Witness cost class: import-closure pollution — zero confirmed exemplars

dag/test/claim/long/dissolution_census_witness_test.dag

@@ -14,6 +14,8 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
+data dissolution_census_cost_class_note: String = "unbound_dissolution_empty_literal_refuses (below) was investigated as a possible third import-closure-pollution exemplar for the witness-cost-class lane (gunbc.roadmap_authority adhoc-0e6f8ea5-158) and FALSIFIED -- NOT import-closure pollution, and not fixable by closure-narrowing. w_unbound_dissolution_empty_literal_red / w_unbound_dissolution_nonempty_literal_green both call compile_dag_rust_emit_check, whose uncached path (compile_dag_rust_emit_check_uncached, src/v1/stage0/src/cli_run.rs) rebuilds a FULL corpus-rooted module index (build_module_path_index_from_witness_roots) and compiles the supplied virtual source against it on every call -- a cost driven entirely by that helper's own corpus-wide work, unrelated to this witness ENTRY's own transitive import closure. The helper is memoized (COMPILE_DAG_RUST_EMIT_CHECK_MEMO) but the memo is only consulted when floor_prepared_inventory_digest() returns Some, i.e. only under a real claim_executor --required-floor run; a standalone claim run never populates or reads it. This produces a first-toucher shared-fill signature within the same module: whichever of this module's compile_dag_rust_emit_check-calling rows the floor visits first under a given inventory pays the uncached full rebuild, and its sibling(s) hit the warm memo -- confirmed against the floor's own [floor-witness-slow] line, 42129ms vs 825ms for two same-module sibling rows, a ~51x gap with no import-closure difference between them. This is the same underlying mechanism as the Class B and loop/bind falsifications in spirit (a fixed corpus-wide cost masquerading as an entry-closure cost) but a DIFFERENT mechanism in kind -- a per-call memo gated on the floor guard, not a witness entry's own static import graph -- so it belongs to the class-2 per-claim deterministic-reconstruction/memoization bucket, not this lane's closure-narrowing scope. No repair attempted here; this module is left as-is."
+
 test fn census_counters_exhaustively_partition_the_rows() -> Bool {
   let r = dissolution_census_report()
   (r.unbound_count + r.pending_count + r.fired_still_present_count) == length(xs: census_closure_frontier_rows())

dag/test/claim/long/extdeps_scope_placement_gate_loudness_witness_test.dag

@@ -17,7 +17,7 @@ import gunbc.test_module_hygiene { failure_receipt_companion }
 import std.process { ProcessExit, ExitSuccess }
 import std.types { String, Bool, List }
 
-data loudness_witness_note: String = "Floor loudness for tools.extdeps_scope_placement_gate (gunbc#7644): lands the seed-runner loudness path + extdeps_scope_placement_gate production companion only; six other production _passes gates remain mute (counted frontier in tools.floor_effect_gate_witness floor_gate_failure_receipt_note). Per-arm fixtures exercise gate REASON GENERATION with synthetic observations (supporting evidence). Executed RED: red_seed_runner_failure_detail_projects_located_receipt calls production seed_runner_bool_false_failure_detail against seed_runner_loudness_probe_passes, an always-false _passes probe declared IN THIS ENTRY beside its _failure_receipt companion. THE PROBE PAIR MOVED HERE (2026-08-18) AND THAT MOVE IS THE POINT: claim_executor evaluates the derived companion in the WITNESS entry's context, so the pair has to be reachable from here — and reaching it by importing tools.floor_effect_gate_witness dragged that entry's whole gate closure (ci_gates, the compile-clean, generated-artifact and regen-verify gates) into a witness that asserts none of them. Measured import closure: 718 modules / 10.1 MB of source before, 62 modules / 0.49 MB after; the witness was the floor's second most expensive row at 78.6s. Nothing about the claim changed — the same production fn is called against the same located receipt text, and the probe pair is deleted from tools.floor_effect_gate_witness rather than duplicated. It is a func (not test fn), so floor discovery, which selects TestMarkedDecl only, does not enroll it. MUTATION CONTROL RE-EXECUTED AGAINST THE MOVED PAIR (2026-08-18, remote sandbox at 3abc17b54c9): renaming seed_runner_loudness_probe_failure_receipt so the companion derivation misses it makes this row FAIL (rc=1) while all seven rows of this entry pass at head (rc=0) — so the claim still discriminates on the production path after the move, and does not merely assert its own literal. Mutation control executed 2026-08-05 at b0a17f608a, when the probe pair still lived on tools.floor_effect_gate_witness: disposable detached worktree, removed _passes handling from production failure_receipt_companion (holds-only), rebuilt claim_batch, re-ran witness — FAIL red_seed_runner_failure_detail_projects_located_receipt (eval_self 0ms, resolved; not resolution); detail collapsed to bare returned Bool(false) without THIS CHANGE or dag/extdeps/browser/opera.dag. Current head PASS; head detail includes returned Bool(false) | extdeps scope placement gate: THIS CHANGE ... dag/extdeps/browser/opera.dag. Guarantee rung: observed validation on the production seed_runner path; no construction wall claimed for seed/.dag mirror parity (DESIGN section 7 seed retention)."
+data loudness_witness_note: String = "Floor loudness for tools.extdeps_scope_placement_gate (gunbc#7644): lands the seed-runner loudness path + extdeps_scope_placement_gate production companion only; six other production _passes gates remain mute (counted frontier in tools.floor_effect_gate_witness floor_gate_failure_receipt_note). Per-arm fixtures exercise gate REASON GENERATION with synthetic observations (supporting evidence). Executed RED: red_seed_runner_failure_detail_projects_located_receipt calls production seed_runner_bool_false_failure_detail against seed_runner_loudness_probe_passes, an always-false _passes probe declared IN THIS ENTRY beside its _failure_receipt companion. THE PROBE PAIR MOVED HERE (2026-08-18) AND THAT MOVE IS THE POINT: claim_executor evaluates the derived companion in the WITNESS entry's context, so the pair has to be reachable from here — and reaching it by importing tools.floor_effect_gate_witness dragged that entry's whole gate closure (ci_gates, the compile-clean, generated-artifact and regen-verify gates) into a witness that asserts none of them. Measured import closure: 718 modules / 10.1 MB of source before, 62 modules / 0.49 MB after; the witness was the floor's second most expensive