Publication standings in a vocabulary no format owns, and the arm that could not exist before by gunbai-bot[bot] · Pull Request #8973 · gunb-ai/gunbc

gunbai-bot · 2026-08-23T02:34:37Z

Stacked on #8965 (base is session/closure-recut). Review that first; this is the layer above it.

What this is

This is what closing #8940 was for. That PR computed exactly this vocabulary inside publication, by matching on one format's error enum. The classification was right and the placement was wrong: §3 rules that the dispatch selecting a realization is itself realization, so each format classifies its own refusals into a shared vocabulary and the consumer sees only the standing.

gunbc.scm.load_standing    the vocabulary — names no format, carries no cause
commit_closure_json_v2     classifies its own 16 refusals, beside the coproduct it reads

The standings carry no cause payload, deliberately. A cause is format-shaped — a member key, a positional reference, a variant tag — and threading it through this type would re-import the exact coupling the split exists to remove. The decision needs only the standing; if publication ever needs to render a cause it asks the format for a rendering rather than pattern-matching one.

The fourth arm is the point, and it had no producer until the recut

LoadPartial is a success arm sitting beside three failure arms. A document whose uncontained references leave objects the store does not hold loads correctly and is a delta.

Under the predecessor format a position denoted nothing outside its own document, so an unresolved reference was damage, full stop — this arm had no mechanism capable of producing it, and adding it would have been an invented arm (reachability read as occupancy). Conflating it with LoadDocumentMalformed would be the state-space conflation: "I could not read this" and "I read this, and it is a delta" have opposite remedies.

Exactly one standing permits replacement

And the three refusals are refused for three different reasons, not by one rule — each is a distinct way to destroy a writer's valid generation:

standing	why it is never superseded
`LoadPartial`	correct and deliberately incomplete — discarding it punishes a delta for doing what it was asked
`LoadUnsupportedProtocol`	may be perfectly good bytes, unreadable only here — an older reader destroying newer work
`LoadIdentityCollision`	both records legitimate; the locator cannot represent both, neither is damaged
`LoadDocumentMalformed`	the only one — tag matched, so this build claimed to understand the exact schema

Permission is still not action: this answers whether replacement is admissible, never performs it.

Evidence

6 standing witnesses + 8 closure witnesses green. All three data-loss paths mutation-proven:

mutation	expected red	result
a partial load becomes supersedable	`a_partial_load_is_never_supersedable`	RED
honest collision classified as malformed	`an_honest_collision_is_its_own_standing_and_never_supersedes`	RED
unrecognized member as a newer writer	`only_an_unrecognized_format_is_a_protocol_gap`	RED
control / restored	—	green both ways

Each test pairs a cause against one that must land elsewhere, so a classifier collapsing everything onto one standing fails here and only here.

Not in this PR

publication itself — which consumes standings and imports no format at all — lands once this vocabulary is in. Keeping it separate is the same discipline that closed #8940: the mistake there was scope, not content.

Skew check on the refresh to main (2026-08-24)

This branch's previous green was measured 42 commits of main ago. Rather than trust or re-run blindly, the import closure of the four modules this PR changes was diffed against main. Two of eleven reachable modules had moved:

dag/std/types.dag — Set and Map were re-pointed: PointwisePower→FinitePowerSet, PartialFunction→FinitelySupportedFunction (Decompose the Set carrier: the predicate half names PointwisePower, and the fork's open half is declared #9055, Re-author the Map literal population: the open half onto PartialFunction, the finite half onto the construction route #9076). The names survive, so this produces no conflict and no signal — mergeable stayed CLEAN throughout.
src/v2/std/collection.dag — re-exports those two names (import std.types { Set, Map }), and dropped TotalMap/TotalPolicy (unused here).

Why this class is invisible, stated precisely: commit_closure_json_v2 imports Map from v2.std.collection, and v2.std.collection imports it from std.types. The authority that moved is two hops up, through a re-export — the module in the diff never names it. A one-hop closure check would have missed this. It was caught by widening the path prefix (v2.* modules live under src/, not dag/, so an earlier check diffed paths that do not exist and read zero-changed-files as "untouched"), not by widening the depth.

commit_closure_json_v2 has five uses of that vocabulary (Map<String, String>, DecodePositions = Map<String, ObjectId>, empty_map() ×2, and the Map import itself), so the re-point lands directly under this diff.

Exercised, not merely survived — now floor-wide. Locally, all 67 SCM witnesses pass on the merged tree, including the 24 commit_closure_json_v2 claims that construct and read those maps. And the required floor has since executed against current main on head b9e6c421f (run 32778125147):

required-ci:     phases_run=4 failed=0
required-floor:  planned=10855 executed=10855 terminal=10855
                 passed=10577 known_red_held=26 failed=0
                 stale_quarantine=0 interrupted_before_verdict=0
required-regen:  first_generation_equal=true
v2-emission:     census=3884 emitted=9 blocking=0 advisory=0

planned= is quoted deliberately: the prior run on this branch refused during preparation and projected no subject at all, so it answered neither way. A run that projects 10855 subjects and executes every one is what turns the alias re-point from survived into measured.

… what it lacks `image` could not express a fetchable absence at any price, and not by oversight. It stored backward POSITIONS with every identity re-derived on load, so a reference that did not resolve inside the document denoted nothing outside it: the disposition was absent BY CONSTRUCTION. That was also a construction wall, and the recut must say what it gives up. Omitting identities made forgery UNWRITABLE -- a decoder is a second producer reading identities from a file it does not control, and a wire with no identity field has nothing to lie in. So the two properties are one decision seen from two sides: unforgeable identity => no identity on the wire; nameable absent object => an identity on the wire. This keeps both by asking what each reference NEEDS to name. A reference to a contained object needs no identity. Only a reference to an ABSENT object does -- the one place a digest cannot be mis-bound, because there is no payload in the document to bind it to. The trust root moves, and that is stated as a condition rather than assumed: derivation-compare proves "I got the object THIS DOCUMENT named", never "the object the COMMIT named". It is safe only if the image identity is derived over the wire bytes INCLUDING absent-arm digests and obtained from outside the document. Strictly weaker than the unconditional guarantee it replaces; paid knowingly. The admission is a value, not a flag: `PartialClosureAdmission` is `sole_constructor`, so an encoder cannot fabricate one and an undeclared partial closure has no constructor. The review tell is written into the module -- if a consumer grows a check the encoder used to do, the wall was moved, not kept. Verified by execution, unpiped exit codes: control 0; "nothing is ever missing" red; "something is missing but the WRONG identity is named" red; restored 0. The second mutation is the load-bearing one -- it keeps the list non-empty and fails anyway, so the witness checks WHICH object is named rather than merely that one is. NOT yet done, and this is half a cutover: the realization (two-arm wire, Merkle identity), the deletion of `image`, and the three consumers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…o alias called image Motion one of the closure cutover, deliberately SEMANTICS-FREE so that any later red belongs unambiguously to the two-arm reference rather than to the port. `image` was never a concept -- it is one serialization of one -- and the name hid that. It dies here rather than forwarding: an alias would be a second name for one concept and every derived surface would carry both (DESIGN section 3). 38 identifiers moved: `Image*` -> `ClosureDoc*`, `encode_image` -> `encode_closure_document`, plus `CommitClosureImageRefused` and `RepositoryEncodeImageRefusal`, which the first sweep missed and a re-grep caught rather than an assumption. The format tag deliberately still reads v1. Bumping it is a SCHEMA change and belongs with the schema change, not with a rename -- and the module's own policy is that a schema which grows a member grows a new tag, so moving it here would have made the tag lie in the other direction. Proven faithful by execution: all 51 existing witnesses green under the rename -- 24 closure-document, 23 repository-envelope, 4 commit-closure -- via drivers generated on the runner and stripped after, so the witness files themselves are untouched by the verification. One harness defect found and fixed en route, worth recording because it looked like a rename break: the first driver appended its `import std.process` AFTER the declarations, which is unparseable, and the corpus loads as a WHOLE -- so one bad file refused the module index and reddened all three suites including one this commit never touches. Fail-closed behaving correctly; my reading of "three independent reds" was wrong before the diagnostic corrected it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts: # dag/gunbc/scm/commit_closure_store.dag

…me what is missing Motion two of the closure cutover. The predecessor could not express a fetchable absence AT ANY PRICE, and that was the same decision as its anti-forgery wall seen from the other side: unforgeable identity => no identity on the wire (a position cannot name what is absent) nameable absent object => an identity on the wire (and a decoder is a second producer) Both are kept by asking what each reference NEEDS to name. A CONTAINED object needs no identity -- it is right there and its identity is derived from its own bytes, so there is no field to lie in. An UNCONTAINED object needs one, and that is the single place a digest cannot be mis-bound, because no payload in the document binds to it. {"at": "3"} this document carries it {"uncontained": "<digest>"} it does not, and here is the content address Exactly one member, checked; both or neither is typed. The digest is MINTED THROUGH A VALIDATOR (fnv1a64_structural_hex_digest), never trusted as text. An uncontained reference is NOT a decode failure -- it decodes to a successful PARTIAL closure, because deciding whether a partial closure is acceptable is policy, not codec. NAMING: the arm is "uncontained", not "absent". Contained/uncontained is INTRINSIC to the document and true of those bytes forever; unresolved is RELATIVE -- what you get joining uncontained identities against the store you actually have. An object this document does not carry may already sit in your local store. Naming it "absent" would freeze a relative observation into immutable vocabulary. TRUST ROOT, corrected from this branch's first form, which was WRONG. Hashing the wire bytes would make the same logical closure under a different object-table order a DIFFERENT commit, undoing the separation this recut exists to make. The condition is the DERIVED LOGICAL ROOT compared against an expected commit identity obtained from outside the document -- and it needs no new machinery, since object_store already folds a child's target identity into its parent's and transitively into the root's. Two identities kept apart: commit identity (logical) vs publication identity (bytes, never semantic). Also recorded: fnv1a64 is structural consistency, NOT authentication, so "Merkle" does not smuggle in a stronger claim. THE ADMISSION IS A TOKEN, NOT A FLAG. PartialClosureAdmission is sole_constructor, so the encoder cannot fabricate one; an undeclared partial closure is refused, typed, naming the first identity that would have gone uncontained. RUNG STATED HONESTLY: the token is unforgeable but the GATE is only mechanically preventable, because encode_closure_document stays callable directly. dissolve-on: module-private functions in .dag. A DELIBERATE NON-CHANGE: the repository still refuses a partial OBJECT TABLE. A commit closure may ship incomplete under an admission because a delta is a real thing to send; a repository with dangling edges is not, and loosening it by proximity would widen the change past what was decided. ONE SILENT DEFECT THIS FOUND, which is why the rename went first and green. The repository asked "is this commit root unresolvable" by ENCODING it and comparing to "" -- the old sentinel. Once the reference became a JsonValue the comparison went permanently false and the refusal SILENTLY STOPPED FIRING; it typechecked, comparing a JsonValue to a String (DESIGN's cross-representation == straddle, a live instance). Repaired by not routing a containment question through a representation at all: position_of answers it directly. A witness caught it; nothing else would have. Also preserved: an unresolved COMMIT ROOT keeps its own refusal rather than arriving as a generic unresolved target -- two states with different owners and different repairs. Verified by execution. 53 witnesses green (6 commit-closure, 24 closure-document, 23 envelope), and the two new claims mutation-proven: encoder ignores the admission -> a_partial_closure_encodes_only_with_an_admission RED uncontained arm names a wrong object -> an_uncontained_object_survives_the_wire_and_is_still_named RED control and restored -> green both ways The second is load-bearing: the digest stays well-formed and non-empty and only the IDENTITY changes, so the witness proves WHICH object is named, through serialized text rather than an in-memory value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

They are generated per run and discarded; the witness files carry only their test fns. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…review 54915) THE DEFECT, and it is the one this module's thesis says cannot exist. `member_set_refusal` admits both "at" and "uncontained" BECAUSE EACH IS INDIVIDUALLY LEGAL -- so it was never what enforced the choice between them. The code leaned on it anyway and read "at" first, so a target carrying BOTH arms resolved to the position and DROPPED THE DIGEST SILENTLY. A document asserting two contradictory things about one target quietly answered with one of them: the last-wins read every closed member set in this file exists to refuse. Worse than the bug: the docstring directly above it CLAIMED the refusal already happened, and the PR body repeated the claim. Specification-without-execution inside a diff arguing that closed member sets make bad states unwritable. THE FIX counts the arms BEFORE either is read, so the choice is enforced where the choice lives rather than borrowed from a check that cannot see it. A duplicated key counts as PRESENT, so a target carrying "at" twice reaches the arm reader and is refused as ClosureDocMemberDuplicated instead of being miscounted as two arms -- two different failures keeping two different names. ClosureDocTargetNotOneArm.found was also always 0, since it had exactly one construction site and a hardcoded payload. It now carries the real count, and the witness asserts THE COUNT rather than just the refusal -- otherwise the field would still be decorative and nothing would notice. Verified by execution: control green (8 closure witnesses); restoring the silent drop turns a_target_must_carry_exactly_one_arm RED; the closure-document and envelope suites are unchanged. A positive control decodes a well-formed single arm, so the two refusals are not satisfied by a decoder that refuses every target. Review found this by reading; no witness executed the claim. One does now. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…that could not exist before This is what closing gunbc#8940 was for. That PR computed exactly this vocabulary INSIDE publication by matching on one format's error enum. The classification was right and the PLACEMENT was wrong: DESIGN section 3 rules that the dispatch selecting a realization is itself realization, so each format classifies ITS OWN refusals into a shared vocabulary and the consumer sees only the standing. gunbc.scm.load_standing the vocabulary, naming no format, carrying no cause payload commit_closure_json_v1 classifies its own 16 refusals, beside the coproduct it reads The standings carry NO CAUSE deliberately: a cause is format-shaped -- a member key, a positional reference, a variant tag -- and threading it through this type would re-import the coupling the split exists to remove. The decision needs only the standing. THE FOURTH ARM IS THE POINT, AND IT HAD NO PRODUCER UNTIL THE RECUT. LoadPartial is a SUCCESS arm sitting beside three failure arms: a document whose uncontained references leave objects the store does not hold LOADS CORRECTLY and is a delta. Under the predecessor format a position denoted nothing outside its own document, so an unresolved reference was damage, full stop, and this arm would have been an invented one (DESIGN: reachability read as occupancy). Conflating it with DocumentMalformed would be the state-space conflation -- "I could not read this" and "I read this, and it is a delta" have opposite remedies. EXACTLY ONE STANDING PERMITS REPLACEMENT, and the three refusals are refused for three DIFFERENT reasons rather than by one rule, because each is a distinct way to destroy a writer's valid generation: a partial load is correct and deliberately incomplete; an unsupported protocol may be perfectly good bytes unreadable only here; a collision has two legitimate records and a locator that cannot represent both. Only a matched tag with a non-conforming document is known-bad to a reader that should have understood it. Permission is still not action. Verified by execution: 6 standing witnesses and 8 closure witnesses green, and all three data-loss paths mutation-proven -- a partial load becomes supersedable -> a_partial_load_is_never_supersedable RED an honest collision classified as malformed -> an_honest_collision_is_its_own_standing... RED an unrecognized member as a newer writer -> only_an_unrecognized_format_is_a_protocol_gap RED control and restored -> green both ways Stacked on the closure recut (gunbc#8965); publication itself, which consumes standings and imports no format at all, lands once this vocabulary is in. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…dy annotation The witness floor refused at PREPARATION -- not a witness going red -- with fourteen diagnostics of one cause: two explanatory blocks sat INSIDE function bodies, and the .dag realization admits only standalone leading // blocks attached to module-scope declarations. Content unchanged; both now sit above the declarations they describe. WHY IT REACHED CI AT ALL, which is the part worth recording. `gunbc run` executes the corpus but does NOT apply the annotation-grain check that floor preparation does, so every local verification tonight -- fourteen green runs -- was silent about a rule CI enforces. That is a real gap between my loop and the gate, not a slip: the loop could not have caught it. A brace-depth scan now runs before dispatch and reports zero body comments across all six touched files. The irony is worth keeping: the two refused blocks were the ones explaining the silently-dead refusal repair and the commit-root specificity fix -- prose about carefully-restored refusals, refused for sitting in the wrong place. Verified after the hoist: envelope (23) and closure (8) witnesses green, so the move changed position only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ewers read too strongly BOTH FOUND BY ANALYSIS, NOT BY THE WITNESSES, in code that had already been approved twice. 1. THE MODULE SAID v1 WHILE ITS TAG SAID v2. Motion two bumped the format tag because the schema genuinely changed -- positional-only targets became two-arm -- and never revisited the module name chosen in motion one. That is two version names for one concrete realization, shipping inside a cut whose whole argument is that one concept gets one name. The tag is the honest half, so the module moves to match: commit_closure_json_v2, no v1 alias, same rule the cut applied to `image`. 2. THE ADMISSION IS A BEARER TOKEN, AND ITS DECLARED RUNG WAS TOO HIGH. admit closure A -> token T encode closure B with T -> ACCEPTED The encoder checks a token is PRESENT, never that it is ABOUT the closure being encoded, and .dag has no module privacy -- so sole_constructor blocks the record literal while the public mint stays freely callable. That is authority substitution in the form this repository has already named: a true admission about one subject answering for another because no relation binds them. The existing mutation does not catch it and could not: deleting the check proves the check is READ, which a bearer token satisfies. The honest rung is MITIGATABLE -- an accidental partial write is caught, a mis-attributed one is not. It is declared rather than quietly fixed later because review 54944 read the wall as "structural". That is the inflation section 4b calls worse than sitting low, and it is now demonstrated rather than hypothesised: a careful reader saw sole_constructor and concluded a guarantee the code does not make. The next-rung trigger is a shape change, not a check -- AdmittedPartialCommitClosure binding closure, unresolved population and reason together, minted by a function that DERIVES the population, with the encoder taking that carrier instead of a closure plus a free-floating token. Then "a token for A used on B" has no spelling. The discriminator that repair owes is named beside it. Closure witnesses (8) green after both changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…_closure_json_v1 The rename ran on session/closure-recut, where this witness did not exist. Merging that branch brought the renamed MODULE and left this stacked branch's new IMPORT dangling -- a rename is atomic only within the branch it runs on. The consequence is the class review 54948 names: the file could not load, so every claim in it, including the arm that could not exist before, was asserted rather than executed. My 6-green run predated the merge; after merging I re-verified commit_closure and not the one file the merge could break. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gunbai-bot · 2026-08-23T03:31:49Z

Fixed. The finding is correct, and the mechanism is a stacking hazard rather than a typo — worth stating so it does not recur.

The rename commit_closure_json_v1 → _v2 ran on session/closure-recut. This witness did not exist on that branch. Merging the recut in brought the renamed module and left this stacked branch's new import dangling — a rename is atomic only within the branch it runs on, and a stacked branch's new files are invisible to it.

Your §5 point is the one that lands hardest: the file could not load, so every claim in it was asserted and not executed, including the "arm that could not exist before" that the PR is named for. My 6-green run predated the merge, and after merging I re-verified commit_closure — not the one file the merge could actually break.

Re-verified now, with the credential rather than just the control:

CONTROL (6 standings)                          exit=0
MUT: a partial load becomes supersedable  →  a_partial_load_is_never_supersedable   exit=1
RESTORED                                       exit=0
closure (8)                                    exit=0

Two process corrections I have taken from this, since a green control alone would have hidden it:

I re-verified the wrong file after the merge. Post-merge verification has to cover what the merge could break, not what I happened to have a driver for.
My pre-dispatch scan checked body comments but not dangling module references. A tree-wide grep for stale module names costs nothing and catches this class immediately; it is now the first thing I run after any rename.

— sent from gentle-eagle-360

Review 54951 flagged one stale image.dag citation in repository_envelope. There were eight, across two files: a rename landed on this stack and the prose kept naming the pre-rename module, so every one of them pointed at a path no longer in the tree. Fixing the instance a review names while leaving its siblings is how a class survives its own repair, so this is the whole population of that class -- `grep -r image.dag dag/` is now empty. Scope, stated rather than assumed: this fixes CITATIONS, names that resolve to nothing. Two neighbouring populations are deliberately untouched, because neither is a false pointer -- 27 comment lines using "image" as a descriptive noun for the closure document, and 135 scm_image_* test-local identifiers. Those are dated wording, not broken references; sweeping them is a rename diff over an approved PR and belongs in its own change if it is wanted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gunbai-bot · 2026-08-23T03:48:26Z

The dangling import is fixed and pushed: the witness imported gunbc.scm.commit_closure_json_v1, which the rename on the branch below turned into a name with no module behind it. grep -r commit_closure_json_v1 dag/ is now empty corpus-wide, not just at the site.

The review's finding was that the six claims were asserted, not executed — the file could not load, so nothing in it ran. A fixed import only restores parsing, so I did not treat it as closing the finding. Executed:

### load_standing_witness_main
exit=0

A green driver is worth nothing if it cannot go red, so I mutated one claim rather than assuming — dropped the ! in a_partial_load_is_never_supersedable so it asserts a partial load is supersedable, which is the exact inversion the standing exists to forbid:

### MUTATED load_standing_witness_main (expect nonzero)
exit=1

Clean 0, mutated 1, same binary and same entry. The mutation was reverted; the tree is byte-identical to the pushed head.

One thing found while verifying, not fixed here. Nothing in witnesses.yml or gunbc.witness_floor_workflow invokes load_standing_witness_main or any *_witness_main — the floor discovers test fn directly, so the driver has no consumer in the required run and exists only as a local route to gunbc run --function, which cannot drive a Bool-returning test fn. Two of the four witness files on this stack carry such a driver and two do not. That inconsistency is mine. I would rather delete both than add two more, but I am leaving them until this stack lands, since the driver is currently the only way to execute these claims outside a full floor run — and deleting the thing that produced the evidence above in the same breath as offering it seemed like the wrong order.

— sent from gentle-eagle-360

…t `at` Review 54959: a duplicated or wrong-shape `at` was not surfaced as an `at` refusal -- it fell through to the `uncontained` read and reported whatever that said. The cause is a state-space conflation in the arm selector. read_string_member returns MemberFailed for BOTH an absent `at` -- the ordinary case, meaning the other arm applies -- and a malformed one. Those are opposite facts with opposite owners: absence says "not applicable here", duplication says "THIS arm is broken". Matching on read success collapsed them, so a target carrying `at` twice entered the uncontained read, found `uncontained` legitimately absent, and was refused as a wrong-shape `uncontained` -- naming an innocent member, with the duplication never mentioned. The tell was in the code: `MemberFailed { cause: c }` bound c and dropped it. Fixed by selecting on presence via json_object_unique_member, then routing each arm's failures through its own reader. Neither arm can now be reached by the other's defect. WHY NO WITNESS CAUGHT IT. Every refusal claim in this file used a cause-agnostic helper that asks only "did it refuse". The decoder refused in both the correct and the broken build, so all of them stayed green while the diagnostic pointed at the wrong key. A refusal-only assertion cannot catch a wrong-cause defect -- it is the weaker observation, and this is the second finding on this stack where the shape of the observation, not the subject, was what let the defect through. The two new claims therefore assert the CAUSE AND ITS KEY. Proven both ways, same binary and entry: fixed decoder, 10 claims exit=0 pre-fix decoder, same 10 claims exit=1 Under the pre-fix build they fail for two DIFFERENT wrong answers -- MemberWrongShape("uncontained") and MemberMissing("uncontained") -- so they are not both satisfied by one shared accident. Also corrects a false comment above target_arm_count, which asserted this refusal already happened. It did not. That is the second docstring on this stack claiming a refusal the code did not perform (the first was review 54915), and the pattern is the finding: prose describing a wall is not evidence the wall exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

restore actually observed Review 54970: uncontained_targets and uncontained_in_record both accumulate with concat-at-end -- the copied-accumulator shape DESIGN section 6 names as always-fix regardless of realized n. The finding is sharper than it reads: this same stack documents that rule in commit_closure_json_v2 encode_step and fixed the equivalent shape in repository_envelope, then reintroduced it in the new module. Fixing a cost shape where a review names it is not the same as not having the defect. BOTH LEVELS, not one. The inner per-edge fold copied per child; the outer per-record fold copied the whole accumulator once per RECORD, which is the worse of the two. So uncontained_in_record now takes the caller's accumulator and prepends onto it directly rather than returning a fresh list to be joined at the top. Nothing is copied at either level and one linear reverse restores authored order. uncontained_in_record is module-private, so the signature change is contained; uncontained_targets keeps its exported signature. AND THE PART THAT IS NOT IN THE REVIEW. I first wrote a comment asserting the reverse was load-bearing because order is observable, citing two existing claims as evidence. I mutated it rather than trusting it. Dropping the reverse left EVERY claim in the file GREEN: names_exactly is a membership fold and every closure fixture asserts exactly ONE missing identity, and a one-element list reversed is itself. Order was never observed by anything. So the property is now held by a claim instead of a sentence. two_uncontained_children_are_named_in_order grafts a parent whose two children are both absent, and pins WHICH COMES FIRST. Verified both ways: with the reverse exit=0 without the reverse exit=1 The cost fix would have been correct either way. What would not have been correct is shipping a comment claiming coverage that did not exist -- the third time in this stack, after the target-arm docstring and the target_arm_count comment. In all three the code was fine or fixable and the PROSE asserted a wall nothing held up. The recurring mechanism is that the claim's OBSERVATION was too weak to see the difference the comment described. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…holds it

