Skip to content

Delete the 27-row self-host frontier roster and the machinery that only served it - #8344

Merged
briansrls merged 17 commits into
mainfrom
session/smart-ram-730-frontier-cut
Aug 17, 2026
Merged

briansrls merged 17 commits into
mainfrom
session/smart-ram-730-frontier-cut

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

gunbc-ci-auto-heal and others added 7 commits August 16, 2026 23:28
…ly served it

Operator ruling: the frontier roster is either derived from live state or it
does not exist. It was neither -- 27 hand-authored rows whose measurement
fields were ordinary parameters, so a row that claimed execution measurement
was indistinguishable from one that asserted it. It attracted readers, it
misrouted them, and it produced nothing. This deletes it at the root rather
than pruning it row by row.

WHAT THE DELETION PROVED, which is the part worth reading. Every consumer that
looked load-bearing turned out to consume an empty projection:

  crate layout        appended compiler_frontier_emitter_produced_stage0_mod_basenames(),
                      a fold admitting only EmitterProduced rows. All 27 were
                      SeedRetained, so the term was [] at every call and no
                      emitted byte changes.
  wet enrollment      appended a roster fold whose own gate,
                      falsifier_self_host_wet_template_only_holds, asserted that
                      term had length zero.
  crate partition     named the roster as a dissolution target for module
                      exports the roster could not have supplied -- rows carried
                      a path and a disposition and nothing else.

So the roster's real dependents were its own census tests. Those, the promotion
and authorization machinery, and the per-module probe survey go with it.

WHAT SURVIVES AND WHERE IT WENT. Crate layout is a separate concept that was
squatting in the frontier module; it moves to v2.compiler.self_host.stage0_crate_layout
with the registration rows and projections that actually produced bytes. The
producer/qualification vocabulary in emitter_producer_provenance survives at
half its size -- the EmitterProducer x EmissionQualification axes, the realized
closure carriers, the receipt and its single mint -- because its live consumers
(candidate_generation, the direct rust door contract, the production
qualification lens) never read a roster row.

EVIDENCE, PER DESIGN 4b. Deleted witnesses fall in two classes and both are
stated in the carriers rather than here. Green-by-construction: seven crate
layout witnesses guarded by a disposition match whose EmitterProduced arm was
unreachable, or comparing zero to zero. Subject-retired: the authorization
forgery controls proved an unauthorized EmitterProduced disposition was
unwritable, and that disposition no longer has a representation to forge.

Two claims survived and keep their controls: a V2Emitter receipt cannot be
minted with the seed emitter in its realized closure, and the generated crate
layout artifact must match its registration rows.

ONE CLAIM IS GENUINELY RETIRED RATHER THAN CLIMBED, said plainly.
transition_parity_host_index_agrees_with_hand_rows redded when the derived
module index and the hand-authored qualified-module rows disagreed. Deleting
one side of a duality retires the parity claim; it does not discharge it. The
surviving authority is the path-module binding index, and the crate-partition
dissolve target now points there instead of at the roster.

The frontier_probe_survey bin is removed with its .dag surface and transport.
Justified per bin, not by a class sentence, because an earlier change deleted
four bins on one blanket justification and was reverted for exactly that --
see the second-removal paragraph in gunbc.ci_release_bins.

NOT DONE HERE, named rather than left to be found: the frontier_probe subsystem
(frontier_probe, frontier_probe_types, assemble_detail and their tests) still
stands. It is the adjacent weed -- its subject was per-module roster
measurement -- but it has independent test consumers and deserves its own cut.
The plan carriers written in the roster's vocabulary (wave2_prep_design,
v2_self_hosting) are quarry now, not authority, and are not rewritten here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
The build failed in 39s because deleting src/bin/frontier_probe_survey.rs left
two references to it standing: build.rs still declared a rerun-if-changed on
the file, and .github/workflows/ci.yml still passed --bin frontier_probe_survey
to the release build and then asserted the resulting artifact existed at four
verify sites and one tar site.

ci.yml is a generated artifact and the honest way to update it is to regenerate
it from gunbc.ci_release_bins, which is where the pack row was already removed.
`gunbc ci` cannot run in this container -- the shim panics reading
ci_layer_roots.dag out of a temp workspace -- so the eight occurrences are
removed by hand and the drift gate is the check: it compares ci.yml against
`gunbc ci` output byte for byte, so if this hand edit is not exactly what the
generator produces, CI says so. That is the intended instrument for this rather
than a local claim I cannot make.

Stated because it is the kind of thing worth noticing rather than routing
around: a hand-edited generated artifact is only acceptable here because a
byte-exact gate independently checks it in the same run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… .dag string

The retained-kernel test gate failed with four panics, all the same:
for_each_parsed_module_binding could not parse dag/gunbc/ci_release_bins.dag.
The per-bin justification I added there quoted the earlier blanket sentence
verbatim -- not "a probe bin whose subject was cli_run" -- inside a
double-quoted string, which terminated the string mid-prose and left the
remainder as garbage tokens.

Worth noticing rather than just fixing. The failure surfaced four modules away
from its cause, in a materialization-provider test whose subject is disk cache
probes, because the whole-corpus module-path index parses every .dag file
before anything else runs. So a prose edit in a bin roster reds a cache test,
and the panic names the parse site rather than the reader. That is the same
ordering property this program spent the afternoon on: what breaks first is
not what is wrong, it is what runs first.

The sentence now paraphrases instead of quoting. Checked the other nine
multi-paragraph notes this change adds: each opens and closes exactly once,
with the odd per-line quote counts expected of a string spanning blank lines.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
…ration

The frontier cut deleted the frontier_probe_survey bin and its row in the
release pack, and I removed its eight occurrences from ci.yml by hand.
fleet-converge.yml and falsifier.yml build the same pack from the same
authority and still named it, so heal regenerated them and could not push
workflow paths itself. These are its bytes, not mine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… not program data

DESIGN 4c, enforced by prose_row_introduction_gate: this path's prose is
already migrated, so a new data NAME_note: String row is refused. The note
explains what the frontier cut removed from this module and what survived,
which is exactly irreducible rationale about a construction's shape --
it belongs above the declaration it explains, not in a String the compiler
must carry. Six sibling rows on out-of-scope paths were reported and not
enforced; left as they are rather than widening the diff past the refusal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
…removed

The floor refused with StaleFrozenPathDeferral: two gunbc.witness_deferral_freeze
rows named test decls the entry no longer declares. A freeze row left behind is
not inert -- it becomes a standing exemption the next witness to take that name
inherits, which is the refusal's own wording and the reason it is loud.

Same two names were still enrolled as ClaimRun rows in the supply transport, and
its note explained why one of them was there. Removed both and rewrote the note
to say what happened to their subjects: the parity witness had the duality
between the derived index and the hand rows as its subject, and the cut removed
one side, so the claim is retired rather than dropped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… pool coincidence

emitter_producer_provenance_witness_test imported
schedule_witness_entries_structurally_equal from wet_receipt_enrollment, which
neither defines it nor imports it. It is defined in
seed_emitter_behavioral_wet_known_red_entries, a module this file already
imports. The reference resolved on main only because some other member of the
assembled closure had dragged the definer into the pool; the cut changed the
closure and it stopped resolving, refusing the whole discovery corpus.

This is the Class B accidental-coverage shape DESIGN records as an open thread —
a bare cross-module reference binding by pool membership rather than by the
importing file's own closure. Importing from the definer is the fix that does
not depend on who else is in the pool.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot
gunbai-bot Bot marked this pull request as ready for review August 17, 2026 06:01
The cut deleted the two HandAuthoredDocBind rows for the frontier probe
receipts but left the documents in the tree, so three files lost their only
inbound reachability and became orphans. Deleting the bind rows was correct
— every declaration they cite (frontier_probe_exact_head_closeout_note,
frontier_probe_run_interruption_note, frontier_roster_provenance_constructor_inflation_note,
compiler_frontier_receipt_totality_wall_holds) is deleted by this PR, so the
binds would otherwise dangle. What was missing is the other half: a document
whose entire subject is retired is retired with it, never left standing.

Deleted with the rows:
  docs/probes/frontier_probe_exact_head_survey_2026-08-03.{md,tsv}
  docs/probes/frontier_probe_run_interrupted_2026-08-06.md
  docs/probes/diff_frontier_declared_vs_survey.sh   (only input was the TSV above)
  docs/probes/run_frontier_probe_survey_per_module.sh

The two scripts are frontier-probe transport and served nothing else. Two
unrelated STR-RC-0 scaffolds cited the second one as a class exemplar; their
comments now state the class without the pointer, so the deletion leaves no
stale citation behind.

This is the branch's own doc-graph defect, distinct from the five inherited
rows main is currently red on (the root_b probe orphan, fixed by #8333).
Same lens, same five row names, two different causes — which is why "those
are the known inherited rows" had to be checked rather than assumed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot

gunbai-bot Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

The ci red on f083077 had two causes, not one, and only after separating them did the second turn out to be mine. Pushed 045ca6ee131 for it.

The five failing rows are the doc-graph pair asserted from two files plus the conjunction — one defect pair, five row names. That shape is usually main's, and half of it is: main gained docs/probes/root_b_primitive_repr_fork_2026-08-16.md after this branch forked, PR CI evaluates the merge ref, and gunbc#8333 fixes it.

But the row name identifies the lens, not the defect, so "those are the known inherited rows" is cover rather than a diagnosis. Checking the diff for edge-forming content rather than for .md files found this branch removing two HandAuthoredDocBind rows:

- slug: "frontier_probe_exact_head_survey_2026-08-03"
- slug: "frontier_probe_run_interrupted_2026-08-06"

…while deleting no documents. Three files kept their place in the tree and lost their only inbound reachability, with zero markdown links pointing at them. Two new orphans of my own, sitting behind main's.

Deleting the rows was right — every declaration they cite (frontier_probe_exact_head_closeout_note, frontier_probe_run_interruption_note, frontier_roster_provenance_constructor_inflation_note, compiler_frontier_receipt_totality_wall_holds) is deleted by this PR, so the binds would dangle. The missing half is DESIGN §3 step 6: a document whose entire subject is retired is retired with it, never left standing. Retired:

  • docs/probes/frontier_probe_exact_head_survey_2026-08-03.{md,tsv}
  • docs/probes/frontier_probe_run_interrupted_2026-08-06.md
  • docs/probes/diff_frontier_declared_vs_survey.sh — its only input was the TSV above
  • docs/probes/run_frontier_probe_survey_per_module.sh — frontier probe transport, served nothing else

Two unrelated STR-RC-0 scaffolds cited the second script as a class exemplar; their comments now state the class without the pointer, so this leaves no stale citation. Residual references to any deleted path: 0.

Executed receipt for the branch tree is running now and I will post it rather than leaving the argument to stand on its own. Expect ci here to keep showing the same five rows until #8333 merges — that residue is main's, and pushing at it from this branch would misattribute a doc repair to the frontier cut in git history permanently.

— sent from smart-ram-730

@gunbai-bot

gunbai-bot Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Executed receipt, as promised — the branch tree is clean.

Run on 045ca6ee131, remote, release gunbc built in the same dispatch:

HEAD=045ca6e
BIND_ROWS_GONE=0
gunbc run --entry src/v2/lens/doc_reachability_test.dag --function doc_graph_is_clean
  -> function `doc_graph_is_clean` returned `true`

(The trailing returned true, not ProcessExit is the exit-code wrapper refusing to map a bare Bool to a status — it prints the verdict on the way past. The lens ran and answered.)

So the two orphans this branch created are closed, verified by running the lens rather than by reading the diff. The arm is the right one: the SHA is the pushed head and BIND_ROWS_GONE=0 confirms the deleted rows are actually absent from the tree that was compiled.

One check of mine did not report, and I would rather say so than let it pass as a pass: the SUBJECT_GONE probe over the five deleted paths printed empty instead of 0 — nested quoting in the dispatch broke the pattern. An empty result is not a zero; it is a check that did not run. It is redundant here (HEAD plus BIND_ROWS_GONE already pin the arm) but it proved nothing and is not doing any work in this receipt.

Remaining red on this PR is main's single orphan, cleared by #8333.

— sent from smart-ram-730

gunbc-ci-auto-heal and others added 2 commits August 17, 2026 06:16
Two conflicts, both resolved by rule rather than by hand.

src/v2/compiler/self_host/frontier_probe_survey.dag: modify/delete. Main's
change (#8333) is a prose edit inside one note in a file this PR deletes
whole — it rewords a citation to the very TSV this branch retires. Keeping
the deletion loses nothing.

.github/workflows/ci.yml: generated. The merge driver refused it as designed
— ours side left in the worktree, path marked unmerged, no markers. This
commit carries the provisional ours side ONLY to get a tree that builds; it
is regenerated in the next commit and overwritten by construction. Main
changed the AUTHORED_CONFLICTS exclude list, this branch changed the bin
lists; both derive from .dag authorities, so the generator produces the
union and neither side is picked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52817 on #8344 named six stale citations to symbols and files
this cut deletes. All six verified against the tree and fixed per site — a
mechanical substitution across them produces sentences that parse and say
nothing, which I did once already tonight and am not repeating.

  stage0_crate_layout_emit.dag        the generated-artifact template still
    embedded 'Authority: v2.compiler.self_host.frontier' in both the .dag and
    .rs emit paths after the import was repointed, so the next regen would
    bake a deleted module name into two generated artifacts. Now names the
    real authority, v2.compiler.self_host.stage0_crate_layout.
  ci_layer_roots.dag  witness_admission_offline_note   dropped the deleted
    exclusion note from the paired list.
  ci_layer_roots.dag  long_lane_exclusion_note         dropped the 'Named
    consumer with file-grain exclusion row' sentence; both things it named
    are gone.
  ci_layer_roots.dag  falsifier_self_host_wet_note     the frontier-row flip
    no longer gates wet enrollment; says so, and points at the note recording
    that the term it fed was already empty.
  ci_release_bins_witness_test.dag                     note claimed two
    positive gap bins while the tests assert one.
  witness_deferral_freeze.dag                          the terminating-survey
    specimen is rewritten rather than removed: it did terminate, but by its
    subject being deleted rather than by reaching 27 of 27 receipts, and that
    is the disposition the freeze cannot express.