row at 78.6s. Nothing about the claim changed — the same production fn is called against the same located receipt text, and the probe pair is deleted from tools.floor_effect_gate_witness rather than duplicated. It is a func (not test fn), so floor discovery, which selects TestMarkedDecl only, does not enroll it. MUTATION CONTROL RE-EXECUTED AGAINST THE MOVED PAIR (2026-08-18, remote sandbox at 3abc17b54c9): renaming seed_runner_loudness_probe_failure_receipt so the companion derivation misses it makes this row FAIL (rc=1) while all seven rows of this entry pass at head (rc=0) — so the claim still discriminates on the production path after the move, and does not merely assert its own literal. Mutation control executed 2026-08-05 at b0a17f608a, when the probe pair still lived on tools.floor_effect_gate_witness: disposable detached worktree, removed _passes handling from production failure_receipt_companion (holds-only), rebuilt claim_batch, re-ran witness — FAIL red_seed_runner_failure_detail_projects_located_receipt (eval_self 0ms, resolved; not resolution); detail collapsed to bare returned Bool(false) without THIS CHANGE or dag/extdeps/browser/opera.dag. Current head PASS; head detail includes returned Bool(false) | extdeps scope placement gate: THIS CHANGE ... dag/extdeps/browser/opera.dag. Guarantee rung: observed validation on the production seed_runner path; no construction wall claimed for seed/.dag mirror parity (DESIGN section 7 seed retention). REMEASURED AGAINST THE FLOOR'S OWN LINE (witness-cost-class lane, gunbc.roadmap_authority adhoc-0e6f8ea5-158, 2026-08-19) AND FALSIFIED AS A WITNESS-COST REPAIR: the narrowing's own commit measured import closure (718 modules/10.1MB -> 62/0.49MB) and standalone entry-resolve time (30.726s -> 1.005s), but standalone resolve time is not the number the floor's ceiling judges. Run 32177951514 (head 59653f569e, which git merge-base --is-ancestor confirms is a descendant of this repair's ff56305b731) is the last floor observation of this identity before #8457 quarantined the module by name (test.claim.long. prefix) out of required_floor's discovery entirely -- there is no floor line for it after that quarantine, and none will exist until the module returns to floor scope. That last, post-repair line: [floor-witness-slow] red_seed_runner_failure_detail_projects_located_receipt 75926ms, BUDGET-REFUSED against the 1552ms ceiling (an exact measured cost, not a bound -- the witness ran to completion), and [floor-claim-memory] recorded this as the single worst claim in that run, growing RSS by 1.00GB to 10.12GB. 75926ms is statistically the same order as this identity's own PRE-repair floor history (42983-97260ms across four earlier CI runs, docs/plans/measurements/floor-slow-rows-2026-08-17.tsv) -- the 718-to-62-module import-closure narrowing left the floor cost effectively unchanged. EXEMPLAR 1 IS THEREFORE UNCONFIRMED, joining the Class B and loop/bind candidates as this lane's third falsification: import-closure pollution, as a witness-cost class with a demonstrated fixable member, tested empty across all three candidates this lane investigated. What is NOT retracted: the closure narrowing itself is real and DESIGN.md §3-legitimate (fewer modules genuinely load faster in isolation), it is retained as a correctness improvement, and it may have cut cold standalone resolve time as measured -- what is refuted is that it moved the FLOOR's own per-row cost, which is the only number the 1552ms ceiling enforces. Same shape as this lane's Class B correction: the right repair, the wrong quantity measured. All three falsifications point at the same underlying object: a fixed, corpus-wide load/index cost paid once per MultiEntryIndex rather than once per entry's import closure (DESIGN.md's floor-shared-compute-memoization open thread on build_both_closure_edge_index, whose closure-size-independence claim this lane's measurements corroborate rather than re-derive)."
 
 fn read_manifest_rows() -> List<String> {
   parse_frontier_manifest(

dag/test/claim/long/rust_test_fixtures_import_closure_witness_test.dag

@@ -1,12 +1,12 @@
 module test.claim.long.rust_test_fixtures_import_closure_witness
 
-import v2.workflow.class_b_import_closure_transport {
+import v2.workflow.class_b_import_closure_probe {
   class_b_declared_import_closure_lists_rust_import,
   class_b_ambient_pool_provider_preserves_listed_import
 }
 import std.types { Bool }
 
-data class_b_witness_note: String = "Rows 1-2 of the Class B rust_test_fixtures control (#6985), delegated to v2.workflow.class_b_import_closure_transport for single authority. QUARANTINED, not path-excluded: this module is excluded from the required floor by its AUTHORED NAME — required_floor.dag matches long_home_prefixes against the module name, and test.claim.long. is one — so the exclusion is the rename #8457 performed, and the directory is for humans. The FalsifierSubstrateLongLane WitnessExclusionRow that this note once cited is deleted with it: the required floor never consulted witness_exclusion_frontier at all (floor_discovery_path_excluded is reached only from claim_batch and a cfg(test) module), and the falsifier cadence those long-lane rows enrolled was deleted outright in the floor cut, so neither mechanism had an executing consumer. WHY IT IS HERE: both rows PASS and exceed the 1552ms ceiling (Cpu 25816ms and 36536ms, run 32179249889), so they landed STALE-QUARANTINE plus BUDGET-REFUSED and no enrollment setting clears a row that is true on both axes. The rows are NOT executing anywhere while they sit here — that coverage loss is #8457's declared bounded rung drop, and it restores when the cost is fixed. Root cause is what class_b_import_closure_transport reaches for, not this file; splitting a witness to move it under the ceiling is refused as a measurement artifact (gunbc.witness_row_cost witness_decomposition_does_not_reduce_entry_cost_note). Rows 3-4 stay in class_b_import_closure_binding_refusal_witness_test.dag and class_b_strip_receipt_witness_test.dag; wet integration remains run_class_b_import_closure_gate on source_root_ingest_gate."
+data class_b_witness_note: String = "Rows 1-2 of the Class B rust_test_fixtures control (#6985), delegated to v2.workflow.class_b_import_closure_probe for single authority. QUARANTINED, not path-excluded: this module is excluded from the required floor by its AUTHORED NAME — required_floor.dag matches long_home_prefixes against the module name, and test.claim.long. is one — so the exclusion is the rename #8457 performed, and the directory is for humans. The FalsifierSubstrateLongLane WitnessExclusionRow that this note once cited is deleted with it: the required floor never consulted witness_exclusion_frontier at all (floor_discovery_path_excluded is reached only from claim_batch and a cfg(test) module), and the falsifier cadence those long-lane rows enrolled was deleted outright in the floor cut, so neither mechanism had an executing consumer. WHY IT WAS HERE: both rows PASSED and exceeded the 1552ms ceiling (Cpu 25816ms and 36536ms, run 32179249889) while this file imported v2.workflow.class_b_import_closure_transport, whose module-level extdeps.git / extdeps.git.inspect / gunbc.ci_layer_roots imports (needed only by that module's separate rows 3-4) inflated this entry's resolve closure — the same signature extdeps_scope_placement_gate_loudness_witness's 718-to-62-module repair fixed. This module now imports v2.workflow.class_b_import_closure_probe instead, which carries only what rows 1-2 need (gunbc.class_b_import_closure_overlay's class_b_entry_rel/class_b_declared_import_pool_roots and gunbc.declared_import_closure_binding), never the heavy transport module. The narrowing does not change what class_b_declared_import_closure_lists_rust_import/class_b_ambient_pool_provider_preserves_listed_import compute — same fn bodies, same DeclaredImportClosureBindingObservation calls, only the entry's own import graph shrank. Splitting a witness's own test file to dodge the ceiling is refused as a measurement artifact (gunbc.witness_row_cost witness_decomposition_does_not_reduce_entry_cost_note); this is not that — the fix narrows what the SAME entry's assertions actually depend on, by fixing the imported dependency's shape (relocation-not-refork per DESIGN.md §3), not by moving these test fns to a new file. Rows 3-4 stay in class_b_import_closure_binding_refusal_witness_test.dag and class_b_strip_receipt_witness_test.dag; wet integration remains run_class_b_import_closure_gate on source_root_ingest_gate. MEASURED 2026-08-19, and the result is NEGATIVE — this narrowing is FALSIFIED as an import-closure-pollution repair, not confirmed. The two-sided test (a paired same-host comparison, per the standing acceptance bar: cost must collapse when the closure narrows AND not collapse under mere repetition) was run via gunbc run --claim-run against a fresh release build in one remote dispatch: declared_import_closure_lists_rust_import through this narrow probe-backed entry measured 70.0s and 69.4s wall (two independent process calls, back to back); the SAME function reached through v2.workflow.class_b_import_closure_transport directly (the heavy module, still carrying its module-level extdeps.git / extdeps.git.inspect / gunbc.ci_layer_roots imports) measured 69.98s in the identical dispatch, on the identical host, moments apart. Narrow and heavy are statistically indistinguishable. ambient_pool_provider_preserves_listed_import (which itself calls the observe function twice in one process) measured 80.8s, consistent with the same fixed floor rather than a per-import-closure charge. CORRECTED MAGNITUDE (per-row floor line, supplied against the required floor's own [floor-witness-slow] output for these same two identities, not the standalone harness): declared_import_closure_lists_rust_import 24674ms and ambient_pool_provider_preserves_listed_import 31603ms -- the standalone --claim-run figures above (70.0s/80.8s) are ~2-3x inflated relative to the floor's own amortized accounting, because a standalone claim run pays the corpus-wide load/index term once per claim while the floor pays that same fixed term once per MultiEntryIndex, amortized across the whole discovered roster (see DESIGN.md's floor-shared-compute-memoization open thread on build_both_closure_edge_index, whose central size-independence claim these figures corroborate on a different subject rather than re-derive). The paired-comparison DESIGN of the standalone measurement is still the right instrument for detecting a closure-size effect (narrow vs heavy, same process shape) -- only its absolute magnitude needs the floor's own line as the citable number. Both the standalone pair and the floor's per-row numbers agree on the same verdict: narrow and heavy did not diverge, and both sit far over the 1552ms ceiling. None of these approach the printed compile.frontend/normalize/reconcile/analyses phase timings (~1-2s total each), meaning the ~25-32s floor-line cost is spent somewhere the entry-closure resolution does not reach -- most plausibly the corpus-wide load/index cost named above. CONCLUSION: the module split (v2.workflow.class_b_import_closure_probe) is a legitimate DESIGN.md §3 relocation-not-refork decomposition and stays -- rows 1-2's shape genuinely does not need git/git.inspect/ci_layer_roots -- but it is NOT a witness-cost fix and this file does NOT leave long/ on its account; 24.7-31.6s (floor line) / 70-80s (standalone) both remain far over the 1552ms ceiling. This is the second candidate this lane has falsified as import-closure pollution (after the loop/bind witnesses), not confirmed as a second exemplar; see the lane's PR description for the full delta."
 
 test fn declared_import_closure_lists_rust_import() -> Bool {
   class_b_declared_import_closure_lists_rust_import()

src/v1/stage0/src/cli_run.rs

@@ -3821,6 +3821,12 @@ pub fn regen_floor_skip_label_for_ci() -> String {
 
 pub const CLASS_B_ENTRY_REL: &str = "src/v2/extdeps/languages/rust_test_fixtures.dag";
 pub const CLASS_B_TRANSPORT_REL: &str = "src/v2/workflow/class_b_import_closure_transport.dag";
+/// Rows 1-2's shape+call, relocated out of CLASS_B_TRANSPORT_REL so a witness reaching only
+/// rows 1-2 does not inherit the transport module's extdeps.git / extdeps.git.inspect /
+/// gunbc.ci_layer_roots closure (DESIGN.md §3 relocation-not-refork; the same signature
+/// extdeps_scope_placement_gate_loudness_witness's repair fixed). The transport module imports
+/// this one back for rows 1-2's own use, so it is part of the gate's input closure too.
+pub const CLASS_B_PROBE_REL: &str = "src/v2/workflow/class_b_import_closure_probe.dag";
 pub const CLASS_B_BINDING_REL: &str = "dag/gunbc/declared_import_closure_binding.dag";
 pub const CLASS_B_OVERLAY_REL: &str = "dag/gunbc/class_b_import_closure_overlay.dag";
 pub const CLASS_B_FIXTURES_PREFIX: &str = "fixtures/class_b_import_closure";
@@ -3829,6 +3835,7 @@ const CLASS_B_DECLARED_POOL_ROOTS_DATA_NAME: &str = "class_b_declared_import_poo
 pub const CLASS_B_GATE_INPUT_ENTRIES: &[&str] = &[
     CLASS_B_ENTRY_REL,
     CLASS_B_TRANSPORT_REL,
+    CLASS_B_PROBE_REL,
     CLASS_B_BINDING_REL,
     CLASS_B_OVERLAY_REL,
 ];