DESIGN.md: cut to first principles (27.5k → 9.5k words), at the model not the emission by briansrls · Pull Request #8476 · gunb-ai/gunbc

briansrls · 2026-08-18T23:50:24Z

Summary

Operator ruling: DESIGN.md is a first-principles document, and per-lane status in it is a dual representation. This cuts it from 27,516 → ~9,460 words.

Every edit is made to dag/gunbc/design_document.dag — the model — and DESIGN.md is regenerated from it, so the committed bytes are a fixed point of the authority rather than a hand-patched file that happens to match. (An earlier attempt edited the emission directly; that was reverted, since DESIGN.md carries merge=generated-artifact.)

Deleted: the Open threads section, 37 per-lane status rows. Ten lanes that cited no design document were re-homed to docs/plans/ first, so nothing was dropped without a home; the other 27 already pointed at one.

Compressed to principle, with operative detail moved out rather than deleted:

§3's replacement-migration rule keeps why leaf-upward editing creates authority before removing any, the attractor and its A3 grounding, delete-first with the deletion as the census, the two carve-outs, and what "atomic" means — citing docs/plans/replacement-migration-doctrine.md for the loop, disposition census, cut search and receipts. §3 goes ~7,000 → ~1,860 words.
§5's scaffold ruling keeps the rule (a dissolution condition is a lifecycle fact, not a permit; the default landing state is the final construction) and cites docs/plans/scaffold-admission-doctrine.md for the verdict vocabulary and the out-of-band-actuation case.
§3's opening paragraph keeps interface/realization/policy as three facts and drops the worked extdeps detail.

Consequential edits, not incidental:

Four documentary citations retired with the paragraphs that cited them (three body-lowering refs, the five-minute-CI-gate ref). Their DeclarationRef declarations survive in doc_graph_roots, where other consumers use them.
The ten re-homed documents plus one main added (Monotone roster contract: an undispositioned SHRINK of floor_expected_red must refuse (instantiate witness_deferral_freeze at inverted polarity; design note first) #8492's shrink-monotonicity lane, whose doc was reachable only through a deleted row) are registered as HandAuthoredDocBind rows, each naming a verified carrier symbol and a retirement condition. doc_graph_orphan_count 16 → 4.
Registered expected_red_roster_join in the stage0 crate-layout authority. Expected-red roster identity join: three-outcome full-roster classification #8428 landed that module's source, its lib.rs line and its Cargo bin without a registration row, so main's lib.rs carried a line its own generator would not emit; regen_stage0 now reproduces it byte for byte.

Test plan

All green by execution on the merged tree:

gunbc compile --source-root dag --source-root src/v2 --source-root src/v1 --dependency-pool-index primary-precedence --target dag — 0 blocking errors
cargo check --workspace --all-targets — 0 errors
documentary_refs_generated_document_renders_the_rows / _population_is_the_union / _renamed_system_refuses / _ambiguous_system_refuses — all true
doc_graph_bind_identities_unique / _works_refs_carry_symbols / production_doc_binds_all_carry_a_retirement / _hand_authored_slugs_not_registered — all true
generated_artifact_gate main_wet — zero drift; DESIGN.md byte-identical across two runs on different binaries (before and after rebuilding against main's interpreter changes), so it is a genuine fixed point and not a stale-emitter artifact

The two perturbation controls in documentary_refs_witness_test were RED for one edit before this landed: their specimen was a body-lowering symbol the document no longer cites, so they were retargeted onto the surviving citation. That red is the receipt that they still discriminate.

Known gaps, stated rather than implied

The "cite the BIG patterns" half of the original ask is not delivered. Realization is cited (§2, pre-existing); leasing/locking is absent; fabric is deliberately deferred per the operator's "design.md doesn't really know about the fabric — I'll dispatch work after we've settled the design". This PR is the cut, not the addition.
Residual doc-graph reds are not mine and are not fixed here: 4 orphans and 5 dangling links predate this branch (docs/plans/ci-selection-vs-scheduling.md is deleted but still linked from ROADMAP.md and four plans). Both witnesses were already false at the merge base — verified by stashing.

🤖 Generated with Claude Code

https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

The control plane was built once (#8016), never deployed, and never ran: it is in no release-bin roster, no systemd unit, no converge membership, and no .gunbc state exists anywhere. Its only live surface was a /ci route that answered a permanent 503 by construction. It therefore holds no boundary, which makes this the cleanest form of the DESIGN 3 delete-first cut: nothing depended on it, so nothing regresses. What it was: 1754 lines of hand-written Rust implementing semantics the substrate already models -- a poll loop, a filesystem queue, a lease, HTTP to GitHub, and JSON state -- under a declared scaffold whose three dissolve-on items were all still open. Per DESIGN 7 the seed shrinks toward zero, and this was the seed growing instead. Two forks die with it. QueueLease was a nickname for std.temporal_effect HeldLease, which already carries lease_key, resource_fingerprint, owner_fingerprint, generation, and a five-armed observed state, and whose decision_for_held_lease_verdict already yields stale-lease reclaim and foreign-holder refusal. CiExecutionSubject fused demand and work into one identity, so a retry had nowhere to live. Deleted whole rather than migrated, per the standing rule that a replacement cuts at the root: both Rust files and the bin registration, gunbc.owned_ci, owned_ci_seed (which existed only to feed the Rust seed), owned_ci_serve, owned_ci_page, gunbc.ci_execution_plan, the witness module, and the design doc whose sequencing was the old shape's gravity. Git history keeps all of it as quarry. The witnesses are retired rather than re-enrolled, with a receipt: their subject is the fused subject/run model, and evidence whose only subject is a rejected shape must not be left standing (DESIGN 4b). The lease obligations they covered are already witnessed against HeldLease in temporal_effect_spine_witness_test. The generated crate-layout artifacts are edited mechanically here rather than regenerated locally; the drift gate is the oracle for them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GJgwfCsHvvRLD5EAErgP7F

review 52992 (cursor): roadmap_serve_witness_test still imported CiRunsPageHandler, CiRunDetailPageHandler and CiRunsJsonHandler and asserted that /ci, /ci/runs.json and /ci/run/{run_id} select them. Those variants, routes and dispatch arms are deleted by this cut, so the enrolled witness would not resolve against the updated module. Correct and confirmed by reading the file; fixed rather than argued. Why the first sweep missed it: the residual grep searched for the deleted MODULE names (owned_ci, ci_execution_plan, ci_control_plane). These three symbols contain none of those strings -- they are symbols removed from a SURVIVING module. A deletion has two reference surfaces, not one, and only the first was swept. The re-sweep covers both: every symbol removed from a surviving module, every exported symbol of each deleted module, and the route literals. All clean across dag/, src/ and .github/. No route-count assertion exists that the three removals would falsify. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GJgwfCsHvvRLD5EAErgP7F

Per merge policy, a merge commit rather than a rebase. One conflict, in src/v1/stage0/src/lib.rs, and it was reported by the generated-artifact merge driver refusing rather than answering: it left the ours side with no conflict markers, marked the path unmerged, and printed the regeneration recipe. That is the driver behaving correctly -- both sides had changed the file since the merge base, and taking either side wholesale would have dropped the other's authority-derived bytes. Resolved by composition rather than by picking a side: main's module list, which gained v1_tests_claim_checkpoint_identity_keying_witness_test in the cutover, MINUS the pub mod ci_control_plane this branch deletes. Both changes survive. The other three generated crate-layout artifacts auto-merged; verified line-by-line that each now equals main's content minus ci_control_plane and nothing else, rather than trusting the auto-merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GJgwfCsHvvRLD5EAErgP7F

Catching up to origin/main at b9763bd. Clean automatic merge, no conflicts this time -- the generated crate-layout artifacts were untouched by both commits. #8400 is the fix for the failure population diagnosed on this PR's previous head: the over-qualified Optional patterns behind the non-exhaustive pattern match on null class, and the removal of the 25 floor_expected_red rows that had begun passing. Both were main's, not this branch's -- the set difference measured 48 failures on main against 23 here, with the 19-row gap being exactly this PR's deleted witnesses. Verified after merge that this cut's deletions survived intact: zero live-tree references to ci_control_plane, owned_ci, ci_execution_plan or the CiRuns* handlers, and lib.rs carries no ci_control_plane module. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GJgwfCsHvvRLD5EAErgP7F

Merge commit rather than a rebase, per the repo's merge policy: the branch is under review and force-pushing it would invalidate the approvals for no change in end state. Four conflicts, all in generated crate-layout artifacts, all reported by the generated-artifact merge driver refusing rather than answering -- it leaves the ours side, marks the path unmerged with no markers, and prints the regeneration recipe. Two surfaced as ordinary conflicts and two as unmerged paths with no diff markers. Resolved identically in each: main's content minus pub mod ci_control_plane and its three roster entries. Main's new codex_app_server_stdio_session registration is preserved in all four artifacts. Verified per file that the ONLY difference from main's version is ci_control_plane, rather than trusting the resolution. Live-tree references to ci_control_plane: zero. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GJgwfCsHvvRLD5EAErgP7F

# Conflicts: # src/v1/stage0/Cargo.toml

…tterns that would have caught the forks Open threads had become the parallel ledger §6 forbids: 15,336 words across 40 rows, 53% of the file, against ~6,800 words for the reasoning the document exists for. The file had already diagnosed this once, in one row -- the five-minute-CI-gate paragraph records its own six-step copy going stale after the roadmap authority was recut. This generalizes that fix. Deleted (operator ruling, overriding the enumerate-before-deleting rule): the whole Open threads section. Four lanes went outright -- SCM economics, gunb.ai site subsumption, srvN build-cache, srv4 subsumption -- each verified first against the test that matters: every module it named resolves and its plan doc exists, so the row was a summary of live carriers and removing it loses nothing. Re-homed the nine rows that had no plan doc, bodies verbatim with provenance: cross-platform-instrument-motion, witness-cost-derives-from-purpose, secret-version-lifecycle, determinism-boundary-relative, disk-tier-repeat-resolve-closeout, content-hash-family-grounding, and parked-questions for the three too small to warrant a document. Extracted two doctrines that were principle-shaped only from a distance: replacement-migration (4,405w, 77% of §3 and 31% of the whole file) and scaffold-admission (792w from §5). Each leaves a statement of the principle and a link; the procedure, carve-outs, disposition census, terminal receipt and dated receipts live in the doc. §3 is 5,729 -> 1,257, §5 2,344 -> 1,755. Added "The recurring patterns": realization, materialization, leasing and fencing, reconcile, allocation, authorization, identity and keying, evidence and claims, observation-to-verdict, dissolution. Each carries its authority and a fork test, because that is the part that does work -- a census of one lane found eleven forked carriers, and every one was introduced by an author who did not know the pattern already had an owner. "If you are writing a record with a generation in it, you are re-declaring leasing" would have caught LeaseIdentity before it dropped owner_fingerprint and left the receipt fence with no owner to compare. Also lands three new design notes from the fabric/CI-minutes work: fabric-concept-reconciliation (the authority census), ci-minutes-product-design, floor-semantic-artifact-design. 29,084 -> 9,340 words. No section over 1,800. Three links, all resolving. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

…ted the emission instead of the model DESIGN.md carries `merge=generated-artifact` in .gitattributes and is emitted from dag/gunbc/design_document.dag via expected_design_md, consumed by gunbc.generated_artifact_emit. The previous commit hand-edited the emitted file, which is out-of-band actuation -- hand-applying an actuator with a commit wrapped around it -- and left live model/emission drift: the model still carried every Open threads row the emission had lost, so the next regen would have silently reverted the whole cut. Caught by checking .gitattributes before flipping the PR to ready. It should have been the first check, not the last. This restores DESIGN.md to the model's current output. The eleven new docs/plans/*.md files are unaffected -- they are hand-authored and were never generated -- so the re-homed lanes and the two extracted doctrines stand. The cut itself is re-applied in dag/gunbc/design_document.dag, where it belongs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

Two conflicts, both in the stage0 seed. Cargo.toml: took main's expected_red_roster_join [[bin]] alongside this branch's additions; verified the file parses and carries 34 bins, and that the one comment line dropped was main's own deletion. lib.rs: git merged it cleanly but the result did not compile — main's cli_run.rs references crate::expected_red_roster_join (12x E0433) while neither main's nor this branch's crate-layout authority registers that module. main carries the drift: PR #8428 landed the source, the lib.rs line and the Cargo bin without a SeedRetainedIntrinsicRegistration row, so main's lib.rs contains a line its own generator will not emit. The floor cut deleted the generated-artifact drift gates, so nothing caught it. Fixed forward at the authority rather than by hand-editing the emission: added the registration row to v2.compiler.self_host.stage0_crate_layout, regenerated dag/gunbc/stage0_crate_layout_generated.dag and the bootstrap mirror via generated_artifact_gate main_wet, rebuilt regen_stage0 against them, and confirmed regen_stage0 now reproduces main's lib.rs byte for byte -- so the emission is a fixed point of the model rather than a hand-patched file that happens to match. Verified: cargo check --workspace --all-targets clean, 0 errors. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

