, and nothing joined them — so the probe bridge left limits Unobserved and a measured bucket produced the same verdict as an unmeasured one. account_standing_authenticated_rate_limits_readable_note specifies this consumer by name and carries its own dissolution: read evidence.rate_limit_buckets per limit_id, project each CodexRateLimitBucketVerdict onto ProviderNativeLimitBucket, never route through ProviderAccountLimit, and never use CodexPressAccountReady as the limit axis. That is what this does. Bucket scope is load-bearing rather than stylistic: the account classification gates on the codex bucket alone, so it reports Ready while a sibling is exhausted. The discriminating witness is the case the note names — one observation set with codex exhausted and codex_bengalfox available yields DIFFERENT verdicts under draws naming each bucket. An account-scoped projection cannot produce that and fails the witness. CapacityUnknown becomes LimitObservationUnobserved, never LimitObservedAvailable: could-not-decode read as nothing-is-wrong would admit a dispatch against a bucket nobody measured. An empty bucket list becomes one located Unobserved; limit_observations_are_selection_eligible already refuses empty, so this adds a reason rather than changing the verdict. NOT DONE, and it still blocks selection: the entitlement axis. No probe grounds ProviderEntitlementObservation for codex, and EntitlementObservationUnobserved is not selection-eligible, so codex remains ineligible on the six-axis conjunction even with limits now observed. The press note is explicit that account standing is not account-wide entitlement, so I have not fabricated one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Dissolve the dead belt_observe entry points and correct a stale roster note Both raised by review on #8132 as non-blocking follow-ups. belt_observe and belt_observe_for_instance are deleted. They observed the tmux session NAME set only, which is precisely why a retained dead pane read as a live agent; dispatch and tick both call belt_sessions_observe_for_instance now, so the pair had no production caller left. belt_observe_from_result SURVIVES deliberately and is now witness-only. Its subject is the tmux stdout parse — nonzero exit with no documented no-server marker, unparseable line, empty set — reached by eight witnesses. Deleting it with its caller would have deleted that evidence, and §4b is explicit that a climb dissolves the lower-rung production handling and never the discriminating evidence. Its dissolve-on is named on the carrier: re-point those parse witnesses at classify_tmux_session_list with the refusal cases preserved one-for-one. belt_dispatch_all_status_labels_note said an "8th variant" makes the label match non-exhaustive, which stopped being true at twelve. The mechanism it describes is unchanged, so the sentence now names a new variant rather than a count — a count in prose beside a live roster is the stale-citation class, and it rots without anyone touching it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the bucket subject on an undecoded limit, per review 51237 CONFIRMED, and the root is worse than the symptom. The bridge matched CodexBucketCapacityUnknown { limit_id: _ } — discarding a limit_id the producer already held — and mapped it to LimitObservationUnobserved, which limit_observation_blocks_dispatch answers `true` for against EVERY draw. So one bucket failing to decode refused a draw naming a measured, available sibling. This is a fail-CLOSED error, which is why the existing sibling witness did not catch it: the exhausted/available pair still discriminated because neither was unknown. Over-refusal reads as caution while it prices out capacity the observation proved was there. ProviderLimitObservation gains LimitSubjectUnobserved { subject, native_token, reason }, routed through limit_subject_covers_dispatch_draw like every other subject-bearing arm. It blocks a draw naming that bucket, and still blocks Unspecified and Automatic draws because those cover every native bucket — precision where the draw names a subject, fail-closed where it does not. It is distinct from LimitCapabilityGapUnobservable, which means the axis is unobservable on this surface at all and correctly never blocks. The zero-bucket case keeps the subject-less LimitObservationUnobserved: with no buckets there is no subject to carry and refusing every draw is right. Witnessed both directions — the sibling draw is admitted, and the undecoded bucket's own draw plus Unspecified and Automatic are all refused. limit_observation_blocks_dispatch was the only exhaustive match over the coproduct; the cursor standing match carries a catch-all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the native cause token on an exhausted bucket; name the dropped reset native_token carried limit_id, which the subject's native_key already carries — so the field restated the bucket and dropped the only thing it could have said. It now carries reached_type when the wire supplied one, falling back to limit_id because native_token is not optional and a bucket that reported exhaustion without a reached_type still has to name something actionable. resets_at is STILL DROPPED, and is now named on the carrier rather than discarded quietly. ProviderLimitObservation has no field to hold it — LimitUnavailableUntilReset is { subject, native_token, reason } — so "when does waiting become valid again" has nowhere to land. That is a model gap, not a projection choice, and serializing a timestamp into `reason` would put a machine fact in a prose field no consumer can read. Dissolve-on: LimitUnavailableUntilReset gains a typed reset instant. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Derive the limit credential from the press receipt, not from the caller Handback item 1 (review artifact 51237). provider_limit_observations_from_codex_press_evidence took the credential identity and the evidence as INDEPENDENT arguments, so a caller could take buckets observed under one CODEX_HOME and publish them as the standing of a different credential. The standing would be honestly decoded and attached to the wrong account — a forgery no arm refuses, because both arguments are individually valid. The receipt already carries the answer: CodexAccountPreflightSubject.credential is the exact ambient context the trip ran under. provider_limit_observations_from_codex_press_receipt derives the identity from it and gives the caller nowhere to supply one. CODEX_HOME is the identity because it IS the isolation mechanism (codex_state_root_isolation_note): two homes are two credential stores. codex_press_credential_identity takes the AmbientCodexCredentialContext rather than the whole subject — it depends on exactly what it needs, and that is also what makes it witnessable without a four-field fixture. Witnessed: two homes never collide, and the label is the home. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * JWKS: model the key set and the verification seam, which cannot yet verify The entitlement axis needs authenticated claims, and codex_auth's parse boundary is explicit that reading unverified claims is fine for showing which account a credential names and illegitimate for authorization. Selection eligibility is authorization. So the missing piece is signature verification, and this is its first half. Cited as three documents rather than one local vocabulary: RFC 7517 for the JWK and its members, RFC 7518 section 6.3.1 for the RSA parameters n and e, section 3.3 for RS256. They are independently versioned and independently extended. WHAT IT DELIBERATELY CANNOT DO. RSASSA-PKCS1-v1_5 is s^e mod n over a 2048-bit modulus plus a padding and digest check, and this corpus has no bignum, no modular exponentiation and no RSA primitive. That is a capability gap, not a modeling gap, and no amount of .dag closes it — it needs a realization handler bound to a host primitive, or bignum grounded in the substrate. So there is no fn here returning Bool for signature validity: such a function could only fabricate, and a `verified` that is always true because nothing checked it is the fabricated-plausible-output failure aimed at a security decision. jws_verification_unavailable is what every caller gets, naming the missing capability, counted rather than absorbed. n and e stay base64url strings for the same reason: decoding them needs the arithmetic the module does not have, so an Int carrier would claim a capability it lacks. Key selection is 0/1/many. RFC 7517 does not require kid uniqueness, so duplicates are a real wire state, and first-wins would decide which key authenticates a credential on list order. Absent and ambiguous stay distinct because refreshing the key set fixes one and not the other. An unmodeled key type decodes without material rather than failing the set — the key we need may be beside it. Recorded for whoever binds the handler: it must check the JWS header alg against what the key permits rather than trusting the header, because substituting none or an HMAC alg against an RSA public key is the standard JWS confusion attack. Dissolve-on: a bound handler with an executed positive control and a discriminating negative control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * JWS: refuse the algorithm-confusion attacks, which need no bignum The header does not get to choose the algorithm. Both historical JWS confusion attacks work because the verifier read `alg` out of the token and did what the token asked: `none` strips the signature entirely, and HS256 against an RSA verifier signs with the PUBLIC key as an HMAC secret — public being the point. The defense is not a stronger primitive, it is deciding agreement from the KEY and only ever checking the header's claim against it. That is structure, not arithmetic, so it lands now rather than waiting for the exponentiation. Witnessed as attacks: an unsigned token refused against every key type, and HS256 against an RSA key as a mismatch. SCOPED DOWN MID-WRITE, and the reason is recorded on the carrier. I first modelled the compact split and header decode too, then found that string_split, drop, code_point_string and uint8_int do not exist — I had written four fabricated primitives, the same class as two earlier slips this session. The corpus consumes text by positional char folds (extdeps.auth.jwt jwt_first_colon_from is the idiom), so the split needs that fold written properly, and writing it badly means a verifier reading the wrong bytes. So the split, the segment-count check that refuses an unsecured JWS and a JWE, and the signing input are deferred with their dissolve-on named, rather than shipped as plausible code over primitives that do not exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Partition tick sessions by the coproduct, not a parallel string vocabulary Review artifact 51309 called this a follow-up modeling cleanup rather than a correctness gap, and that is right, but it is the nicknaming class so it is worth closing. belt_tick_session_is(s, arm: "running") compared string arms — a second naming scheme for BeltSessionLiveness, which already names exactly those states. The string version is strictly worse than the coproduct: a typo in an arm name compiles and silently empties a bucket, where a missing coproduct arm is a non-exhaustive match the compiler catches. belt_tick_session_class now returns BeltSessionLiveness and the four predicates match its arms. Node-awareness stays at this layer rather than moving into belt_session_liveness_from_process, because multiplicity is a fact about a node's ROWS while that function sees one row's process — the same split belt_node_session_liveness makes on the dispatch path. Landed on the stacked PR rather than #8132, which has three approvals sitting on a head whose CI run is finally in progress; restarting it for a cleanup the reviewer explicitly called non-blocking would trade a verified merge candidate for a tidier one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * JWS: land the compact split, so the segment count is checked The deferred half of the JWS structure. RFC 7515 section 7.1 is exactly three base64url segments joined by two periods, and the COUNT is a security fact rather than a parsing detail: two segments with an empty third is the unsecured JWS of section 6, five is a JWE. Verifiers that split on periods and read position two have accepted both as signed tokens, so each wrong count refuses by its own name. The signing input is carried on the split rather than rebuilt later, because RFC 7515 section 5.2 step 8 covers the ENCODED segments joined by a period, and reconstructing that from decoded parts is where a re-encoding difference silently produces different bytes than the ones the signature covers. THE SEGMENTER IS LOCAL AND THAT IS A COMPROMISE, stated on the carrier rather than hidden. Splitting on a separator is not a JWS concept and belongs in std, but no general split, index-of or substring exists in this corpus, and minting a std primitive is not a decision to take inside a JWS module. jws_segments is scoped and named for its subject. Dissolve-on: a general std separator fold lands and this becomes a call to it; a second consumer needing the same scan first is the signal to promote rather than copy. This closes the fabricated-primitive gap from the earlier commit — the scan is written against char_at / code_point / string_length, the idiom extdeps.auth.jwt already uses, rather than the string_split and drop I had invented. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Remove JWS/JWKS from the critical path; delete the rebindable evidence entry TWO CORRECTIONS, THE FIRST OF WHICH IS MINE TO OWN. JWT/JWKS IS NOT THE ENTITLEMENT JOIN. I built a signature-verification lane on the premise that entitlement required authenticated id_token claims, citing codex_auth's parse boundary. That note is correct and governs the auth.json id_token — a different surface. The app-server account/read response already carries the account realm, and the proof was a captured wire specimen in this repository's own test tree: {"result":{"account":{"type":"chatgpt","planType":"pro",...}}} That is the admitted Codex process answering an authenticated control request, not gunbc decoding an untrusted bearer token, so the prohibition never applied. I grepped for entitlement producers and for planType in the extdeps models; I did not read the response fixture, which settles it in one line. The lane is preserved on branch jwks-security-substrate rather than deleted — it is cited and correct as far as it goes — but it has no production consumer, cannot authenticate any constructible value, and brings this branch no closer to a provider turn. Keeping it here would make entitlement depend on a capability that does not exist. THE CREDENTIAL FIX WAS INCOMPLETE. Adding the receipt-taking entry point did not remove the forgery: provider_limit_observations_from_codex_press_evidence still took credential and evidence as independent arguments, so evidence observed under one CODEX_HOME could still be published as another account's standing. A safe path added beside an unsafe path leaves the unsafe path. Deleted — the only production entry consumes the complete receipt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the stale CapacityUnknown arm assertion left behind by the mixed-decode repair witness_capacity_unknown_is_not_capacity asserted LimitObservationUnobserved, the subject-less arm the bridge returned BEFORE review 51237. That repair moved CapacityUnknown onto LimitSubjectUnobserved so an undecoded bucket refuses its own draw without refusing a measured sibling; the witness was not re-read after the producer changed, so it reported the repair as a regression. The assertion is now stronger than a swapped label: it matches the subject and pins native_key, which is the fact the repair added and the whole reason the subject-carrying arm exists. The CI red is the discriminating receipt — the old arm fails against the current producer, the new one passes. Also merges main (#8182, #8180, #8164). * Decode the Codex account union and project entitlement from what it reports account/read's `account` member was decoded to "the object was nonempty" and stopped there, so an apiKey platform credential, an amazonBedrock contract and a personal ChatGPT subscription all reached the same Ready. Those are three different credential realizations, and a profile requiring personal ChatGPT OAuth is satisfied by exactly one of them. Grounded in the upstream schema rather than in our captured fixture: read from `codex app-server generate-json-schema --out` against @openai/codex 0.147.0, v2/GetAccountResponse.json. Two facts from it changed the design: Account is a CLOSED oneOf discriminated on `type` — apiKey | chatgpt | amazonBedrock — so the realm is an enumerable decode, not an open string. PlanType is a CLOSED 15-value enum whose members INCLUDE `unknown`. I was about to treat any nonempty planType as entitling, which would have read upstream's own I-do-not-know as a yes. It decodes cleanly and entitles nothing. The two negatives stay distinct because their remedies differ. A Bedrock account is REJECTED — read successfully, wrong realization, permanent until the credential changes. A plan or type outside the cited enum is UNOBSERVED — our pin is stale, repaired by editing a roster. Both refuse dispatch today, which is exactly why a witness asserting only "not available" would pass while the model conflated them. Entitlement policy lives at the bridge, not in the decoder: the press says what upstream reported, gunbc.codex_plan_is_entitling says which plans we draw on. OpenAI publishes no machine-readable plan→entitlement map, so the roster is a declared policy budget with `free` and `unknown` excluded by name, not a fabricated citation. Six witnesses, green by execution; mutating the roster's CodexPlanUnknown arm reds witness_upstream_unknown_plan_is_not_a_yes and leaves its sibling green. Downstream consumers re-run at full roster count: press 22/22, bridge 21/21, dispatch_selection 19/19, roadmap_dispatch_actuator 36/36. * Give the exhausted-bucket arm a typed cause and a typed reset LimitUnavailableUntilReset carried a required native_token and no reset, which produced two defects from one shape: The cause was `match reached_type { Present{t} => t Absent => limit_id }`. A bucket that reported exhaustion without naming a cause got the bucket's own id in the cause slot, so a reader could not tell an upstream-reported rate_limit_reached from our substitution. The substitution was not chosen — it was the only expression that typechecked, because a required field whose producer lacks a value MANUFACTURES a fallback. resets_at decoded off the wire and was dropped, so an arm named UntilReset could not say until when. Now ProviderNativeLimitCause (Reported{token} | Unreported) and ProviderLimitReset (ResetAt{at} | ResetInstantUnobserved). Both absent arms are reachable: rateLimitReachedType and resetsAt are optional upstream. An unobserved reset is not an immediate one — zero is the BEST possible reset and therefore the worst available default. THE WITNESS WAS PINNING THE DEFECT. witness_codex_bucket_projects_to_native_ bucket_never_account_scope asserted `t == "codex"` against a fixture declaring reached_type: none — so the value it held in place was the fallback itself. It now asserts NativeCauseUnreported, and a second fixture carrying both a cause and a reset proves the two project differently. Scope, declared: LimitWarning/Rejected/Exhausted/RateLimited keep bare tokens. They have one producer between them and no observed case of a missing token, so converting them would add an unreachable state. Trigger recorded on the arm. The superseded note is replaced rather than left beside the fix — it had named this exact change as its dissolve-on. Full-roster reruns: bridge 23/23, provider_standing 17/17, standing_selection 7/7, dispatch_selection 19/19, roadmap_dispatch_actuator 36/36, press 22/22. * Make the account-realm matches exhaustive instead of rostering new residue The non-fold residue ratchet found one unrostered site (stale count zero): my realm decoder matched JsonNull and JsonObject and swept the rest into `_`, and realm_from_account_read_frame did the same over the JsonMember arms. Rostering it was the wrong repair. A roster row carries a reason AND a dissolution trigger, so it is a net-new active dissolution obligation, and DESIGN §5 is explicit that a trigger is a lifecycle fact rather than permission — absent an operator verdict on this exact population, marked debt is refused exactly like unmarked debt. The obligation also would not have been true: there was nothing to dissolve to, because the exhaustive form was available now. Both matches now name every variant. JsonValue's four non-object non-null arms route through one named function rather than four copies of the same record, so exhaustiveness costs nothing in duplication. Verified: unrostered and stale counts both 0, the ratchet witness passes, and its two RED controls still hold. Bridge 23/23, press 22/22. * Cite the account schema from the pinned runtime, and narrow the entitling roster Two P0 corrections from analyst review, both real and both mine. P0-1 — the branch modeled a protocol no executable implements. I read the account schema from the codex that happened to be installed on this build host, 0.147.0, while every other fact in the module and the materialized bundle the turn executes are pinned at 0.146.0. I noticed the version gap while working and declared the new number in my notes instead of resolving the mixture. Measured against both executables rather than assumed: the Account union is structurally identical, but PlanType is 13 values at 0.146.0 and 15 at 0.147.0 — self_serve_business_prolite and enterprise_cbp_automation do not exist for the pinned runtime. So the model named two plans our executable cannot emit. The identical union is exactly why it was easy to miss: the part that changed was the part nobody diffed. Restated to 0.146.0, the version the runtime receipt admits. The two later strings now decode as CodexPlanTypeUnrecognized — a stale pin, which is the honest reading — and a witness asserts that rather than the note claiming it. The rule is not which version wins: a protocol fact comes from the exact