…(carrier-exactness recut) (#8990) * Split the encode refusal domain out of the decode one, so the load classifier cannot name a state the loader cannot produce Recut item 1 of 7. This is a correctness fix, not carrier tidying. THE DEFECT. ClosureDocIncompleteWithoutAdmission is produced by encode_closure_document_checked and by nothing else -- no decode path reaches it. It nevertheless sat in ClosureDocRefusal, which closure_document_load_standing matches EXHAUSTIVELY. So the load classifier was obliged to assign a standing to a state loading cannot produce, and it answered LoadDocumentMalformed -- which standing_may_supersede_generation makes the ONE standing permitted to supersede a newer document. An encode-only state had a route to "may overwrite". This is a closed match over a dishonest domain: exhaustiveness is satisfied, the compiler is content, and the arm answers for something that cannot occur. Nothing was miswritten; the TYPE was wider than the operation's domain. THE FIX is not a new guard. ClosureDocEncodeRefusal now carries that arm and ClosureDocEncodeOutcome refers to it, so the classifier's parameter can no longer express the cause. The question stops being answerable rather than being answered correctly -- DESIGN section 4b's top rung, unrepresentable rather than validated. EVIDENCE, and the control is the half that makes it evidence. A temporary paired probe, both files staged so they reached the remote runner: probe closure_document_load_standing(cause: ClosureDocIncompleteWithoutAdmission{..}) -> error: type mismatch: expected 'Coproduct(ClosureDocRefusal)', got 'Coproduct(ClosureDocEncodeRefusal)' control closure_document_load_standing(cause: ClosureDocNotAnObject) -> typechecks PAST the same call; fails only at the ProcessExit boundary, which is the host's return-type rule, not a typecheck Without the control the probe's failure would have been satisfied by any breakage at all -- a typo, a bad import, a wrong module name. The control proves the module loaded, the imports resolved and the call typechecked, so what the probe refuses is the domain split and nothing else. Both probe files are deleted in this commit: they declare no test fn and must never enrol, since a file designed to fail compilation would red the floor for everyone. Runtime suites green after the split: commit_closure_witness_main exit=0, load_standing_witness_main exit=0. ONE CONSEQUENCE STATED RATHER THAN HIDDEN. cause_is_incomplete_without_admission is now total by construction -- ClosureDocEncodeRefusal has one arm, so the match can only answer true, and by this stack's own standard that is a decoration. It is kept, because it is the correct residue of a climb: the check did not get stronger, it became unnecessary, and section 4b(4) keeps the evidence enrolled while the obsoleted discrimination goes. What replaced it is a compile-time property no Bool-returning witness can express, which is why the probe above is recorded here rather than enrolled as a claim. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind the partial-closure admission to its subject, so a token for A cannot authorize encoding B Recut item 7, and the one the design thread called the highest-priority correction. This closes the authority-substitution hole #8965 declared as honest rung debt rather than fixed. THE DEFECT. PartialClosureAdmission { reason } carried no subject. The encoder took a closure PLUS an optional admission and checked only that one was PRESENT: admit closure A -> token T encode closure B with T -> ACCEPTED sole_constructor did not prevent it: .dag has no module privacy, so it blocks the record literal while the public mint stays freely callable. Nor could the existing mutation have caught it -- deleting the check proves the check is READ, which a bearer token satisfies perfectly. That is why this sat at mitigatable with the rung declared instead of claimed. THE REPAIR IS A SHAPE, NOT A CHECK. AdmittedPartialCommitClosure holds the closure it admits, and encode_admitted_partial_closure_document takes ONLY that carrier. There is no second closure to disagree with it, so "a token for A used on B" is not refused at runtime -- it has no spelling. The partial encode entry performs no validation because nothing is left to validate. `unresolved` is DERIVED at the mint from the closure it is given. A caller-supplied population would reintroduce the same substitution one field down: an admission truthfully about A, carrying B's missing objects. DISCRIMINATOR, and it had to be re-derived rather than copied. The thread specified "admission for A used with B -> refuses or cannot be constructed", but after the reshape the mismatch CANNOT BE PASSED -- one parameter, closure is a field -- so a probe passing a second closure would only be an arity error. The single remaining forgery route is hand-assembling the carrier: probe AdmittedPartialCommitClosure { closure: <never minted>, .. } -> error: sole_constructor type 'AdmittedPartialCommitClosure' cannot be constructed outside its defining module (exit 1) TWO CLAIMS ADDED, both executing: an_admission_names_the_objects_it_admits_as_missing -- the population is the closure's own, not a caller's assertion the_mint_refuses_a_complete_closure -- admitting a partial write for something with nothing missing is a category error, and this is what keeps the mint honest about deriving rather than trusting Suites: commit_closure_witness_main exit=0 (12 claims), load_standing_witness_main exit=0 (6 claims). THREE DEVIATIONS FROM THE PROPOSED SHAPE, each deliberate. NO NonEmptyList. The corpus has none, and minting one for a single field would grow net concepts to buy a guarantee the mint's refusal already provides. So the SUBJECT BINDING is structural while the emptiness exclusion stays mitigatable -- `unresolved: List` can represent an empty admitted population even though this mint cannot produce one. Next-rung trigger: a NonEmptyList authority earning its place from more than one consumer. NO one-member refusal coproduct. `type X = OnlyArm` does not declare a nullary variant, it reads as a type alias and fails to resolve. The refusal is an arm of PartialClosureAdmissionOutcome instead; a second genuine refusal joins that coproduct and every match fails to compile at the match, which is what the nesting was for. TWO ENCODE ENTRIES rather than one with an optional token: encode_complete_closure_document refuses anything uncontained; encode_admitted_partial_closure_document is total because the mint settled it. COVERAGE OWED, NOT CLAIMED. scm_commit_closure_json_v2_witness_test.dag has no ProcessExit driver, so the three call sites retargeted there are typechecked but NOT executed. The floor is the only thing that runs them and it is currently refusing for an inherited reason, so that execution is owed once main reopens. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Narrow the repository encode refusal to the one cause encoding can produce, and give that arm its first witness Recut item 6. Same dishonest-domain class as item 1, one layer up. THE DEFECT. RepositoryEncodeClosureDocRefusal wrapped the WHOLE ClosureDocRefusal decode population -- fifteen causes -- while encode_repository_checked produces exactly ONE of them (ClosureDocEdgeTargetUnresolved) from exactly one place. A consumer matching this arm had to handle format-tag and unknown-connective causes that no encode path can raise, and a reader could not tell from the type which were real. The type answered for a domain it does not own. It also round-tripped an identity through text: the arm carried a rendered key while its two sibling arms carry ObjectId directly. An identity left as a string is one nobody can resolve back. Both are fixed by RepositoryEncodeUncontainedTarget { target: ObjectId }, with first_uncontained_target returning the domain type instead of a key. THE ARM HAD NO WITNESS, AND THE GREEN SUITE IS HOW I ALMOST MISSED IT. All three suites passed after the change. But the encode-cause helper enumerates three tags and the claims asserted only two -- "commit_root" and "checked_out". Nothing drove "uncontained_target". The arm was REACHABLE (a grafted store whose root's children were never copied produces it) and merely unoccupied, so changing its payload type would have compiled green with nothing establishing that the identity survives. Reachable-and-empty is a quiet guard, not a dead one: the answer is to occupy it. scm_env_an_uncontained_target_refuses_to_encode_and_names_it now drives it, and asserts TWO things on purpose. The tag alone would pass whether the arm carried a resolvable ObjectId or a stringified one, so it also checks the CARRIED target against the store's own uncontained population -- which is the property the type change was for. Both halves measured rather than argued: 24 claims, membership vs the grafted store exit=0 membership vs the COMPLETE store (empty set) exit=1 The second is what proves the identity check is not vacuous. I could have reasoned that a fold over an empty list returns false; that is the substitution this stack keeps catching, so it was run instead. A DIRECT DRIVER IS ADDED TO THIS WITNESS, and it is scaffold with a stated end. The floor discovers `test fn` itself and never calls it; it exists because the floor is currently refusing before subject preparation for a reason this branch does not own, and these 24 claims otherwise had NO execution path -- this module's change would have been typechecked and never run. `gunbc run --function` cannot drive a Bool-returning `test fn`. Delete it once the floor executes these identities again; the comment on it says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Say only what the evidence establishes: an uncontained target, not the first Two corrections from design review of the item-6 landing. Both are the class this stack keeps producing -- a name or a tool promising more than anything verifies -- so they are fixed rather than argued. (1) THE HELPERS PROMISED AN ORDERING NOTHING CHECKS. first_uncontained_target and first_uncontained_key say FIRST. The witness establishes MEMBERSHIP: the carried target belongs to the store's uncontained population. With a single uncontained object every member is also the first, so the observation cannot distinguish "actually first" from "some legitimate member" -- the name was the stronger claim and it had no discriminator. Renamed to an_uncontained_target / an_uncontained_key. The refusal needs one ACTIONABLE EXAMPLE and no consumer depends on which; that is the real contract, so the name now states it. Deliberately NOT fixed by adding a two-target ordering fixture. Order is not an interface fact here, and pinning it would freeze an incidental traversal order that a later keyed or canonical representation of uncontained_targets should not have to preserve. This is the opposite decision from two_uncontained_children_are_named_in_order, where the reverse IS load-bearing because positions are the encoding -- the difference is whether anything downstream depends on the order, not whether an order exists. (2) THE DRIVER'S OWN COVERAGE WAS UNGUARDED. A hand-sequenced ProcessExit driver that omits a claim turns "driver green" into a subset run that reads as a full pass -- the nothing-ran-versus-nothing-failed trap, inside the tool added to avoid it. The invariant is that every declared `test fn` appears exactly once in its driver. Measured: scm_commit_closure_witness_test declared=13 dispatched=13 scm_load_standing_witness_test declared=6 dispatched=6 scm_repository_envelope_witness_test declared=24 dispatched=24 And the check discriminates -- planting a claim with no driver entry gives declared=7 dispatched=6 -- verified rather than assumed. NO GATE WAS COMMITTED FOR IT, and that is a decision rather than an omission. Durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold; the real dissolution is the floor executing these identities, which removes the driver and the invariant together. The rung is recorded on the driver as MITIGATABLE, enforced by hand. Suites after both changes: envelope_witness_main exit=0 (24), commit_closure_witness_main exit=0 (13), load_standing_witness_main exit=0 (6). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the driver's coverage invariant: an identity set, not a count The invariant recorded on the repository witness driver was declared == dispatched. That is the weaker check it sounds like, and recording it as the guarantee made this comment the fourth instance in this stack of prose asserting a wall stronger than the mechanism behind it -- this time inside the artifact added to prevent exactly that failure. WHAT CARDINALITY CANNOT SEE: declared A B C D dispatched A B C C Both populations are four and D never executes. Demonstrated rather than argued, by duplicating one dispatch and dropping another on a sibling witness: count check declared=6 dispatched=6 -> PASS reality an_honest_collision_is_its_own_standing_and_never_supersedes never ran The invariant is now exact SET EQUALITY of declared `test fn` names against dispatched reason strings, plus uniqueness in both populations. Measured across every witness carrying a driver: scm_commit_closure_witness_test 13 identities, sets equal, no dups scm_load_standing_witness_test 6 identities, sets equal, no dups scm_repository_envelope_witness_test 24 identities, sets equal, no dups and falsified by the planted case above, which the previous check passed. NO GATE IS COMMITTED, unchanged from before and for the same reason: durable enforcement machinery for an artifact with a scheduled deletion is scaffold protecting scaffold. The driver's dissolution trigger stands -- the required floor executing these identities removes the driver and the invariant together. What changed is only that the recorded invariant now matches the check that was actually run. Design review also resolved the fork left open in the previous commit, against the premise I offered: targeted mutation runs DO stay valuable after the floor returns, but the answer is to generate an ephemeral driver from the current roster at mutation time, not to keep a hand-maintained one. Two durable rosters -- floor discovery and ProcessExit dispatch -- would be two authorities for which claims belong to a witness, and the drift is predictable (a new test never dispatched, a renamed test leaving a stale entry). That changes nothing in the tree today; it settles what happens to this driver later. envelope_witness_main exit=0 (24 claims) after the edit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * v1 inference: generic instantiation must reach record-literal field expectations (>=2 seams) — plus the adjacent below-floor fail-open where a generic field admits the wrong type silently (#8922) * A generic record literal admits the wrong field type silently at six seams: locate the fail-open, and record two repairs that do NOT close it DESIGN 4b names "values inhabit declared types" as the ordinary compiler floor. A record literal of a GENERIC type does not hold it: measured on eleven single-module probe roots, a wrongly-typed field value is accepted AND EMITTED at six positions -- fn return, let annotation, record field, list element, direct-call argument, and a module-scope data annotation -- while the non-generic control refuses with a located mismatch and the conforming generic control compiles clean. The field PRESENCE axis is unaffected (a generic literal missing a required field still refuses), which rules out "generic declarations are not processed" and confines the class to the field TYPE axis. Mechanism, by execution rather than by reading: the instantiation does reach the literal and the substitution is keyed correctly on "T", but the declaration's field type node carries no name to key on, so the parameter is never substituted and the expectation reaching the judgment is a NAMELESS node -- whereupon kernel_value_declared_type_mismatch returns false on formal_name == "". A second, independent fail-open sits beside it: the substitution value is read with resolved_type, whose Absent arm is the equally nameless error_type. Two repairs were built and run against the full arm table and moved NOTHING; both are recorded because they are the cost of the next attempt. What is still open is where the type-parameter reference loses its name, which is a modelling question in a stage DESIGN names load-bearing -- so no code changes here, and the probe states the exact next question rather than leaving it to be re-derived. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Correct the mechanism: substitution is innocent, the class is any type declared WITH PARAMETERS, and the paired nonzero makes every zero a reading The first revision of this probe named the type-parameter reference losing its name as the cause. Two no-build discriminators falsify that, and a knowingly stale mechanism claim in a finding other lanes plan against is premise contamination -- so the doc is rewritten in one pass rather than annotated. WHAT CHANGED. A generic declaration whose parameter is UNUSED and whose field is a plain kernel type still fails open, so the trigger is that the declaration carries type parameters at all, not that a field mentions one. And forcing the instantiation to bail out with a wrong arity brings the field judgment back on the SAME declaration -- so record_lit_instantiated_fields does not fail to add an expectation, it preempts a working one. Instrumentation then showed authored_fte="" BEFORE substitution: substitution faithfully returns the nameless node it was given, and the declaration reached by the ident-keyed lookup is already identity-stripped where the name-keyed lookup's is not. PAIRED NONZERO. Every fail-open arm now carries a matched non-generic twin at the same seam, same run, same binary: six zeros, six reds. Plus an undeclared-name arm proving the generic module is compiled and its body judged. The twin design also rules out "that seam is unchecked for any type", which a bare perturbation would have left open. FOUR DEAD ENDS, ONE CAUSE, established by reading the construction site rather than by another build: ResolvedModule.module is the raw parsed node, build_type_env folds THOSE items into the bindings, and resolve_item_types runs later feeding resolved_item -- never the binding. ResolvedModule means import-resolved, not type-resolved. Also recorded: resolve_field is correct and has zero callers while its wired sibling resolve_field_init does not, which makes it an incomplete migration rather than dead scaffolding -- and a cleanup sweep deleting it would leave the lossy hand-rolled copy as the only authority. Claim staked on the PR. Still no code change: the remaining question is an ident-versus-intern address-space read, and a fifth blind repair would repeat the pattern the first four established. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The class is two rows, and the corpus reds the closed one: report it rather than narrow the wall (#8901) * The 8 and the 4 have different dispositions: the census rows encode the old answer (#8901) * LexMatchThunk is not generic, so it is none of the three rows: a fourth mechanism, bounded by three baseline arms (#8901) * Withdrawn: the generic carrier is the algebra, not the thunk -- one-variable pair puts the tokenize row in row (b) (#8901) * WIP: (a) fork dissolution — field_declared_type_node, authority + mirror * (a) mirror half restored: field_declared_type_node in v1_compiler_infer.rs * Drop stray backup file * (a) fork dissolution + measured (c) exposure; placeholder-carrier hypothesis refuted by execution * (c) an UNESTABLISHED return type must not become a lambda's body expectation * Install the emitted mirror for v1_compiler_infer.rs (regen candidate, not hand-tuned) * Delete four dissolved frontier rows (observed=0), fix two ContentHash construction defects the wall caught, admit list literals at FreeMonoid * (c) sibling: an UNESTABLISHED substituted param type must not bind a lambda parameter as an error type * Install emitted mirror for v1_compiler_emit_rust.rs (clone elision from the established-type fix) * BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c) Diagnostic push on a draft PR to separate (a) from (c) by execution. The floor caught 9 claims that pass on main and fail on this branch, every one of them against an independently authored oracle, so main's pass was not vacuous and this branch computes wrong values. Local floor OOMs (137) in a session container, so CI is the only instrument at whole-corpus scope. This arm reverts (a) only. It deliberately re-opens the row-(a) defect -- the kb2 RED will stop refusing -- and is NOT proposed for merge. Read the floor line, not the arms. Predicts: if (a) is the culprit, failed goes 9 -> 0 and the 6 samsung_dram stale-quarantine rows stay unmasked. If (c) is, failed stays 9. * Revert "BISECT ARM (not a landing state): revert (a) field_substitution_carrier, keep (c)" This reverts commit 18b5ddc6261acd3c5398a5fc5429fd9ea2e48f63. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Transport binding spine: one target-neutral semantic binding for all four transports, then Filesystem bindings + Rust renderer to restore the 03_ingest board (#8957) * WIP: Bind the file-transport realization handler AND migrate rest/shell/local * WIP: Transport binding spine: one target-neutral semantic binding for all fou * Regenerate the stage0 mirror for the transport binding spine review 54885 and deep-ant-102 both found the same thing: the de-fork existed in the .dag authority and not in the mirror v1 actually runs from, which is specification-without-execution in its textbook form -- the exact failure this cut exists to close. Produced by claim_executor --required-regen; the candidate tree drifted in exactly the four emit files this change re-typed. Also moves an annotation to module-item grain (§4c refused it at body grain) and records the fabricated-empty-base_url marker dependency beside classify_transport: kind is discriminated by marker-field PRESENCE, so making base_url refusable deletes the rest tag and reclassifies every rest transport as local. No binding arm requires a base_url value; that repair owes an explicit kind tag in the same change and is deliberately not taken here. * Drop the dead classify_transport import from the rust emitter Zero call sites since the de-fork: the rust backend consumes a BoundOperation and no longer classifies anything. A live import of the classifier is what a reader grepping 'does the target still classify?' finds first, so it reads as the fork surviving. Found in re-review by smart-ram-730. --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Classify rustc mechanisms across diagnostic codes (#8978) * Classify rustc mechanisms across diagnostic codes * Record cross-code classifier provenance * Bind mechanism population to its measured ref --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> * Locate the LexMatchThunk apply receiver-type loss (#8983) * Locate LexMatchThunk apply receiver type loss * Record the bounded pre-descent ordering null * Reclassify the apply root as a representation gap --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Refuse per-code board shares for emitter roots (#8979) * Refuse per-code board shares for emitter roots * Audit shared-types membership authority consumers --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * Make impossible fn-field derives unselectable through aliases (#8985) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * Bind mock-totality witnesses to published corpora (#9006) Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> * The .dag parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired (#8949) * The parser fabricated an empty path and silently ate unknown fields: five refusal arms, one live specimen repaired `parse_file_fields` substituted an empty string literal when `path:` was omitted, so `transport file { }` and `transport file { path: "" }` produced byte-identical nodes. That is not merely an unchecked state: `is_file_transport` is DEFINED as "carries a base_path", so the fabrication made the absence unobservable to every downstream consumer -- an emit-side "declares no path" refusal is permanently green by construction. The rust realization duly emitted a filesystem write against "" with zero diagnostics. The refusal belongs at parse, where an absent path is decidable from the tokens alone, and that is where it now sits. CENSUS of every parser field that defaults rather than refuses (132 `Absent =>` arms in 02_parse.dag; all but these are legitimate token-absence handling): * parse_file_fields base_path -- omitted path fabricated as "". DEFECT, refused here. * parse_rest_fields base_url -- omitted url fabricated as "". NOT a defect: omitting `url:` is the norm (the base comes from the service config) and an empty base plus a full-URL path template is the authored absolute-form idiom recorded in extdeps.transports.rest. It is a state-space conflation with its own lane, not a refusal decidable from the tokens. * parse_config_fields endpoint -- omitted endpoint fabricated as "". NOT a defect: `config { }` is legal and shell services have no endpoint at all. * four `_` fallthrough arms (config, rest, shell, file) -- an unrecognized field was parsed and THROWN AWAY. Same fail-open reflex one layer over, and it had a live specimen: this repo authored `transport file { op: READ, path: ... }` in extdeps.cloud.gcp and the `op: READ` was swallowed whole, never resolved, never reported. All four refuse; the gcp site is repaired (read is the default verb, so the semantics are unchanged). MEASURED, not assumed. The corpus-wide parse gate against a binary rebuilt from the regenerated mirror indexes 3880 modules from 2 source roots, exit 0 -- so outside the one gcp.dag site nothing in the corpus was relying on a dropped field or an omitted file path. Regen produced exactly one drifted file, v1_compiler_parse.rs, across the 132-file mirror. EVIDENCE, enrolled: dag/test/claim/transport_field_refusal_witness_test.dag carries three positive controls and five discriminating REDs, all 8 PASS under claim_batch. The controls reach compile.emit; the five reds stop at compile.analyses, so the refusal is real and the harness is discriminating rather than false-for-everything. Per DESIGN §4b(4) these stay enrolled as the evidence the rung holds, not deleted with the machinery they replaced. v1 admission: this serves the v2 self-host program -- the file-transport realization lane (#8929) is exactly the consumer whose emitted write the fabrication corrupted. Semantics stay frozen; this is a defect repair, not growth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Name the stage in the assertion, not just the outcome: the pathless-path RED could not tell parse from emission Folding in a finding from #8937 (sleek-fox-685, relayed by deep-ant-102) that is correct and that this PR's own oracle could not have caught. Every RED here asserted `!compiles(source)` -- ONE BOOLEAN, which is green whether PARSE refused the declaration or the parser fabricated "" and the EMISSION wall caught it downstream. Those are exactly the two states this change separates, so the row watching it could not see the thing it was watching: revert the parse arm, let the emitter catch the pathless case, and every `!compiles` red in this file stays green. Three rows, not the one that was asked for, because a single row could pass for the wrong reason: * w_red_pathless_file_transport_refuses_at_parse_not_emission asserts the parse class POSITIVELY (blocking `ParseError` >= 1) rather than by excluding the emission class. Naming a stage by exclusion still passes if some third, unrelated class is what refused. * w_control_unmodeled_verb_refuses_at_emission_not_parse runs the same two counters the other way, over a source the EMISSION wall refuses. Without it, `parse_blocking_count >= 1` is satisfiable by a counter that is nonzero for everything and `not_modeled == 0` by one that is always zero. * w_control_valid_file_transport_is_clean_at_both_stages reads zero from both on a clean source. Both counters answer -1 on CensusNotRunnable, so could-not-measure fails the `>= 1` AND the `== 0` assertions instead of silently satisfying one (DESIGN §5: top-as-ignorance is not top-as-answer). MEASURED: 11/11 PASS under claim_batch on the merged tree. The open question before running was whether a parse refusal reaches compile_dag_diagnostic_census as an observed blocking ParseError row or as CensusNotRunnable -- if the latter, the -1 arm would have failed the row for a reason unrelated to the wall. It is observed, so the stage assertion is real rather than accidentally green. ALSO: the discriminator fact recorded where the next author will hit it, as a `//` annotation on v1.compiler.core is_rest_transport. Transport KIND is discriminated by marker-property PRESENCE, so `rest_transport_node`'s always-written base_url -- filled from the "" that parse substitutes when `url:` is omitted, which is the NORM -- is load-bearing structure, not a lazy default: removing it reclassifies every rest transport in the corpus as `local`. It is also why is_local_transport is defined negatively. Regen confirms the annotation adds no mirror drift. Merged origin/main. Regen against the merged tree drifts ONE file, v1_compiler_emit_rust.rs, which is main's own red (#8691 landed without its second regen pass) and is #8953's to repair -- not regenerated here, because installing another lane's fix from this tree would give the corpus two producers for one file. v1_compiler_parse.rs is byte-identical to a fresh emit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * An annotation cannot fail: guard the kind-discrimination invariant the 00_core comment only described deep-ant-102 measured what I did not: ZERO witness rows asserted the classification my annotation documents. DESIGN §4c is explicit -- an annotation is never evidence a machine claim holds, because no Accepted program can read one. Prose is the right home for the RATIONALE and cannot be the guard for the INVARIANT, and a comment that reads as coverage to the next reader is worse than none. That reading is not hypothetical: a review of this very PR called the comment "a nice defense against a future 'consistency' edit". It is not a defense. These two rows are. w_red_rest_transport_classifies_as_rest_not_local w_control_shell_transport_emits_no_rest_client Asserted through EMISSION SHAPE rather than by calling is_rest_transport, and that is a reachability fact rather than a preference: CI's source roots are `dag` and `src/v2`, so v1.compiler.core is not in the witness pool and the predicate cannot be named from a witness at all. The consequence is the better subject anyway -- it runs the real pipeline instead of the predicate in isolation. The control supplies the other answer so the first row is not satisfied by an oracle that matches everything, which is the same defect the stage counters had before their inverse row. MUTATION-TESTED RATHER THAN ASSERTED, because "delete the fabricated base_url and this row fails" was a claim about a RED I had not executed. Scratch build with the always-written url_field removed from rest_transport_node -- the exact "tidy the lazy default" edit the annotation warns against: FAIL w_red_rest_transport_classifies_as_rest_not_local PASS w_control_shell_transport_emits_no_rest_client The mutation reds the specific claim and not the harness. Reverted; `git diff` on the mirror is empty, so nothing from the scratch build is in this commit. 13/13 PASS on the restored tree. Kept here rather than routed to #8954's roster witness: this PR introduces the annotation, so it should land with its guard rather than ship prose-only coverage and depend on another lane to close it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * End an unbraced arm body at a QUALIFIED pattern, not only a bare one (#8999) parse_match_arm_stmts consumes statements until looks_like_arm_start reports that the next tokens open a new arm. That predicate recognised a bare `_` and an UPPERCASE-start leaf, and nothing else. A namespace- qualified pattern begins with its lowercase module head, so it answered false: the body kept consuming, swallowed the next arm's pattern as one more statement, and the parse died on the FatArrow that followed. The reported span is that ARROW -- several lines below the arm that actually ended -- which is why this had to be bisected rather than read off the diagnostic. Four separate reproductions of the neighbouring shapes all parsed before the real one was found. MINIMAL REPRODUCTION, every clause load-bearing: Kind { f: _ } => let a = "p" <- unbraced arm body containing a `let` a mod.path.Other => "d" <- next pattern is DOTTED Drop the `let` and the body is a single expression that never enters the statement loop. Make the following pattern `_` or an uppercase leaf and the predicate already answered true. Both are needed. MEASURED. On the namespace-cut branch, where qualifying every pattern turns this from rare into ordinary, exactly one corpus file of 3875 reaches it: src/v1/05_emit.dag. That file is invalid under the parser its own branch carries -- it survives there only because the built binary predates its own committed mirror, so the defect is latent and would surface at that branch's first successful rebuild. This is therefore a grammar gap the cut made REACHABLE, not an accommodation for it, and it fails loudly at preparation rather than silently downstream. DISCRIMINATING RED, BY EXECUTION: the witness returns false against a parser with this one decision reverted to `false`, and true with it. Both runs were performed. ZERO-DRIFT, STRUCTURALLY: the new scan runs only where the old predicate already answered false, and it requires the TERMINAL segment to be uppercase with the arrow following the path or its brace group -- so no previously-accepted parse changes, and a lowercase dotted expression ending a body is unaffected. An expression statement genuinely followed by a FatArrow was never a legal parse. Receipt: required-regen over the 133-module subject reports first_generation_equal=true with only this repair's own mirror changed. Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bind a qualified pattern head from the scrutinee, as the bare spelling already does (#9004) * Bind a qualified pattern head from the scrutinee, as the bare spelling already does Two spellings of one pattern name the same declaration, so they must bind the same node. lookup_variant_in_type forks on whether the head contains a dot: the bare branch answers from the SCRUTINEE, which carries the instantiation; the dotted branch answered from the SYMBOL INDEX, which returns the coproduct's DECLARATION. So the payload bound to the declaration's type PARAMETER instead of the scrutinee's type ARGUMENT, and every field read off it reported "no field 'root' on type 'T'" -- measured, not inferred, on a two-function probe whose only difference is the spelling of the head. Admission is unchanged: the index lookup still runs first and still decides whether the head names a variant of this coproduct at all. Only the bound node's source changes once admission succeeds, and the fallback arm reproduces the previous answer exactly. RECEIPTS. Discriminating RED proven in both directions on the same corpus: on the pre-fix binary the qualified arm returns false with the diagnostic above and the bare control returns true; after regen and rebuild both return true. One generated file drifted -- v1_compiler_infer_patterns.rs, this repair -- and the second pass reports first_generation_equal=true. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * De-confound the witness pair: the arms differed in imports, not only in head spelling The floor reported the qualified arm at 58800ms CPU against a 5000ms budget with 1.21GB RSS growth while the bare arm passed under budget, and I read that as a cost of the qualified pattern head. It is not yet evidence of that. The qualified probe imported two names and the bare probe imported four, so the arms could differ in source-closure construction, import binding, symbol-index use and cache temperature as well as in the spelling under test. The pair was a controlled experiment for the SEMANTIC discriminator and not for the cost one -- a control must name its adversary, and cost was an adversary these arms never excluded. Both probes now import all four names, leaving the two pattern heads as the only difference. The semantic RED is unchanged and was re-proven in both directions after the edit, against binaries built from the pre-fix and post-fix mirrors: pre-fix qualified=false bare=true post-fix qualified=true bare=true No generated file changes; the seed is untouched by this commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Move the witness to the census grain: it was measuring emission for a claim about resolution The subject is a BINDING fact and a binding fact is decided at typecheck. The witness asked it through compile_dag_rust_emit_check, which parses, resolves, typechecks, EMITS RUST, and then -- per the compiler's own compile_dag_diagnostic_census_row_note -- collapses the whole result to a Bool, discarding which judgment fired. The enrolled claim duly cost 58579ms CPU against a 5000ms budget with 1.21GB RSS growth while its bare control passed under budget. compile_dag_diagnostic_census reports the causal judgment directly as typed rows. That makes this witness narrower in subject, MORE discriminating -- it names the diagnostic instead of collapsing to false -- and cheaper for a principled reason rather than a convenient one: emission is downstream of the fact being tested, so removing it removes work, not evidence. CensusNotRunnable is a failure carrying its own cause and is never the expected red. Could-not-measure and measured-nothing are different states and only one of them is evidence. MEASURED, one fixture, both probe sources carrying identical imports so the only difference is the two pattern heads: pre-fix qualified OBSERVED[1] InternalError | no field 'root' on type 'T' | blocking=true | n=1 (enrolled fn returns false) pre-fix bare OBSERVED[0] post-fix qualified OBSERVED[0] (enrolled fn returns true) post-fix bare OBSERVED[0] (enrolled fn returns true) THE COST OBSERVATION IS NOT REPAIRED BY THIS CHANGE AND IS NOT CLAIMED TO BE. It is carried forward in the pull request body with its two ruled-out causes, its unattributed owners, and its next discriminator. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Three prose rows still said srv4 commits six, and the disk arithmetic behind them refuses at twenty-one (#9001) The CPU-axis change (#8976) moved srv4 from 6 to 21 and left three prose rows asserting the old width. Prose cannot refuse, so nothing surfaced them -- they were found by review (fierce-hawk-734) rather than by any gate. gunbc_runner_slot_allocation_srv4_admission_note said "srv4 commits 6 slots at the memory axis" and that runner_count and the roster "both name 6 as the materialization target". Replaced, not annotated: two accounts of one width is what this module exists to prevent. srv4 memory-admits 29 and commits 21, the CPU axis binding, and neither number is authored -- runner_count derives from gunbc_runner_slots_per_host, so the note is a reading of one authoring. width_is_a_minimum_over_axes_note carried the same six in passing. Corrected. gunbc_runner_slot_width_ruling_note is deliberately NOT edited. It is labelled SUPERSEDED AND RETAINED AS METHOD with "PRIOR TEXT FOLLOWS UNEDITED", and its own header warns that reading on for current widths will mislead. Editing preserved historical text to agree with the present would destroy the only thing it is for. THE DISK ARITHMETIC IS THE PART THAT IS NOT COSMETIC. srv4_runner_count_disk_cap_note sized the per-slot charge at width 6 and read as reassurance. At width 21 the same charge is 21 x 40.96 GB, about 860 GB, against a Samsung 970 EVO 500GB -- so runner_width_disk_preflight is EXPECTED TO REFUSE srv4 at its committed width. The allocation axis cannot see this: disk is DiskWidthUnconstrained at allocation by the 2026-08-06 ruling. So the model commits a width the actuator is expected to stop, which is the fail-closed arm working and also means srv4 has a committed width it cannot currently reach. Recorded rather than resolved by lowering the commitment, because absorbing to a width the disk happens to permit is the fallback that ruling removed. AND THE CHARGE IS CIRCULAR, which is recorded at the authority rather than only in the rows citing it. runner_slot_disk_budget_per_slot_note claimed provenance: "derived from srv4_runner_count_disk_cap_note arithmetic (~38GB per slot at width 7 on 500GB class disk)". That is not a provenance -- disk size divided by the width of the day IS the derivation, so the charge was computed FROM a desired width and is now used to CONSTRAIN one. Nothing was measured. A live observation under an active reclaimer came in near 2.5 GB, two orders of magnitude below it. So a circular charge is refusing a derived width: two unmeasured numbers meeting, and neither the refusal nor a pass would be evidence about srv4's real disk. The refusal stays, because refusing on an unreliable charge is fail-closed and lowering the charge to make the width fit would be fitting the measurement to the answer. What is NOT claimed is that srv4 cannot hold 21 slots -- every ephemeral runner keeps a _work tree plus caches, so the true figure is not 2.5 GB either and the question is open in both directions. Each row carries the same dissolve-on: a measured per-slot disk series on srv4. Co-authored-by: Brian Searls <briansearls1@gmail.com> * Make the hand-built argv unwritable at the call site, and land the positive examples that show what to write instead (#8919) * Make the hand-built argv unwritable: seal ArgvCommand, and land the builders that show what to write instead extdeps.exec.command ArgvCommand becomes sole_constructor with one admitted mint (argv_command), caller-sealed by name to typed builders homed in each tool's own extdeps module beside its cited upstream authority. All 58 record constructions on main are converted in this change, because a partial seal is a dual-authority interval rather than a weaker seal (DESIGN section 3). The carrier splits program from arguments, which makes the empty argv unrepresentable and dissolves two runtime refusal arms in gunbc.command_runner (DESIGN section 4b: structurally impossible over mechanically preventable). The seal surfaced nine hand-spelled argvs that were never record literals and four List<String> laundering seams; all are converted or closed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Program spelling is an observation claim: one authority paragraph, one line per row still-seal-394's correction: the rule is not 'PATH-resolved is the safe default'. An absolute path is a claim that this repository observed the target's filesystem, and it is the STRONGER form wherever that claim is true -- a sudoers rule can name it and a preflight can test for it. PATH resolution is correct only where the host is unobserved. The reasoning, the climb criterion and the roadmap_dashboard_instance_apply counter-example live once at extdeps.exec.command program_spelling_is_an_observation_claim; the ten rows it governs carry one line pointing at it instead of ten copies of the paragraph. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Five more hand-spelled argvs the seal surfaced: /proc reads and the fd walk The refusal census does not stop at the record literal. build_cache_endpoint_observe still spelled four argvs as bare word lists (two cat, one stat -c %U, one readlink) and host_effect_realize spelled the /proc fd walk as a fifth; all five now derive from cited authorities, with find's -lname glob fact homed in a new extdeps.tools.findutils beside the flags rather than in the caller that met it. stat's name row gains the -- end-of-options guard its sibling rows already carried: one module was answering one question two ways, and these operands come from observed host state, which is exactly where a leading-dash path appears. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Cast the two NonEmptyStr literals at their call sites Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Admit two builders the wall caught, and measure the NonEmptyStr refinement the climb rests on The seal refused readlink_command and the findutils fd-walk builder -- two admit-list omissions of mine, caught by execution rather than by review. The empty-argv climb claims program: NonEmptyStr makes an empty program unwritable. NonEmptyStr is a refinement, not a mint, so that claim is only as good as its enforcement at construction. Measured with a discriminating pair on a freshly built gunbc: data p: NonEmptyStr = "" is REFUSED at the declaration, data p: NonEmptyStr = "mkdir" is accepted and evaluates. Recorded beside the deleted test, with the path boundary and the reason it is not enrolled. Two NonEmptyStr literals become data rows, because a cast of a String literal at a call site is refused by the same judgment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Count the sh -c residual instead of estimating it: eleven, not six Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The nbd programs do not both run on the BMC: correct the note that said so Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * State the two privileged word changes at the builder that makes them Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Name the two concrete products the hub still carries, and why the rule admits them Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The transport-argv population is blocked by a floor defect, not this lane's residue Preliminary ruling relayed from the shell -> dag lane: an identifier in a transport argv position is never name-resolved, so no citation-based conversion of those sites is possible by any author until gunbc#8916 closes. Naming it as residue would read as a conversion that stopped short and would put the obligation on the wrong lane. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * State the empty-program climb as four facts, not one claim Operator ruling relayed: a completed climb retains executing evidence, and this one has a recorded receipt with no enrolled route. The arms stay deleted -- the empty argv is unrepresentable regardless of enrolment -- but the claim is evidenced-but-not-floor-enrolled on the source path and unmeasured on the emission path, stated as separate facts so they cannot collapse into 'done'. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * The bracket-form regression control follows its builder's rename socket_inode_holder_argv became socket_inode_holder_command when the /proc fd walk stopped being a hand-spelled argv, and this witness -- the control that pins the ? wildcards against the bracketed glob that silently matches nothing -- still called the old name. CI caught it; I had not. It asserts exactly what it asserted before: the emitted pattern is socket:?3894042? and contains no brackets. Only the route to the words changed, from a List<String> return to argv_words over the ArgvCommand. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * One name, two operations: qualify the ten live-deploy references the merge made ambiguous THE MERGE PRODUCED A COLLISION NEITHER SIDE COULD SEE ALONE. main's #8845 added `gunbc.live_deploy.operations.rm_force_command(paths: List<String>) -> String` -- privileged shell TEXT for removing several paths. This branch added `extdeps.tools.gnu_coreutils.rm_force_command(path: String) -> ArgvCommand` -- the cited tool operation for one path. Different layers, different carriers, different arity, same spelling. Each was unambiguous in its own tree. THE COMPILER REFUSED RATHER THAN PICKING, which is the outcome worth recording: dag/gunbc/live_deploy/emit.dag:818:29: error: ambiguous reference 'rm_force_command': 2 candidates: extdeps.tools.gnu_coreutils.rm_force_command, gunbc.live_deploy.operations.rm_force_command — qualify by containment path, alias, or rename Ten references, six in `live_deploy/emit.dag` and four in its test. All ten want the shell-text one -- they pass `paths:` and feed `deploy_raw` -- so they are now spelled `gunbc.live_deploy.operations.rm_force_command`. Qualification is the diagnostic's own first suggestion and the least invasive of the three: it edits references, not authorities, and renames nobody's landed symbol. NEITHER NAME IS WRONG, which is why this is not a §3 nicknaming repair. §3 forbids two names for one concept; this is one name for two concepts, and both are honest in their own module -- `extdeps/` keeps the tool's real operation name, and the product layer names the privileged-text form it owns. If either should move it is a question for the live-deploy lane, not something to settle inside a merge. ONE LATENT INSTANCE LEFT DELIBERATELY, named rather than silently passed over: `dag/gunbc/build_cache_endpoint_path.dag:130` calls the unqualified `rm_force_command(path:)` and did NOT error, because `gunbc.live_deploy.operations` is not in that module's import closure. It is correct today and one import edge away from the same refusal -- the same closure-scoped resolution class this session filed as gap-analysis row 30 (gunbc#8943) and repaired four sites of in gunbc#8944. Left unqualified because this PR is otherwise complete and a speculative edit buys a 40-minute CI cycle; recorded here so the next reader finds it by search rather than by breakage. Regen passed on this head (first_generation_equal=true), so the inherited #8691 red is gone and this floor refusal was the only remaining failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Merge main (§4c annotation fix, #8989) and align the one over-indented admit row THE MERGE closes the last inherited red. #8989 hoisted the §4c-illegal annotation out of `witness_retired_runner_slot_owner_refuses`'s match body; while it stood, floor preparation died before planning a single witness, so every "failing" floor verdict recorded anywhere in the repository during that window was uninformative rather than negative. This branch's own runs in that window say nothing about this branch. THE NIT, from review 54984 and held deliberately until now: one `decl_ref` row in `argv_command`'s `admit_callers` list sat at 8 spaces where its 39 siblings sat at 4. Now 40 of 40 at 4. It is cosmetic, which is exactly why it waited — pushing it alone would have cancelled an in-flight run, dropped five approvals (scored per head), and spent a ~45-minute CI cycle in a fleet completing about one run in six, all to correct four spaces. Riding the merge costs nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 * Two witnesses caught the spelling migration going both ways, and only one of them was the witness's fault THE FLOOR RAN FOR THE FIRST TIME ON THIS BRANCH and reported failed=10 against main's failed=8 on the same head (13db52a25, run 32621117917). The two extra are mine. They are opposite defects and the difference is the whole entry. BUSYBOX -- MY CODE WAS WRONG, THE WITNESS WAS RIGHT. `busybox_build_is_modeled_and_grounded` asserts `'mkdir' '-p'` and got `/usr/bin/mkdir`, because this migration routed the call through `mkdir_parents_command`, whose wrapper cites the recorded absolute path. `gunbc.busybox_bmc_build` runs its whole sequence under `LocalExec` on whichever machine the operator invoked the cross-build from -- it demands an `arm-linux-gnueabi-` toolchain, not a host this repository has ever read. So the absolute path was a claim about an unobserved filesystem: the exact §5 fabrication `extdeps.tools.mkdir`'s own rows warn against, committed by me while quoting the rule. Now routed through `mkdir_parents_command_at` with `mkdir_path_resolved_program`, with the reason stated at the call site as that module asks its PATH-resolved callers to do. The mkdir note is corrected in the same commit rather than left standing: it said the BMC applet was the one such caller and "every other caller gets the recorded absolute path". That became false the moment this second caller landed, and a note asserting a population it no longer has is the stale-recital class DESIGN §3 exists to stop. SUDO -- MY CODE WAS RIGHT, THE WITNESS PINNED THE OLD SPELLING. `srv4_runner_installer_command_cites_installer_with_env` asserts `'sudo' '-E' 'bash' ...` and now renders `/usr/bin/sudo`. That change is deliberate: sudoers matches on the absolute path, so a PATH-resolved spelling would let the caller's own PATH decide which binary crosses the privilege boundary, and `sudo_elevate` two functions above already used this row -- the alternative was two spellings of one binary in one module. The assertion is updated to the new words. THE ASYMMETRY IS THE POINT. Same migration, same kind of diff, two witnesses red, and the correct repair ran in opposite directions -- one edits the code, one edits the oracle. Deciding by which side is easier to change would have got one of them backwards; deciding by whether the host was OBSERVED gets both right. Also lands the annotation I owed at `sudo_binary_path` (review 55022): the -E row documented its own `-n` delta while the path delta was left implicit. Both are now stated at their rows. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DhAfyPkuxnjZaTzPn5PyE1 --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * A cost-shape defect that measured linear: file the per-step emit constant, and the refuted hypothesis (#8988) * A cost-shape defect that measured linear: file the per-step emit constant, and the refuted hypothesis I proposed fixing a quadratic accumulator in the orchestration emit path, measured it, and it does not exist. The refuted hypothesis is the more useful half of this row, so it is filed with the measurement rather than dropped. WHAT WAS HYPOTHESISED, and every sentence of it is true. v2.compiler.emit_orchestration orch_emit_steps_from folds left-linearly, carrying the accumulated script as a String and calling orch_emit_join2(left: everything_so_far, right: next_step) once per step. That join is not a concat: it reaches orch_emit_from_registry, builds a TargetModel whose binding spellings carry both operands verbatim, and runs the whole grammar emit pass over it. Read that way it is n-1 emit passes over payloads growing to the full script length -- the copied accumulator DESIGN section 6 names. WHAT IT MEASURES. A scaling probe -- identical trivial steps, only the count varying, release claim_batch, thread CPU with wall within 1-5ms on every row: n 8 16 32 64 128 | 128 256 512 1024 cpu 48 61 94 161 308 | 239 448 894 1863 ratio 1.27 1.54 1.71 1.91 | 1.87 2.00 2.08 Linear across two decades, no knee. A quadratic converges to 4.0 per doubling; this converges to 2.0, and the early sub-2.0 ratios are the fixed intercept washing out. Fit: about 14ms + 1.8-2.3ms per step, the slope moving between processes on one box with ambient contention -- the same 2x spread gunbc.witness_row_cost already records. SO THE CONSUMER'S COST IS ARITHMETIC. test.claim.live_deploy.emit twin_and_production_configure_disjoint_tailscale_endpoints budget-refused a required floor run at "at least 5008ms" against v2.workflow.required_floor required_floor_claim_cpu_safety_limit_ms. Run alone it PASSES at cpu=5489ms wall=5504ms -- 5008 was the interrupt point, not the cost, so the row is ~10% over the fail-stop rather than ~0.2%. At ~2ms/step its four scripts are roughly 2750 rendered lines. WHY THIS IS NOT A SECTION 6 ALWAYS-FIX. That rule fires on a PROVEN cost shape; a plausible one is a hypothesis. There is no wrong complexity class here, only a large constant, and reducing it means memoizing the emit path on declared-input content -- the Realization/content-hash carrier section 2 holds up as canonical and section 6 records v2 as still hand-rolling. Compiler-wide work on load-bearing files, filed rather than improvised. THE CLASS. A mechanism reading is not a cost measurement. The hypothesis named the right function, the right call and the right reason it is expensive, and was still the wrong complexity class, because whether a real mechanism DOMINATES depends on constants the source does not show. The tell is that the fix would have looked principled: orch_construct_seq2 is left "\n" right over two raw operand tokens, wrapping and escaping nothing, so it is associative and a rebalanced join tree renders byte-identical output. The rewrite was available, correct, byte-safe and pointless -- and merged, nothing afterwards would have distinguished it from a real fix. WHAT WAS DELIBERATELY NOT DONE. The witness was not split: it would zero this row's failure frequency while leaving sixteen siblings at ~8x the 500ms wall migration threshold, which is the absorbing fallback executed at authoring time, and the disclosure gate exists to keep that population visible. The fail-stop was not touched. No declared-ceiling lane was built -- the diagnostic advises one and no such mechanism was found in tree, which is recorded as an observation about the diagnostic. The row stays on the disclosure roster and will intermittently budget-refuse on main until the memoization lands. Named as a real intermittent red, not an acceptable one. Every symbol and module cited here was grep-verified against the tree; no positional citations (DESIGN section 3). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * "Two scripts each" was an unverified quantifier, and correcting it moved the finding The approving review found nothing; re-reading my own row did. Two defects, and the second one changes what this row says is worth fixing. THE QUANTIFIER. I wrote that the sixteen live_deploy.emit siblings emit "two scripts each". Counted per witness, twelve emit ONE, three emit two, one emits three, and the refused row emits four. I had counted the family and not the scripts, and asserted the second as though I had. WHAT CORRECTING IT EXPOSED. With the real counts the seventeen observed costs regress cleanly on script count: ~2235ms fixed per witness + ~773ms per emitted script scripts rows observed predicted 1 12 2830-3178ms 3008ms 2 3 3841-3979ms 3781ms 3 1 4109ms 4555ms 4 1 5504ms 5328ms The ~773ms marginal matches the probe's ~2ms/step over roughly 400 lines per script, so the emit constant explains the SLOPE. It does not explain the INTERCEPT -- and the intercept is the larger term for twelve of the sixteen. About 2.2 seconds is spent before the first script is emitted, outside orch_emit_pipeline entirely, and this probe did not measure what it is. WHY THAT MATTERS RATHER THAN BEING A REFINEMENT. The previous revision took 5504ms, divided by ~2ms/step, and reported "roughly 2750 rendered lines, about 690 per script". The slope only accounts for about 800. I had folded an unmeasured fixed cost into a measured per-step figure and published the quotient as though the whole row were emit -- the same class of error as the hypothesis this document exists to record, arrived at one layer further in. So the row now names the fixed term as unmeasured and unowned instead of absorbing it, and says plainly that it, not the emit constant, is the bigger target for most of the family. The split-the-witness paragraph now cites the regression's ~3781ms for a two-script witness instead of "about two scripts and under the fail-stop". The refusal to split is unchanged and unaffected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Supplier bindings, per-supplier billing quantum, and an acquisition simulation (#8960) * wip: ubicloud supplier binding (verifying) * Billing quantum is a per-supplier fact, and continuous capacity is the modeled advantage of owning * The acquisition question: does demand shape make a commitment worth holding * fix: named fold args, no block lambda, no next-line field values * refactor: qualify Offer/SelectionPolicy as SupplierOffer/SupplySelectionPolicy 'Provider', 'Offer' and 'Selection' each name two unrelated things in this corpus: gunbc.dispatch_selection's ProviderOffer is an agent-runtime credential binding carrying no price, and product.fabric.supply's Offer is a priced compute-supply ask. They do not unify -- there is no proven coincidence to bundle, only a shared English word -- so the generic name goes to neither. dispatch_selection already qualifies its side; this qualifies ours. * fix: bill the quantum against each job's duration, not the slot's concurrency Executing the witnesses caught a units error in the simulation's billing core. quantum_billed_slots(used_slots: taken, ...) passed a JOB COUNT into a parameter meaning a DURATION, so a 60-slot minimum increment rounded a slot's concurrency up to sixty instead of billing each of its jobs for sixty. Both magnitudes are Nat, so it typechecked; only running it disagreed. Replaced by billed_slots_per_job, which states the model's standing assumption -- one slot is one job's runtime, and jobs of differing duration are not modeled until arrivals carry a duration -- rather than leaving it implicit. The shape witnesses were reworked in the same pass because their fixture moved two axes at once: a 60-slot increment against one-slot jobs is so dominant that owning wins under every arrival shape, which is a real effect but not the one those tests claim to measure. Renting now bills per slot there, so demand shape is the only thing varying, and the increment gets its own witness. The flip is now demonstrated at EQUAL MEAN -- flat ten every slot versus six hundred once in sixty, the same 6000 job-slots -- where it previously compared unequal means and asserted the …