…sion Operator ruling: DESIGN.md is a first-principles document; per-lane status in it is a dual representation. 27,516 -> 9,279 words. Every edit is to dag/gunbc/design_document.dag; DESIGN.md is regenerated from it, so the committed bytes are a fixed point of the model rather than a hand-patched file that happens to match. Deleted: the Open threads section, 37 per-lane status rows. Ten lanes that named no design document were re-homed to docs/plans/ first (the other 27 already cited one), so nothing was dropped without a home. Compressed to principle, with the operative detail moved out rather than deleted: the section 3 replacement-migration rule (why leaf-upward editing creates authority before removing any; the attractor and its A3 grounding; delete-first with the deletion as the census; the two carve-outs; what "atomic" means) now cites docs/plans/replacement-migration-doctrine.md for the loop, the disposition census, the cut search and the receipts. The section 5 scaffold ruling keeps the rule -- a dissolution condition is a lifecycle fact, not a permit; the default landing state is the final construction -- and cites docs/plans/scaffold-admission-doctrine.md for the verdict vocabulary and the out-of-band-actuation case. Section 3's opening paragraph keeps interface/realization/policy as three facts and drops the worked extdeps detail. Four documentary citations retired with the paragraph that cited them (three body-lowering refs, the five-minute-CI-gate ref); their DeclarationRef declarations survive in doc_graph_roots where other consumers use them. Evidence, all green by execution on this tree: - documentary_refs_generated_document_renders_the_rows: true - documentary_refs_population_is_the_union: true - documentary_refs_renamed_system_refuses: true - documentary_refs_ambiguous_system_refuses: true - doc_graph_bind_identities_unique / works_refs_carry_symbols / production_doc_binds_all_carry_a_retirement / hand_authored_slugs_not_registered: true - compile-clean gate (3 roots, primary-precedence): 0 blocking errors The two perturbation controls were RED for one edit before this landed: their specimen was a body-lowering symbol the document no longer cites, so they were retargeted onto the surviving citation. That red is the receipt that they still discriminate. Orphan wall: the ten re-homed documents are registered as HandAuthoredDocBind rows, each naming a verified carrier symbol and a retirement condition. That moves doc_graph_orphan_count 16 -> 4. The residual 4 orphans and all 5 dangling links predate this branch (docs/plans/ci-selection-vs-scheduling.md is deleted but still linked from ROADMAP.md and four plans); not fixed here, and reported rather than absorbed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

One conflict: DESIGN.md, a generated artifact. Both sides changed it since the merge base, so the merge driver refused rather than taking a side -- correctly, since neither side's bytes are the projection of the merged authorities. The model auto-merged cleanly and disjointly: main edited one line in Building & checks, which this branch never touched, and this branch's Open-threads deletion and section 3/5 compression are untouched by main. DESIGN.md was therefore regenerated from the merged model rather than resolved by hand, and it is byte-identical across two main_wet runs on different binaries (before and after rebuilding against main's interpreter changes), so it is a genuine fixed point and not an artifact of a stale emitter. Verified on the merged tree: - compile-clean gate (3 roots, primary-precedence): 0 blocking errors - four documentary_refs witnesses: true - three doc_graph bind witnesses: true - staged diff vs origin/main is exactly this branch's intended change set NOT done, and not this merge's to fix: `claim_executor --required-regen`, which replaced regen_stage0 in #8406, refuses on this tree -- and refuses by construction on any tree. required_regen_host.rs builds the emitted population from emitter path keys ("src/std_algebra.rs") and the committed population from bare basenames ("std_algebra.rs"), then compares the two sets directly in validate_compared_populations, so all 145 emitted names miss every committed name. Stripping the prefix leaves zero emitted-only files and six committed-only ones, which are hand-Rust seed modules excluded by two different vocabularies (is_hand_maintained_path on paths vs HAND_MAINTAINED_STAGE0_FILES on basenames). Reported rather than worked around; no stage0 emission in this branch depends on it. Also stale on main: .githooks/generated-artifact-merge still instructs `cargo build --release --bin regen_stage0`, a bin #8406 deleted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

Conflict this time was in the MODEL, not the emission: delete-vs-edit on dag/gunbc/design_document.dag. This branch deletes open_threads_blocks(); main edited rows inside it. Resolved toward the deletion per the operator ruling, but not by simply taking our side -- main's edits had to be carried somewhere, so all three parts were handled: 1. Took the deletion of open_threads_blocks(). 2. main REWROTE the "witness cost derives from purpose" row in #8501 (typing the falsifier cadence gap as DeclaredCadenceUnrealized). This branch had re-homed that lane verbatim from the OLDER text, so taking our side wholesale would have silently reverted #8501's rewrite. docs/plans/witness-cost-derives-from-purpose.md now carries main's current text, with the provenance header naming the commit it came from. 3. main ADDED one lane, floor_expected_red shrink monotonicity (#8492), whose document docs/plans/floor-expected-red-shrink-monotonicity-design.md is reachable ONLY through the row being deleted -- verified: no bind on main, and DESIGN.md is its sole .md referrer. Registered as a HandAuthoredDocBind on v2.workflow.floor_expected_red floor_expected_red_roster so the deletion does not orphan it. Verified the row-level delta rather than eyeballing the conflict: main added exactly 1 row and edited exactly 1, with 0 removed. KNOWN RED, NOT MINE AND NOT FIXED HERE: compile-clean now reports one hard diagnostic, "expected Colon, found Newline (src/v1/trait_bound_witness.dag:5482-5483)". That file arrived with this merge from main (#8466, 6aac73c), is byte-identical to main's copy, and is absent from this branch's diff. Reproduced on a pristine 122677c worktree with the same binary: identical diagnostic, so main is red on compile-clean by itself. The defect is line 7 -- `data TraitBoundWitnessScope = BoundedToDirectTopLevelMatchBody` declares a coproduct with `data`, which requires a `: Type` annotation, so the parser hits a newline where the colon belongs; it wants `type`. Nothing runs compile-clean in CI since the floor cut removed that job, which is why this landed on main unnoticed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

Third conflict, same shape as the second and benign: main's #8500 rewrote the Building & checks CI rung-drop line (correcting the falsified "no witness has executed" sentence now that the floor fold does execute). This branch never touched that line, so the model auto-merged and only the generated DESIGN.md conflicted; the merge driver refused rather than picking a side, and DESIGN.md was regenerated from the merged model. Verified: the merged model carries main's CI line byte-identical, and this branch's Open-threads deletion and section 3/5 compression are intact. Staged diff vs MERGE_HEAD is exactly this branch's change set, and the tree has no generated-artifact drift after regen. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012q31BK3okLA8vG4kdTWtBf

The boundary section asserted DESIGN.md needed no edit BECAUSE its shell -> intent open-thread row already routed runtime-present sites to typed effects. That row is gone: #8476 cut DESIGN to ~9.5k words and removed open-threads wholesale, and this branch merged main two commits ago. The conclusion survives, the reason does not. What the boundary instantiates now is section 3 general paragraph -- interface, realization and policy are three facts, transport is a Realization handler one of N, dispatch sits peripheral -- so a CLI-backed handler is that shape at the tool seam and DESIGN still needs no edit. Caught while verifying the previous commit against the rewritten DESIGN rather than the one the clause was written against, which is the same check the previous commit performed on fourteen other claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… the authority, and CLI invocation is not the universal effect model (#8535) * Name the boundary: argv is not the authority, and CLI invocation is not the universal effect model gunbc#8467 establishes that an argv array is a serialization, exactly as bash text is a serialization of a bash AST. Accepted. But stated without a boundary it reads as replacing every typed effect with a CLI tree, which moves the authority downward into one realization technology -- the section 3 violation this lane exists to name, one layer below where it usually appears. So the two lanes are one migration program with a named boundary. This lane owns the semantic destination and site routing: the authority stays the typed domain operation or typed HostEffect, and it decides whether a realization is native, REST, filesystem, library, CLI-backed, or necessarily text-emitting. #8467 owns the inside of the CLI-backed cell. A native handler reaches no CLI surface at all. The census also carried a stale unit. Sizing by argv occurrence, then by executable head, then by tool each produced an inflated remainder, because a tool vertical, its site cutovers and its host_effect_apply caller are commonly ONE vertical whose acceptance condition is the old site's deletion. The measured shape, production only: transport shell 236 lines / 48 files -- 230 lines / 45 files in extdeps argv: 457 lines -- 275 extdeps, 172 gunbc, 10 src/v2 bridge calls 48 across 13 files fn *_argv 333, of which ~158 model no tool at all transport shell is overwhelmingly an extdeps population, i.e. beneath already-typed operations. This lane's original job -- getting shell out of the intent -- is substantially done; the remainder is transport depth. Recorded with the caution that a transport shell block is not a shell program at all: the seed executes it as Command::new(&argv[0]).args(&argv[1..]). Two finish lines are therefore named separately, SHELL-DAG and CLI-AUTHORITY, so a row complete against the first but owing the second reads as the boundary working rather than as incomplete work. A SHELL-DAG row is never blocked on CLI-AUTHORITY. One live instance found while verifying: extdeps.exec.command command_over_transport builds append(ssh_exec_prefix, command.argv) -- the exact SSH-as-prefix shape the boundary forbids -- in production, beneath the generic runner, which is the mechanism by which remote argument boundaries are lost. It shares a file with command_runner's argv -> quoted text -> heredoc round trip, whose carrier already declared the repair in command_runner_dissolution_trigger. The runner cut and the SSH target are one vertical. No code changes. DESIGN.md needs no edit and says so in the text: its shell -> intent row already routes runtime-present sites to typed effects and confines emission to foreign executors and bootstrap, so the boundary falsifies no sentence in it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Delete the refuted transport-wall prose; enumerate the bridge files; weaken the sequencing claim Review on #8535 found the first commit did the exact thing this document warns about five times: it appended a corrected boundary beside stale operational text without deleting the text it supersedes. The finding is correct and the stale claim is load-bearing. TransportScript has not been a transparent brand since #7962. It is a sole_constructor record whose single mint transport_script_seal is admit_callers-sealed to two production declarations, and the cast form closed with it -- 04_infer sole_constructor_construction_diags judges a cast into a sealed type. Both documents still asserted, in the present tense and in fourteen places, that the brand is transparent, that `String as TransportScript` is writable from any module, and that direct shell.Exec.Run is guarded by validation rather than construction. All false at this head. Enumerated by claim across both authorities rather than fixing the site under review -- the document's own standing rule, added after the fifth time this class recurred -- and rewrote every occurrence in place: section 3's terminal paragraph, 4.F's heading and three table cells, the 4 dissolution trigger, 5's end-state paragraph, 5.E's heading, premise and ruling block, the wind-down ledger row, the meta-exec row, and both sites in the invariant doc. The leak fixture is reclassified as scan input and historical record; it can no longer be cited as evidence the cast compiles. What actually survives is smaller and different in kind: the two admitted bridges take a bare body String, so arbitrary text still reaches a transport through a counted, reason-bearing, dissolves_to-carrying call. Conspicuous, not impossible, and it dissolves by per-site migration rather than by further wall work. Also from the review, each verified before acting: - The bridge count named no files. Enumerated all 13. Three -- package_delivery, codex_app_server_press, bmc_netboot_serve -- are absent from the section 4 punch-list that still calls itself complete at 78f43c3. Recorded as that snapshot's correction, not as a second census. - A classification question the count concealed: package_delivery (7 calls) and codex_app_server_press (3) route through retained_foreign, whose dissolves_to is the Bash emitter, while both appear to run inside a present gunbc runtime. If so, ten calls declare the wrong destination. Flagged for their owners; the executor window decides it and this document does not own that fact. - "A SHELL-DAG row is never blocked on CLI-AUTHORITY" was true of the homing decision and false as a sequencing rule, with the counter-example named in the same document: command_runner's cutover needs the structured process-argv carrier, and its SSH arm the nested shell-command target. Reworded. - Added an explicit statement that this is a boundary and scoping increment, not a closeout receipt -- neither finish line is met at this commit. Merged main to pick up #8467, now landed, so the cross-PR references describe a merged authority rather than an open branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the DESIGN clause this PR falsified: #8476 cut the row it cited The boundary section asserted DESIGN.md needed no edit BECAUSE its shell -> intent open-thread row already routed runtime-present sites to typed effects. That row is gone: #8476 cut DESIGN to ~9.5k words and removed open-threads wholesale, and this branch merged main two commits ago. The conclusion survives, the reason does not. What the boundary instantiates now is section 3 general paragraph -- interface, realization and policy are three facts, transport is a Realization handler one of N, dispatch sits peripheral -- so a CLI-backed handler is that shape at the tool seam and DESIGN still needs no edit. Caught while verifying the previous commit against the rewritten DESIGN rather than the one the clause was written against, which is the same check the previous commit performed on fourteen other claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…he dead import it names (#8612) * Name the boundary: argv is not the authority, and CLI invocation is not the universal effect model gunbc#8467 establishes that an argv array is a serialization, exactly as bash text is a serialization of a bash AST. Accepted. But stated without a boundary it reads as replacing every typed effect with a CLI tree, which moves the authority downward into one realization technology -- the section 3 violation this lane exists to name, one layer below where it usually appears. So the two lanes are one migration program with a named boundary. This lane owns the semantic destination and site routing: the authority stays the typed domain operation or typed HostEffect, and it decides whether a realization is native, REST, filesystem, library, CLI-backed, or necessarily text-emitting. #8467 owns the inside of the CLI-backed cell. A native handler reaches no CLI surface at all. The census also carried a stale unit. Sizing by argv occurrence, then by executable head, then by tool each produced an inflated remainder, because a tool vertical, its site cutovers and its host_effect_apply caller are commonly ONE vertical whose acceptance condition is the old site's deletion. The measured shape, production only: transport shell 236 lines / 48 files -- 230 lines / 45 files in extdeps argv: 457 lines -- 275 extdeps, 172 gunbc, 10 src/v2 bridge calls 48 across 13 files fn *_argv 333, of which ~158 model no tool at all transport shell is overwhelmingly an extdeps population, i.e. beneath already-typed operations. This lane's original job -- getting shell out of the intent -- is substantially done; the remainder is transport depth. Recorded with the caution that a transport shell block is not a shell program at all: the seed executes it as Command::new(&argv[0]).args(&argv[1..]). Two finish lines are therefore named separately, SHELL-DAG and CLI-AUTHORITY, so a row complete against the first but owing the second reads as the boundary working rather than as incomplete work. A SHELL-DAG row is never blocked on CLI-AUTHORITY. One live instance found while verifying: extdeps.exec.command command_over_transport builds append(ssh_exec_prefix, command.argv) -- the exact SSH-as-prefix shape the boundary forbids -- in production, beneath the generic runner, which is the mechanism by which remote argument boundaries are lost. It shares a file with command_runner's argv -> quoted text -> heredoc round trip, whose carrier already declared the repair in command_runner_dissolution_trigger. The runner cut and the SSH target are one vertical. No code changes. DESIGN.md needs no edit and says so in the text: its shell -> intent row already routes runtime-present sites to typed effects and confines emission to foreign executors and bootstrap, so the boundary falsifies no sentence in it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Delete the refuted transport-wall prose; enumerate the bridge files; weaken the sequencing claim Review on #8535 found the first commit did the exact thing this document warns about five times: it appended a corrected boundary beside stale operational text without deleting the text it supersedes. The finding is correct and the stale claim is load-bearing. TransportScript has not been a transparent brand since #7962. It is a sole_constructor record whose single mint transport_script_seal is admit_callers-sealed to two production declarations, and the cast form closed with it -- 04_infer sole_constructor_construction_diags judges a cast into a sealed type. Both documents still asserted, in the present tense and in fourteen places, that the brand is transparent, that `String as TransportScript` is writable from any module, and that direct shell.Exec.Run is guarded by validation rather than construction. All false at this head. Enumerated by claim across both authorities rather than fixing the site under review -- the document's own standing rule, added after the fifth time this class recurred -- and rewrote every occurrence in place: section 3's terminal paragraph, 4.F's heading and three table cells, the 4 dissolution trigger, 5's end-state paragraph, 5.E's heading, premise and ruling block, the wind-down ledger row, the meta-exec row, and both sites in the invariant doc. The leak fixture is reclassified as scan input and historical record; it can no longer be cited as evidence the cast compiles. What actually survives is smaller and different in kind: the two admitted bridges take a bare body String, so arbitrary text still reaches a transport through a counted, reason-bearing, dissolves_to-carrying call. Conspicuous, not impossible, and it dissolves by per-site migration rather than by further wall work. Also from the review, each verified before acting: - The bridge count named no files. Enumerated all 13. Three -- package_delivery, codex_app_server_press, bmc_netboot_serve -- are absent from the section 4 punch-list that still calls itself complete at 78f43c3. Recorded as that snapshot's correction, not as a second census. - A classification question the count concealed: package_delivery (7 calls) and codex_app_server_press (3) route through retained_foreign, whose dissolves_to is the Bash emitter, while both appear to run inside a present gunbc runtime. If so, ten calls declare the wrong destination. Flagged for their owners; the executor window decides it and this document does not own that fact. - "A SHELL-DAG row is never blocked on CLI-AUTHORITY" was true of the homing decision and false as a sequencing rule, with the counter-example named in the same document: command_runner's cutover needs the structured process-argv carrier, and its SSH arm the nested shell-command target. Reworded. - Added an explicit statement that this is a boundary and scoping increment, not a closeout receipt -- neither finish line is met at this commit. Merged main to pick up #8467, now landed, so the cross-PR references describe a merged authority rather than an open branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the DESIGN clause this PR falsified: #8476 cut the row it cited The boundary section asserted DESIGN.md needed no edit BECAUSE its shell -> intent open-thread row already routed runtime-present sites to typed effects. That row is gone: #8476 cut DESIGN to ~9.5k words and removed open-threads wholesale, and this branch merged main two commits ago. The conclusion survives, the reason does not. What the boundary instantiates now is section 3 general paragraph -- interface, realization and policy are three facts, transport is a Realization handler one of N, dispatch sits peripheral -- so a CLI-backed handler is that shape at the tool seam and DESIGN still needs no edit. Caught while verifying the previous commit against the rewritten DESIGN rather than the one the clause was written against, which is the same check the previous commit performed on fourteen other claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Settle the census's misfiled-bucket question by measurement, and delete the dead import it names The census flagged three modules as possibly-misfiled -- package_delivery, codex_app_server_press and provider_wire_evidence route through retained_foreign, whose dissolves_to is the Bash emitter (foreign executors and pre-runtime bootstrap), while appearing to run inside a present gunbc runtime. It recorded that as "a question for their owners -- the executor window is the deciding fact and this document does not own it." The question was decidable without them. package_delivery calls shell.Mkdir.Parents and shell.Find.FilesAndSymlinksWithMode -- typed operations that cannot execute without a present runtime -- in the same function bodies that then fall back to retained_foreign. A function that interleaves a typed operation with a retained foreign script is runtime-present by the fact that its first half ran. So the six remaining calls declare the wrong dissolution target. Three corrections fall out, all measured on 98d7147: - provider_wire_evidence has ZERO retained_foreign call sites. Its effects became typed extdeps.shell operations under review 50540; what survived was an unused import, deleted here. It is struck from the bucket, which is 12 rather than 13, struck through rather than dropped -- a census row that vanishes without explanation cannot be told from one that was never measured. - The call counts are stale in the direction the census warns about elsewhere: 5 and 1, not 7 and 3. - package_materialized_tree_observation_note records replacing a find-piped-to-sort string with shell.Find plus in-substrate std sort, because the string form escaped its quoting on a root containing an apostrophe and forked an authority extdeps.shell already owned. That migration landed at ONE site; another instance remains in the same module with the same shape and the same exposure. A carrier that records a fix should name the population it fixed, or the next reader takes the note as coverage. Local whole-corpus compile was started and killed at 15 minutes without terminating, so it is INCONCLUSIVE rather than clean -- stated rather than omitted. The deleted import is verified unreferenced by grep; CI's floor is the census. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ority, not dead code (#8623) * Name the boundary: argv is not the authority, and CLI invocation is not the universal effect model gunbc#8467 establishes that an argv array is a serialization, exactly as bash text is a serialization of a bash AST. Accepted. But stated without a boundary it reads as replacing every typed effect with a CLI tree, which moves the authority downward into one realization technology -- the section 3 violation this lane exists to name, one layer below where it usually appears. So the two lanes are one migration program with a named boundary. This lane owns the semantic destination and site routing: the authority stays the typed domain operation or typed HostEffect, and it decides whether a realization is native, REST, filesystem, library, CLI-backed, or necessarily text-emitting. #8467 owns the inside of the CLI-backed cell. A native handler reaches no CLI surface at all. The census also carried a stale unit. Sizing by argv occurrence, then by executable head, then by tool each produced an inflated remainder, because a tool vertical, its site cutovers and its host_effect_apply caller are commonly ONE vertical whose acceptance condition is the old site's deletion. The measured shape, production only: transport shell 236 lines / 48 files -- 230 lines / 45 files in extdeps argv: 457 lines -- 275 extdeps, 172 gunbc, 10 src/v2 bridge calls 48 across 13 files fn *_argv 333, of which ~158 model no tool at all transport shell is overwhelmingly an extdeps population, i.e. beneath already-typed operations. This lane's original job -- getting shell out of the intent -- is substantially done; the remainder is transport depth. Recorded with the caution that a transport shell block is not a shell program at all: the seed executes it as Command::new(&argv[0]).args(&argv[1..]). Two finish lines are therefore named separately, SHELL-DAG and CLI-AUTHORITY, so a row complete against the first but owing the second reads as the boundary working rather than as incomplete work. A SHELL-DAG row is never blocked on CLI-AUTHORITY. One live instance found while verifying: extdeps.exec.command command_over_transport builds append(ssh_exec_prefix, command.argv) -- the exact SSH-as-prefix shape the boundary forbids -- in production, beneath the generic runner, which is the mechanism by which remote argument boundaries are lost. It shares a file with command_runner's argv -> quoted text -> heredoc round trip, whose carrier already declared the repair in command_runner_dissolution_trigger. The runner cut and the SSH target are one vertical. No code changes. DESIGN.md needs no edit and says so in the text: its shell -> intent row already routes runtime-present sites to typed effects and confines emission to foreign executors and bootstrap, so the boundary falsifies no sentence in it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Delete the refuted transport-wall prose; enumerate the bridge files; weaken the sequencing claim Review on #8535 found the first commit did the exact thing this document warns about five times: it appended a corrected boundary beside stale operational text without deleting the text it supersedes. The finding is correct and the stale claim is load-bearing. TransportScript has not been a transparent brand since #7962. It is a sole_constructor record whose single mint transport_script_seal is admit_callers-sealed to two production declarations, and the cast form closed with it -- 04_infer sole_constructor_construction_diags judges a cast into a sealed type. Both documents still asserted, in the present tense and in fourteen places, that the brand is transparent, that `String as TransportScript` is writable from any module, and that direct shell.Exec.Run is guarded by validation rather than construction. All false at this head. Enumerated by claim across both authorities rather than fixing the site under review -- the document's own standing rule, added after the fifth time this class recurred -- and rewrote every occurrence in place: section 3's terminal paragraph, 4.F's heading and three table cells, the 4 dissolution trigger, 5's end-state paragraph, 5.E's heading, premise and ruling block, the wind-down ledger row, the meta-exec row, and both sites in the invariant doc. The leak fixture is reclassified as scan input and historical record; it can no longer be cited as evidence the cast compiles. What actually survives is smaller and different in kind: the two admitted bridges take a bare body String, so arbitrary text still reaches a transport through a counted, reason-bearing, dissolves_to-carrying call. Conspicuous, not impossible, and it dissolves by per-site migration rather than by further wall work. Also from the review, each verified before acting: - The bridge count named no files. Enumerated all 13. Three -- package_delivery, codex_app_server_press, bmc_netboot_serve -- are absent from the section 4 punch-list that still calls itself complete at 78f43c3. Recorded as that snapshot's correction, not as a second census. - A classification question the count concealed: package_delivery (7 calls) and codex_app_server_press (3) route through retained_foreign, whose dissolves_to is the Bash emitter, while both appear to run inside a present gunbc runtime. If so, ten calls declare the wrong destination. Flagged for their owners; the executor window decides it and this document does not own that fact. - "A SHELL-DAG row is never blocked on CLI-AUTHORITY" was true of the homing decision and false as a sequencing rule, with the counter-example named in the same document: command_runner's cutover needs the structured process-argv carrier, and its SSH arm the nested shell-command target. Reworded. - Added an explicit statement that this is a boundary and scoping increment, not a closeout receipt -- neither finish line is met at this commit. Merged main to pick up #8467, now landed, so the cross-PR references describe a merged authority rather than an open branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the DESIGN clause this PR falsified: #8476 cut the row it cited The boundary section asserted DESIGN.md needed no edit BECAUSE its shell -> intent open-thread row already routed runtime-present sites to typed effects. That row is gone: #8476 cut DESIGN to ~9.5k words and removed open-threads wholesale, and this branch merged main two commits ago. The conclusion survives, the reason does not. What the boundary instantiates now is section 3 general paragraph -- interface, realization and policy are three facts, transport is a Realization handler one of N, dispatch sits peripheral -- so a CLI-backed handler is that shape at the tool seam and DESIGN still needs no edit. Caught while verifying the previous commit against the rewritten DESIGN rather than the one the clause was written against, which is the same check the previous commit performed on fourteen other claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Settle the census's misfiled-bucket question by measurement, and delete the dead import it names The census flagged three modules as possibly-misfiled -- package_delivery, codex_app_server_press and provider_wire_evidence route through retained_foreign, whose dissolves_to is the Bash emitter (foreign executors and pre-runtime bootstrap), while appearing to run inside a present gunbc runtime. It recorded that as "a question for their owners -- the executor window is the deciding fact and this document does not own it." The question was decidable without them. package_delivery calls shell.Mkdir.Parents and shell.Find.FilesAndSymlinksWithMode -- typed operations that cannot execute without a present runtime -- in the same function bodies that then fall back to retained_foreign. A function that interleaves a typed operation with a retained foreign script is runtime-present by the fact that its first half ran. So the six remaining calls declare the wrong dissolution target. Three corrections fall out, all measured on 98d7147: - provider_wire_evidence has ZERO retained_foreign call sites. Its effects became typed extdeps.shell operations under review 50540; what survived was an unused import, deleted here. It is struck from the bucket, which is 12 rather than 13, struck through rather than dropped -- a census row that vanishes without explanation cannot be told from one that was never measured. - The call counts are stale in the direction the census warns about elsewhere: 5 and 1, not 7 and 3. - package_materialized_tree_observation_note records replacing a find-piped-to-sort string with shell.Find plus in-substrate std sort, because the string form escaped its quoting on a root containing an apostrophe and forked an authority extdeps.shell already owned. That migration landed at ONE site; another instance remains in the same module with the same shape and the same exposure. A carrier that records a fix should name the population it fixed, or the next reader takes the note as coverage. Local whole-corpus compile was started and killed at 15 minutes without terminating, so it is INCONCLUSIVE rather than clean -- stated rather than omitted. The deleted import is verified unreferenced by grep; CI's floor is the census. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the C-note: the fold is an unconsumed authority, not dead code The C-note filed BuildCacheDaemonObservation / provision_build_cache_verdict / placement_verdict / build_cache_provision_gate_accepts as pre-existing dead production code with a deletion plan. I re-ran the census before acting on it. The zero-caller number reproduces exactly: 8 call sites for the gate, all in one witness file; zero production callers for any of the four symbols. The characterization does not. Reading the module's own receipt rather than the grep output, lane_e_srv1_ci_noncompletion_root_cause_receipt names placement_verdict as the FIX AUTHORITY for the stranded-sccache-server incident that killed CI builds at the 15m compile ceiling, and records that class as "INCIDENT CLEARED, NOT REPAIRED". Nine production modules import the module for other declarations, so the symbol-level zero sits inside a live file. That makes this a §4b rung finding, not a §2 redundancy one: the fold is correct and unasked. Green witnesses establish correctness, not that the class is guarded, and reporting them as the latter reads a rung above where the class sits. The deletion would have applied cleanly, taken the witnesses with it, broken nothing, and removed the named remedy for a recurrable CI-capacity incident -- with the witnesses' greenness as the property that made it look safe. Disposition changed from delete to wire-it-up, with the one measurement that could still make it benign named as the first thing to test. No code touched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Answer the C-note's first test: the path is genuinely ungated for placement The correction said nobody should wire anything before establishing whether the provisioning path is ungated or gated by an equivalent check under another name. Measured on origin/main by reading the three modules involved. There is a check under a different name and it is not equivalent. realize_provision_build_cache gates on provision_build_cache_catalog_gate_verdict, which is pure catalog-id validation in a third module -- unknown id refuses, a non-sccache_local id refuses, otherwise realizable. It never observes placement, principal, unit ownership or lifecycle, so passing it says nothing about the stranded-daemon class the incident receipt names placement_verdict as the fix for. host_effect_realize matches none of the admission symbols. Two unconsumed authorities, not one: build_cache_ensure's admit_ensure_build_cache_instance is in the same state. Both name the same single next consumer, realize_provision_build_cache_body, so this is one wiring job rather than two -- materially smaller than the correction implied. The tree recorded this itself in ensure_effect_grain_migration_note. Verified against the code rather than quoted, since tonight's repeated failure was a correct measurement of a subject that had moved. It has not moved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the refinement calibration: no predicate is evaluated, on any kernel The guarantee-recovery doc's calibration example read "a nonliteral refined argument is RuntimeBoundaryOnly" -- a check that fires at the runtime boundary rather than at compile time. Measured across all three kernels the refinement family uses, that is true of none of them. String the conversion runs and is the identity. Executed: "" as NonEmptyStr returns "". Int the only conversion refuses every value, so it is never used; values arrive by declaration and no conversion runs. Executed: the cast refuses a valid 5 identically to -1, and -1 reaching an EpochMs-declared parameter comes back unchanged. collection a sound unforgeable wall -- private tuple field, new the only door -- with zero call sites corpus-wide, and zero refinement declarations over any collection base behind it. A gate that passes everything, a gate nobody walks through, and a wall with no door behind it. The Int row most needs stating: "fail-closed by absence of capability" reads as safe and is not, since 74 declared positions against effectively zero casts means the refusing conversion is almost never on the path. This is the document's own section 4b failure rather than a wording slip: one state was recorded for a class whose paths differ, and it was the strongest of them. Each kernel needs a different remedy, so the row cannot be weakened -- it has to be split. Population recorded as a dated measurement with its limits: 3939 across 612 files at a750b67, four pre-committed predicates passing including a by-name planted control, reproduced exactly on separate runners, corroborated by an independent static scan smaller in the predicted direction. The instrument was deleted, so the number is not reproducible without rebuilding it, and it is an unverified-obligation population -- the census cannot distinguish violated from unverified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Census: retire the stale srv3_join_shell_words citation, record the srv3 deferral measurement Two corrections to the residual census, both measured at origin/main 4cec10f. srv3_join_shell_words has zero definitions and zero mentions on main; it was cited in two places (the §1.C row and the §4.D deferred table) as a live srv3 transport helper. Removed from both. The five sibling symbols cited beside it all still resolve in gunbc.host_effect_realize and are left untouched. The srv3 deferral's premise is refuted by typed refusal: all 22 EmitArtifactThenThinRun arms in gunbc.host_effect_realize refuse, none accept, and the refusal names "reserved for ConvergePlan (host-effect Phase D)." The control widens it past that file -- the variant is realized nowhere in the tree; the three sites that appear to accept it are classifiers returning a Bool or the variant name for totality. So nothing is pending cutover and no srv3 site waits on a Phase D that exists. That settles the premise, not the disposition. Whether the srv* actuator graph survives at all is an operator decision, and migrating 22 call sites in a subgraph slated for deletion by another route is wasted work under a different premise than the original. Recorded as due for re-decision rather than expired. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Census: correct "realized nowhere" — EmitArtifactThenThinRun has exactly one realizer The paragraph committed earlier today claimed EmitArtifactThenThinRun is realized nowhere in the tree and is therefore declared-but-unrealized. That is false, by exactly one path, in the file the claim examined most closely. realize_converge_on_host splits its EmitArtifactThenThinRun arm on gunbc_apply_mode_for_host: FreshStandup refuses as fail-closed Unimplemented, but ExistingHostQuiescentReload calls realize_converge_in_process -- the identical call the LocalShell arm makes. For an existing quiescent host the transport takes the same path as the shell transport. The sibling SshShell and FleetSsh refusals direct the caller to "use EmitArtifactThenThinRun", which points the same way. Two disguises produced the wrong count and each survives a scan written for the other: a refusal shaped as a success-valued record (hostname_set answers HostnameSetCasApplyFailed with the refusal in a stderr field, invisible to a NotConverged scan), and a realizer behind a refusing first sub-arm (the arm above, whose opening lines read as a refusal). Reading all 24 bodies was the only method that survived; the corrected text records both disguises so the next reader does not re-derive them. The srv3 conclusion is unchanged. The realizing path is for HostConverge, not for any srv3 effect -- every Srv3* arm still refuses. Only the supporting sentence changes: not "realized nowhere so nothing is pending" but "exactly one realizer, and srv3 is not on it." Corrected in place rather than annotated beside, per the standing rule against two accounts of one fact. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Census: correct the arm denominator — 36 production arms, not 24 The paragraph recording how the one-realizer finding was measured stated that all 24 arm bodies had been read. That number came from the manual audits and is wrong. Measured at 4cec10f: 41 EmitArtifactThenThinRun occurrences -- 1 variant declaration in gunbc.host_effect, 36 production match arms across 14 modules, 4 in dag/test/claim. Neither manual audit reached 36 and neither mentioned gunbc.host_effect_codex_supervised_turn, whose arm answers CodexSupervisedSessionApplyRefused: a refusal named by its record rather than by a refusal type, which is the same disguise class the paragraph documents. The finding is unchanged -- exactly one arm realizes, realize_converge_on_host under ExistingHostQuiescentReload. What was wrong was the stated size of what had been examined, inside the paragraph about examining carefully. Recorded as a dated measurement at a named SHA for a derived detector to reproduce and reconcile against, explicitly not as a fixed law, since migrations are expected to change it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Census: record v2.lens.effect_reach as prior art to supersede, not extend Answering the census brief's stop condition -- whether existing parsed-body facts can carry the derived census -- surfaced a lens already answering approximately this question, which a later reader could mistake for coverage. v2.lens.effect_reach classifies host-effect sinks and carries a ShellExecRunSink variant. But sink_kind_for_callee selects by name equality against a remembered callee-text list ("Run", "shell.Exec.Run", "Exec.Run", "WitnessBin.Run", "Read"), everything else falling to UnknownHostEffectSink. That is the forbidden seed form -- where we remember doing it rather than what interprets bytes as shell -- and it cannot see sh -c, sh -s on stdin, or a sudo -S sh -s wrapper. It carries the same blind spot this census carried before Spark was found. Two bounds on its weight: it classifies from callee text rather than resolved callee identity, the text-scanning substitution the brief's stop condition forbids; and enforcement_live_witness_test asserts its contract is unbound, the corpus's own record that it has no enrolled consumer. Disposition is supersede rather than extend: a census seeded from interpretation semantics subsumes its whole sink vocabulary, while extending it would inherit its selection principle. Recorded so the derived cut treats it as prior art with a known-narrow frontier, and so its ShellExecRunSink rows are never read as an existing shell-reach population. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Brian Searls and others added 15 commits August 17, 2026 18:41

Merge remote-tracking branch 'origin/main' into session/silent-bear-842

882b118

Merge remote-tracking branch 'origin/main' into session/silent-bear-842

8f8b5c9

# Conflicts: # src/v1/stage0/Cargo.toml

Merge remote-tracking branch 'origin/main' into session/silent-bear-842

296d78f

briansrls marked this pull request as ready for review August 19, 2026 05:29

gunbai-bot Bot changed the title ~~compute fabric design~~ DESIGN.md: cut to first principles (27.5k → 9.5k words), at the model not the emission Aug 19, 2026

briansrls merged commit 66e66c4 into main Aug 19, 2026
1 of 2 checks passed

briansrls deleted the session/silent-bear-842 branch August 19, 2026 06:31

gunbai-bot Bot mentioned this pull request Aug 19, 2026

Model expected_red_roster_join in .dag; fix two required_regen_host bugs blocking regen verification #8527

Merged

briansrls restored the session/silent-bear-842 branch August 20, 2026 04:09

Navigation Menu

Repository navigation

DESIGN.md: cut to first principles (27.5k → 9.5k words), at the model not the emission - #8476

DESIGN.md: cut to first principles (27.5k → 9.5k words), at the model not the emission#8476
briansrls merged 15 commits into
mainfrom
session/silent-bear-842

briansrls commented Aug 18, 2026 •

edited by gunbai-bot Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

briansrls commented Aug 18, 2026 • edited by gunbai-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Known gaps, stated rather than implied

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

briansrls commented Aug 18, 2026 •

edited by gunbai-bot Bot

Loading