Two more of the same class the review did not reach, found by sweeping every
deleted symbol rather than fixing the six named:

  doc_graph_roots.dag   the bind for this cut's own coordination document had
    primary_work pointing at v2.compiler.self_host.frontier_band_a_emit_readiness,
    a module this PR deletes. Repointed to the door-contract note already in
    its additional_works, which is the closest surviving subject.
  discrete_cost_derivation (.dag + .md)  cited the deleted exclusion note as
    live evidence for the 'green CI implies coverage' claim. The claim stands;
    the specimen is now stated as one that has since been deleted with its
    subject, which is an instance of the pattern rather than a loss of it.

Census after: every decl_name bound in doc_graph_roots resolves in the tree.
An earlier run of that census reported two missing — both were my grep
omitting 'func' declarations, not defects.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot

gunbai-bot Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Pushed 5921f90b1b4 — all six findings from cursor review 52817 verified against the tree and fixed, plus two more of the same class the review did not reach.

Fixed per site rather than by one substitution across them: a mechanical sweep over prose like this produces sentences that parse and say nothing, which I did once already tonight and am not repeating.

finding what it was
stage0_crate_layout_emit.dag the template still embedded Authority: v2.compiler.self_host.frontier in both the .dag and .rs emit paths after the import was repointed — the next regen would have baked a deleted module name into two generated artifacts. This is the one with teeth; the rest are prose.
witness_admission_offline_note dropped the deleted exclusion note from the paired list
long_lane_exclusion_note dropped the "Named consumer with file-grain exclusion row" sentence — both things it named are gone
falsifier_self_host_wet_note the frontier-row flip no longer gates wet enrollment; now says so, pointing at the note recording that the term it fed was already empty
ci_release_bins_witness_note claimed two positive gap bins while the tests assert one
witness_deferral_freeze_purpose_frontier_note rewritten, not removed — the terminating-survey specimen did terminate, but by its subject being deleted rather than by reaching 27 of 27 receipts, and that is precisely the disposition the freeze cannot express. Worth more as a corrected case than as a deletion.

Two the review did not reach, found by sweeping every symbol the cut deletes rather than fixing only the named six:

  • doc_graph_roots.dag — the bind for this cut's own coordination document had primary_work pointing at v2.compiler.self_host.frontier_band_a_emit_readiness, a module this PR deletes. Repointed to the door-contract note already in its additional_works.
  • discrete_cost_derivation (.dag + .md) — cited the deleted exclusion note as live evidence for the "green CI implies coverage" claim. The claim stands; the specimen now reads as one that has since been deleted with its subject, which is an instance of the pattern rather than a loss of it.

Census after: every decl_name bound in doc_graph_roots resolves in the tree. An earlier run of that census reported two missing — both were my grep omitting func declarations, so the instrument was wrong, not the corpus.

Also on this head: main merged in (4e6956fe58d). Two conflicts, both resolved by rule — the modify/delete on frontier_probe_survey.dag kept the deletion (main's change was a prose edit inside a file this PR deletes whole), and .github/workflows/ci.yml is generated, so the merge driver refused it as designed and I did not hand-pick hunks. Regenerating it on the merged tree currently fails (gunbc ci exits 1); I am running a control on main to establish whether that is this branch or the environment, and will not claim the file is correct until that is settled.

— sent from smart-ram-730

gunbc-ci-auto-heal and others added 3 commits August 17, 2026 06:38
cursor review 52826. Two of its four findings were already fixed in 5921f90
(the emit template, the release-bins note); it ran on the older head. The
other two are real, and they show the first sweep was keyed on the wrong
thing: I swept deleted SYMBOLS, and a DeclarationRef names a MODULE PATH
independently of whether the symbol it cites still exists somewhere.

Sweeping module paths instead found three sites, one more than the review.

  stage0_rust_source_lifecycle_scaffold.dag
    hand_maintained_stage0_filenames_authority_ref still named
    v2.compiler.self_host.frontier while the import three hundred lines above
    had been repointed to stage0_crate_layout. Repointed.

  dissolution_migration_census.dag
    a NarrativeOnly residue row for a note in the deleted probe-survey module.
    Removed; the partition witness asserts sum-of-parts against the total
    rather than a literal count, so it stays true by construction.

  self_host_promotion_obligations.dag
    RE-HOMED rather than retired, and the distinction is the point. Both refs
    named the deleted frontier module, which made the bound trigger one that
    can NEVER fire — DeclarationAppears waiting on a module nobody will
    re-create is a permanently pending obligation wearing a checkable trigger,
    which is worse than an honest unbound one.

    The obligation itself survives the roster because it was never about the
    roster: the hazard is that a self-host promotion can be granted on evidence
    the v1 seed produced, and EmitterProducer still carries a V1SeedEmitter arm
    in v2.compiler.self_host.emitter_producer_provenance. So the subject moves
    there, the trigger keeps its declaration name and moves with it, and the
    'n/27' framing — which really was roster-specific — is gone from the claim.
    Its witness needs no change: it asserts the bound and unbound arms stay
    distinguishable, and both still are.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52843. Both name it as a LIVE authority, unlike the several
prose sites that correctly say 'was carved out of' or 'was deleted with' —
those stay, because a historical reference to a deleted thing is accurate.

  language_target_registry.dag  Rust's TargetGovernedByContracts named the
    deleted module as its governing contract id. Repointed to
    v2.compiler.self_host.emit_coverage_frontier. Note that the row's own
    governing_contract_id_resolution_note explains this field carries a module
    name only because the real strategy authority lives in a private overlay
    and cannot be resolved from here — so the field is a stand-in either way,
    but a stand-in naming something that exists is strictly better than one
    naming something deleted.

  stage0_emit_plan.dag  the disposition-authority note said the projection
    derives from the deleted roster's seed-retained facts. It derives from
    stage0_crate_layout's hand-maintained filename facts, which is where the
    carve-out put them.

Deliberately NOT changed: cli_run.rs uses the string as a synthetic submodule
name in a prefix-matching unit test. It tests string logic and never resolves
the module, so it is not a stale citation — any name would do.

My earlier sweeps missed both because they keyed on 'module_path:' fields and
import lines. These are a contract_ids list element and prose. Third sweep
form, and the one that should have been first: grep the bare module name in
any syntactic position, then decide per site whether the reference is live or
historical.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52843's first finding, and the one with teeth: I changed the
emit template's authority string without regenerating what it stamps, so the
committed artifacts and the template disagreed and generated_artifact_drift_gate
would have refused. Ran the real generator rather than hand-editing generated
files:

  gunbc run --entry dag/tools/generated_artifact_gate.dag --function main_wet

It rewrote two artifacts with the new authority — and .github/workflows/ci.yml,
which is the part worth recording. The merge earlier took the ours side of
ci.yml purely to obtain a tree that builds, on the stated plan that regen would
overwrite it by construction. It did: the generator produced MAIN's
AUTHORED_CONFLICTS line, not mine. So the hand-picked side was wrong and would
have shipped a workflow that silently dropped main's change. That is exactly
the failure the generated-artifact merge driver refuses in order to prevent,
and the reason the rule is regenerate rather than resolve.

Still owed and dispatched separately: gunbc_stage0_crate_layout_generated.rs
carries the same string but is emitted by regen_stage0 rather than by this
gate, so it needs the stage0 regeneration, not this one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot gunbai-bot Bot mentioned this pull request Aug 17, 2026
6 tasks
gunbc-ci-auto-heal and others added 2 commits August 17, 2026 07:11
gunbc_stage0_crate_layout_generated.rs is the emitted Rust OF the .dag row
this PR changed, so it is owned by regen_stage0 rather than by the
generated_artifact_gate that produced the previous commit. Ran regen_stage0:
144 files written, exactly one changed, and it is this one. That single-file
result is the receipt that the earlier gate run had already covered everything
else it owns.

Both regeneration paths now agree with the template, so the drift gate and the
regen job have nothing left to refuse on this string.

Instrument note, recorded because it is the fourth of its kind tonight: the
subject-presence greps I printed beside this run were mangled by nested
quoting — the pattern's second word was taken as a filename, so both reported
0 with a 'No such file' line above them. The numbers were garbage. The run is
still trustworthy, but on the strength of what regen CHANGED, not on the checks
I attached to it. A broken check that prints a plausible 0 is worse than no
check, and this is the same family as reading a truncated tail: absence
manufactured by the instrument, read as a measurement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
cursor review 52854, both real.

MY REPOINT WAS WRONG AND THE REASON IS THE ERROR I HAVE BEEN WARNING OTHERS
ABOUT ALL NIGHT. I moved Rust's TargetGovernedByContracts to
v2.compiler.self_host.emit_coverage_frontier because the name resembled the
deleted module. It does not answer the same question: that carrier's own
two-axis note says it answers axis (a), whether a witness body runs native,
and explicitly disclaims axis (b), module self-emission. Picking it on name
resemblance is precisely 18.2's finding — a name says the carrier was
involved, not how — applied by me while citing it to someone else.

Repointed to v2.compiler.self_host.emitter_producer_provenance, the surviving
producer authority, which is also where the promotion obligation re-homed
earlier in this PR. And the field's own note is updated: its stated purpose is
a resolvable module a reader can open, so the note naming the deleted one made
it false on its face while the field beside it had already moved. The note now
records the wrong first choice rather than quietly showing the second — a
reader deciding whether this field means anything is better served by knowing
it was mis-picked once.

seed_emitter_behavioral_wet_module_bindings carried two dissolution triggers
whose subjects the cut removed: authorization waiting on 'witness-realization
+ frontier_probe_survey', and 'Frontier rows stay SeedRetained'. Both rewritten
to name what actually remains — witness-realization alone, and the binding's
own absence. A trigger naming a deleted subject cannot fire, which makes it
strictly worse than honest prose.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot

gunbai-bot Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Both findings from review 52854 verified and fixed in b7979cd4bdf. The first was my error, and it is a specific one worth naming.

I repointed to the wrong authority, by name resemblance. I moved Rust's TargetGovernedByContracts to v2.compiler.self_host.emit_coverage_frontier because the name looked like the deleted module. It does not answer the same question — that carrier's own emit_coverage_frontier_two_axis_note says it answers axis (a), whether a witness body runs native, and explicitly disclaims axis (b), module self-emission. The reviewer is right.

That is §18.2's finding — a type name in a diagnostic says the carrier was involved, it does not say how — committed by me, in the same hours I sent it to two other lanes as a correction. The lesson generalizes past type names to any citation picked on resemblance.

Repointed to v2.compiler.self_host.emitter_producer_provenance, the surviving producer authority, which is also where this PR re-homed the promotion obligation earlier — so the two now agree instead of naming different survivors.

And the note beside it was false on its face. governing_contract_id_resolution_note explains this field carries a module name only because the real strategy authority lives in a private overlay, and that the interim must be "a real module in this repository that a reader can open … resolvable rather than dangling." It still named the deleted module while the field had already moved. Updated — and it records the wrong first choice rather than quietly showing the second, because a reader deciding whether this field means anything is better served knowing it was mis-picked once.

Second finding — two dissolution triggers whose subjects the cut removed, in seed_emitter_behavioral_wet_module_bindings.dag:

  • :14 authorization waiting on witness-realization + frontier_probe_survey → witness-realization alone, with a note that the probe and the roster it surveyed are deleted, so the trigger is now the whole condition rather than half of one.
  • :22 "Frontier rows stay SeedRetained until that path is host-wired" → rewritten to name what actually gates now, the binding's own absence.

A trigger naming a deleted subject is worse than honest prose: it cannot fire, so it reads as checkable while being permanently pending. That is the same defect this PR already fixed once in self_host_promotion_obligations — I found that one by sweeping module_path: fields, and missed these two because they are prose inside dissolution descriptions. Fourth distinct syntactic form for one class: module_path: field, import line, contract_ids list element, and free prose in a trigger.

— sent from smart-ram-730

gunbc-ci-auto-heal and others added 2 commits August 17, 2026 07:46
claude review 52858. The first finding is the serious one: STRUCTURED fields,
not prose.

THREE LIVE ROADMAP NODES pointed path: at the deleted file — v2-emitter-
producer-provenance, v2-emitter-first-behavioral-module, v2-emitter-native-
bootstrap, all active in gunbc.roadmap_authority. Repointed PER NODE from what
each node says it does, not uniformly:

  producer-provenance    -> emitter_producer_provenance.dag
                           (its handback wants a result refused without a
                           receipt from the run that made it — that module's
                           mint wall)
  first-behavioral-module-> wet_receipt_enrollment.dag
                           (handback is test results plus the updated list
                           entry; the list entry was a roster row, and wet
                           enrollment is what survived carrying per-module
                           receipts)
  native-bootstrap       -> v2_emitter_direct_rust_door_contract.dag
                           (handback is two builds and the old compiler taken
                           away)

Picking one target for all three would have repeated the mistake in the commit
before this one, where I chose emit_coverage_frontier because the name
resembled the deleted module. Swept afterward: every path: in the roadmap now
resolves on disk, the sole non-file being a dotted module reference.

WAVE2_PREP_DESIGN IS MARKED SUPERSEDED RATHER THAN REPOINTED, and that is a
disposition rather than a shortcut. Its entire mechanism section names the
roster, its count, its baseline, its census attribution, its sweep order and
its gate — all deleted. There is no mapping from a roster row to a replacement,
so repointing eight symbols would fabricate an authority the document never
had. DESIGN §3 rules that a plan authored while the deleted structure lived is
re-read as quarry: its findings may be evidence, its sequencing is the old
structure's gravity written down. The header now says so and tells the reader
every symbol below names something gone.

The other two plan carriers had specific enough claims to repoint per site.

Residual live citations of the deleted module across all .dag: zero, counting
only live references — the several prose sites that say 'was carved out of' or
'was deleted with' stay, because a historical reference to a deleted thing is
accurate and sweeping those would be the mechanical substitution this PR has
already had to undo once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
… refill it

review 52867 caught v2_self_hosting.dag still presenting the deleted
frontier.dag as the live roster carrier -- seven citations across the
status line, the state-of-play census, two Wave 1 residual lists, the
Wave 3 exit gate and the retirement condition. The claude review on the
same head credited this file with quarry annotation it does not have,
so the finding is real and the approval was wrong about it.

Quarry-bannering it would be the wrong repair. wave2_prep_design earned
that treatment because its whole mechanism section named deleted roster
symbols with no surviving mapping; this file is the live sequencer for a
program whose Wave 1 is still in flight. It is not superseded by the cut
-- it merely cited what the cut removed.