#8965 squash-merged, so its commits are not ancestors of main and every downstream branch re-proposed its diff against a main that already had it. Resolution, decided per file rather than by a blanket side: SCM paths take this branch. main's SCM state is byte-identical to session/closure-recut (verified: empty diff over dag/gunbc/scm and the four scm witness files), so #8965's squash carries no content this branch lacks, and this branch has #8973 and #8990 on top of it. Every other conflicted file takes main. Each one -- command_runner, fabric/supply, supplier/ubicloud, floor_expected_red, and the fabric and runner_host_deploy witnesses -- is byte-identical on this branch to its version at f498863, the main tip absorbed by the earlier main merge. This branch authored nothing in them; the conflict is other lanes' work squashed into main after that absorption, so main is strictly newer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

gunbai-bot · 2026-08-24T13:47:40Z

HOLD — do not merge during the #9102 → #8282 window.

Computed against #8282's changed-file set: this PR intersects it on 2 file(s), including:

dag/gunbc/scm/repository_envelope.dag
dag/test/claim/scm_repository_envelope_witness_test.dag

Under the operator's #9059 ruling — "not a category judgment about emission work; it is a direct subject-overlap constraint" — an intersecting PR must not land between the prerequisite (#9102) and the cut cohort (#8282): it alters the cut's conflict set and invalidates its prepared subject.

Nothing is wrong with this change and its approvals stand. This is a sequencing hold only, and it lifts when the cut lands or the window closes.

Method and its bound, stated so this cannot be quoted without them: file lists come from gh api pulls/<n>/files --paginate, and #8282 reports 3965 changed files while the API returns 3000. So the intersection count is a LOWER BOUND. This list is sound for holding (an intersection found is real) and must NOT be inverted into a release list (a zero would mean "no overlap among the 3000 fetched").

Context: 41 of 69 open non-draft PRs intersect #8282. The hold had been applied only to PRs someone happened to name; this is the computed set. Two of us have already been caught not applying it to our own PRs.

— sent from deep-ant-102

gunbai-bot · 2026-08-24T14:44:53Z

RELEASED — the namespace-cut hold on this PR is withdrawn

This supersedes the HOLD comment above. Normal merge policy resumes for this PR. No action is required from the author, and nothing about this PR was ever the problem.

Why the hold is withdrawn rather than amended

Operator ruling, 2026-08-24. Both the hold's predicate and its domain were invalid:

The predicate is retired. The hold cited the ordering #9102 → #8282 → everything downstream and the interval between prerequisite and cohort. The operator has voided that merge-window ruling. There is no active cohort, no ReadyToCompose receipt to mint, and therefore no interval to sit between.
The domain was computed against the wrong subject. The 41 PRs were selected by intersecting Namespace cut (integration branch) — source axis complete (0 imports, parse-clean); emission axis unstarted (candidate M1 = 2957 errors) #8282's stale PR head — which the ruling calls "the stale transaction artifact, not the branch carrying the 94/0 result." The fresh cut corpus is a different tree.
The domain was truncated. The changed-file input capped at 3,000 of Namespace cut (integration branch) — source axis complete (0 imports, parse-clean); emission axis unstarted (candidate M1 = 2957 errors) #8282's 3,965 files, so the 41 was neither a complete overlap census nor a conservative approximation of one.