executable the runtime admits, and a bump moves manifest, lock, artifacts, receipt and every fact together. P0-2 — the roster was a broad allow path from a locally authored assumption. It admitted every plan but free and unknown, in a note that simultaneously said no upstream plan-to-entitlement mapping exists. Narrowed to the single plan actually observed on the deployed credential, behind an explicit CodexPersonalSubscriptionPolicy so the set is unmistakably authored policy. A non-admitted plan reads UNOBSERVED, not REJECTED, on the same remedy line the module already draws: ratifying a plan is our-side like a stale pin, while an apiKey or Bedrock account is repaired only by changing the credential. Every previous assertion here was about a REFUSAL, which is why no witness noticed the widening. witness_deployed_profile_admits_exactly_the_observed_plan pins the admitted set at exactly one member, so a future admission reds first. Bridge 26/26, press 22/22, provider_standing 17/17, standing_selection 7/7, dispatch_selection 19/19, roadmap_dispatch_actuator 36/36, residue ratchet green with both RED controls holding. * PRESS-0 step 2: credential liveness split and HeldLease supervised turn Split account/read realm from rate-limit liveness: authentication derives from CodexCredentialLive (buckets returned) via the press receipt bridge, not from account/read alone — the continuity-receipt trap where chatgpt/pro coexists with a dead token. Model supervised execution on std.temporal_effect HeldLease in gunbc.codex_supervised_turn: turn/start admission refuses idle threads without a runner-written terminal receipt, and witnesses pin the trap. Wet srv1 shell-typed-invocation turn remains open on this vertical. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix parse error in codex_supervised_turn witness test. Leading == on a continuation line is invalid syntax; bind the policy comparison via let so the file parses and corpus discovery can run. Co-authored-by: Cursor <cursoragent@cursor.com> * Pin unobserved credential liveness in witness; mutation-checked traps. Extend witness_credential_liveness_splits_from_realm to assert CodexCredentialLivenessUnobserved maps to AuthenticationStandingUnobserved, not AuthenticationAuthenticated. Mutation checks confirm both traps red: idle-thread admission and unobserved-liveness authentication. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix compile-clean: remove unattached // prose from witness file. Standalone leading comment blocks lacked module-item subjects and failed dag_compile_clean_gate (64 annotation refusals). Rationale already lives in typed data witness_note rows per DESIGN 4c. Co-authored-by: Cursor <cursoragent@cursor.com> * Revert "Merge annotation-grain fix from #8215 to clear inherited compile-clean red." This reverts commit 50e02c3, reversing changes made to 1c97fc0. * Add supervised Codex turn runner for bounded wet execution. Implements run_codex_supervised_turn with HeldLease fencing, bundled-native app-server script (thread/start then turn/start), stdout parse, and runner-written terminal receipt with client_command_id; cites srv1 execution receipt for supervised-lease selection over detached reconciliation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix non-fold residue in serialize_supervised_rpc_error. Replace JsonValue wildcard arm with exhaustive match over all six variants so non_fold_residue_no_unrostered_or_stale passes without a roster row. Co-authored-by: Cursor <cursoragent@cursor.com> * Add wet supervised-turn witness and srv1 handoff entry. Runner was already realized; this wires a falsifier-rehomed wet witness that materializes the bundled native, preflights via rateLimits, runs run_codex_supervised_turn, and asserts terminal receipt + client_command_id without belt dispatch. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix wet supervised-turn witness parse errors. Match-arm bodies need braces; split client_command_id check into let bindings so multi-line == does not follow && inside a match arm. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix wet witness parse: trailing == on continuation lines. Parser rejects continuation lines that START with == but accepts || (measured on main binary). Move == to end of prior line in wet_supervised_turn_terminal_ok; record defect in std.language_target_identity continuation_eq_operator_shape_note with hermetic witness repro controls. Co-authored-by: Cursor <cursoragent@cursor.com> * Record srv1 wet OOM receipt and add bisect witnesses. Full supervised wet witness killed at ~89 GiB with no child processes; move file to OfflineLocalRecipe, remove falsifier roster row, add bisect fns with declared MemoryMax envelopes for operator-bounded srv1 runs. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix wet bisect witness: bind registry_artifacts in match arm. Pattern used registry_artifacts: _ then referenced the name in the body, which fails compile before bisect step 1 can run. Co-authored-by: Cursor <cursoragent@cursor.com> * Isolate materialize leak: prepare split + lookup fold fix. Bisect confirmed leak in package_delivery.materialize_codex_runtime_bundle on main. Split prepare_codex_runtime_closure for narrower wet bisect; eliminate filter allocation in package_lock_lookup_node; record production defect note. No wet re-run until capped confirmation. Co-authored-by: Cursor <cursoragent@cursor.com> * Add wet bisect step 2b: select_codex_exact_target_closure only. Isolates closure selection and codex_wrapper_lookup / codex_target_package_lookup from materialize shell path for capped srv1 run at MemoryMax=2G. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop wet bisect from witness enrollment until materialize is fixed. Convert bisect entrypoints from test fn to plain fn so Phase 0(b) admission does not count five UnclassifiedPathDeferral rows with zero consumers. Remove OfflineLocalRecipe exclusion row; file stays as operator-only reproduction via gunbc run. Co-authored-by: Cursor <cursoragent@cursor.com> * Add wet bisect step 2c: wrapper tarball acquire only. Isolates acquire_and_admit_registry_artifact for the wrapper after closure prepare — DownloadToFile plus sha512 verify, no platform pair or npm path. Co-authored-by: Cursor <cursoragent@cursor.com> * Add pre-shell materialize bisect entries after instrumented trace. Split source construct, prepare, and through_prepare from full materialize body eval; remove pre-mktemp from materialize wet witness so bisect has zero shell before materialize. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix wet bisect parse: data decl value must be same line as '='. Continuation-operator fix (#8259) does not cover declaration '=' breaks; corpus has zero split-line data rows. Co-authored-by: Cursor <cursoragent@cursor.com> * Add wet bisect rung: platform artifact acquire only. Ladder through through-prepare passes at 72f6ead; full materialize pins 8G — next isolate native platform tarball acquire. Co-authored-by: Cursor <cursoragent@cursor.com> * Add final materialize bisect seams: pair, npm ci, finish. Extract codex_runtime_install_from_prepared for install-through-verify; add through_pair_acquire, through_npm_ci_offline, and finish_after_install bisect entrypoints. Co-authored-by: Cursor <cursoragent@cursor.com> * Add finish-stage observe bisect rungs for materialize leak (#8166). One wet entrypoint per observe inside finish_codex_runtime_materialization_after_install plus a two-file tiny-tree fixture for observe_package_materialized_tree isolation. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove duplicate npm import after main merge. Co-authored-by: Cursor <cursoragent@cursor.com> * Add single-file protocol schema interpreter bisect rung. wet_finish_parse_canonicalize_largest_protocol_schema_only installs Codex, generates the schema dir, then parse_json + canonicalize_json_value on only codex_app_server_protocol.schemas.json — no fold, manifest, serialize, or sha512. Co-authored-by: Cursor <cursoragent@cursor.com> * Restore package_delivery.dag after rebase conflict resolution. Auto-resolving rebase conflicts with main dropped PR materialize/bisect changes; restore the full #8166 package_delivery surface from pre-rebase tip. Co-authored-by: Cursor <cursoragent@cursor.com> * Take main's rack_power.dag to fix annotation grain CI red. Branch revert 45f81ae re-introduced body-grain // comments that main had already hoisted to module-item grain above PowerRefusal and rack_power_budget. Co-authored-by: Cursor <cursoragent@cursor.com> * Take main's spatial_projection and planar_projection annotation fixes. Complete the 45f81ae revert undo: hoist // comments to module-item grain in the two remaining files that rack_power fix alone did not cover. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop false continuation_eq note; update accounting note for #8259. #8259 dissolved operator-leading continuation asymmetry for == and +. Remove the PR-only continuation_eq_operator_shape_note, restore main's continuation witness at src/v1/tests/claim/, and rewrite accounting_arithmetic_shape_note as a receipt rather than stale parser advice. Co-authored-by: Cursor <cursoragent@cursor.com> * Add parse-only rung for protocol schema JSON memory split. (#8272) Confirmed on srv1 under MemoryMax=8G: parse-only and parse+canonicalize both pin 8 GiB on codex_app_server_protocol.schemas.json (506,984 bytes, ~16,500x input). Defect is parse_json / JsonValue construction. Rebased onto press-0-step2 (8990f2a). Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * Address supervised-turn correctness floor for #8166. Keep stdin open through turn terminal, supervise process groups, persist client_command_id before turn/start, refresh in-session standing, and use generation-scoped lease binding; witnesses cover exit-0-not-observed. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix supervised turn JSON escaping and remove Python thread-id fork (#8166). Route turn/start through codex_app_server_turn_start_request_line (serialize_json), delete the embedded Python extractor, add typed supervised_thread_id_from_line for post-hoc decode, and mark the concat-built fifo coprocess as declared scaffold with dissolution toward host_effect_apply Phase 2. Co-authored-by: Cursor <cursoragent@cursor.com> * Document thread-id sed substitution assumption for supervised turn (#8166). Record that in-shell sed into the turn/start JSON line is interim and charset-unbound until protocol schema or typed transport lands. Co-authored-by: Cursor <cursoragent@cursor.com> * Delete supervised turn bash coprocess; wire typed host_effect transport (#8166). Operator RejectAndFinishNow: remove codex_supervised_turn_script (36 concat), retained_transport, and sed thread-id substitution. Add extdeps.llm.codex_app_server_stdio_session intent, CodexSupervisedWorkerTurn host effect, and gunbc.codex_supervised_turn_run routing through host_effect_apply; realize refuses until native session driver lands. Co-authored-by: Cursor <cursoragent@cursor.com> * Land Codex app-server stdio session driver for supervised turns (#8166). Native coprocess driver (pipe stdin, setsid, poll-to-terminal, process-group kill) ships as target/release/codex_app_server_stdio_session and is invoked through gunbc.host_effect_codex_supervised_turn via host_effect_apply CodexSupervisedWorkerTurn. turn/start uses JSON parse+re-serialize (no sed). ShellEffectApplied carries stderr for capture wiring. Co-authored-by: Cursor <cursoragent@cursor.com> * Register codex_app_server_stdio_session in self-host frontier for regen. Seed-retained intrinsic registration drives stage0_crate_layout_generated and emitted gunbc_stage0_crate_layout_generated so lib.rs and fresh self-compile agree on pub mod codex_app_server_stdio_session. Includes workflow regen drift from generated_artifact_gate main_wet. Co-authored-by: Cursor <cursoragent@cursor.com> * Enroll codex_app_server_stdio_session in extdeps scope frontier. Declare ExternalModelScope for the Codex app-server stdio session transport (citing github.com/openai/codex) and add the module to scope_carrier_paths so extdeps_scope_placement_gate admits the new extdeps file. Co-authored-by: Cursor <cursoragent@cursor.com> * Add CodexSupervisedWorkerTurn arm to converge_cli_applied_knob_count. Fleet converge CLI does not count supervised worker turns as applied knobs; return fallback like neighboring non-ConvergePlan HostEffect variants. Co-authored-by: Cursor <cursoragent@cursor.com> * Fail closed when Codex session preamble file cannot be read. Return exit 1 before spawning the coprocess instead of substituting an empty preamble (review 52819 / composer-2.5 REQUEST_CHANGES). Co-authored-by: Cursor <cursoragent@cursor.com> * Refuse invalid thread/turn-start-id argv instead of silent defaults. When --thread-start-id or --turn-start-id is present, a missing value or non-integer parse fails with exit 2 before spawn — same idiom as other required argv and the preamble read fix (review 52819 second instance). Omitted flags still default to 4 and 5. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix generation-store conflation for supervised turn exactly-once fence. Replace Int? collapse with CodexSupervisedGenerationRead coproduct, route store failures through codex_supervised_turn_generation_admission into turn-start refusals, and refuse when generation fence write fails. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix stdio session driver RPC id matching to exact JSON parse. Replace substring "id":{rpc_id} pre-filter with parsed id comparison so id 41 cannot satisfy rpc_id 4; aligns seed driver with codex_supervised_turn.dag exact-id matching. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove frontier_probe_survey from release bin pack after roster deletion. Main deleted the bin with the self-host frontier roster; merge incorrectly re-enlisted it. Regenerate CI workflows via main_wet. Co-authored-by: Cursor <cursoragent@cursor.com> * Regen compiler_tests.rs after #8344 frontier roster deletion. Fresh seed rebuild + regen_stage0 --verify (divergence 0); removes stale Witness coercion/is_copy assertions dropped when frontier probe witnesses were deleted on main. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>
* Record a hypothesis three lanes killed, so the next session re-reads it instead of re-running it While root-causing a Root D residue, keen-ibex-435 found the emit authority rendering types with empty_emit_graph_info() and classified all 14 production sites (2 context-free, 7 latent, 5 plumbing). I then proposed the natural next step: that this is the shared upstream beneath Roots B2 and R1, since both are "the decision disagrees between declaration and call site" and that is what a missing env looks like from downstream. It is false. lively-ibex-709 killed it twice -- population disjointness (zero of 112 B1 E0369 sites are in the operation/capability emit paths; all seven files are std_*) and then signature absence (0/112 carry a placeholder or unresolved type var; all name concrete carriers). bold-lark-722 killed it for the wrap axis by mechanism: shared_types arrives as its own positional argument carrying the real set, so wrap membership is not degraded at those sites; what an empty info zeroes is generic-scope rendering and applied-binding resolution, a different diagnostic class. The hypothesis cost three lanes an hour and produced nothing citable, so without a record the next session regenerates it -- it is the obvious reading of the evidence and it will occur to whoever reads the same two root descriptions. That regeneration is the redundant future work DESIGN section 2 prices, and a negative result is the cheapest thing in this program to lose and the most expensive to rediscover. Two details are preserved deliberately rather than compressed away: that the five plumbing sites had a discriminating case ATTEMPTED per site and not found (which is what licenses leaving them alone -- "no case found" and "nobody looked" are indistinguishable a month out), and that bold-lark's mechanism read is structural rather than executed, which its own author refused to upgrade to proof. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * chore: regenerate drifted generated artifacts (ci auto-heal) * I repointed a dead citation to another dead citation, twice, in the sweep meant to fix dead citations review 52919 caught it. The F5 row and the rust end-state row in gunbc.plans.language_target_self_host_frontier cite emitter_produced_baseline as the surviving count authority after the roster cut. That symbol does not exist. Verified: it appears three times in the tree and all three are prose -- two notes in interpreter_replacement_cut and stage0_crate_layout, and my own two cells. seed_emitter_behavioral_green_count and its baseline appear exactly once each, in the same cell I wrote. Neither has a declaration anywhere. So the repoint in #8344 replaced a citation to a deleted symbol with a citation to a symbol that was never declared, which is worse than what it fixed: the old one at least named something that had existed and would fail a grep against history. This is the class I have been quoting at other lanes all night, committed by me, in the diff whose entire purpose was clearing it. The root is that I searched for the FORM of the old citation rather than resolving the NEW one. A repoint is two obligations, not one -- remove the dead name, and prove the replacement resolves -- and I performed only the first. DESIGN section 3 says a stale name is decidable and grep-checkable, which is exactly why there is no excuse for it. Fixed by stating the bar qualitatively where no symbol survives to carry it, rather than by finding a third name to point at. After the roster cut nothing counts producer-qualified emissions, and the honest sentence is that no module carries a producer-qualified promotion -- not a fabricated tally. Where a real symbol does carry the fact, the cells now name it: EmitterProducer x EmissionQualification, mint_producer_emission_receipt as the only route to a receipt, the realized-closure wall seed_emit_rust_reachable, and BehavioralProbeUnbound as the honest standing for a receipt that has produced source and nothing more. The rust end-state cell also still read "SeedRetained roster", which contradicted the roster deletion this same PR documents. It now says there is no denominator and declines to invent one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Sync the projection to the carrier I already fixed, derived from the carrier rather than retyped review 52930 is correct and the finding is the drift itself: 694e10e fixed gunbc.plans.language_target_self_host_frontier and CI auto-heal had already regenerated the .md against the PREVIOUS head, so the carrier said one thing and its projection said another. The PR therefore still showed F5 and the rust end-state row citing emitter_produced_baseline -- reintroducing, in the generated artifact, exactly the defect the commit message described fixing in the source. The projection is regenerated FROM the carrier, not retyped to match it: the two cell texts are parsed out of the .dag rows, unescaped, and substituted into the corresponding table cells, so the .md carries the carrier's bytes rather than my second rendering of the same sentence. Retyping is how a projection acquires an independent voice, which is the dual authority the generated-artifact discipline exists to prevent -- and it would have been undetectable here, since nobody diffs prose for meaning. Verified both directions: zero occurrences of emitter_produced_baseline or seed_emitter_behavioral_green* remain in either file, the surviving symbols the cells now name (seed_emit_rust_reachable, BehavioralProbeUnbound) are present in the projection, and the file line count is unchanged at 85 so no row was structurally disturbed. If CI auto-heal regenerates on this head it should be a no-op; a heal commit that CHANGES these two cells would mean my substitution does not match the real generator, which is worth knowing and is why the file count and cell-presence controls are recorded here rather than assumed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5 * Retract the ungrounded 112: state the two findings as universals, flag the denominator unreconciled The killed-hypothesis section asserted "zero of the 112 B1 E0369 sites" and "0/112 show a placeholder", carrying a bare literal copied from another session's run with no command, no scope, and no reconciliation. This document's own section 18 mechanism table puts E0369 at 191, explicitly undetermined and unclassified, and the only other 112 in the document is source_authority's E0599 count. A reader joining the two sections gets 191 against 112 with nothing to reconcile them, in a document whose closing paragraph advertises that every claim in it names its measurement. That is the DESIGN section 5 oracle rule violated in prose: a measurement copied from another tree is not an oracle for this one. Both findings are universals over whatever set was examined -- a wrong count cannot turn a "none" into a "some" -- so they are restated without the denominator and the denominator is carried as unverified with the 191 discrepancy named. Also disambiguates the coincident 7: the std_* file set and the seven-site latent set are different quantities sharing no member. Found by an independent read, not by the two approvals this PR already carries. * The 112/191 reconciliation landed in #8371: cite section 18.4 instead of declaring it owed My retraction correctly refused to invent a reconciliation and recorded one as owed. It landed while this PR was open. Section 18.4 states both scopes: 112 is the distinct-site count of the July 7-module measured bank, 191 is the same classification at M=11 scope, both repr_fork with zero missing_trait_impl. Two scopes of one population, not a discrepancy. Leaving the "owed" clause would advertise an open obligation that is closed, which is the stale-citation class this PR exists to remove -- the same failure one turn later. Also makes the coincident sevens precise now that the bank is named: the seven std_* files are the July bank's module set, a different quantity from the seven latent empty_emit_graph_info() sites, sharing no member. --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>