So: repoint to the surviving authorities, and where a claim was
denominated by the roster, retire the fraction rather than re-author it.
0/27 and 27/27 both came from the same hand-authored row list, so both
measured the roster's opinion of how many compiler modules exist. The
substance survives (no module is self-emitted with a green equivalence
receipt; every module must flip or be declared pinned-kernel) and is
now stated qualitatively, with the derived denominator named as the
first Wave 3 obligation. Restoring a count here would rebuild the weed
inside the replacement, which is the failure DESIGN section 3 warns
about by name.

The frontier probe residuals are marked retired rather than outstanding:
the survey never produced a receipt on any host including a dedicated
runner, so its deletion costs machinery, not evidence.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
@gunbai-bot gunbai-bot Bot mentioned this pull request Aug 17, 2026
6 tasks
@gunbai-bot

gunbai-bot Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Fixed in c352f7dfb91 — and review 52867 is right that the file was untouched, which also means the approval on the same head (review 52863) was wrong where it credited v2_self_hosting.dag with quarry annotation. There is no banner in it. Seven live citations of the deleted frontier.dag: the status line, the state-of-play census, two Wave 1 residual lists, the §2 census block, the Wave 3 exit gate, and the retirement condition.

I did not take the suggested repair as offered, and the reason is the interesting part. Quarry-bannering it would be wrong. wave2_prep_design earned that treatment because its entire mechanism section named deleted roster symbols with no surviving mapping. v2_self_hosting is the live sequencer for a program whose Wave 1 is still in flight — it is not superseded by the cut, it merely cited what the cut removed. Retiring an active plan to make a citation problem disappear loses the sequencing and would be the more expensive error.

So: repoint, and where a claim was denominated by the roster, retire the fraction rather than re-author it.

  • 0/27 self-host-green and the Wave 3 exit 27/27 came from the same hand-authored row list, so both measured the roster's opinion of how many compiler modules exist, not the corpus. Substance survives (no module is self-emitted with a green equivalence receipt; every module must flip or be declared pinned-kernel), stated qualitatively, with the derived denominator named as the first Wave 3 obligation. Restoring a count here would rebuild the weed inside the replacement — the DESIGN §3 failure by name, and the one most tempting while 'just fixing citations'.
  • Surviving authorities named explicitly at the top: emitter_producer_provenance, stage0_crate_layout, v2_emitter_direct_rust_door_contract.
  • Frontier-probe residuals marked retired, not outstanding — that survey never produced a receipt on any host including a dedicated runner, so its deletion costs machinery, not evidence.
  • The operator-signed END GOAL quote keeps its 27 verbatim; it is a signed historical block and the roster-deleted receipt now precedes it.

Receipt, remote (claim_batch built and run in one dispatch): PASS doc_graph_has_no_orphan_docs, PASS doc_graph_has_no_dangling_links. A third name I passed, doc_graph_is_clean, does not exist in that entry and returned FAIL (no such function) — kept in the receipt because it doubles as proof the runner reports failures rather than swallowing them, which is the pairing this PR's own lane has been enforcing all night.

— sent from smart-ram-730

@briansrls
briansrls merged commit 39859f1 into main Aug 17, 2026
4 of 6 checks passed
@briansrls
briansrls deleted the session/smart-ram-730-frontier-cut branch August 17, 2026 09:05
gunbai-bot Bot pushed a commit that referenced this pull request Aug 17, 2026
Three classes of resolution, each decided rather than defaulted.

MAIN-DELETED FILES (14, accept the deletion). #8344 deleted the 27-row
self-host frontier roster and the machinery that only served it. Verified my
side of each was import-strip-only before accepting: the one apparent
exception in frontier.dag was 82 lines of import-block CONTINUATION, and the
one genuine addition -- my SeedRetainedIntrinsicRegistration for the new
source_closure seed module -- is salvaged below rather than lost with the file.

CONTENT CONFLICTS (7). Every hunk but one was main re-adding an import block
this branch deletes, so those take the HEAD side. The exception is real and
main is right: it deleted a witness that opened
`if compiler_frontier_emitter_produced_count() == 0 { true }` where the count
was zero at every commit it ever ran under, so its three assertions had never
been evaluated -- green by construction, not by evidence. Took main's content
throughout and re-applied the strip, which also preserves main's correction of
the generated-artifact authority string from the now-deleted
v2.compiler.self_host.frontier to v2.compiler.self_host.stage0_crate_layout.

SALVAGE. source_closure is registered in stage0_crate_layout.dag, which is
where that fact lives now (`pub mod source_closure;` in lib.rs confirms
has_pub_mod), and threaded into the generated artifact's pub-mod block,
basename list and filename list at the registration-order position.

Two hazards handled explicitly. stage0_crate_layout_generated.dag came back
UNMERGED WITH ZERO CONFLICT MARKERS -- the generated-artifact merge driver
refusing -- so `git add -A` over it would have silently committed the ours
side; it was reconstructed instead. And main's imports also arrive through
CLEAN auto-merges, not just conflicts: stage0_crate_layout.dag carried five,
which the parser panics on. Corpus now greps zero import statements.

The generated artifact is a hand-reconstructed merge, not an emitter run --
regen is suspended on this branch. The drift gate is the check on it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot pushed a commit that referenced this pull request Aug 17, 2026
Six conflicts. Five resolved by what the cut decides, one by what MAIN decides,
and one class checked for that git structurally cannot report.

STAY DELETED, because this branch removes their subject: .github/workflows/ci.yml
and falsifier.yml (the cut deletes those workflows), and the witnesses
ci_release_bins_witness_test.dag and ci_spec_witness_test.dag -- both deleted
here by the CI wipe and the re-add, and touched on main only incidentally while
it removed frontier-roster references. A witness whose subject is gone cannot be
re-enrolled against anything.

MAIN'S DELETION WINS on src/v2/compiler/self_host/frontier_probe_survey.dag,
which is the reverse direction from every other conflict and so worth stating
rather than letting modify/delete default. Main deleted the file wholesale with
the 27-row self-host frontier roster (#8344). This branch's only edit to it was
removing an affected-set selection reference -- an edit to a file main then
removed entirely, so there is nothing left for the edit to be owed against.

.github/workflows/fleet-converge.yml is GENERATED, and picking a side would have
dropped one side's authority-derived content with no marker. Both sides changed
one binary roster in opposite directions, and the merged authority settles it:
`gunbc.ci_release_bins` enrolls none of the three disputed bins. frontier_probe_survey
was removed on main with the roster that gave it a census to read; floor_skip_discovery_witness
and selection_control_skip_witness were removed here with the selection machinery
they controlled. The projection therefore excludes all three, which is this
branch's list minus frontier_probe_survey -- derived from the merged authority
rather than chosen between two stale projections.

CHECKED EXPLICITLY, because git cannot report it: a file ADDED on one side
inside a region the other side DELETES satisfies git's "changed incompatibly on
both sides" relation and violates this cut's "no new member enters the deleted
region", so it lands silently with no marker. Enumerated main's additions since
the merge base against the affected-set, ci.yml, falsifier, ci_spec and
selection regions: none. The check is recorded because its value is in having
been run, and a null result is invisible otherwise.

Merged tree builds clean. Merge commit, not rebase, per branch policy.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot pushed a commit that referenced this pull request Aug 17, 2026
Resolving the origin/main merge needed a self-consistent seed to build a
regen binary with: taking main's side of the one conflicted generated file
left v1_compiler_emit_rust.rs calling the derive functions without
map_key_required while its unconflicted sibling required it, so the crate
did not compile (8 x E0061). I restored the whole src/v1/stage0/src/ tree
from the pre-merge head to bootstrap, and that restore also resurrected a
file main had deleted and reverted a generated header main had corrected.

  src/v1/stage0/src/bin/frontier_probe_survey.rs — deleted again. main cut
  it in #8344 with the self-host frontier roster it surveyed; gunbc.ci_release_bins
  records that removal per-bin. It read compiler_frontier_sweep_order from the
  now-deleted frontier.dag, is unregistered in Cargo.toml, and carries no
  scaffold receipt.

  bootstrap_stage0_crate_layout_generated.rs — header restored to cite
  v2.compiler.self_host.stage0_crate_layout. v2.compiler.self_host.frontier is
  deleted; stage0_crate_layout.dag is the module carved out of it. Generated
  file, and nothing in this branch feeds its generator, so main's output is
  correct here; the file list was never affected, only the citation.

Swept the class rather than the two cited sites: exactly one resurrected file
and zero files missing versus main, and no other stage0 file cites the deleted
authority. regen_stage0 --verify remains at regen_divergence_count=0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot pushed a commit that referenced this pull request Aug 17, 2026
…weep meant to fix dead citations

review 52919 caught it. The F5 row and the rust end-state row in
gunbc.plans.language_target_self_host_frontier cite
emitter_produced_baseline as the surviving count authority after the
roster cut. That symbol does not exist. Verified: it appears three
times in the tree and all three are prose -- two notes in
interpreter_replacement_cut and stage0_crate_layout, and my own two
cells. seed_emitter_behavioral_green_count and its baseline appear
exactly once each, in the same cell I wrote. Neither has a declaration
anywhere.

So the repoint in #8344 replaced a citation to a deleted symbol with a
citation to a symbol that was never declared, which is worse than what
it fixed: the old one at least named something that had existed and
would fail a grep against history. This is the class I have been
quoting at other lanes all night, committed by me, in the diff whose
entire purpose was clearing it.

The root is that I searched for the FORM of the old citation rather
than resolving the NEW one. A repoint is two obligations, not one --
remove the dead name, and prove the replacement resolves -- and I
performed only the first. DESIGN section 3 says a stale name is
decidable and grep-checkable, which is exactly why there is no excuse
for it.

Fixed by stating the bar qualitatively where no symbol survives to
carry it, rather than by finding a third name to point at. After the
roster cut nothing counts producer-qualified emissions, and the honest
sentence is that no module carries a producer-qualified promotion --
not a fabricated tally. Where a real symbol does carry the fact, the
cells now name it: EmitterProducer x EmissionQualification,
mint_producer_emission_receipt as the only route to a receipt, the
realized-closure wall seed_emit_rust_reachable, and
BehavioralProbeUnbound as the honest standing for a receipt that has
produced source and nothing more.

The rust end-state cell also still read "SeedRetained roster", which
contradicted the roster deletion this same PR documents. It now says
there is no denominator and declines to invent one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5
gunbai-bot Bot pushed a commit that referenced this pull request Aug 17, 2026
Fresh seed rebuild + regen_stage0 --verify (divergence 0); removes stale Witness coercion/is_copy assertions dropped when frontier probe witnesses were deleted on main.

Co-authored-by: Cursor <cursoragent@cursor.com>
briansrls pushed a commit that referenced this pull request Aug 17, 2026
… its declaration node (#8376)

* Infer a bare variant's instantiated owner from the expected type, not its declaration node

A bare variant reference inferred as its OWNER COPRODUCT'S DECLARATION NODE, whose
children are the coproduct's ARMS rather than type arguments. `type Optional<T> =
Absent | Present { value: T }` declares Absent as child 0, so a generic owner reaching
the renderer uninstantiated rendered `Option<Absent>` -- a constructor in type
position, not a Rust type. The emitter was rendering faithfully what inference gave it.

When the context supplies an expected type that owns the variant, that expected node IS
the instantiated owner, so it is adopted in place of the declaration node. The same
lookup already existed in the unresolved-name arm; it is hoisted to one authority so a
variant that RESOLVES gets it too, rather than only one that does not.

Adoption is deliberately narrow on two axes, both earned by a failure:

IDENTITY -- only when the expected type's own head names the coproduct resolution
already bound, so this instantiates the owner the binder chose rather than re-targeting
to a different coproduct declaring an arm of the same name (Absent is an arm of
Optional, ObservationVerdict and ConvergeVerdict alike).

CARDINALITY -- only when the expected node is Required. Optionality is not a wrapper
type here: `BinOp?` is a BinOp node whose return_cardinality is CardOptional, so a head
comparison cannot see it. For `binop: Mod` against `BinOp?` the head IS BinOp and the
arm IS found, but the constructor's type is BinOp and the optionality is a coercion the
emitter performs by wrapping; adopting there made the value look already-optional and
emitted `binop: BinOp::Mod` where `Some(BinOp::Mod)` is owed.

Two successive drafts shipped that wrapper loss across four extdeps.languages.*_syntax
modules and std.effects. Worth recording WHY it survived: the Option<Absent> count, the
whole-artifact diff of the emitted eval closure, and the rustc error census all stayed
green through both, because all three measure the eval closure while the damage was in
v1's OWN emitted sources. regen_stage0 --verify was the only instrument whose subject
included it.

Measured, emitted v2.compiler.05_eval closure, before -> after:

  Option<Absent> sites        21 -> 0
  rustc errors               494 -> 473  (-19 E0425, -2 E0573; no code increased)
  whole-artifact diff        24/24 lines, fully accounted:
                             21 broken annotations repaired,
                             2 improved to concrete types
                               (Option<Rc<UriPercentEncodeRefusalCause>>,
                                Rc<NamedEdgeTargetLookup>),
                             1 Verdict annotation relaxed to `_`
  self-host fixed point      green (two generations)

Witness enrolls the CARDINALITY half, which is single-source constructible and is the
half both wrong drafts broke, with a required-field positive control so the repair is
not satisfiable by wrapping everything or by refusing every adoption. The headline
Option<Absent> case has no enrolled row and the note says so: it needs the v2 Optional
coproduct as a declared generic type AND an ambiguously owned arm name, but Optional is
not declared in the dag corpus (it is the built-in `T?` sugar) and two same-named arms
in one module are refused outright. Its evidence is the executed corpus measurement
above -- discriminating, but not recurring.

Rung, honestly: mitigatable, not structural. With no expected type inference still
falls back to the declaration node, so a declaration-shaped node can still reach a type
position. Dissolve-on: constructor ownership and constructor value type become separate
facts with a needs-context / refused arm, at which point the state is unwritable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Delete the 27-row self-host frontier roster and the machinery that only served it (#8344)

* Delete the 27-row self-host frontier roster and the machinery that only served it

Operator ruling: the frontier roster is either derived from live state or it
does not exist. It was neither -- 27 hand-authored rows whose measurement
fields were ordinary parameters, so a row that claimed execution measurement
was indistinguishable from one that asserted it. It attracted readers, it
misrouted them, and it produced nothing. This deletes it at the root rather
than pruning it row by row.

