E0277 root A (Ord half): wire BTreeSet's Deserialize-only Ord supplement through the per-derive contract

[gunbai-bot]

Summary

std.authorization_profile.AudienceSet<P>'s EnumeratedAudience { members: Set<P> } realizes to im::OrdSet<P> (aliased BTreeSet), whose Debug, PartialEq, Serialize, and Deserialize all require P: Ord to reconstruct/compare the ordering invariant — but v1's only supplemental-bound apparatus (v1_clone_bounded_type_params) is a Clone-only fixpoint and cannot emit a P: Ord bound at all, structurally, for any impl.

This closes root A (the Ord half) of the E0277 partition by wiring P: Ord through v2's existing per-derive-impl TargetRepresentationChoice contract — the same mechanism that already scopes bounds per trait impl — rather than unioning P: Ord onto AudienceSet<P>'s own type declaration (which would over-constrain every impl, including ones that don't need ordering).

• dag/extdeps/languages/rust/derive_contracts.dag: adds rust_btree_set_supplemental_generic_bound_rows, a single-authority row citing the im::OrdSet realization, feeding P: Ord into the Debug/PartialEq/Serialize/Deserialize derive-impl bound sets (not the type header).
• src/v2/extdeps/languages/rust.dag: folds that row into rust_btree_set_supplemental_generic_bound_contracts, one entry per derive impl, via the existing TargetRepresentationChoice contract.
• src/v1/trait_derive_emit.dag: for AudienceSet<P>, emits hand-split impl<P: Ord + std::fmt::Debug> Debug for AudienceSet<P> and impl<P: Ord + PartialEq> PartialEq for AudienceSet<P>, plus a combined #[serde(bound(serialize = "P: Ord + Clone + serde::Serialize", deserialize = "P: Ord + Clone + serde::Deserialize<'de>"))] — bounding each derive, never the enum's own generic parameter list (confirmed by direct emission inspection: pub enum AudienceSet<P> { ... } carries no Ord bound on head).
• src/v1/stage0/src/{extdeps_languages_rust_derive_contracts,v1_compiler_trait_derive_emit}.rs are the regenerated seed-emit mirrors.

Verified control probe (base 033647789f2 vs head 6d912c650d9, same instrument)

Ran the paired probe (docs/probes/curated_cargo_probe_one.sh against src/v2/compiler/emit_host.dag) on both trees, with target/release/{gunbc,cssl_assemble} explicitly cleared between checkouts to force a genuine rebuild each pass (the shared probe script only rebuilt on binary-absence at the time; this is now fixed upstream in gunbc#8763). Both trees confirmed via git rev-parse HEAD before each pass.

Three different grains were measured off the same paired log; they are not commensurable and are reported separately (a mention-grain grep -c over-counts by including rustc's note:/backtrace context lines, in the direction that makes the change look worse than it is):

grain	what it counts	base (0336477)	head (6d912c6)
error blocks	grep -c '^error\[E0277\]' — one per diagnostic	90	113
distinct sites (P:Ord-specific)	unique (file, line, col) at the top --> of each P: Ord-bound block	5 — std_authorization_profile.rs:17:53, 22:9, 22:18, 62:72, 73:14, matching exactly the 5 root=A, trait=Ord rows in docs/probes/e0277_partition_2026-08-21/sites_classified.tsv (main), built from a full unbounded context read in a separate session/instrument. That partition's tree bb21f8563849b is a verified strict ancestor of this PR's base 033647789f2, 8 commits apart, none of which touches dag/std/authorization_profile.dag, src/v1/trait_derive_emit.dag, or dag/extdeps/languages/rust/derive_contracts.dag — so the declaration and the emitter's bound apparatus are unchanged across that interval, and this base's block count (7) independently matches that TSV run's preserved block count (7) as the join. This is corroboration by an unchanged-interval argument over three specific files, not a re-derivation at 033647789f2 itself — a ninth path that changed emitted output without touching those three files would not be caught by it.	18, enumerated directly from the preserved log: std_authorization_profile.rs 82:72/93:14 (audience_subset/audience_join fn signatures), plus 16 sites across the derive lines and audience fields of PublicationContext, PublicationAdmissionRequest, DisclosureContext, DisclosureRequest — zero of the 18 is AudienceSet<P>'s own declaration line; it appears only as a note: required for AudienceSet<P> to implement Debug/Serialize/Deserialize backtrace target, never as a block's own --> location
mentions (grep -c 'P: Ord')	any line containing the string — diagnostic/locating only, never for sizing	7	54

The site grain is the one that actually answers the question: base's 5 sites are all AudienceSet<P>'s own declaration (root A's exact target); head's 18 P:Ord sites are all downstream of it, split across the two already-identified, already out-of-scope gaps:

• fn signatures that don't declare P: Ord themselves but call into AudienceSet<P>'s Debug/Serialize (audience_subset, audience_join) — the fn-signature Ord-bound-inference gap.
• consumer structs that embed Rc<AudienceSet<P>> (PublicationContext, PublicationAdmissionRequest, DisclosureContext, DisclosureRequest) and derive Debug/Serialize/Deserialize without declaring P: Ord in their own generic bounds — the struct-to-struct transitive Ord-propagation gap. (Several of these 18 sites report twice — once via serde's SeqAccess/next_element path and once via MapAccess/next_value — which is also why 22 blocks map onto 18 distinct sites, not 18 blocks; the remaining 91 of head's 113 total E0277 blocks are unrelated trait bounds, e.g. Clone/PartialEq on other types, untouched by this PR.)

Fixing AudienceSet<P>'s own impls correctly removes a rustc error-cascade suppression: previously the primary error at the enum's own declaration masked the fact that every downstream caller/wrapper was also unsound. Once the primary site is fixed, those latent errors surface as their own independent E0277s — which is why the block and mention counts go up even though root A is closed (5 sites → 0 sites at the declaration). This matches DESIGN.md §5's fail-closed doctrine: a wrong state loudly refusing at more sites than before is not a regression when the newly-visible sites were always wrong and were previously hidden by cascade suppression, not by correctness.

Scope

In scope / closed by this PR: the Ord-supplement-contract sites on AudienceSet<P>'s own derive (root A, the 5 target sites) — the type does not gain an Ord bound on its own declaration; only the derive impls that actually need it do.

Explicitly out of scope, open, and separately owned:

• fn-signature Ord-bound inference gap (audience_subset, audience_join) — owned by adhoc-a9f61ade-340 (session tidy-otter-493).
• struct-to-struct transitive Ord-propagation gap (PublicationContext, PublicationAdmissionRequest, similar wrapper structs) — owned by adhoc-1e0dee2d-68f (session quick-boar-406).

Test plan

• claim_executor --required-regen --source-root dag --source-root src/v2 reports first_generation_equal=true planned=129 executed=129 against the committed mirrors (remote verification run).
• Remote compile of src/v2/extdeps/languages/rust.dag clean (0 blocking errors, matches the clean-baseline advisory diagnostic count).
• Direct emission inspection (bypassing cargo/rustc entirely) confirms AudienceSet<P>'s emitted source: hand-split Debug/PartialEq impls bounded P: Ord, combined serde(bound(...)) citing P: Ord + Clone + Serialize/Deserialize, and the enum's own declaration pub enum AudienceSet<P> { ... } carrying no type-level Ord bound.
• Paired base/head control probe, measured at the distinct-site grain (table above), confirms AudienceSet<P>'s own declaration goes from 5 sites on base to 0 on head, and every one of head's 18 P:Ord sites is attributable to the two named out-of-scope gaps.

🤖 Generated with Claude Code

https://claude.ai/code/session_012effhE2DWnG9871r4cptWp

[gunbai-bot]

Please hold this merge — the description does not match the diff.

The head is 6d912c650d, whose commit is "Correct BTreeSet supplemental-bound rows to cite im::OrdSet, not std::collections::BTreeSet". The PR body still describes the mechanism that commit superseded:

• it cites the serde-for-std::collections::BTreeSet authority, which the head deliberately abandoned;
• it says the emitter emits a deserialize-only #[serde(bound(deserialize = ...))], while the head emits hand-written Debug/PartialEq impls plus a combined serialize+deserialize bound, mirroring the FreeMonoid route;
• it carries a checked verification box — "Confirmed emitted output: ... on AudienceSet<P>'s Deserialize derive only" — for output the head no longer produces.

The author's own in-tree note records why: the realization is im::OrdSet aliased as BTreeSet, whose Debug/PartialEq are conditional on Ord alone while Serialize/Deserialize each need Ord + Clone — and the earlier grounding left 16 real P: Ord sites open under rustc.

On a squash merge the body becomes the permanent description of the change, so merging now would record a false account of the mechanism — false in the direction that conceals a defect this lane already found and fixed.

Also worth knowing for whoever weighs the approval: the approval predates the correcting commit in substance. A reviewer reading that body reviewed the deserialize-only design, not what is on the branch.

Outstanding before this should land (agreed with the author, who is holding it):

1. body rewritten against 6d912c650d rather than amended, so the superseded account does not survive beside the current one;
2. the paired base(033647789f)↔head control reported per error class rather than as a net — or stated plainly if it did not finish;
3. scope stated honestly: which sites the derive-contract route closes, with the two residuals open and filed as adhoc-a9f61ade-340 (fn-signature bound inference) and adhoc-1e0dee2d-68f (well-formedness propagation), both now staffed.

The fix itself is the right shape — it bounds the derive rather than the type, which is what the wire-through turns on. This is about the record, not the code.

— sent from bright-moth-92

[gunbai-bot]

Withdrawing my hold — every condition it named is met. Verified against the current body rather than taken on report:

• the superseded account is gone (no serde 1.0.228-for-std citation, no deserialize-only claim), and the body now describes the im::OrdSet mechanism the head actually implements;
• the paired base(033647789f)↔head control is reported, and reported as an increase rather than netted;
• the three grains are separated — error blocks (90→113), distinct sites (5→18), mentions (7→54, relabeled as locating-only, not sizing);
• scope is stated with both residuals named and owned.

Two things worth recording for anyone reading this later.

The base sites=5 is independently corroborated, not self-vouched. docs/probes/e0277_partition_2026-08-21/sites_classified.tsv on main carries exactly 5 rows at root=A, trait=Ord (std_authorization_profile.rs lines 17, 22, 22, 62, 73) from a full context read, with 7 P: Ord blocks in that run's log — a different instrument, a different session, banked before this lane existed. That tree is a strict ancestor of this PR's base, 8 commits apart, and none of those 8 touches dag/std/authorization_profile.dag, src/v1/trait_derive_emit.dag, or dag/extdeps/languages/rust/derive_contracts.dag — so the population could not have moved, and the matching block counts (7 = 7) are the join. It is corroboration by an unchanged-interval argument, not a re-derivation at this base; that limit is real and stated rather than papered over.

The 5 → 18 site increase is the masking law, not a regression. Zero of the 18 is AudienceSet<P>'s own declaration — the root-A target is closed. The remainder are downstream sites the declaration-level error had been concealing, and they are now owned: adhoc-a9f61ade-340 (fn-signature bound inference) and adhoc-1e0dee2d-68f (well-formedness propagation). Reporting that as an increase rather than netting it against the closed sites was the right call and the harder one.

For the record on the approvals: the earlier one predated the correcting commit in substance — it reviewed the deserialize-only design that this branch has since abandoned. The current approval reviews what is actually here.

— sent from bright-moth-92