Delete the cited-symbol census job from CI (operator directive), and declare the rung it drops

[gunbai-bot]

Delete the cited-symbol census job from CI (operator directive), and declare the rung it drops

WHAT IS REMOVED. The cited-symbol job — a second GitHub check-run invoking
claim_executor --required-cited-symbol over dag and src/v2, which resolved
every authored DeclarationRef against live declaration facts and refused a
reference whose module, declaration or field was absent or ambiguous. On the last
green main it reported OK every authored reference resolves checked=390.

Operator directive, 2026-08-23, in session chat: "i basically just want to delete
the cite census job". The instruction was given twice — first as "delete that, i
don't want it in CI", then narrowed after I began scoping a substrate change that
had not been asked for.

THE EDIT IS IN THE AUTHORITY, NOT THE ARTIFACT. .github/workflows/witnesses.yml
is generated from gunbc.witness_floor_workflow via
gunbc.generated_artifact WitnessFloorYamlArtifact; editing the YAML directly
would be drift that the next regen reverts. Removed from the authority: the job,
its id, run step, run script, bound steps, step annotations, capability-closure
predicate, and the 47-line comment block documenting the second-job rationale;
jobs becomes [witness_floor_job()] and the floor's needs becomes []. The
orphaned argv producer gunbc.fabric_witness_run cited_symbol_run_command goes
with it, as does the one witness assertion over the deleted predicate. The YAML is
regenerated rather than hand-edited: -24 lines, exactly the job and the edge.

The deletion asserts 'fn witness_floor_job()' not in removed before writing, so
a mis-anchored range cannot take the floor job with the census job.

WHAT IS DELIBERATELY NOT REMOVED, because a wider first reading of the instruction
would have broken a live wall. std.decl_ref and its 345 uses stay.
DeclarationRef is the MECHANISM, not the census: admit_callers on the sealed
ArgvCommand mint is one of those uses, and it correctly refused main earlier
today (#9031). Deleting the type or its uses would have dissolved a working
guarantee while removing a check. The lens v2.lens.cited_symbol_resolution and
the --required-cited-symbol mode also stay, now uninvoked — the same standing as
--behavioral-receipt-* and --required-regen-fixed-point, capabilities that
survive at their entry points with no workflow calling them.

THE RUNG DROP, DECLARED (DESIGN §4b(3)).
PREVIOUS RUNG: mechanically preventable. A gate reliably exposed and blocked an
unresolvable authored reference; the invalid state stayed writable.
TEMPORARY RUNG: none. The class is now unguarded — a stale DeclarationRef is
writable and nothing detects it. Review diligence is strictly weaker and is not
claimed here as a substitute.
REASON: operator directive. Recorded as given rather than reconstructed.
BOUNDED POPULATION: the 390 references the last green run checked, plus every
reference authored after it.
RESTORATION TRIGGER: the lens's own declared dissolve-on — "substrate refuses
unwritable DeclarationRef at construction". The operator named the same
remedy: "you would just make them a normal compiler error or something". So
this census was a §5 validation pass standing where construction was
available, and it has carried its own replacement condition since it was
written. The replacement is NOT built here.

WHAT THE CLASS ACTUALLY WAS, so the restoration is not re-derived from scratch.
The lens exists because §3 rules that citations are symbolic — a file:line
pointer is a second positional naming scheme that rots when anything above the
line moves. A symbolic citation is decidable, because resolving a name is the
Node-tree read the namespace authority already performs. A compile-time refusal
would be strictly STRONGER than what is deleted: decl_facts deliberately skips
test .dag files, so today a reference can be true and unresolvable at once and
needs a whole CitationIndexCoverage disposition to carry that; the compiler has
the full module graph and would not need the carrier. The open design question is
what a construction check resolves AGAINST — the entry closure (deterministic, but
refuses deliberate non-dependency citations) or the whole module graph (matches
today's behaviour, but makes the answer depend on what else is loaded, which is
the pool-dependence class). That question is not settled here.

REMOVING THE JOB ALSO REMOVES AN ORDERING EDGE, named because its reason
disappears with it. The floor needs-ed this job (operator ruling 2026-08-22)
after a measured race: both jobs are byte-identical through checkout, toolchain
and build, and when they started together on one self-hosted host both installs
wrote the same /home/ghrunner/.cargo/bin/rustc — Text file busy, ETXTBSY,
exit 126, at 1 run in 5. With one job left the collision is unrepresentable rather
than rare, so the edge is not needed. But the repair now lives nowhere: a second
job added later re-opens it, and the rejected alternative (per-job
CARGO_HOME/RUSTUP_HOME, paying a cold build every run) is recorded here so it is
not re-litigated from zero.

VERIFIED, WITH A CONTROL, BECAUSE "MY EDIT COULD NOT HAVE CAUSED THAT" IS THE
ASSUMPTION THAT FAILS HERE. Compiling the touched witness entry returns RC=1 with
53 hard diagnostics — ~52 §4c annotation violations in dag/test/manual/ and one
unresolved stat_owner_user_name_command in gunbc.command_runner. Neither file
is touched here, but this change DELETES A FUNCTION, closures move, and name
resolution in this tree is pool-dependent, so a same-binary control was run
against unmodified origin/main in a detached worktree:

branch produced 53 hard no-subject 52 stat_owner 1
control produced 53 hard no-subject 52 stat_owner 1
diagnostic sets: IDENTICAL

So both are pre-existing and this change moves neither. Note also that they stand
on a GREEN main, which means dag/test/manual/ is outside the required floor's
subject: a directory of §4c violations of exactly the class that refused the whole
floor this morning is accumulating where nothing checks it. Not repaired here —
named so it is not rediscovered as new.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_017HBx8dnz3oCiiHXoSBdtH2

🤖 Generated with Claude Code

https://claude.ai/code/session_017HBx8dnz3oCiiHXoSBdtH2

[gunbai-bot]

Both findings addressed in 22e19b3385.

The rung-drop declaration (blocking finding). Correct, and the framing is right: the operator directive licenses the deletion, §4b(3) still demands the declaration land with it. The row now carries all five required things — previous rung mechanically preventable, measured green at checked=390 on run 32664434197 (f49886339a5, 2026-08-23T20:26Z); temporary rung mitigatable (review diligence, strictly weaker in the way §6 already records for the deleted inert-lens census); reason (operator directive, explicitly not a defect finding — the mechanism was executing and green); bounded population (those 390 references plus every citation authored after, carried as the size at the moment of the drop, not a standing figure); and a restoration trigger — the wall re-derived at ingestion, on the module whose source carries the citation, per the operator's own framing that this should be a normal compiler error rather than a corpus-wide job.

Two deliberate choices worth naming, since neither is what the review suggested verbatim:

• It is a sibling row beside the CI bullet, not a clause inside the "unguarded in the meantime" list. That list enumerates what the floor cut left unguarded; this is a third drop on its own clock, and the regen row one line above already establishes the precedent and states the reason — a declaration wedged into the repository's most-edited paragraph collides with every unrelated edit to it (three merge conflicts in two hours, by that row's own account).
• The row declines to claim the surviving --required-cited-symbol flag as a mitigation. The mode still exists and still runs the census standalone, but no workflow invokes it, and a mode nothing calls guards nothing. Counting it would be exactly the §4b(1) inflation the declaration exists to avoid.

The trailing blank line. Fixed.

One thing I found that is not mine and is not in scope, flagged rather than buried. Regenerating DESIGN.md for this change would have silently deleted a ~2350-character §4b passage — "At this rung, ask whether the check's RED is authorable before writing the check", with its two-boundaries correction and the reach-roster receipt. gunbc#8914 (f7de1fbcc9) added that text to the generated DESIGN.md and never touched gunbc.design_document; its stat is DESIGN.md | 2 +- and fleet_reach_endpoint.dag, nothing else. It has been quoted by readers since and existed nowhere the compiler could see. Nothing caught it, because the generated-artifact drift gate is on DESIGN's own unguarded list.

I ported it back into the authority at its exact anchor rather than restoring the .md hunk — restoring the .md re-creates the drift and the next regen deletes it again. The receipt that the port is faithful is the regen itself: DESIGN.md comes back 1 insertion, 0 deletions, and the §4b line is byte-identical to origin/main. So this PR adds one row and removes nothing, which is what it should do; had I regenerated without checking, it would have carried away operator-approved prose as a side effect.

— sent from fierce-hawk-734

[gunbai-bot]

Follow-up review raised three pushbacks against the rung-drop row. One landed and is fixed in a4f3e69128; the other two do not change the row, and the reasons are worth recording rather than left implicit.

1. "390 plus every future reference is not bounded" — correct, fixed. The row read BOUNDED POPULATION: the 390 authored references that run walked, plus every citation authored after it. The first half is a measurement; the second is unbounded by construction, since nothing counts a citation authored after the cut and nothing refuses one. Their union is not bounded, and calling it so is the same move §5 forbids when a tree-copied count is asked to serve as an oracle — committed inside the one row whose whole job is honesty about a rung. It is now two separate facts, with the §4b(3) status stated outright: the bounded-population requirement is not satisfied by this drop, so the drop is an operator-approved exception to that clause rather than an instance of it. A row that quietly failed a clause it cites would be worse than one that admits it.

2. "Temporary rung: none should not mint a rung named none" — agreed, and the row never did. It claims mitigatable. That is not a coinage for this PR: DESIGN.md already assigns that rung to exactly this residue twice — §6 for the deleted inert-lens census ("the obligation survives as review diligence, which is strictly weaker … the class sits at mitigatable") and §3 for v1_seed_standing ("consumed by review diligence, not by any gate, so it sits at mitigatable"). Following two in-document precedents is the right call here; inventing a third vocabulary for the same situation would be the §3 violation.

3. "Disclose that global main_wet reconciliation is blocked" — this reads a superseded state, and the requested sentence would now be false. The review describes the design passage as reverted, leaving the split-brain open pending a content ruling. It was not reverted. It was ported into dag/gunbc/design_document.dag at its exact anchor and regenerated, so the disagreement is closed rather than deferred: DESIGN.md comes back with that line byte-identical to origin/main, and this commit's regen is 1 insertion / 1 deletion, both of them this row's own line. Nothing else in the generated surface moved.

On the deeper point behind (3) — that regeneration is mechanically faithful to its generator and has no authority to settle a content question — I agree, and that is exactly why I ported instead of letting the deletion ride. Between retain and retire, retain is the arm that changes nothing anyone reads, and the text arrived through an operator-merged PR (#8914), so retiring it would need a justification no one has offered. The verify/actuate split the review proposes for the generated-artifact mechanism is a real design point, but it is a separate change and not this PR's to make.

— sent from fierce-hawk-734