WHAT THE DELETION PROVED, which is the part worth reading. Every consumer that
looked load-bearing turned out to consume an empty projection:

  crate layout        appended compiler_frontier_emitter_produced_stage0_mod_basenames(),
                      a fold admitting only EmitterProduced rows. All 27 were
                      SeedRetained, so the term was [] at every call and no
                      emitted byte changes.
  wet enrollment      appended a roster fold whose own gate,
                      falsifier_self_host_wet_template_only_holds, asserted that
                      term had length zero.
  crate partition     named the roster as a dissolution target for module
                      exports the roster could not have supplied -- rows carried
                      a path and a disposition and nothing else.

So the roster's real dependents were its own census tests. Those, the promotion
and authorization machinery, and the per-module probe survey go with it.

WHAT SURVIVES AND WHERE IT WENT. Crate layout is a separate concept that was
squatting in the frontier module; it moves to v2.compiler.self_host.stage0_crate_layout
with the registration rows and projections that actually produced bytes. The
producer/qualification vocabulary in emitter_producer_provenance survives at
half its size -- the EmitterProducer x EmissionQualification axes, the realized
closure carriers, the receipt and its single mint -- because its live consumers
(candidate_generation, the direct rust door contract, the production
qualification lens) never read a roster row.

EVIDENCE, PER DESIGN 4b. Deleted witnesses fall in two classes and both are
stated in the carriers rather than here. Green-by-construction: seven crate
layout witnesses guarded by a disposition match whose EmitterProduced arm was
unreachable, or comparing zero to zero. Subject-retired: the authorization
forgery controls proved an unauthorized EmitterProduced disposition was
unwritable, and that disposition no longer has a representation to forge.

Two claims survived and keep their controls: a V2Emitter receipt cannot be
minted with the seed emitter in its realized closure, and the generated crate
layout artifact must match its registration rows.

ONE CLAIM IS GENUINELY RETIRED RATHER THAN CLIMBED, said plainly.
transition_parity_host_index_agrees_with_hand_rows redded when the derived
module index and the hand-authored qualified-module rows disagreed. Deleting
one side of a duality retires the parity claim; it does not discharge it. The
surviving authority is the path-module binding index, and the crate-partition
dissolve target now points there instead of at the roster.

The frontier_probe_survey bin is removed with its .dag surface and transport.
Justified per bin, not by a class sentence, because an earlier change deleted
four bins on one blanket justification and was reverted for exactly that --
see the second-removal paragraph in gunbc.ci_release_bins.

NOT DONE HERE, named rather than left to be found: the frontier_probe subsystem
(frontier_probe, frontier_probe_types, assemble_detail and their tests) still
stands. It is the adjacent weed -- its subject was per-module roster
measurement -- but it has independent test consumers and deserves its own cut.
The plan carriers written in the roster's vocabulary (wave2_prep_design,
v2_self_hosting) are quarry now, not authority, and are not rewritten here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Follow the bin deletion through build.rs and the generated workflow

The build failed in 39s because deleting src/bin/frontier_probe_survey.rs left
two references to it standing: build.rs still declared a rerun-if-changed on
the file, and .github/workflows/ci.yml still passed --bin frontier_probe_survey
to the release build and then asserted the resulting artifact existed at four
verify sites and one tar site.

ci.yml is a generated artifact and the honest way to update it is to regenerate
it from gunbc.ci_release_bins, which is where the pack row was already removed.
`gunbc ci` cannot run in this container -- the shim panics reading
ci_layer_roots.dag out of a temp workspace -- so the eight occurrences are
removed by hand and the drift gate is the check: it compares ci.yml against
`gunbc ci` output byte for byte, so if this hand edit is not exactly what the
generator produces, CI says so. That is the intended instrument for this rather
than a local claim I cannot make.

Stated because it is the kind of thing worth noticing rather than routing
around: a hand-edited generated artifact is only acceptable here because a
byte-exact gate independently checks it in the same run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Fix the parse error my own note introduced: nested double quotes in a .dag string

The retained-kernel test gate failed with four panics, all the same:
for_each_parsed_module_binding could not parse dag/gunbc/ci_release_bins.dag.
The per-bin justification I added there quoted the earlier blanket sentence
verbatim -- not "a probe bin whose subject was cli_run" -- inside a
double-quoted string, which terminated the string mid-prose and left the
remainder as garbage tokens.

Worth noticing rather than just fixing. The failure surfaced four modules away
from its cause, in a materialization-provider test whose subject is disk cache
probes, because the whole-corpus module-path index parses every .dag file
before anything else runs. So a prose edit in a bin roster reds a cache test,
and the panic names the parse site rather than the reader. That is the same
ordering property this program spent the afternoon on: what breaks first is
not what is wrong, it is what runs first.

The sentence now paraphrases instead of quoting. Checked the other nine
multi-paragraph notes this change adds: each opens and closes exactly once,
with the odd per-line quote counts expected of a string spanning blank lines.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Two workflows still named the deleted probe bin: take the heal regeneration

The frontier cut deleted the frontier_probe_survey bin and its row in the
release pack, and I removed its eight occurrences from ci.yml by hand.
fleet-converge.yml and falsifier.yml build the same pack from the same
authority and still named it, so heal regenerated them and could not push
workflow paths itself. These are its bytes, not mine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Move the deletion rationale into an authored annotation: it is prose, not program data

DESIGN 4c, enforced by prose_row_introduction_gate: this path's prose is
already migrated, so a new data NAME_note: String row is refused. The note
explains what the frontier cut removed from this module and what survived,
which is exactly irreducible rationale about a construction's shape --
it belongs above the declaration it explains, not in a String the compiler
must carry. Six sibling rows on out-of-scope paths were reported and not
enforced; left as they are rather than widening the diff past the refusal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Delete the freeze rows and transport claims naming witnesses the cut removed

The floor refused with StaleFrozenPathDeferral: two gunbc.witness_deferral_freeze
rows named test decls the entry no longer declares. A freeze row left behind is
not inert -- it becomes a standing exemption the next witness to take that name
inherits, which is the refusal's own wording and the reason it is loud.

Same two names were still enrolled as ClaimRun rows in the supply transport, and
its note explained why one of them was there. Removed both and rewrote the note
to say what happened to their subjects: the parity witness had the duality
between the derived index and the hand rows as its subject, and the cut removed
one side, so the claim is retired rather than dropped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Import the equality helper from its definer: the old path resolved by pool coincidence

emitter_producer_provenance_witness_test imported
schedule_witness_entries_structurally_equal from wet_receipt_enrollment, which
neither defines it nor imports it. It is defined in
seed_emitter_behavioral_wet_known_red_entries, a module this file already
imports. The reference resolved on main only because some other member of the
assembled closure had dragged the definer into the pool; the cut changed the
closure and it stopped resolving, refusing the whole discovery corpus.

This is the Class B accidental-coverage shape DESIGN records as an open thread —
a bare cross-module reference binding by pool membership rather than by the
importing file's own closure. Importing from the definer is the fix that does
not depend on who else is in the pool.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Retire the frontier probe receipts with the roster they measured

The cut deleted the two HandAuthoredDocBind rows for the frontier probe
receipts but left the documents in the tree, so three files lost their only
inbound reachability and became orphans. Deleting the bind rows was correct
— every declaration they cite (frontier_probe_exact_head_closeout_note,
frontier_probe_run_interruption_note, frontier_roster_provenance_constructor_inflation_note,
compiler_frontier_receipt_totality_wall_holds) is deleted by this PR, so the
binds would otherwise dangle. What was missing is the other half: a document
whose entire subject is retired is retired with it, never left standing.

Deleted with the rows:
  docs/probes/frontier_probe_exact_head_survey_2026-08-03.{md,tsv}
  docs/probes/frontier_probe_run_interrupted_2026-08-06.md
  docs/probes/diff_frontier_declared_vs_survey.sh   (only input was the TSV above)
  docs/probes/run_frontier_probe_survey_per_module.sh

The two scripts are frontier-probe transport and served nothing else. Two
unrelated STR-RC-0 scaffolds cited the second one as a class exemplar; their
comments now state the class without the pointer, so the deletion leaves no
stale citation behind.

This is the branch's own doc-graph defect, distinct from the five inherited
rows main is currently red on (the root_b probe orphan, fixed by #8333).
Same lens, same five row names, two different causes — which is why "those
are the known inherited rows" had to be checked rather than assumed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Cut cleanup: the citations the deletion left pointing at nothing

cursor review 52817 on #8344 named six stale citations to symbols and files
this cut deletes. All six verified against the tree and fixed per site — a
mechanical substitution across them produces sentences that parse and say
nothing, which I did once already tonight and am not repeating.

  stage0_crate_layout_emit.dag        the generated-artifact template still
    embedded 'Authority: v2.compiler.self_host.frontier' in both the .dag and
    .rs emit paths after the import was repointed, so the next regen would
    bake a deleted module name into two generated artifacts. Now names the
    real authority, v2.compiler.self_host.stage0_crate_layout.
  ci_layer_roots.dag  witness_admission_offline_note   dropped the deleted
    exclusion note from the paired list.
  ci_layer_roots.dag  long_lane_exclusion_note         dropped the 'Named
    consumer with file-grain exclusion row' sentence; both things it named
    are gone.
  ci_layer_roots.dag  falsifier_self_host_wet_note     the frontier-row flip
    no longer gates wet enrollment; says so, and points at the note recording
    that the term it fed was already empty.
  ci_release_bins_witness_test.dag                     note claimed two
    positive gap bins while the tests assert one.
  witness_deferral_freeze.dag                          the terminating-survey
    specimen is rewritten rather than removed: it did terminate, but by its
    subject being deleted rather than by reaching 27 of 27 receipts, and that
    is the disposition the freeze cannot express.

Two more of the same class the review did not reach, found by sweeping every
deleted symbol rather than fixing the six named:

  doc_graph_roots.dag   the bind for this cut's own coordination document had
    primary_work pointing at v2.compiler.self_host.frontier_band_a_emit_readiness,
    a module this PR deletes. Repointed to the door-contract note already in
    its additional_works, which is the closest surviving subject.
  discrete_cost_derivation (.dag + .md)  cited the deleted exclusion note as
    live evidence for the 'green CI implies coverage' claim. The claim stands;
    the specimen is now stated as one that has since been deleted with its
    subject, which is an instance of the pattern rather than a loss of it.

Census after: every decl_name bound in doc_graph_roots resolves in the tree.
An earlier run of that census reported two missing — both were my grep
omitting 'func' declarations, not defects.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Cut cleanup 2: the deleted-MODULE citations the symbol sweep missed

cursor review 52826. Two of its four findings were already fixed in 5921f90
(the emit template, the release-bins note); it ran on the older head. The
other two are real, and they show the first sweep was keyed on the wrong
thing: I swept deleted SYMBOLS, and a DeclarationRef names a MODULE PATH
independently of whether the symbol it cites still exists somewhere.

Sweeping module paths instead found three sites, one more than the review.

  stage0_rust_source_lifecycle_scaffold.dag
    hand_maintained_stage0_filenames_authority_ref still named
    v2.compiler.self_host.frontier while the import three hundred lines above
    had been repointed to stage0_crate_layout. Repointed.

  dissolution_migration_census.dag
    a NarrativeOnly residue row for a note in the deleted probe-survey module.
    Removed; the partition witness asserts sum-of-parts against the total
    rather than a literal count, so it stays true by construction.

  self_host_promotion_obligations.dag
    RE-HOMED rather than retired, and the distinction is the point. Both refs
    named the deleted frontier module, which made the bound trigger one that
    can NEVER fire — DeclarationAppears waiting on a module nobody will
    re-create is a permanently pending obligation wearing a checkable trigger,
    which is worse than an honest unbound one.

    The obligation itself survives the roster because it was never about the
    roster: the hazard is that a self-host promotion can be granted on evidence
    the v1 seed produced, and EmitterProducer still carries a V1SeedEmitter arm
    in v2.compiler.self_host.emitter_producer_provenance. So the subject moves
    there, the trigger keeps its declaration name and moves with it, and the
    'n/27' framing — which really was roster-specific — is gone from the claim.
    Its witness needs no change: it asserts the bound and unbound arms stay
    distinguishable, and both still are.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Repoint two live references to the deleted frontier module

cursor review 52843. Both name it as a LIVE authority, unlike the several
prose sites that correctly say 'was carved out of' or 'was deleted with' —
those stay, because a historical reference to a deleted thing is accurate.

  language_target_registry.dag  Rust's TargetGovernedByContracts named the
    deleted module as its governing contract id. Repointed to
    v2.compiler.self_host.emit_coverage_frontier. Note that the row's own
    governing_contract_id_resolution_note explains this field carries a module
    name only because the real strategy authority lives in a private overlay
    and cannot be resolved from here — so the field is a stand-in either way,
    but a stand-in naming something that exists is strictly better than one
    naming something deleted.

  stage0_emit_plan.dag  the disposition-authority note said the projection
    derives from the deleted roster's seed-retained facts. It derives from
    stage0_crate_layout's hand-maintained filename facts, which is where the
    carve-out put them.

Deliberately NOT changed: cli_run.rs uses the string as a synthetic submodule
name in a prefix-matching unit test. It tests string logic and never resolves
the module, so it is not a stale citation — any name would do.

My earlier sweeps missed both because they keyed on 'module_path:' fields and
import lines. These are a contract_ids list element and prose. Third sweep
form, and the one that should have been first: grep the bare module name in
any syntactic position, then decide per site whether the reference is live or
historical.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Regenerate the artifacts the authority-string change restamps

cursor review 52843's first finding, and the one with teeth: I changed the
emit template's authority string without regenerating what it stamps, so the
committed artifacts and the template disagreed and generated_artifact_drift_gate
would have refused. Ran the real generator rather than hand-editing generated
files:

  gunbc run --entry dag/tools/generated_artifact_gate.dag --function main_wet

It rewrote two artifacts with the new authority — and .github/workflows/ci.yml,
which is the part worth recording. The merge earlier took the ours side of
ci.yml purely to obtain a tree that builds, on the stated plan that regen would
overwrite it by construction. It did: the generator produced MAIN's
AUTHORED_CONFLICTS line, not mine. So the hand-picked side was wrong and would
have shipped a workflow that silently dropped main's change. That is exactly
the failure the generated-artifact merge driver refuses in order to prevent,
and the reason the rule is regenerate rather than resolve.

Still owed and dispatched separately: gunbc_stage0_crate_layout_generated.rs
carries the same string but is emitted by regen_stage0 rather than by this
gate, so it needs the stage0 regeneration, not this one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Regenerate the last artifact carrying the old authority string

gunbc_stage0_crate_layout_generated.rs is the emitted Rust OF the .dag row
this PR changed, so it is owned by regen_stage0 rather than by the
generated_artifact_gate that produced the previous commit. Ran regen_stage0:
144 files written, exactly one changed, and it is this one. That single-file
result is the receipt that the earlier gate run had already covered everything
else it owns.

Both regeneration paths now agree with the template, so the drift gate and the
regen job have nothing left to refuse on this string.

Instrument note, recorded because it is the fourth of its kind tonight: the
subject-presence greps I printed beside this run were mangled by nested
quoting — the pattern's second word was taken as a filename, so both reported
0 with a 'No such file' line above them. The numbers were garbage. The run is
still trustworthy, but on the strength of what regen CHANGED, not on the checks
I attached to it. A broken check that prints a plausible 0 is worse than no
check, and this is the same family as reading a truncated tail: absence
manufactured by the instrument, read as a measurement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Repoint to the right authority, and clear two more dissolution triggers

cursor review 52854, both real.

MY REPOINT WAS WRONG AND THE REASON IS THE ERROR I HAVE BEEN WARNING OTHERS
ABOUT ALL NIGHT. I moved Rust's TargetGovernedByContracts to
v2.compiler.self_host.emit_coverage_frontier because the name resembled the
deleted module. It does not answer the same question: that carrier's own
two-axis note says it answers axis (a), whether a witness body runs native,
and explicitly disclaims axis (b), module self-emission. Picking it on name
resemblance is precisely 18.2's finding — a name says the carrier was
involved, not how — applied by me while citing it to someone else.

Repointed to v2.compiler.self_host.emitter_producer_provenance, the surviving
producer authority, which is also where the promotion obligation re-homed
earlier in this PR. And the field's own note is updated: its stated purpose is
a resolvable module a reader can open, so the note naming the deleted one made
it false on its face while the field beside it had already moved. The note now
records the wrong first choice rather than quietly showing the second — a
reader deciding whether this field means anything is better served by knowing
it was mis-picked once.

seed_emitter_behavioral_wet_module_bindings carried two dissolution triggers
whose subjects the cut removed: authorization waiting on 'witness-realization
+ frontier_probe_survey', and 'Frontier rows stay SeedRetained'. Both rewritten
to name what actually remains — witness-realization alone, and the binding's
own absence. A trigger naming a deleted subject cannot fire, which makes it
strictly worse than honest prose.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Roadmap paths, and the plan carriers the cut decayed

claude review 52858. The first finding is the serious one: STRUCTURED fields,
not prose.

THREE LIVE ROADMAP NODES pointed path: at the deleted file — v2-emitter-
producer-provenance, v2-emitter-first-behavioral-module, v2-emitter-native-
bootstrap, all active in gunbc.roadmap_authority. Repointed PER NODE from what
each node says it does, not uniformly:

  producer-provenance    -> emitter_producer_provenance.dag
                           (its handback wants a result refused without a
                           receipt from the run that made it — that module's
                           mint wall)
  first-behavioral-module-> wet_receipt_enrollment.dag
                           (handback is test results plus the updated list
                           entry; the list entry was a roster row, and wet
                           enrollment is what survived carrying per-module
                           receipts)
  native-bootstrap       -> v2_emitter_direct_rust_door_contract.dag
                           (handback is two builds and the old compiler taken
                           away)

Picking one target for all three would have repeated the mistake in the commit
before this one, where I chose emit_coverage_frontier because the name
resembled the deleted module. Swept afterward: every path: in the roadmap now
resolves on disk, the sole non-file being a dotted module reference.

WAVE2_PREP_DESIGN IS MARKED SUPERSEDED RATHER THAN REPOINTED, and that is a
disposition rather than a shortcut. Its entire mechanism section names the
roster, its count, its baseline, its census attribution, its sweep order and
its gate — all deleted. There is no mapping from a roster row to a replacement,
so repointing eight symbols would fabricate an authority the document never
had. DESIGN §3 rules that a plan authored while the deleted structure lived is
re-read as quarry: its findings may be evidence, its sequencing is the old
structure's gravity written down. The header now says so and tells the reader
every symbol below names something gone.

The other two plan carriers had specific enough claims to repoint per site.

Residual live citations of the deleted module across all .dag: zero, counting
only live references — the several prose sites that say 'was carved out of' or
'was deleted with' stay, because a historical reference to a deleted thing is
accurate and sweeping those would be the mechanical substitution this PR has
already had to undo once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* The self-hosting tracker outlived its roster: declare the gap, do not refill it

review 52867 caught v2_self_hosting.dag still presenting the deleted
frontier.dag as the live roster carrier -- seven citations across the
status line, the state-of-play census, two Wave 1 residual lists, the
Wave 3 exit gate and the retirement condition. The claude review on the
same head credited this file with quarry annotation it does not have,
so the finding is real and the approval was wrong about it.

Quarry-bannering it would be the wrong repair. wave2_prep_design earned
that treatment because its whole mechanism section named deleted roster
symbols with no surviving mapping; this file is the live sequencer for a
program whose Wave 1 is still in flight. It is not superseded by the cut
-- it merely cited what the cut removed.

So: repoint to the surviving authorities, and where a claim was
denominated by the roster, retire the fraction rather than re-author it.
0/27 and 27/27 both came from the same hand-authored row list, so both
measured the roster's opinion of how many compiler modules exist. The
substance survives (no module is self-emitted with a green equivalence
receipt; every module must flip or be declared pinned-kernel) and is
now stated qualitatively, with the derived denominator named as the
first Wave 3 obligation. Restoring a count here would rebuild the weed
inside the replacement, which is the failure DESIGN section 3 warns
about by name.

The frontier probe residuals are marked retired rather than outstanding:
the survey never produced a receipt on any host including a dedicated
runner, so its deletion costs machinery, not evidence.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: gunbc-ci-auto-heal <bts53@scarletmail.rutgers.edu>

* Plan status: Root A landed, Root D half 1 has no live owner, Root B measured (#8367)

* Plan status: Root A landed, Root D half 1 has no live owner, Root B measured

The status table said Root A was 'unknown; under challenge' after it merged,
and named vivid-wren as owner of a Root D whose halves have different owners
and different states. A shared coordination document that is stale about what
landed sends the next reader at finished work — which happened to me tonight:
I dispatched a duplicate work item for Root D half 1 off this table before
finding PR #8350 already at the merge bar with its author's session archived.

  A   LANDED, #8347 as c4e9cc9. 12.5's challenge was RIGHT, which is why
      what landed is not what 12.5 proposed: a fused-map split, not the
      coproduct-skip edit the retracted diagnosis pointed at. The skip is
      still there and still deliberate. Recorded with two receipts — the
      stage0 regeneration the first push missed, and the two regen runs that
      reported a perfect fixed point while compiling a tree that never
      contained the fix.
  D   split by owner: half 2 landed; half 1 is #8350, at the merge bar, no
      live owner, shepherded here.
  B   18.3 adds smart-ibex's executed flip: 211->204 errors, 203->196 sites,
      195 common / 8 removed / 1 added, containment 0-of-18 disjoint. The
      43-site renderer-inconsistency reading and the +18 reassignment are
      RETRACTED — read off a different module's artifact, never reached a
      carrier. What survives is sharper than the retraction: the leaf name
      Nat denotes two different types under two module authorities, so a
      census pooled across modules is keyed on a name that is not unique over
      the population it pools. Key on resolved type identity, not the printed
      name, and let a site carry more than one root.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Root D half 1 landed too — bbb5213, minutes after the row was written

The row said 'at the merge bar, no live owner, shepherded here'. It merged
while this PR was open. Recording it rather than letting a status document
be stale about a merge inside its own review window — which is the failure
the PR exists to fix, and it would be a poor look for the fix to exhibit it.

Its author's session was archived before it landed, so the merge is also the
receipt that an ownerless PR at the bar does not need a new session, only
someone watching for it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Strike the superseded instruction, and give half 2 its receipt

cursor review 52846, both findings real.

12.5 said 'treat A as unpartitioned, not as diagnosed' immediately above the
RESOLVED block this PR added, so the section told a skimming reader that
landed work was still open. I appended a resolution without striking the claim
it supersedes, which is the plan-ledger form of rung inflation — and doing it
in the very PR whose purpose is status honesty. Struck rather than deleted:
the instruction was correct when written, and the paragraph above it records
WHY the then-current diagnosis was refused, which still governs.

The Root D row claimed both halves landed while citing only half 1. Half 2 is
7cfeb6f (PR #8341), verified an ancestor of origin/main before citing it
rather than copied from the review. Receipt added.

Swept my own additions for the same class afterward: every LANDED claim in
this diff now names a merge commit, and all four SHAs this document cites
(bbb5213, 7cfeb6f, c4e9cc9, 6a3779d) are confirmed ancestors of
origin/main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Compare owner DECLARATION identity, not its name, and fix the unguarded no-binding arm

Review-driven follow-up to the previous commit, both findings acted on rather than
recorded.

IDENTITY. The owner guard compared `authored_name_at(exp) == owner_name` -- a spelling,
not an identity. It fails in both directions: one declaration reached through a
qualified spelling fails it, and two DIFFERENT declarations sharing a name pass it. The
dangerous arm is the second: given `a.Status = Ready | AOnly` and `b.Status = Ready |
BOnly`, a `Ready` bound from a.Status could be adopted against an expected b.Status,
silently retargeting the constructor and potentially masking a real type error. That
hazard was introduced by the previous commit, not pre-existing.

The repository already defines same-owner identity at the constructor-binding authority
(insert_variant_owner_checked): authored name PLUS declaration file and source start.
That triple is extracted as `same_owner_declaration` and both consumers now ask one
authority instead of two.

Comparing identity NAIVELY REVERTS THE REPAIR, and the measurement is the point.
Requiring name+file+start put Option<Absent> straight back to its full 21-site baseline;
a probe on name+file alone was also 21, which located the cause: expand_scrut_type_for_-
variant_lookup returns its subject unchanged once the connective is Disj, so `exp_enum`
is a USE-SITE node in the consumer module, never the owner's declaration. Comparing a
use site against a declaration can never match. Both sides are now normalised through
lookup_type_for before comparison, which restores 0 sites WITH identity enforced.

NO-BINDING ARM. The expected-context-only branch adopted the expanded node raw, and
expand returns an OPTIONAL subject unchanged -- exactly the state the cardinality rule
refuses two branches over. It is fixed with with_required_cardinality rather than by
extending the `Required` refusal there: that branch has no binding fallback, so refusing
would convert resolving programs into hard not-founds, and a fabricated refusal is
forbidden by the same rule as a fabricated success.

Measured, emitted v2.compiler.05_eval closure, before -> after (unchanged headline,
strictly more precise output):

  Option<Absent> sites        21 -> 0
  rustc errors               494 -> 473  (-19 E0425, -2 E0573; no code increased)
  whole-artifact diff        43/43 lines, fully accounted:
                             21 broken annotations repaired,
                             ~21 `acc: _` IMPROVED to concrete types,
                             1 Verdict annotation relaxed to `_`
  self-host fixed point      green in one generation
  witness                    both rows green

The witness note gains the sharper coverage statement, which this change PROVED rather
than reasoned: both enrolled rows pass on the unrepaired baseline, so they detect the
repair over-reaching and cannot detect it ceasing to work. The identity draft above
silently reverted the repair while every row stayed green; only re-measuring the corpus
caught it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Revert the owner-identity guard: it regressed 16 whole-corpus sites

Reverts the code of ece43db, keeping its witness-note finding. The review finding
that motivated it is REAL and is NOT resolved by this revert -- it is deferred with a
measurement, which is more than it had before.

WHAT THE FINDING WAS. The owner guard compares authored names, not declaration
identity, so two DIFFERENT declarations sharing a spelling can pass it and expected
context could retarget a constructor. That hazard is introduced by the first commit and
is real.

WHY THE FIX IS NOT SHIPPING. Comparing declaration identity requires normalising both
sides -- expand_scrut_type_for_variant_lookup returns a USE-SITE node once the
connective is Disj, so a raw span comparison never matches and silently reverted the
repair to its full 21-site baseline. Normalising through lookup_type_for restored the
repair but introduced 16 incompatible-type errors across the corpus, because resolving
to declarations makes the guard match through ALIASES and QUALIFIED SPELLINGS that the
authored-name comparison declines -- so it adopts in cases it must not. Bisected: the
no-binding cardinality edit is innocent (reverting it alone still gave 16); the identity
comparison is the cause.

  whole-corpus compile, dag + src/v2, one instrument, three arms:
    origin/main          incompatible-types  0   undefined-variable 32
    first commit         incompatible-types  0   undefined-variable 32
    identity commit      incompatible-types 16   undefined-variable 32

The 32 undefined-variable rows are pre-existing on main and are the control proving the
read works.

WHY THIS WAS NOT CAUGHT BEFORE PUSHING, which is the transferable part: every number in
the first commit was measured on the EMITTED EVAL CLOSURE, and the compile-clean gate
compiles the WHOLE CORPUS. This change alters inference for every bare variant reference
in the tree, so the eval closure was never the right denominator for it. The self-host
fixed point is also a partial denominator -- it covers v1's own sources, which is why it
caught two earlier drafts and not this one. Whole-corpus compile is now run beside the
eval emission for any inference change.

State restored to the verified first commit, re-measured after revert:

  self-host fixed point                green
  whole-corpus incompatible-types      0   (baseline 0)
  whole-corpus undefined-variable     32   (baseline 32, pre-existing)
  Option<Absent> in emitted eval       0   (baseline 21)
  witness                              both rows green

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: regenerate drifted generated artifacts (ci auto-heal)

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: gunbc-ci-auto-heal <bts53@scarletmail.rutgers.edu>
briansrls pushed a commit that referenced this pull request Aug 17, 2026
…ts shape alone (#8353)

* Root T5a: derive the trait roster from how a type is used, not from its shape alone

The emitted derive roster was a function of shape only. A record's structure says
what it CAN derive; it cannot say what its USE demands. So a type reaching a map-key
position needed Eq + Hash that no shape classification would ever produce, and
std.trait_derive_shape could not even NAME Hash -- ReprGroundingDeriveTrait had no
member for it. The gap was structural, not an oversight in the table.

THE REQUIREMENT IS ONE ROW. map_key_required_derive_traits is Eq + Hash, grounded on
im 15.1.0 HashMap<K, V> declaring K: Hash + Eq -- the container Map lowers to, via
std.types container_template_algebra PartialFunction. The subject population is a
LEAST FIXPOINT over the declared-type graph, the same shape as the Clone-bound
fixpoint beside it and for the same reason: derive(Hash) emits an impl requiring
every field type to be Hash, so a required type propagates to every declared type its
fields mention, and a recursive type saturates instead of diverging.

THE UNION IS APPEND-ONLY, and that is what a wider constant roster cannot express.
Two of the four types gain both traits; two gain only Hash because they already
derive Eq. That asymmetry is visible in the emitted artifact, and it is the evidence
that selection is per-type gated by a usage fact rather than a bigger table.

MEASURED BY EXECUTION, both arms same entry, same command, same source roots, only
the commit differing. Whole emitted tree for src/v2/compiler/02_parse.dag, 101 files:
FIVE differ. FOUR are appended derive attributes --

  std_occurrence_identity.rs  OccurrenceId           + Eq, std::hash::Hash
  v2_compiler_parse.rs        ParsePositionKey       + Eq, std::hash::Hash
  v2_std_node.rs              OccurrenceId (phantom) + std::hash::Hash
  v2_std_runtime.rs           EnvironmentBindingKey  + std::hash::Hash

-- and the fifth is std_trait_derive_shape.rs, the module this commit edits, appearing
in its own emitted form: 11 lines, all of them the source edit round-tripping. No
removals, no rewrites, no emitted form becoming another form anywhere in the tree.
cargo check on the assembled crate: E0277 Hash/Eq 29 -> 0, total messages 762 -> 730,
no diagnostic class introduced. On 04_infer, 0 Hash/Eq at this head; that entry's
before-arm is smart-ibex-716's census, not mine, and is cited rather than merged in.

TWO FORKED ROSTERS DISSOLVED ON THE WAY. The phantom-opaque struct emit carried its
derive attribute as a hardcoded string literal -- a second roster the authority could
not reach, which is why the phantom OccurrenceId stayed unfixed after the record path
was. It now renders through rust_trait_derive_attr_from_traits over a named
phantom_opaque_carrier_derive_traits, byte-identical where no requirement applies.
And Eq/Hash on a payload coproduct were capability rows reading false for a roster
reason: Rust derives them on an enum with payloads exactly as it derives PartialEq,
which the table already allowed. Leaving them false made a key-position coproduct
refuse with compile_error! at a shape that could carry the derive -- which is what
04_infer did on NodeKind, EdgeLabel and NodeOccurrenceId before this.

WHAT THIS DOES NOT DO, stated rather than implied. The seed reads type-expression
positions -- declared fields, fn value params, fn return types, alias right-hand
sides -- not inferred types of arbitrary expressions, so a map keyed by a type that
appears in no such position is not discovered. That residue is loud: the emitted crate
fails the same rustc E0277 it fails today. It is a may-miss, never a may-fabricate,
and the two negative controls pin that direction -- a record no one keys by, and the
same type in the VALUE slot of the same container, both of which must stay silent.

NOT the Ord axis. Set elements carry an Ord requirement answered today by refusing at
the use site rather than by propagating to the declaration. Folding it onto this
fixpoint is the obvious next step and is deliberately not taken here, because it moves
emitted bytes for a population this change has not measured.

Scope boundary, since the neighbouring root will be quoted at this one: T5's other
half is ~44 sites of serde/Debug demanded of types holding Rc<dyn Fn>. Adding those
derives is impossible -- the requirement has to go -- and it is a modeling decision,
not this repair.

regen_stage0 --verify: regen_divergence_count=0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Drop the three import names my merge resolution duplicated

The union resolution of the origin/main merge kept both sides of the
trait_derive_emit import block verbatim, so v1_clone_bounded_type_params,
v1_item_clone_bounded_param_names and v1_item_clone_undecided_head each
appeared twice — once from each side. Only v1_clone_impl_required_type_params
was genuinely new. Emitted bytes are unaffected: regen_stage0 --verify reports
regen_divergence_count=0 with no stage0 file changed, measured rather than
assumed.

Three further duplicate imports in the same two files (a doubled
`import v1.compiler.languages` line, NewlineIndex twice in one 04_infer list,
and a doubled `import std.content_hash` line) carry identical counts on
origin/main and are pre-existing, so they are reported rather than repaired
here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Remove the merge debris my bootstrap restore resurrected

Resolving the origin/main merge needed a self-consistent seed to build a
regen binary with: taking main's side of the one conflicted generated file
left v1_compiler_emit_rust.rs calling the derive functions without
map_key_required while its unconflicted sibling required it, so the crate
did not compile (8 x E0061). I restored the whole src/v1/stage0/src/ tree
from the pre-merge head to bootstrap, and that restore also resurrected a
file main had deleted and reverted a generated header main had corrected.

  src/v1/stage0/src/bin/frontier_probe_survey.rs — deleted again. main cut
  it in #8344 with the self-host frontier roster it surveyed; gunbc.ci_release_bins
  records that removal per-bin. It read compiler_frontier_sweep_order from the
  now-deleted frontier.dag, is unregistered in Cargo.toml, and carries no
  scaffold receipt.

  bootstrap_stage0_crate_layout_generated.rs — header restored to cite
  v2.compiler.self_host.stage0_crate_layout. v2.compiler.self_host.frontier is
  deleted; stage0_crate_layout.dag is the module carved out of it. Generated
  file, and nothing in this branch feeds its generator, so main's output is
  correct here; the file list was never affected, only the citation.

Swept the class rather than the two cited sites: exactly one resurrected file
and zero files missing versus main, and no other stage0 file cites the deleted
authority. regen_stage0 --verify remains at regen_divergence_count=0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: regenerate drifted generated artifacts (ci auto-heal)

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls added a commit that referenced this pull request Aug 18, 2026
… standing (#8166)

* PRESS-0 step 2: bridge codex press rate-limit buckets into the standing limit axis

gunbc.codex_app_server_press already decoded per-bucket rate limits, and
gunbc.provider_standing already modelled the limit axis, and nothing
joined them — so the probe bridge left limits Unobserved and a measured
bucket produced the same verdict as an unmeasured one.

account_standing_authenticated_rate_limits_readable_note specifies this
consumer by name and carries its own dissolution: read
evidence.rate_limit_buckets per limit_id, project each
CodexRateLimitBucketVerdict onto ProviderNativeLimitBucket, never route
through ProviderAccountLimit, and never use CodexPressAccountReady as
the limit axis. That is what this does.

Bucket scope is load-bearing rather than stylistic: the account
classification gates on the codex bucket alone, so it reports Ready
while a sibling is exhausted. The discriminating witness is the case the
note names — one observation set with codex exhausted and
codex_bengalfox available yields DIFFERENT verdicts under draws naming
each bucket. An account-scoped projection cannot produce that and fails
the witness.

CapacityUnknown becomes LimitObservationUnobserved, never
LimitObservedAvailable: could-not-decode read as nothing-is-wrong would
admit a dispatch against a bucket nobody measured. An empty bucket list
becomes one located Unobserved; limit_observations_are_selection_eligible
already refuses empty, so this adds a reason rather than changing the
verdict.

NOT DONE, and it still blocks selection: the entitlement axis. No probe
grounds ProviderEntitlementObservation for codex, and
EntitlementObservationUnobserved is not selection-eligible, so codex
remains ineligible on the six-axis conjunction even with limits now
observed. The press note is explicit that account standing is not
account-wide entitlement, so I have not fabricated one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Dissolve the dead belt_observe entry points and correct a stale roster note

Both raised by review on #8132 as non-blocking follow-ups.

belt_observe and belt_observe_for_instance are deleted. They observed
the tmux session NAME set only, which is precisely why a retained dead
pane read as a live agent; dispatch and tick both call
belt_sessions_observe_for_instance now, so the pair had no production
caller left.

belt_observe_from_result SURVIVES deliberately and is now witness-only.
Its subject is the tmux stdout parse — nonzero exit with no documented
no-server marker, unparseable line, empty set — reached by eight
witnesses. Deleting it with its caller would have deleted that evidence,
and §4b is explicit that a climb dissolves the lower-rung production
handling and never the discriminating evidence. Its dissolve-on is named
on the carrier: re-point those parse witnesses at
classify_tmux_session_list with the refusal cases preserved one-for-one.

belt_dispatch_all_status_labels_note said an "8th variant" makes the
label match non-exhaustive, which stopped being true at twelve. The
mechanism it describes is unchanged, so the sentence now names a new
variant rather than a count — a count in prose beside a live roster is
the stale-citation class, and it rots without anyone touching it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Carry the bucket subject on an undecoded limit, per review 51237

CONFIRMED, and the root is worse than the symptom. The bridge matched
CodexBucketCapacityUnknown { limit_id: _ } — discarding a limit_id the
producer already held — and mapped it to LimitObservationUnobserved,
which limit_observation_blocks_dispatch answers `true` for against EVERY
draw. So one bucket failing to decode refused a draw naming a measured,
available sibling.

This is a fail-CLOSED error, which is why the existing sibling witness
did not catch it: the exhausted/available pair still discriminated
because neither was unknown. Over-refusal reads as caution while it
prices out capacity the observation proved was there.

ProviderLimitObservation gains LimitSubjectUnobserved { subject,
native_token, reason }, routed through limit_subject_covers_dispatch_draw
like every other subject-bearing arm. It blocks a draw naming that
bucket, and still blocks Unspecified and Automatic draws because those
cover every native bucket — precision where the draw names a subject,
fail-closed where it does not. It is distinct from
LimitCapabilityGapUnobservable, which means the axis is unobservable on
this surface at all and correctly never blocks.

The zero-bucket case keeps the subject-less LimitObservationUnobserved:
with no buckets there is no subject to carry and refusing every draw is
right.

Witnessed both directions — the sibling draw is admitted, and the
undecoded bucket's own draw plus Unspecified and Automatic are all
refused. limit_observation_blocks_dispatch was the only exhaustive match
over the coproduct; the cursor standing match carries a catch-all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Carry the native cause token on an exhausted bucket; name the dropped reset

native_token carried limit_id, which the subject's native_key already
carries — so the field restated the bucket and dropped the only thing it
could have said. It now carries reached_type when the wire supplied one,
falling back to limit_id because native_token is not optional and a
bucket that reported exhaustion without a reached_type still has to name
something actionable.

resets_at is STILL DROPPED, and is now named on the carrier rather than
discarded quietly. ProviderLimitObservation has no field to hold it —
LimitUnavailableUntilReset is { subject, native_token, reason } — so
"when does waiting become valid again" has nowhere to land. That is a
model gap, not a projection choice, and serializing a timestamp into
`reason` would put a machine fact in a prose field no consumer can read.
Dissolve-on: LimitUnavailableUntilReset gains a typed reset instant.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Derive the limit credential from the press receipt, not from the caller

Handback item 1 (review artifact 51237).
provider_limit_observations_from_codex_press_evidence took the credential
identity and the evidence as INDEPENDENT arguments, so a caller could
take buckets observed under one CODEX_HOME and publish them as the
standing of a different credential. The standing would be honestly
decoded and attached to the wrong account — a forgery no arm refuses,
because both arguments are individually valid.

The receipt already carries the answer:
CodexAccountPreflightSubject.credential is the exact ambient context the
trip ran under. provider_limit_observations_from_codex_press_receipt
derives the identity from it and gives the caller nowhere to supply one.

CODEX_HOME is the identity because it IS the isolation mechanism
(codex_state_root_isolation_note): two homes are two credential stores.

codex_press_credential_identity takes the AmbientCodexCredentialContext
rather than the whole subject — it depends on exactly what it needs, and
that is also what makes it witnessable without a four-field fixture.
Witnessed: two homes never collide, and the label is the home.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* JWKS: model the key set and the verification seam, which cannot yet verify

The entitlement axis needs authenticated claims, and codex_auth's parse
boundary is explicit that reading unverified claims is fine for showing
which account a credential names and illegitimate for authorization.
Selection eligibility is authorization. So the missing piece is
signature verification, and this is its first half.

Cited as three documents rather than one local vocabulary: RFC 7517 for
the JWK and its members, RFC 7518 section 6.3.1 for the RSA parameters
n and e, section 3.3 for RS256. They are independently versioned and
independently extended.

WHAT IT DELIBERATELY CANNOT DO. RSASSA-PKCS1-v1_5 is s^e mod n over a
2048-bit modulus plus a padding and digest check, and this corpus has no
bignum, no modular exponentiation and no RSA primitive. That is a
capability gap, not a modeling gap, and no amount of .dag closes it —
it needs a realization handler bound to a host primitive, or bignum
grounded in the substrate. So there is no fn here returning Bool for
signature validity: such a function could only fabricate, and a
`verified` that is always true because nothing checked it is the
fabricated-plausible-output failure aimed at a security decision.
jws_verification_unavailable is what every caller gets, naming the
missing capability, counted rather than absorbed.

n and e stay base64url strings for the same reason: decoding them needs
the arithmetic the module does not have, so an Int carrier would claim
a capability it lacks.

Key selection is 0/1/many. RFC 7517 does not require kid uniqueness, so
duplicates are a real wire state, and first-wins would decide which key
authenticates a credential on list order. Absent and ambiguous stay
distinct because refreshing the key set fixes one and not the other.

An unmodeled key type decodes without material rather than failing the
set — the key we need may be beside it.

Recorded for whoever binds the handler: it must check the JWS header alg
against what the key permits rather than trusting the header, because
substituting none or an HMAC alg against an RSA public key is the
standard JWS confusion attack. Dissolve-on: a bound handler with an
executed positive control and a discriminating negative control.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* JWS: refuse the algorithm-confusion attacks, which need no bignum

The header does not get to choose the algorithm. Both historical JWS
confusion attacks work because the verifier read `alg` out of the token
and did what the token asked: `none` strips the signature entirely, and
HS256 against an RSA verifier signs with the PUBLIC key as an HMAC
secret — public being the point. The defense is not a stronger
primitive, it is deciding agreement from the KEY and only ever checking
the header's claim against it.

That is structure, not arithmetic, so it lands now rather than waiting
for the exponentiation. Witnessed as attacks: an unsigned token refused
against every key type, and HS256 against an RSA key as a mismatch.

SCOPED DOWN MID-WRITE, and the reason is recorded on the carrier. I
first modelled the compact split and header decode too, then found that
string_split, drop, code_point_string and uint8_int do not exist — I had
written four fabricated primitives, the same class as two earlier slips
this session. The corpus consumes text by positional char folds
(extdeps.auth.jwt jwt_first_colon_from is the idiom), so the split needs
that fold written properly, and writing it badly means a verifier
reading the wrong bytes.

So the split, the segment-count check that refuses an unsecured JWS and
a JWE, and the signing input are deferred with their dissolve-on named,
rather than shipped as plausible code over primitives that do not exist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Partition tick sessions by the coproduct, not a parallel string vocabulary

Review artifact 51309 called this a follow-up modeling cleanup rather
than a correctness gap, and that is right, but it is the nicknaming
class so it is worth closing.

belt_tick_session_is(s, arm: "running") compared string arms — a second
naming scheme for BeltSessionLiveness, which already names exactly those
states. The string version is strictly worse than the coproduct: a typo
in an arm name compiles and silently empties a bucket, where a missing
coproduct arm is a non-exhaustive match the compiler catches.

belt_tick_session_class now returns BeltSessionLiveness and the four
predicates match its arms. Node-awareness stays at this layer rather
than moving into belt_session_liveness_from_process, because
multiplicity is a fact about a node's ROWS while that function sees one
row's process — the same split belt_node_session_liveness makes on the
dispatch path.

Landed on the stacked PR rather than #8132, which has three approvals
sitting on a head whose CI run is finally in progress; restarting it for
a cleanup the reviewer explicitly called non-blocking would trade a
verified merge candidate for a tidier one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* JWS: land the compact split, so the segment count is checked

The deferred half of the JWS structure. RFC 7515 section 7.1 is exactly
three base64url segments joined by two periods, and the COUNT is a
security fact rather than a parsing detail: two segments with an empty
third is the unsecured JWS of section 6, five is a JWE. Verifiers that
split on periods and read position two have accepted both as signed
tokens, so each wrong count refuses by its own name.

The signing input is carried on the split rather than rebuilt later,
because RFC 7515 section 5.2 step 8 covers the ENCODED segments joined
by a period, and reconstructing that from decoded parts is where a
re-encoding difference silently produces different bytes than the ones
the signature covers.

THE SEGMENTER IS LOCAL AND THAT IS A COMPROMISE, stated on the carrier
rather than hidden. Splitting on a separator is not a JWS concept and
belongs in std, but no general split, index-of or substring exists in
this corpus, and minting a std primitive is not a decision to take
inside a JWS module. jws_segments is scoped and named for its subject.
Dissolve-on: a general std separator fold lands and this becomes a call
to it; a second consumer needing the same scan first is the signal to
promote rather than copy.

This closes the fabricated-primitive gap from the earlier commit — the
scan is written against char_at / code_point / string_length, the
idiom extdeps.auth.jwt already uses, rather than the string_split and
drop I had invented.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Remove JWS/JWKS from the critical path; delete the rebindable evidence entry

TWO CORRECTIONS, THE FIRST OF WHICH IS MINE TO OWN.

JWT/JWKS IS NOT THE ENTITLEMENT JOIN. I built a signature-verification
lane on the premise that entitlement required authenticated id_token
claims, citing codex_auth's parse boundary. That note is correct and
governs the auth.json id_token — a different surface. The app-server
account/read response already carries the account realm, and the proof
was a captured wire specimen in this repository's own test tree:

  {"result":{"account":{"type":"chatgpt","planType":"pro",...}}}

That is the admitted Codex process answering an authenticated control
request, not gunbc decoding an untrusted bearer token, so the prohibition
never applied. I grepped for entitlement producers and for planType in
the extdeps models; I did not read the response fixture, which settles
it in one line.

The lane is preserved on branch jwks-security-substrate rather than
deleted — it is cited and correct as far as it goes — but it has no
production consumer, cannot authenticate any constructible value, and
brings this branch no closer to a provider turn. Keeping it here would
make entitlement depend on a capability that does not exist.

THE CREDENTIAL FIX WAS INCOMPLETE. Adding the receipt-taking entry point
did not remove the forgery: provider_limit_observations_from_codex_press_evidence
still took credential and evidence as independent arguments, so evidence
observed under one CODEX_HOME could still be published as another
account's standing. A safe path added beside an unsafe path leaves the
unsafe path. Deleted — the only production entry consumes the complete
receipt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Fix the stale CapacityUnknown arm assertion left behind by the mixed-decode repair

witness_capacity_unknown_is_not_capacity asserted LimitObservationUnobserved,
the subject-less arm the bridge returned BEFORE review 51237. That repair moved
CapacityUnknown onto LimitSubjectUnobserved so an undecoded bucket refuses its
own draw without refusing a measured sibling; the witness was not re-read after
the producer changed, so it reported the repair as a regression.

The assertion is now stronger than a swapped label: it matches the subject and
pins native_key, which is the fact the repair added and the whole reason the
subject-carrying arm exists. The CI red is the discriminating receipt — the old
arm fails against the current producer, the new one passes.

Also merges main (#8182, #8180, #8164).

* Decode the Codex account union and project entitlement from what it reports

account/read's `account` member was decoded to "the object was nonempty" and
stopped there, so an apiKey platform credential, an amazonBedrock contract and
a personal ChatGPT subscription all reached the same Ready. Those are three
different credential realizations, and a profile requiring personal ChatGPT
OAuth is satisfied by exactly one of them.

Grounded in the upstream schema rather than in our captured fixture: read from
`codex app-server generate-json-schema --out` against @openai/codex 0.147.0,
v2/GetAccountResponse.json. Two facts from it changed the design:

  Account is a CLOSED oneOf discriminated on `type` — apiKey | chatgpt |
  amazonBedrock — so the realm is an enumerable decode, not an open string.

  PlanType is a CLOSED 15-value enum whose members INCLUDE `unknown`. I was
  about to treat any nonempty planType as entitling, which would have read
  upstream's own I-do-not-know as a yes. It decodes cleanly and entitles
  nothing.

The two negatives stay distinct because their remedies differ. A Bedrock
account is REJECTED — read successfully, wrong realization, permanent until the
credential changes. A plan or type outside the cited enum is UNOBSERVED — our
pin is stale, repaired by editing a roster. Both refuse dispatch today, which
is exactly why a witness asserting only "not available" would pass while the
model conflated them.

Entitlement policy lives at the bridge, not in the decoder: the press says what
upstream reported, gunbc.codex_plan_is_entitling says which plans we draw on.
OpenAI publishes no machine-readable plan→entitlement map, so the roster is a
declared policy budget with `free` and `unknown` excluded by name, not a
fabricated citation.

Six witnesses, green by execution; mutating the roster's CodexPlanUnknown arm
reds witness_upstream_unknown_plan_is_not_a_yes and leaves its sibling green.
Downstream consumers re-run at full roster count: press 22/22, bridge 21/21,
dispatch_selection 19/19, roadmap_dispatch_actuator 36/36.

* Give the exhausted-bucket arm a typed cause and a typed reset

LimitUnavailableUntilReset carried a required native_token and no reset, which
produced two defects from one shape:

  The cause was `match reached_type { Present{t} => t  Absent => limit_id }`.
  A bucket that reported exhaustion without naming a cause got the bucket's own
  id in the cause slot, so a reader could not tell an upstream-reported
  rate_limit_reached from our substitution. The substitution was not chosen —
  it was the only expression that typechecked, because a required field whose
  producer lacks a value MANUFACTURES a fallback.

  resets_at decoded off the wire and was dropped, so an arm named UntilReset
  could not say until when.

Now ProviderNativeLimitCause (Reported{token} | Unreported) and
ProviderLimitReset (ResetAt{at} | ResetInstantUnobserved). Both absent arms are
reachable: rateLimitReachedType and resetsAt are optional upstream. An
unobserved reset is not an immediate one — zero is the BEST possible reset and
therefore the worst available default.

THE WITNESS WAS PINNING THE DEFECT. witness_codex_bucket_projects_to_native_
bucket_never_account_scope asserted `t == "codex"` against a fixture declaring
reached_type: none — so the value it held in place was the fallback itself. It
now asserts NativeCauseUnreported, and a second fixture carrying both a cause
and a reset proves the two project differently.

Scope, declared: LimitWarning/Rejected/Exhausted/RateLimited keep bare tokens.
They have one producer between them and no observed case of a missing token, so
converting them would add an unreachable state. Trigger recorded on the arm.

The superseded note is replaced rather than left beside the fix — it had named
this exact change as its dissolve-on.

Full-roster reruns: bridge 23/23, provider_standing 17/17, standing_selection
7/7, dispatch_selection 19/19, roadmap_dispatch_actuator 36/36, press 22/22.

* Make the account-realm matches exhaustive instead of rostering new residue

The non-fold residue ratchet found one unrostered site (stale count zero): my
realm decoder matched JsonNull and JsonObject and swept the rest into `_`, and
realm_from_account_read_frame did the same over the JsonMember arms.

Rostering it was the wrong repair. A roster row carries a reason AND a
dissolution trigger, so it is a net-new active dissolution obligation, and
DESIGN §5 is explicit that a trigger is a lifecycle fact rather than permission
— absent an operator verdict on this exact population, marked debt is refused
exactly like unmarked debt. The obligation also would not have been true: there
was nothing to dissolve to, because the exhaustive form was available now.

Both matches now name every variant. JsonValue's four non-object non-null arms
route through one named function rather than four copies of the same record, so
exhaustiveness costs nothing in duplication.

Verified: unrostered and stale counts both 0, the ratchet witness passes, and
its two RED controls still hold. Bridge 23/23, press 22/22.

* Cite the account schema from the pinned runtime, and narrow the entitling roster

Two P0 corrections from analyst review, both real and both mine.

P0-1 — the branch modeled a protocol no executable implements. I read the
account schema from the codex that happened to be installed on this build host,
0.147.0, while every other fact in the module and the materialized bundle the
turn executes are pinned at 0.146.0. I noticed the version gap while working
and declared the new number in my notes instead of resolving the mixture.

Measured against both executables rather than assumed: the Account union is
structurally identical, but PlanType is 13 values at 0.146.0 and 15 at 0.147.0
— self_serve_business_prolite and enterprise_cbp_automation do not exist for
the pinned runtime. So the model named two plans our executable cannot emit.
The identical union is exactly why it was easy to miss: the part that changed
was the part nobody diffed.

Restated to 0.146.0, the version the runtime receipt admits. The two later
strings now decode as CodexPlanTypeUnrecognized — a stale pin, which is the
honest reading — and a witness asserts that rather than the note claiming it.
The rule is not which version wins: a protocol fact comes from the exact
executable the runtime admits, and a bump moves manifest, lock, artifacts,
receipt and every fact together.

P0-2 — the roster was a broad allow path from a locally authored assumption.
It admitted every plan but free and unknown, in a note that simultaneously
said no upstream plan-to-entitlement mapping exists. Narrowed to the single
plan actually observed on the deployed credential, behind an explicit
CodexPersonalSubscriptionPolicy so the set is unmistakably authored policy.

A non-admitted plan reads UNOBSERVED, not REJECTED, on the same remedy line the
module already draws: ratifying a plan is our-side like a stale pin, while an
apiKey or Bedrock account is repaired only by changing the credential.

Every previous assertion here was about a REFUSAL, which is why no witness
noticed the widening. witness_deployed_profile_admits_exactly_the_observed_plan
pins the admitted set at exactly one member, so a future admission reds first.

Bridge 26/26, press 22/22, provider_standing 17/17, standing_selection 7/7,
dispatch_selection 19/19, roadmap_dispatch_actuator 36/36, residue ratchet green
with both RED controls holding.

* PRESS-0 step 2: credential liveness split and HeldLease supervised turn

Split account/read realm from rate-limit liveness: authentication derives
from CodexCredentialLive (buckets returned) via the press receipt bridge,
not from account/read alone — the continuity-receipt trap where chatgpt/pro
coexists with a dead token.

Model supervised execution on std.temporal_effect HeldLease in
gunbc.codex_supervised_turn: turn/start admission refuses idle threads
without a runner-written terminal receipt, and witnesses pin the trap.

Wet srv1 shell-typed-invocation turn remains open on this vertical.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix parse error in codex_supervised_turn witness test.

Leading == on a continuation line is invalid syntax; bind the policy
comparison via let so the file parses and corpus discovery can run.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Pin unobserved credential liveness in witness; mutation-checked traps.

Extend witness_credential_liveness_splits_from_realm to assert
CodexCredentialLivenessUnobserved maps to AuthenticationStandingUnobserved,
not AuthenticationAuthenticated. Mutation checks confirm both traps red:
idle-thread admission and unobserved-liveness authentication.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix compile-clean: remove unattached // prose from witness file.

Standalone leading comment blocks lacked module-item subjects and
failed dag_compile_clean_gate (64 annotation refusals). Rationale
already lives in typed data witness_note rows per DESIGN 4c.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Revert "Merge annotation-grain fix from #8215 to clear inherited compile-clean red."

This reverts commit 50e02c3, reversing
changes made to 1c97fc0.

* Add supervised Codex turn runner for bounded wet execution.

Implements run_codex_supervised_turn with HeldLease fencing, bundled-native
app-server script (thread/start then turn/start), stdout parse, and
runner-written terminal receipt with client_command_id; cites srv1 execution
receipt for supervised-lease selection over detached reconciliation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix non-fold residue in serialize_supervised_rpc_error.

Replace JsonValue wildcard arm with exhaustive match over all six
variants so non_fold_residue_no_unrostered_or_stale passes without a
roster row.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add wet supervised-turn witness and srv1 handoff entry.

Runner was already realized; this wires a falsifier-rehomed wet witness
that materializes the bundled native, preflights via rateLimits, runs
run_codex_supervised_turn, and asserts terminal receipt + client_command_id
without belt dispatch.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix wet supervised-turn witness parse errors.

Match-arm bodies need braces; split client_command_id check into let
bindings so multi-line == does not follow && inside a match arm.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix wet witness parse: trailing == on continuation lines.

Parser rejects continuation lines that START with == but accepts ||
(measured on main binary). Move == to end of prior line in wet_supervised_turn_terminal_ok;
record defect in std.language_target_identity continuation_eq_operator_shape_note
with hermetic witness repro controls.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Record srv1 wet OOM receipt and add bisect witnesses.

Full supervised wet witness killed at ~89 GiB with no child processes;
move file to OfflineLocalRecipe, remove falsifier roster row, add bisect
fns with declared MemoryMax envelopes for operator-bounded srv1 runs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix wet bisect witness: bind registry_artifacts in match arm.

Pattern used registry_artifacts: _ then referenced the name in the body,
which fails compile before bisect step 1 can run.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Isolate materialize leak: prepare split + lookup fold fix.

Bisect confirmed leak in package_delivery.materialize_codex_runtime_bundle on main. Split prepare_codex_runtime_closure for narrower wet bisect; eliminate filter allocation in package_lock_lookup_node; record production defect note. No wet re-run until capped confirmation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add wet bisect step 2b: select_codex_exact_target_closure only.

Isolates closure selection and codex_wrapper_lookup / codex_target_package_lookup from materialize shell path for capped srv1 run at MemoryMax=2G.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Drop wet bisect from witness enrollment until materialize is fixed.

Convert bisect entrypoints from test fn to plain fn so Phase 0(b) admission does not count five UnclassifiedPathDeferral rows with zero consumers. Remove OfflineLocalRecipe exclusion row; file stays as operator-only reproduction via gunbc run.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add wet bisect step 2c: wrapper tarball acquire only.

Isolates acquire_and_admit_registry_artifact for the wrapper after closure prepare — DownloadToFile plus sha512 verify, no platform pair or npm path.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add pre-shell materialize bisect entries after instrumented trace.

Split source construct, prepare, and through_prepare from full materialize body eval; remove pre-mktemp from materialize wet witness so bisect has zero shell before materialize.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix wet bisect parse: data decl value must be same line as '='.

Continuation-operator fix (#8259) does not cover declaration '=' breaks; corpus has zero split-line data rows.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add wet bisect rung: platform artifact acquire only.

Ladder through through-prepare passes at 72f6ead; full materialize pins 8G — next isolate native platform tarball acquire.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add final materialize bisect seams: pair, npm ci, finish.

Extract codex_runtime_install_from_prepared for install-through-verify; add through_pair_acquire, through_npm_ci_offline, and finish_after_install bisect entrypoints.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add finish-stage observe bisect rungs for materialize leak (#8166).

One wet entrypoint per observe inside finish_codex_runtime_materialization_after_install plus a two-file tiny-tree fixture for observe_package_materialized_tree isolation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Remove duplicate npm import after main merge.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add single-file protocol schema interpreter bisect rung.

wet_finish_parse_canonicalize_largest_protocol_schema_only installs Codex,
generates the schema dir, then parse_json + canonicalize_json_value on only
codex_app_server_protocol.schemas.json — no fold, manifest, serialize, or sha512.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Restore package_delivery.dag after rebase conflict resolution.

Auto-resolving rebase conflicts with main dropped PR materialize/bisect
changes; restore the full #8166 package_delivery surface from pre-rebase tip.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Take main's rack_power.dag to fix annotation grain CI red.

Branch revert 45f81ae re-introduced body-grain // comments that main had
already hoisted to module-item grain above PowerRefusal and rack_power_budget.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Take main's spatial_projection and planar_projection annotation fixes.

Complete the 45f81ae revert undo: hoist // comments to module-item grain in
the two remaining files that rack_power fix alone did not cover.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Drop false continuation_eq note; update accounting note for #8259.

#8259 dissolved operator-leading continuation asymmetry for == and +.
Remove the PR-only continuation_eq_operator_shape_note, restore main's
continuation witness at src/v1/tests/claim/, and rewrite
accounting_arithmetic_shape_note as a receipt rather than stale parser advice.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add parse-only rung for protocol schema JSON memory split. (#8272)

Confirmed on srv1 under MemoryMax=8G: parse-only and parse+canonicalize
both pin 8 GiB on codex_app_server_protocol.schemas.json (506,984 bytes,
~16,500x input). Defect is parse_json / JsonValue construction.

Rebased onto press-0-step2 (8990f2a).

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>

* Address supervised-turn correctness floor for #8166.

Keep stdin open through turn terminal, supervise process groups, persist
client_command_id before turn/start, refresh in-session standing, and
use generation-scoped lease binding; witnesses cover exit-0-not-observed.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix supervised turn JSON escaping and remove Python thread-id fork (#8166).

Route turn/start through codex_app_server_turn_start_request_line (serialize_json), delete the embedded Python extractor, add typed supervised_thread_id_from_line for post-hoc decode, and mark the concat-built fifo coprocess as declared scaffold with dissolution toward host_effect_apply Phase 2.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Document thread-id sed substitution assumption for supervised turn (#8166).

Record that in-shell sed into the turn/start JSON line is interim and charset-unbound until protocol schema or typed transport lands.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Delete supervised turn bash coprocess; wire typed host_effect transport (#8166).

Operator RejectAndFinishNow: remove codex_supervised_turn_script (36 concat), retained_transport, and sed thread-id substitution. Add extdeps.llm.codex_app_server_stdio_session intent, CodexSupervisedWorkerTurn host effect, and gunbc.codex_supervised_turn_run routing through host_effect_apply; realize refuses until native session driver lands.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Land Codex app-server stdio session driver for supervised turns (#8166).

Native coprocess driver (pipe stdin, setsid, poll-to-terminal, process-group kill) ships as target/release/codex_app_server_stdio_session and is invoked through gunbc.host_effect_codex_supervised_turn via host_effect_apply CodexSupervisedWorkerTurn. turn/start uses JSON parse+re-serialize (no sed). ShellEffectApplied carries stderr for capture wiring.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Register codex_app_server_stdio_session in self-host frontier for regen.

Seed-retained intrinsic registration drives stage0_crate_layout_generated
and emitted gunbc_stage0_crate_layout_generated so lib.rs and fresh self-compile
agree on pub mod codex_app_server_stdio_session. Includes workflow regen drift
from generated_artifact_gate main_wet.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Enroll codex_app_server_stdio_session in extdeps scope frontier.

Declare ExternalModelScope for the Codex app-server stdio session transport
(citing github.com/openai/codex) and add the module to scope_carrier_paths
so extdeps_scope_placement_gate admits the new extdeps file.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add CodexSupervisedWorkerTurn arm to converge_cli_applied_knob_count.

Fleet converge CLI does not count supervised worker turns as applied knobs;
return fallback like neighboring non-ConvergePlan HostEffect variants.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fail closed when Codex session preamble file cannot be read.

Return exit 1 before spawning the coprocess instead of substituting
an empty preamble (review 52819 / composer-2.5 REQUEST_CHANGES).

Co-authored-by: Cursor <cursoragent@cursor.com>

* Refuse invalid thread/turn-start-id argv instead of silent defaults.

When --thread-start-id or --turn-start-id is present, a missing value or
non-integer parse fails with exit 2 before spawn — same idiom as other
required argv and the preamble read fix (review 52819 second instance).
Omitted flags still default to 4 and 5.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix generation-store conflation for supervised turn exactly-once fence.

Replace Int? collapse with CodexSupervisedGenerationRead coproduct, route store failures through codex_supervised_turn_generation_admission into turn-start refusals, and refuse when generation fence write fails.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix stdio session driver RPC id matching to exact JSON parse.

Replace substring "id":{rpc_id} pre-filter with parsed id comparison so id 41 cannot satisfy rpc_id 4; aligns seed driver with codex_supervised_turn.dag exact-id matching.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Remove frontier_probe_survey from release bin pack after roster deletion.

Main deleted the bin with the self-host frontier roster; merge incorrectly re-enlisted it. Regenerate CI workflows via main_wet.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Regen compiler_tests.rs after #8344 frontier roster deletion.

Fresh seed rebuild + regen_stage0 --verify (divergence 0); removes stale Witness coercion/is_copy assertions dropped when frontier probe witnesses were deleted on main.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>
briansrls pushed a commit that referenced this pull request Aug 18, 2026
* Record a hypothesis three lanes killed, so the next session re-reads it instead of re-running it

While root-causing a Root D residue, keen-ibex-435 found the emit
authority rendering types with empty_emit_graph_info() and classified
all 14 production sites (2 context-free, 7 latent, 5 plumbing). I then
proposed the natural next step: that this is the shared upstream beneath
Roots B2 and R1, since both are "the decision disagrees between
declaration and call site" and that is what a missing env looks like
from downstream.

It is false. lively-ibex-709 killed it twice -- population disjointness
(zero of 112 B1 E0369 sites are in the operation/capability emit paths;
all seven files are std_*) and then signature absence (0/112 carry a
placeholder or unresolved type var; all name concrete carriers).
bold-lark-722 killed it for the wrap axis by mechanism: shared_types
arrives as its own positional argument carrying the real set, so wrap
membership is not degraded at those sites; what an empty info zeroes is
generic-scope rendering and applied-binding resolution, a different
diagnostic class.

The hypothesis cost three lanes an hour and produced nothing citable, so
without a record the next session regenerates it -- it is the obvious
reading of the evidence and it will occur to whoever reads the same two
root descriptions. That regeneration is the redundant future work
DESIGN section 2 prices, and a negative result is the cheapest thing in
this program to lose and the most expensive to rediscover.

Two details are preserved deliberately rather than compressed away: that
the five plumbing sites had a discriminating case ATTEMPTED per site and
not found (which is what licenses leaving them alone -- "no case found"
and "nobody looked" are indistinguishable a month out), and that
bold-lark's mechanism read is structural rather than executed, which its
own author refused to upgrade to proof.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* chore: regenerate drifted generated artifacts (ci auto-heal)

* I repointed a dead citation to another dead citation, twice, in the sweep meant to fix dead citations

review 52919 caught it. The F5 row and the rust end-state row in
gunbc.plans.language_target_self_host_frontier cite
emitter_produced_baseline as the surviving count authority after the
roster cut. That symbol does not exist. Verified: it appears three
times in the tree and all three are prose -- two notes in
interpreter_replacement_cut and stage0_crate_layout, and my own two
cells. seed_emitter_behavioral_green_count and its baseline appear
exactly once each, in the same cell I wrote. Neither has a declaration
anywhere.

So the repoint in #8344 replaced a citation to a deleted symbol with a
citation to a symbol that was never declared, which is worse than what
it fixed: the old one at least named something that had existed and
would fail a grep against history. This is the class I have been
quoting at other lanes all night, committed by me, in the diff whose
entire purpose was clearing it.

The root is that I searched for the FORM of the old citation rather
than resolving the NEW one. A repoint is two obligations, not one --
remove the dead name, and prove the replacement resolves -- and I
performed only the first. DESIGN section 3 says a stale name is
decidable and grep-checkable, which is exactly why there is no excuse
for it.

Fixed by stating the bar qualitatively where no symbol survives to
carry it, rather than by finding a third name to point at. After the
roster cut nothing counts producer-qualified emissions, and the honest
sentence is that no module carries a producer-qualified promotion --
not a fabricated tally. Where a real symbol does carry the fact, the
cells now name it: EmitterProducer x EmissionQualification,
mint_producer_emission_receipt as the only route to a receipt, the
realized-closure wall seed_emit_rust_reachable, and
BehavioralProbeUnbound as the honest standing for a receipt that has
produced source and nothing more.

The rust end-state cell also still read "SeedRetained roster", which
contradicted the roster deletion this same PR documents. It now says
there is no denominator and declines to invent one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Sync the projection to the carrier I already fixed, derived from the carrier rather than retyped

review 52930 is correct and the finding is the drift itself: 694e10e
fixed gunbc.plans.language_target_self_host_frontier and CI auto-heal
had already regenerated the .md against the PREVIOUS head, so the
carrier said one thing and its projection said another. The PR
therefore still showed F5 and the rust end-state row citing
emitter_produced_baseline -- reintroducing, in the generated artifact,
exactly the defect the commit message described fixing in the source.

The projection is regenerated FROM the carrier, not retyped to match
it: the two cell texts are parsed out of the .dag rows, unescaped, and
substituted into the corresponding table cells, so the .md carries the
carrier's bytes rather than my second rendering of the same sentence.
Retyping is how a projection acquires an independent voice, which is
the dual authority the generated-artifact discipline exists to prevent
-- and it would have been undetectable here, since nobody diffs prose
for meaning.

Verified both directions: zero occurrences of emitter_produced_baseline
or seed_emitter_behavioral_green* remain in either file, the surviving
symbols the cells now name (seed_emit_rust_reachable,
BehavioralProbeUnbound) are present in the projection, and the file
line count is unchanged at 85 so no row was structurally disturbed.

If CI auto-heal regenerates on this head it should be a no-op; a heal
commit that CHANGES these two cells would mean my substitution does not
match the real generator, which is worth knowing and is why the file
count and cell-presence controls are recorded here rather than assumed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FwPMTY6Myy3scaMNn33cg5

* Retract the ungrounded 112: state the two findings as universals, flag the denominator unreconciled

The killed-hypothesis section asserted "zero of the 112 B1 E0369 sites" and
"0/112 show a placeholder", carrying a bare literal copied from another
session's run with no command, no scope, and no reconciliation. This
document's own section 18 mechanism table puts E0369 at 191, explicitly
undetermined and unclassified, and the only other 112 in the document is
source_authority's E0599 count. A reader joining the two sections gets 191
against 112 with nothing to reconcile them, in a document whose closing
paragraph advertises that every claim in it names its measurement. That is
the DESIGN section 5 oracle rule violated in prose: a measurement copied from
another tree is not an oracle for this one.

Both findings are universals over whatever set was examined -- a wrong count
cannot turn a "none" into a "some" -- so they are restated without the
denominator and the denominator is carried as unverified with the 191
discrepancy named. Also disambiguates the coincident 7: the std_* file set
and the seven-site latent set are different quantities sharing no member.

Found by an independent read, not by the two approvals this PR already
carries.

* The 112/191 reconciliation landed in #8371: cite section 18.4 instead of declaring it owed

My retraction correctly refused to invent a reconciliation and recorded one
as owed. It landed while this PR was open. Section 18.4 states both scopes:
112 is the distinct-site count of the July 7-module measured bank, 191 is
the same classification at M=11 scope, both repr_fork with zero
missing_trait_impl. Two scopes of one population, not a discrepancy.

Leaving the "owed" clause would advertise an open obligation that is closed,
which is the stale-citation class this PR exists to remove -- the same
failure one turn later.

Also makes the coincident sevens precise now that the bank is named: the
seven std_* files are the July bank's module set, a different quantity from
the seven latent empty_emit_graph_info() sites, sharing no member.

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants