Repair 23 stale citations the cuts left behind — and say plainly that the lens which should have caught them still runs nowhere

[gunbai-bot]

What this fixes, and what it does not

v2.lens.cited_symbol_resolution is the mechanism DESIGN §3 names for making a stale citation decidable. Measured by execution on BuildBuddy against main: it refuses 27 production DeclarationRefs. It was not broken — it was unobserved. Every witness carrying its live-corpus claim lives in dag/test/claim/long/cited_symbol_resolution_witness_test.dag, a file classified OfflineLocalRecipe: enrolled, executed nowhere.

This PR repairs 23 of those references. It does not close the class.

The ceiling, stated rather than implied: after this PR the lens still runs nowhere. These repairs fix the instances, not the mechanism that let them ship. The remaining four references, and the enrolment that would make the class observable, are held in a separate change (below). A reader should not take a green tree here as evidence that a stale citation would now be caught. It would not be.

Why 23 references were dangling

Every one is a citation whose subject a deletion removed while the citation stayed authored — the §3 stale-citation class, in a structural carrier rather than in prose:

cause	refs
v2.workflow.ci_floor_plan — module deleted by the floor cut	7
gunbc.ci_workflow — deleted by the floor cut	3
gunbc.falsifier_workflow + its witness — deleted with the falsifier	3
tools.regen_verify_transport / tools.floor_effect_gate_witness — deleted by the regen cut	2
relocated declarations (v1.compiler.emit_rust×3, v2.compiler.infer, the fast-lane rule note)	5
v2.workflow.required_floor RequiredFloorClaim — a Rust type in the seed, never a .dag declaration	1

The repairs, by class

Each class has a different correct answer, so this is not a bulk rewrite.

• Relocated subject → repoint. v1.compiler.emit_rust → v1.compiler.coercion, v2.compiler.infer InferredTree → v2.compiler.inferred_tree, gunbc_ci_fast_lane_rule_note → gunbc.witness_row_cost (re-homed by the floor cut itself).

• Dead work beside a live one → drop the dead reference (5 rows).

• Dead work was the document's only one, document still live → rebind to what the document is actually about, with the rebinding recorded on the row: progress-observation-design → std.observation ObservationEvent; witness-realization-plan → std.emit_on_demand + std.realize_pack; ci-invocation-fixed-tax-attribution → the frontend root its own §5 names; floor-time-namespace-walk-regression-diagnosis → the reconcile-assembly row its §7 measures at 58% of the resolve wall; resolve-regression-journey and ci2-native-cutover-reobservation → the surviving work each already carried.

• Whole subject deleted → enumerate, then delete the document with its bind and its inbound links. Two, each enumerated before deletion per DESIGN's rule that a prose row takes everything in it unless its contents are enumerated first:

  • falsifier-memory-root-cause-diagnosis — the A/B failure-class split, a witness list at a 2026-08-03 head, a governor receipt, an abandoned bisect, the falsifier job split. Enumerated, nothing survives the deleted falsifier; its one general lesson (BudgetExceeded is host-sensitive and is not a semantic verdict) is already carried by gunbc.witness_deferral_freeze.
  • regen-divergence-ratchet-shape — a shape proposal for a divergence ratchet on regen_stage0 --verify, deleted at the root by the regen cut. Enumerated, nothing survives; its B1 baseline-monotone idea is already DESIGN §5's monotone-debt-contract rule.

  Inbound links fixed in the same change: ROADMAP.md with its gunbc.roadmap_authority row, and seed-honesty-discharge-design.md.

Held out of this PR, deliberately

Split on my parent's direction so a scope question does not gate real repairs:

1. The four remaining references are a different class — references into witness modules that v2.std.decl_index decl_facts deliberately never indexes, so they are uncitable through this resolver by construction, not stale. Measured with a positive control: all four target files report indexed_in_decl_facts=false / module_declared=true while src/v2/lens/cited_symbol_resolution.dag and dag/gunbc/doc_graph_roots.dag report true/true — the control proves the walk reaches src/v2, so the skip is on the file being a test file, not on the root. Their disposition consumes CitationIndexCoverage from Enroll both instance-gap carriers in cited-symbol resolution, with a counted outside-index disposition #8775.
2. The enrolment — a cited-symbol phase in claim_executor --required-ci, measured at 2m13s, verified executing on real CI. The required floor cannot host this census: run_required_floor declines any entry that reads the live tree, and reading the live corpus is the census's whole subject. But CI keeps only the parse sweep, regen, and the witness floor: five phases leave --required-ci #8791 narrowed --required-ci from eight phases to three by operator ruling hours earlier, so whether a fourth goes in is that ruling's owner's call. Held on session/quiet-lark-881-phase.

[gunbai-bot]

Receipts, all by execution on BuildBuddy against this head

The repairs hold. The census over the real production population returns [] — the 23 cut-orphaned citations are green, and nothing else refuses. Cost of the whole census including resolve: 2m13s wall / 2m09s CPU (~7% of a ~30 minute required-ci run).

An empty result is a claim about the instrument first, so here is the discriminating arm. Marking one resolvable reference outside-index — a mutation, reverted — makes the same report return:

OUTSIDE-INDEX-RESOLVES gunbc.witness_row_cost gunbc_ci_fast_lane_rule_note — marked outside the declaration index, but it resolves; the marking is false

So the [] is a measured green rather than a vacuous one, and the anti-dodge guard discriminates by execution rather than by review.

The four uncitable references are settled as one class, with a positive control. All four target files report indexed_in_decl_facts=false / module_declared=true; src/v2/lens/cited_symbol_resolution.dag and dag/gunbc/doc_graph_roots.dag report true/true. That control is the load-bearing half — it proves the walk reaches src/v2, so the exclusion is on the file being a test file, not on the root, and the src/v2/test row belongs to the same class as the three under dag/test/claim. One variant covers all four; no second minted.

The guard is per-reference, not per-count. A count identity (N refusals against N claimed) is satisfiable by the wrong N refusing once the population is live and moving — so each marked reference is asserted to refuse on its own.

cargo check --bin claim_executor is clean with the phase wired.

Blocked on

#8775 (CitationIndexCoverage in std.decl_ref), approved and mergeable, awaiting the operator's manual merge. Their type was overlaid locally to take the measurements above — an instrument, not part of this diff. On merge: integrate, re-measure both facts (the empty census and the 2m13s are facts about this head, not portable across the integration), then out of draft.

[gunbai-bot]

The failing check is the declared dependency, and the same log is the enrollment receipt

Run 32503722908 at 070fb09, required-ci: phases_run=9 failed=2. Both failures are one cause:

required-ci: phase cited-symbol (every authored DeclarationRef resolves)
required-ci: cited-symbol refused: resolve src/v2/lens/cited_symbol_resolution.dag failed:
  dag/gunbc/doc_graph_roots.dag:5:3: error: name 'CitationIndexCoverage' not found in module 'std.decl_ref'

CitationIndexCoverage lands in #8775, which is approved and mergeable and waiting on the operator's manual merge. This branch imports it; on main it does not exist yet. The floor phase refuses on the same unresolved import, which is why the count is 2 and not 1. Nothing else in the run is attributable here — the doc_reachability_witness_test and trait_derive_supplemental_generic_bound_contract_test diagnostics in the same refusal are downstream of that one unresolved module, or pre-existing on the merge base.

I am not fixing this by making the phase lenient. A census that cannot resolve its own subject is ignorance, not a pass, and the refusal above is the phase behaving exactly as specified. The fix is merge order: #8775, then integrate here.

What this run bought that no local measurement could

The phase executes on real CI. required-ci: phase cited-symbol appears in the ledger, runs, and refuses with a located, typed reason — so the enrollment is live rather than declared, which is the entire point of this PR. It also shows the phase failing without stopping the run: nine phases ran, the ledger is complete, and the merge-admission receipt was minted carrying conclusion=failure rather than a fabricated success.

Still draft. On #8775's merge: integrate, re-measure the census and its cost against the integrated head (neither figure is portable across the integration), then out of draft.

[gunbai-bot]

Thanks — one thing in the review turned out to be a real finding, though it reads as a compliment.

The probe module should never have been here, and I have removed it (006fa48). "The new probe module's imports all resolve to existing files" is true and is exactly the problem: dag/test/claim/long/cited_symbol_dangling_probe.dag is the throwaway instrument I used to read the census and the index-coverage facts off a BuildBuddy runner. It has no consumer, no dissolution obligation and no operator approval — an undeclared scaffold under DESIGN §6, whose correct landing state is absence. I took it out of the index once and a later merge's git add -A put it back, which is how it reached you looking like an intended artifact. Every measurement it produced is recorded in this thread, and the same facts are reachable from the lens itself in the held enrolment change, so nothing is lost with it.

That is the general shape worth naming: a reviewer checking that a file is internally well-formed cannot see that it should not exist. The check that would have caught it is the one this PR's own subject is about — whether an artifact has an executing consumer.

One diff entry is not a change of mine. docs/plans/self-host-cargo-refusal-root-partition.md shows +54 lines against the PR's merge base; that content came from main through a merge, and git diff origin/main -- <that file> is empty, so my branch is byte-identical to current main there. Merge-base artifact, not an edit.

Nothing else in the review needs action — the rebinding notes, the de-linking of the two deleted plans, and the §3/§4b framing are what the review confirms rather than questions.

— sent from quiet-lark-881