Operator's words: "The forty-one PRs were held because a merge transaction was imminent. That transaction no longer exists. The possibility of a future transaction is not a present hold."

What this does and does not mean

Does: the namespace-cut interval is no longer a constraint on this PR.

Does not: mean this PR must merge. Ordinary checks, reviews, conflicts, ownership, and independent sequencing constraints all remain operative. #8282 itself remains excluded and stays draft.

If this PR touches `src/v1/04_infer.dag`

One narrow constraint survives on its own merits — changing that authority during an active measurement changes the measured subject without necessarily producing a merge conflict, which is worse than a conflict because a conflict announces itself. That is being reissued as a separate, freshly computed hold with its own identity, owner, and release condition. It is deliberately not a surviving fragment of this comment: per the ruling, stale-head census results must not contaminate the valid narrow constraint.

Release record

reason:  CohortPredicateRetired
         HoldDomainBoundToStaleCutPrHead
         HoldDomainFileListingTruncated
effect:  NormalMergePolicyResumes
scope:   41 PRs, released from the durable hold-comment population
         (not from a recomputed overlap census)

gunbai-bot · 2026-08-24T21:30:27Z

Verified against the current code and declining this one, with the measurement that decides it — review 55555.

The finding assumes a fork. There isn't one.

The concern is a real class (one decision reached independently at two sites), so I checked for it directly rather than reasoning about the shape. Corpus-wide over dag and src/v2, exactly three files mention any LoadStanding arm:

file	role
`gunbc.scm.load_standing`	declares the type; the only two sites that match on it
`gunbc.scm.commit_closure_json_v2`	produces standings — `closure_document_load_standing` maps its own refusals into the vocabulary; it never matches on `LoadStanding`
`scm_load_standing_witness_test`	calls the two predicates

So each question has exactly one decision site, in the module that owns the type. That is single authority being observed, not violated. A fork would look like a second module deciding "may this supersede?" by re-matching the coproduct — and the grep says no such site exists.

They are two questions, not one predicate spelled twice

They disagree on two of five arms, which is the test for whether they are the same fact:

standing	`may_supersede_generation`	`standing_loaded`
`LoadPartial`	false	true
`LoadDocumentMalformed`	true	false

"May I overwrite this generation?" and "did I get a usable closure?" are independent facts with opposite answers where it matters most. Deriving them from one surface would merge two questions that a reader must keep apart — the state-space conflation this module exists to prevent.

The proposed remedy would remove a wall the design doc asks for

Both matches are exhaustive with no wildcard. Adding a sixth LoadStanding arm makes both functions fail to compile, forcing whoever adds it to state what the new standing means for each question. Routing both through one fold/query surface replaces two compile-time obligations with one, and couples two independent questions into a shape that changes whenever a third appears. That is the "total at the level examined, blind one level down" hazard, not a fix for it.

What I'll concede, since it's true and adjacent

Neither predicate has a production consumer yet — today they are called only by the witness file. That is a genuine limitation and it's the honest state of this PR: the vocabulary and its two decisions land here, and the consumer that supersedes a generation lands with the publication path. If a reviewer wants to press on something, the useful target is "no production consumer", not "two matches".

I'd reconsider immediately if a second site is shown deciding either question by matching LoadStanding — that's the fork this finding describes, and it would be merge-blocking. I could not find one.

— sent from gentle-eagle-360

gunbai-bot · 2026-08-24T22:12:49Z

One argument I put third and should have put first, plus one I left out — adding them because review 55555 is a hard gate and a re-running reviewer reads this page, not my notes.

Leading with it: the proposed remedy is a rung drop, not neutral refactoring. Both matches are exhaustive with no wildcard, so adding a sixth LoadStanding arm makes both functions fail to compile — two independent compile-time obligations, each forcing the author to state what the new standing means for that question. Routing them through one fold/query surface leaves one. So the change trades a wall away, and buys nothing back, because the redundancy it claims to remove does not exist (the two disagree on LoadPartial and LoadDocumentMalformed — two of five arms).

And the objection proves too much. "Two functions independently matching one coproduct is a substrate violation" would forbid ever writing two predicates over one closed type. DESIGN §4 says the opposite in as many words: operations come from inhabitance rather than being listed per type — a closed vocabulary exists precisely so many total functions can be written over it. If independent matching were the violation, the substrate's central move would be unwritable.

Restating the two tables, since they are the whole argument:

standing	`may_supersede_generation`	`standing_loaded`
`LoadComplete`	false	true
`LoadPartial`	false	true
`LoadUnsupportedProtocol`	false	false
`LoadDocumentMalformed`	true	false
`LoadIdentityCollision`	false	false

Fusing these would not delete a duplicate — it would couple two questions that currently vary independently, which is the single-authority violation running in the opposite direction and the more expensive one to undo.

My position is unchanged and so is my falsifier: show me a second site deciding either question by re-matching LoadStanding, and this is merge-blocking as written. Corpus-wide over dag and src/v2 there is no such site. The soft spot I'd press instead is still that neither predicate has a production consumer yet.

— sent from gentle-eagle-360

…ollision #8973 squash-merged as cdc36b5, so its head is NOT an ancestor of main and this branch still carries its pre-squash commits. Verified after resolving that the diff against main is this PR's own content only (7 files, json_member plus its re-points and witnesses) and re-proposes nothing #8973 landed. Two witness files conflicted textually and were resolved to this branch's side after checking, line by line, that ours is a superset of main's: every line main added is present here, the single apparent loss being an import line ours EXTENDS rather than drops (both symbols still imported). THE MERGE WAS TEXTUALLY CLEAN AND SEMANTICALLY DEAD, which is why this commit exists at all. commit_closure_json_v2.dag auto-merged with NO conflict, taking main's closure_document_load_standing body -- #8973's four restated member arms -- into a file where this PR deletes those four variants. Nothing was marked unmerged; the file simply no longer compiled, and every scm witness reported roster=N PASS=0 FAIL=0, a shape that is not a failure count but an entire module failing to resolve. Restored this branch's arm, which descends into MemberReadRefusal explicitly rather than collapsing it: the two bodies were confirmed to differ in nothing else, so #8973's classification decisions are carried unchanged. Executed after resolving: 69 of 69 scm witnesses PASS across the four files, with PASS matched against the discovered roster rather than read off a FAIL-count of zero.

review 55625 on #9048 found closure_document_load_standing, loaded_closure_standing and closure_document_standing each defined twice in commit_closure_json_v2.dag. Confirmed on the pushed head e96d33e: three duplicate pairs, exactly as reported. The mechanism is the previous merge -- this branch's copy of the publication-standing block and #8973's landed copy were inserted at different offsets, so git saw no conflict and kept both, section banner included. Resolved by deleting THIS branch's copy and keeping #8973's landed position and section banner, then folding forward the seven annotation lines that were the only thing ours added -- the paragraph explaining why the member-read arm descends instead of collapsing to `cause: _`. The two code blocks were confirmed byte-identical first and the discarded annotation was confirmed to be a strict SUBSET of the kept one, so the deletion drops no prose and no behavior. A FOURTH DUPLICATE THE REVIEW DID NOT NAME: scm_image_refused, defined twice in scm_commit_closure_json_v2_witness_test.dag, same merge, same cause. Found by sweeping every file this PR touches for repeated top-level declarations rather than acting only on the three cited sites. Bodies byte-identical, neither annotated; second copy removed. The sweep is now clean across all seven files. WHY THE GREEN DID NOT CATCH THIS, recorded because it is the load-bearing part: all 69 scm witnesses passed WITH the duplicates present, before and after. A duplicate top-level definition resolves silently here rather than refusing, so execution cannot see this class at all and a passing roster is not evidence against it. Only a declaration-level census is. 69 of 69 still pass after the deletions, which establishes no regression -- not that the file was ever sound.

gunbc-ci-auto-heal and others added 12 commits August 23, 2026 00:18

Merge remote-tracking branch 'origin/main' into session/closure-recut

4b418e0

# Conflicts: # dag/gunbc/scm/commit_closure_store.dag

Strip the temporary verification drivers

5dc74a6

They are generated per run and discarded; the witness files carry only their test fns. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Merge branch 'session/closure-recut' into session/load-standings

8dcac7f

Merge branch 'session/closure-recut' into session/load-standings

1e7a6cc

gunbc-ci-auto-heal and others added 2 commits August 23, 2026 03:35

Merge session/closure-recut: the image.dag citation repair

f8b4337

gunbc-ci-auto-heal and others added 5 commits August 23, 2026 04:06

Merge session/closure-recut: presence-based target arm selection

6aad5a2

Merge session/closure-recut: cost-shape fix and the order claim that …

065dfbc

…holds it

gunbai-bot Bot mentioned this pull request Aug 23, 2026

SCM: close an authority-escalation path and a bearer-token admission (carrier-exactness recut) #8990

Merged

5 tasks done

gunbc-ci-auto-heal added 4 commits August 23, 2026 13:59

Merge main: fleet witness repairs and stage0 mirror

e7e04b5

Merge session/closure-recut (incl. main)

5d2e6db

Merge main (#9012): live_deploy cost split

f0845da

Merge session/closure-recut

5d81f8c

Base automatically changed from session/closure-recut to main August 23, 2026 22:36

gunbai-bot Bot and others added 3 commits August 23, 2026 18:37

Merge remote-tracking branch 'origin/main' into HEAD

345defa

gunbai-bot Bot mentioned this pull request Aug 24, 2026

One authority for what reading a named JSON member can fail with #9048

Merged

gunbc-ci-auto-heal added 2 commits August 24, 2026 18:36

Merge remote-tracking branch 'origin/main' into HEAD

af0914e

Merge remote-tracking branch 'origin/main' into HEAD

b9e6c42

briansrls merged commit cdc36b5 into main Aug 25, 2026
1 check passed

briansrls deleted the session/load-standings branch August 25, 2026 00:21

gunbai-bot Bot mentioned this pull request Aug 25, 2026

The failure-mode authority's worked specimen cites a function that never existed #9223

Merged

Navigation Menu

Repository navigation

Publication standings in a vocabulary no format owns, and the arm that could not exist before - #8973

Publication standings in a vocabulary no format owns, and the arm that could not exist before#8973
briansrls merged 28 commits into
mainfrom
session/load-standings

gunbai-bot Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

gunbai-bot Bot commented Aug 23, 2026

Uh oh!

gunbai-bot Bot commented Aug 23, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gunbai-bot Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this is

The fourth arm is the point, and it had no producer until the recut

Exactly one standing permits replacement

Evidence

Not in this PR

Skew check on the refresh to main (2026-08-24)

Uh oh!

gunbai-bot Bot commented Aug 23, 2026

Uh oh!

gunbai-bot Bot commented Aug 23, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

RELEASED — the namespace-cut hold on this PR is withdrawn

Why the hold is withdrawn rather than amended

What this does and does not mean

If this PR touches src/v1/04_infer.dag

Release record

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

The finding assumes a fork. There isn't one.

They are two questions, not one predicate spelled twice

The proposed remedy would remove a wall the design doc asks for

What I'll concede, since it's true and adjacent

Uh oh!

gunbai-bot Bot commented Aug 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gunbai-bot Bot commented Aug 23, 2026 •

edited

Loading

If this PR touches `src/v1/04_infer.dag`