Repository navigation
SCM work - #8921
Merged
Merged
SCM work#8921
Conversation
Two rulings landed today that read into direct contradiction, and the
collision is destructive in one direction: a check whose RED IS
UNREACHABLE is a decoration, permanently green and worse than absent
because it gets cited as coverage; and an arm whose CURRENT OCCUPANCY IS
ZERO is legitimate and must not be deleted. Read carelessly the first
licenses deleting exactly what the second protects, and the deletion looks
principled while removing a live wall.
They do not conflict. The boundary is a three-question decomposition, and
only the first two bear on whether the arm should exist:
mechanism existence can any governing authority produce this state?
join reachability can it classify an element of THIS operation's
denominator?
current occupancy does anything receive it today?
Yes / yes / zero is a healthy guard being quiet. Unreachable means the red
cannot be produced at all; empty means it can and nothing does.
Two corollaries, each from a lane that got it wrong first and neither
inferred. Reachability is judged against what a FIXTURE MAY AUTHOR, not
what the accepted corpus contains -- a regression probe is an invalid
program by definition, so a state no Accepted program holds is usually
still authorable, and scoping reachability to corpus-expressible is the
same conflation one layer out. And an arm is reachable relative to ONE
operation: the scm path-exclusion disposition is unreachable from the
floor's fold, which drops excluded subjects before inventory, and reachable
from a join over admission rows, which exclusion never removes.
Filed in the recurring-failure-modes list because that is where a reviewer
pattern-matches and where both rules are read, and because the failure has
the shape its neighbours have -- it is a state-space conflation, two states
with opposite remedies collapsed onto one observation.
Neither ruling is restated or weakened here; this names the line between
them so that applying one does not silently execute the other.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 22, 2026
…verted hand-added content Review 54786 is correct and the cause is worse than a rebase artifact. I resolved both files as generated artifacts -- took one side to clear the marker, then regenerated through main_wet and committed the output. That is the right discipline for a generated file and it produced a WRONG result here, because both files carry content that exists in NO .dag authority: - DESIGN.md: "authority substitution" (#8880), "reachability read as occupancy" (#8921), and the floor-counter measurement from run 32553487573 / 967b5bc (#8895). git grep over origin/main finds all three in DESIGN.md and in no .dag file at all, and dag/gunbc/design_document.dag is BYTE-IDENTICAL between my HEAD and main -- so the generator never carried them and regenerating on main's own tree would drop them too. - .gitignore: four !docs/probes/... allow-listings, same shape. So the deletion was not my merge losing a hunk; it was the generator faithfully emitting an authority that no longer describes the committed file. Both files have DRIFTED on main by hand-editing, and any regeneration by anyone silently reverts the hand-added half. Restored both to main's exact bytes: this PR now touches neither. The drift itself is main's condition, not mine, and it is reported on the PR rather than carried -- the generated-artifact drift gates are on DESIGN's own unguarded list since the floor cut, which is precisely why nothing caught it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 22, 2026
briansrls
pushed a commit
that referenced
this pull request
Aug 22, 2026
…-required-ci stays at three phases) (#8800) * Repair 23 of the 27 dangling cited-symbol references, and give the lens an executing consumer v2.lens.cited_symbol_resolution was RED on unmodified main and nothing ran it: every witness carrying its live-corpus claim sits in dag/test/claim/long/, a file classified OfflineLocalRecipe. Measured on BuildBuddy against main: 27 production DeclarationRefs refuse. The repairs, by class rather than in bulk: - relocated subjects, repointed: v1.compiler.emit_rust x3 -> v1.compiler.coercion, v2.compiler.infer InferredTree -> v2.compiler.inferred_tree, ci_floor_plan gunbc_ci_fast_lane_rule_note -> gunbc.witness_row_cost - deleted subjects whose document keeps a live one: the dead additional_work is dropped - deleted subjects that were the document's only work, document still live: rebound to the system the document is actually about, each with the rebinding recorded on the row - documents whose whole subject a cut deleted: enumerated first, then deleted with their bind and their inbound links (falsifier-memory-root-cause-diagnosis, regen-divergence-ratchet-shape) The four remaining refusals are a different class - references into witness modules that decl_facts deliberately never indexes - and are wise-boar-649's typed counted disposition, not mine to repoint. Execution route: claim_executor --required-ci gains a cited-symbol phase. The required floor cannot host this census - run_required_floor declines any entry that reads the live tree, and reading the live corpus is the census's whole subject - so a phase, which is not a claim, is the route. It reports every refusal with its typed arm instead of a count. * Drop the measurement probe from the tree — it is a local instrument, not a landing artifact * The four uncitable references get a typed counted disposition, and its one dodge is refused by execution Four documents bind to the witness that IS their evidence, and no resolver can reach it: v2.std.decl_index decl_facts does not index declarations in test .dag files, so a reference into a witness module refuses DECLARATION-ABSENT however correct it is. Measured with a positive control rather than assumed (BuildBuddy, 2026-08-21): all four target files report indexed_in_decl_facts=false / module_declared=true, while src/v2/lens/cited_symbol_resolution.dag and dag/gunbc/doc_graph_roots.dag report true/true. The control is the load-bearing arm - it proves the walk REACHES src/v2, so the skip is about the file being a TEST file and not about the root, and the src/v2/test row is the same class as the three under dag/test/claim rather than a second one. So the rows carry std.decl_ref CitationIndexCoverage - wise-boar-649's axis, consumed rather than re-minted - and the population is counted, not silently subtracted. THE DODGE THIS ADMITS IS REFUSED BY EXECUTION, NOT BY REVIEW. Marking a resolvable reference outside-index would shrink the population and green the census over something nobody checked. The report refuses such a row as OUTSIDE-INDEX-RESOLVES, per reference rather than by count identity: N refusals against N claimed is satisfiable by the WRONG N refusing once the population is live. Both arms executed on BuildBuddy against this head: census on the real type -> [] (the 23 repairs hold; nothing else refuses) one resolvable ref marked -> OUTSIDE-INDEX-RESOLVES gunbc.witness_row_cost gunbc_ci_fast_lane_rule_note The guard lives in the phase rather than in a witness deliberately: a witness carrying it would land in the same OfflineLocalRecipe file that executes nowhere, which is the defect this change exists to close. * A green names its denominator: the phase reports checked=N and fails if it cannot read one An empty refusal list means BOTH "every authored reference resolved" and "there were no references to check". Those are different states with different remedies, and the second is an instrument failure wearing the first one's clothes — the empty-observation narrow, on the answer lattice's bottom rather than its top. So the phase now prints the population beside the verdict: required-ci: cited-symbol OK every authored reference resolves checked=390 390 measured by execution on this head (BuildBuddy). A population it cannot read FAILS the phase rather than reporting a green over an unknown denominator — reading "nothing refused" as coverage while unable to establish that anything was examined is the fabricated-plausible-output arm. Both readers share one context construction (`cited_symbol_lens_context`): two constructions would be two chances to answer from different trees, and a denominator is only meaningful for the census it accompanies. `cargo check --release --bin claim_executor` clean on this change. * The partition witness went red because the population gained a third bucket — restate it as three terms, do not relax it required-floor: FAIL test.claim.cited_symbol_resolution_witness_test .cited_symbol_production_population_excludes_planted_controls returned Bool(false) That witness asserted all-works == production + planted-controls, an identity that held while every authored work sat in exactly one of two buckets. Marking the four references decl_facts cannot index as OutsideDeclIndexTestWitnessModule removed them from the production projection, so the two-term sum went short by exactly four and the floor reported it. The witness was right and my change was incomplete. Restated as three terms rather than relaxed. The property it protects is that NO AUTHORED WORK FALLS OUT OF EVERY BUCKET — a reference silently dropped from the production population is precisely how a census greens over something nobody checked, which is the failure this lens exists to catch. An inequality, or subtracting the outside-index rows from the left side, would each make that undetectable. The exact sum also means a fourth bucket added later reds here too. Worth recording where the catch came from: this is the partition witness wise-boar-649 asked for when they handed over the disposition shape, doing exactly the job they named — a row cannot fall out of both halves. It ran on the required floor, per-PR, and failed in the same run where the new cited-symbol phase reported green with checked=390. * The census is a separately named required check, not a fourth --required-ci phase The operator narrowed --required-ci from eight phases to three (#8791). That ruling is about what one composed entry point is responsible for, so this census -- a different subject, over the live corpus -- gets its own named check instead of being routed back in under that mode. --required-ci is left at exactly three phases; its invocation in witnesses.yml is unchanged. - claim_executor gains --required-cited-symbol as its own top-level mode, reporting every unresolved reference with the arm that refused it and, on a green, the population it checked (an unreadable denominator FAILS). - gunbc.fabric_witness_run owns the argv, as it does for the floor, so the transport renders a command rather than re-spelling one. - gunbc.witness_floor_workflow emits a second JOB -- a check-run is a job, not a step -- with no `needs` edge, so neither job can silence the other. - witnesses.yml regenerated through main_wet, never hand-edited. - the capability-closure witness gains the second live job as a subject. Measured: cited-symbol: OK every authored reference resolves checked=390. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The check caught its first live dangling citation on the merge ref, and repointing it is the fix `--required-cited-symbol` went red on the merge with main: the doc bind for gate1_repr_mismatch_e0308_diagnosis_2026-07-23 named v1.compiler.emit_rust rust_string_grounded_type_alias_decl_line, and main DELETED that arm when the two spelling roles it was compensating for were split apart. The citation outlived what it names -- exactly the DESIGN §3 class this census makes decidable, arriving from a direction no branch-local measurement could see (the subject is branch + main, not the branch). Repointed to rust_scalar_checkpoint_grounding_base, the successor for the question that doc diagnoses: what a DECLARATION is grounded in. Also corrected two mechanism claims the separate-check rework falsified in my own carriers, which would have shipped as stale citations inside the PR that fixes citations: - doc_graph_roots outside_index_works_note said the anti-dodge report runs as a `--required-ci` phase; it runs as `--required-cited-symbol` in its own job. - the lens's required_ci_phase_note is renamed and restated for the same reason. Measured after the repair: cited-symbol: OK every authored reference resolves checked=390. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Move the repoint rationale out of the row: annotations are module-item grain only The floor refused my own last push with seven `source annotation sits inside a declaration body` errors -- the `//` block explaining the repoint sat between the fields of a HandAuthoredDocBind row inside a data list. DESIGN §4c models annotations at module-item grain only, so that placement is unwritable, not a style preference. The rationale lives in the previous commit's message and on the PR; the row carries the corrected reference and nothing else. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Share the lens context for real, instead of a comment saying it is shared Review 54581: cited_symbol_lens_context's doc-comment claimed the context was "built once and shared by both readers of it", while cited_symbol_census and cited_symbol_population each built their own -- two reads of a tree that can change between them, the exact hazard the comment said was closed. A stale mechanism claim inside the census whose subject is stale claims. Fixed in the direction that makes the comment true: run() builds the context once and lends it, so both helpers now take a &InterpContext and cannot construct a second one. The comment records what was false rather than being quietly reworded. Also corrected two neighbouring sentences the separate-check rework falsified: the header said "RUN AS A PHASE" and the route paragraph called it a phase. Re-measured: cited-symbol: OK every authored reference resolves checked=390 (3m07s local, unchanged -- evaluation dominates, so no speedup is claimed). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Order the two jobs instead of isolating their toolchains: ETXTBSY becomes unwritable, not rare Operator ruling 2026-08-22, deciding the trade I declined to make unilaterally. The race is this PR's cost, not a host condition: the cited-symbol job does not exist on main. Both jobs are byte-identical through checkout, toolchain and build, and when they start together on one self-hosted host both installs write the SAME /home/ghrunner/.cargo/bin/rustc -- ETXTBSY, exit 126, measured at 1 run in 5. The census step skipped, so the job reported no verdict rather than a wrong one; the problem is not a wrong answer, it is that a required check redding one run in five for reasons unrelated to the diff trains reflexive rerunning, and that is how a real failure gets rerun away. The floor job now `needs: [cited-symbol]`, so the census runs FIRST: - the two setups cannot coincide, so the race is structurally impossible rather than rare (§5 construction over mitigation); - the shared toolchain and registry survive, so the second build stays a cache hit -- the rejected alternative, per-job CARGO_HOME/RUSTUP_HOME, would pay a cold build on every run to avoid a collision on one in five; - both jobs keep their own check identity, which was the point of the split; - the fast signal comes first: minutes, not after ~30 minutes of floor. What the edge costs is named in the carrier rather than buried: a red census leaves the floor SKIPPED, so that run yields no floor verdict. Also de-duplicated the two jobs' preparation into prepared_bound_steps(), so checkout/toolchain/build are authored once and rendered twice rather than copied -- the operator's second constraint, taken now so the copy cannot calcify into two blocks that drift. Landed in the authority (dag/gunbc/witness_floor_workflow.dag) and regenerated through main_wet; .github/workflows/witnesses.yml is never hand-edited. Verified green by execution: both live capability-closure witnesses and all four workflow-consolidation witnesses. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Remove the measurement probe: it is an undeclared scaffold, not a deliverable dag/test/claim/long/cited_symbol_dangling_probe.dag was the instrument that produced the 27-dangling-reference measurement. It has no consumer, no witness enrolment, and no dissolution obligation, and it will not survive the terminal architecture -- the census it was scaffolding for now executes as a required check, so the probe's whole function is discharged. I removed this same file once already on the repairs branch and it reached review here regardless, because this branch carries its own history and the file was re-added by the commit that opened it. Naming that rather than quietly deleting: a scaffold removed on one branch is not removed on another. Kept out of tree, not out of reach -- the measurement it produced is recorded in the PR body and its receipt in the commit history. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Restore DESIGN.md and .gitignore to main: my regeneration silently reverted hand-added content Review 54786 is correct and the cause is worse than a rebase artifact. I resolved both files as generated artifacts -- took one side to clear the marker, then regenerated through main_wet and committed the output. That is the right discipline for a generated file and it produced a WRONG result here, because both files carry content that exists in NO .dag authority: - DESIGN.md: "authority substitution" (#8880), "reachability read as occupancy" (#8921), and the floor-counter measurement from run 32553487573 / 967b5bc (#8895). git grep over origin/main finds all three in DESIGN.md and in no .dag file at all, and dag/gunbc/design_document.dag is BYTE-IDENTICAL between my HEAD and main -- so the generator never carried them and regenerating on main's own tree would drop them too. - .gitignore: four !docs/probes/... allow-listings, same shape. So the deletion was not my merge losing a hunk; it was the generator faithfully emitting an authority that no longer describes the committed file. Both files have DRIFTED on main by hand-editing, and any regeneration by anyone silently reverts the hand-added half. Restored both to main's exact bytes: this PR now touches neither. The drift itself is main's condition, not mine, and it is reported on the PR rather than carried -- the generated-artifact drift gates are on DESIGN's own unguarded list since the floor cut, which is precisely why nothing caught it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls
pushed a commit
that referenced
this pull request
Aug 23, 2026
…on (#8931) * DESIGN failure-mode entries belong in the authority, not the projection DESIGN.md IS A GENERATED ARTIFACT. `DesignArtifact => "DESIGN.md"` is in the generated-artifact registry and .gitattributes binds the path to the generated-artifact merge driver; the prose is projected from dag/gunbc/design_document.dag. README.md and CLAUDE.md are symlinks to DESIGN.md, so all three are downstream of that one module. I edited the projection three times today. Two of those are ALREADY MERGED: authority substitution #8880 authority 0 / projection 1 reachability read as occupancy #8921 authority 0 / projection 1 total at the level examined #8926 authority 0 / projection 0 So two entries currently exist only in the derived artifact on main. With the drift gates and heal among the things the floor cut left unguarded, nothing refuses this today -- which is worse than being caught, not better: the next regen deletes both sentences and nobody learns why they vanished. It is also the exact tell DESIGN section 6 lists, a hand-authored projection the model should generate, committed in the document listing it. This moves all three into the authority and leaves the projection matching. Braces are escaped as \{ \} per the module's own convention (`CpuSocket \{ package: ... \}`); the prose contains no inner double quote, checked before writing, because one closes the .dag string early and surfaces as a parse error far from its cause. VERIFIED TWO WAYS, AND NEITHER IS A REGEN RUN: parse a scratch entry importing gunbc.design_document resolved and PASSED, so the whole-corpus parse phase accepted the edited prose. The pre-push hook runs cargo fmt and never parses .dag, so nothing else would have caught a broken string before CI. bytes the authority row, unescaped, is byte-identical to the projection row: 7748 == 7748. A regen therefore reproduces DESIGN.md exactly rather than rewriting it. I could NOT execute the generator to produce DESIGN.md, and say so rather than imply otherwise: the regen cut re-derived the verifier half and not the producer half, so run_required_regen writes a candidate tree only on the path where the populations already agree. String equivalence plus a parse resolve is what is available; a generator run is not. Content is unchanged from #8880, #8921 and #8926 -- only the file. #8926 is superseded by this and closed. Found by swift-badger-524, who checked the authority rather than trusting that a Markdown file is a Markdown file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The counter refresh was projection-only too: port #8895 into the authority A FOURTH edit of mine to DESIGN.md that never reached dag/gunbc/design_document.dag, found by auditing the whole document rather than only the row this PR started with. On main today: authority offered=11615 routed=10253 ... run 32515441229 projection offered=11812 routed=10439 ... run 32553487573 #8895 repointed stale counters in DESIGN.md to stop a session planning against a population that had moved. Putting that fix in the projection means the next regen reverts it to the stale values -- the change would have been undone by the mechanism it was written to protect against. Ports all of it: the four counter substitutions, the derived 1373 / 11.6% figure, the re-pointed meta-note, and the 437-character sentence raising the standing question of whether a receipt line belongs in prose at all. NO OTHER LANE HAS DRIFTED. A sliding-window comparison of every prose line in DESIGN.md against the unescaped authority leaves exactly one candidate that is not mine, and it is a false positive: that sentence is composed via `documentary_ref_symbol_text(v1_maintenance_standing_ref)` rather than stored literally, which is section 3's cite-the-symbol rule implemented inside the generator. All four divergences were mine. A NOTE ON THE AUDIT THAT FOUND THIS, because it nearly did not. The first sweep probed one 100-character window per line and reported ZERO divergences. My additions sit at the end of a 7748-character line, so it sampled a region already known to match -- a confident clean result over a subset of what the question ranged over, which is the class this PR's own new entry names. It surfaced only because a zero that tidy was worth distrusting. Ported prose carries no double quote, backslash or brace (checked before writing); the file's unescaped quote count stays even. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
gentle-eagle-360.Pushing to
session/reachability-vs-occupancyadvances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan