Repository navigation
Conversation
…ed twice
The floor marshalled 10,498 discovered sites into the interpreter, folded them
through `required_floor_manifest` to decide which are required-floor claims, and
marshalled 9,008 back. The host then applied the identical prefix test itself, in
Rust, to explain the difference between sites offered and claims returned. One
decision, two computations, with an interpreted round trip between them whose only
product was a population the host could derive from facts it already held in
`prepared.witness_files`.
The externally required outcome is exactly: exclude a witness whose AUTHORED module
sits in the long home, exclude one that reads the live tree, claim everything else
Hermetic. That is now one loop over the inventory.
Three findings made this a deletion rather than an optimisation:
- `WitnessDisposition` (five arms) had no consumer. Its one predicate,
`disposition_is_required_floor`, was never called; the file said so itself
("stays modelled and unconsumed exactly as it was"). `disposition_for_module`,
cited in `cli_run.rs` and DESIGN.md as the admission authority, does not exist.
- The duplicate-enrollment invariant was already enforced downstream.
`receipted: HashSet<String>` is keyed on the same qualified name, so two claims
sharing one give executed=2, receipted=1 and `ClaimIdentityCountsDisagree`
refuses. `ManifestScan.enrollments` was a second mechanism for that one
invariant -- and, being a growing `Value::Map` re-hashed once per fold step, was
the whole of the phase's quadratic cost.
- The Wet arm was dead: `wet_sites` was always passed as `empty_sites`.
The authored facts stay authored. `long_home_prefixes`, the claim budget and the
warn threshold are still read from `v2.workflow.required_floor`; what is deleted is
the reconstruction, never the fact. The test remains on the module's AUTHORED name
and never its path, which is the 2026-08-04 ruling's actual requirement.
Two refusals were deleted with their producer. `SitePartitionInexact` and the
unexplained-decline arm existed to catch the two computations disagreeing; with one
computation they have no reachable producer, and the partition is now exact by
construction. One refusal was added in their place: `LongHomePrefixesEmpty`, since
an empty roster would otherwise silently admit the long home into the floor.
Deliberately NOT in this change: `eval_call_memo` is untouched, and `Value::Map` is
unchanged. Whether the generic eval-frame memo should survive is a separate question
with its own consumers, and optimising a foundational datatype on behalf of this
machinery was the wrong dependency direction while the machinery's necessity was
still unestablished.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Review 53686: its only call sites were the WitnessSite / ObservedSubjectIdentity marshalling into the interpreter, both deleted with the manifest path. A helper whose only purpose was to construct values for a deleted consumer is residue, not a utility. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…urvivor Four corrections from the architectural review, three of which are defects this branch introduced rather than inherited. DUPLICATE IDENTITY IS REFUSED AT CONSTRUCTION AGAIN, AND NAMED. The claim that `receipt_identities` carried this invariant "unchanged and unmoved" was wrong. The deleted manifest refused BEFORE executing anything and named the offending declaration; the downstream count check compares populations after all 9,122 claims have run, so a duplicate costs a full duplicated evaluation first, and a count mismatch reports only that two populations disagree -- never which identity did it. Planned-identity uniqueness and receipt completeness are different properties. A HashSet at claim construction now refuses with `DuplicateWitnessIdentity` naming the exact identity, and `planned == executed == receipted` stays as the separate terminal-completeness check. THE BUDGET DECODER'S BOUNDARY IS RESTORED. It accepted `n >= 0`, where the deleted admission decoder refused non-positive values -- a weaker wall wearing the same name. A zero ceiling is not lenient policy; it refuses every witness before evaluating one. Now `n > 0`, plus a `ClaimBudgetTiersInverted` refusal enforcing `0 < warn_ms < budget_ms`: read independently, an inverted policy whose warn tier sits at or above the hard ceiling can never warn, and both values still typecheck. LongHomePrefixesEmpty IS DELETED -- it was backwards. An empty exception roster is the DESIRED terminal state, so refusing on it made "at least one exclusion must exist forever" a structural requirement of the floor. Once the long home is discharged, admitting those witnesses to the ordinary population is the intended result. A failed decode still refuses; a failed read and a legitimately empty roster are different states and only the first is an error. THE FIFTH SURVIVOR IS DELETED. `floor_bare_name_ambiguity_next_rung_trigger` had no consumer -- only a doc-comment citation in `v1_interpreter.rs`, which is not one. It is namespace-program debt, not a required-floor input, and leaving it here turns this module into a parking place for adjacent concerns immediately after the cut removed exactly that accumulation. If the namespace lane needs the finding, its own authority should carry it. The now-unused `std.dissolution` import goes with it. STALE MANIFEST-ERA NAMES CORRECTED, because these are the same stale authority claims that led the first analysis of this area to defend a mechanism that did not exist: `REQUIRED_FLOOR_MANIFEST_MODULE` -> `REQUIRED_FLOOR_POLICY_MODULE`, `manifest_scope` -> `policy_scope`, and the surviving prose no longer describes `.dag` as evaluating a manifest or supplying admission facts. It supplies policy constants; the host inventory and one loop decide the population. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
fierce-ram-721.Pushing to
integration/manifest-cutadvances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan