Delete the cited-symbol census job from CI (operator directive), and declare the rung it drops

.github/workflows/witnesses.yml

@@ -17,32 +17,8 @@ env:
   GUNBC_REQUIRED_FLOOR_DISPOSITION: required_floor_disposition.tsv
   GUNBC_LONG_HOME_STORAGE_AGREEMENT: long_home_storage_agreement.tsv
 jobs:
-  cited-symbol:
-    runs-on: [self-hosted, linux, arm64]
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.0
-        with:
-          components: rustfmt
-          cache: false
-      - name: Build the witness fold
-        id: build_witness_fold
-        run: |
-          cargo build --release -p v1-compiler --bin claim_executor --bin gunbc
-      - name: Cited-symbol census (every authored DeclarationRef resolves)
-        run: |
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-          cd "$ROOT"
-          'target/release/claim_executor' '--required-cited-symbol' '--source-root' 'dag' '--source-root' 'src/v2'
-        if: "!cancelled() && steps.build_witness_fold.outcome == 'success'"
   witnesses:
     runs-on: [self-hosted, linux, arm64]
-    needs: [cited-symbol]
     timeout-minutes: 180
     steps:
       - name: Checkout

dag/gunbc/fabric_witness_run.dag

@@ -220,35 +220,6 @@ fn floor_execution_requirements() -> ExecutionRequirements {
 fn floor_inputs_manifest_ref() -> ArtifactManifestRef {
   concat("gunbc.floor.inputs.source-roots:", join(witness_layer_roots, "+"))
 }
-
-// A modeled command, not a string blob. extdeps.exec.command already owns the
-// argv carrier, so authoring a shell line here would have been a second
-// representation of "how a process is invoked" -- the medium-as-string tell.
-
-// THE CITED-SYMBOL CHECK'S COMMAND, BUILT HERE FOR THE SAME REASON THE FLOOR'S IS.
-//
-// One authority owns what a required invocation of our own binary IS, so a transport renders a
-// command rather than re-spelling one. The floor step learned that the expensive way: an earlier
-// revision built its invocation a second time in the workflow module and pinned the two together
-// with a witness asserting they agreed on SOURCE ROOTS, which stayed green while the binary path,
-// the flag spelling or the argument order drifted. Agreeing on the roots is not agreeing on the
-// command.
-//
-// The flag is not --required-ci. This census is a separately named required check, not a fourth
-// phase of that mode: the operator narrowed --required-ci to three phases on 2026-08-21 (#8791),
-// and that ruling governs what one composed entry point is responsible for. A distinct subject
-// gets its own check, and --required-ci is left at exactly three.
-fn cited_symbol_run_command() -> ArgvCommand {
-  claim_executor_command(
-    mode_flag: "--required-cited-symbol",
-    operands: fold(
-      witness_layer_roots,
-      init: [],
-      f: fn(acc, root) { append(acc, items: ["--source-root", root]) },
-    ),
-  )
-}
-
 fn floor_run_command() -> ArgvCommand {
   claim_executor_command(
     mode_flag: "--required-ci",

dag/gunbc/witness_floor_workflow.dag

@@ -29,7 +29,7 @@ import gunbc.ci_runner_target { gunbc_ci_selected_runner_spec }
 import gunbc.repo_identity { gunbc_default_branch_name }
 import gunbc.merge_admission_produce { ci_repo_root_shell }
 import gunbc.ci_layer_roots { witness_layer_roots }
-import gunbc.fabric_witness_run { cited_symbol_run_command, floor_run_command }
+import gunbc.fabric_witness_run { floor_run_command }
 import extdeps.exec.command { shell_command_render }
 import std.types { List, String, Int }
 
@@ -716,131 +716,11 @@ fn witness_floor_job() -> Job {
     name: none,
     runner: gunbc_ci_selected_runner_spec(),
     steps: witness_floor_steps(),
-    needs: [cited_symbol_job_id],
-    env: none,
-    outputs: none,
-    if_condition: none,
-    timeout_minutes: 180,
-    continue_on_error: none,
-    concurrency: none,
-    permissions: none
-  }
-}
-
-// THE CITED-SYMBOL CENSUS IS A SECOND JOB, WHICH IS WHAT MAKES IT A SEPARATELY NAMED CHECK.
-//
-// A GitHub check-run is a JOB, not a step, so a census that is meant to be its own required check
-// cannot be a step inside the witnesses job -- it would report under that job's name and its
-// verdict would be indistinguishable from the floor's on the checks list.
-//
-// WHY IT IS NOT A FOURTH `--required-ci` PHASE. The operator narrowed that mode from eight phases
-// to three on 2026-08-21 (#8791). That ruling is about what one composed entry point is
-// responsible for, and this job does not touch it: `--required-ci` still runs exactly three
-// phases, and its invocation above is unchanged. Routing the same work back in under a different
-// name would be the workaround this repository refuses; a distinct subject with its own check is
-// the shape the ruling points at.
-//
-// WHY IT IS NOT A FLOOR CLAIM, which is structural rather than a preference: `run_required_floor`
-// declines any entry that reads the live tree (`DeclinedLiveTree`), and reading the live corpus IS
-// this census's subject. Relocating the witness moves it from `DeclinedLongModule` to
-// `DeclinedLiveTree` and never to `Planned`, so no amount of making it cheaper opens that route.
-//
-// THE COST OF A SECOND JOB, stated rather than hidden: it re-does checkout, toolchain and build.
-// The build is the same cargo invocation against the same self-hosted runner pool, so it is warm
-// in the ordinary case, and the census itself is ~2 minutes against a floor job of ~30.
-//
-// THIS JOB RUNS FIRST AND THE FLOOR `needs` IT (operator ruling, 2026-08-22), which is a REVERSAL
-// of the independence an earlier revision of this comment claimed, and the reason is a measured
-// race rather than a preference. Both jobs are byte-identical through checkout, toolchain and
-// build, and when they started simultaneously on one self-hosted host both installs wrote the
-// SAME /home/ghrunner/.cargo/bin/rustc: `Text file busy`, ETXTBSY, exit 126, at a measured 1 run
-// in 5. The census step was skipped, so the job reported NO verdict rather than a wrong one --
-// honest, but the wrong thing to leave standing, because a required check that reds one run in
-// five for reasons unrelated to the diff teaches authors to rerun without reading, and reflexive
-// rerunning is how a real failure gets rerun away. A required check must be believable or it is
-// decorative.
-//
-// The ordering edge makes the overlap STRUCTURALLY IMPOSSIBLE rather than rare, which is the §5
-// construction move: the two setups cannot coincide, so there is no window to lose. The rejected
-// alternative was per-job CARGO_HOME/RUSTUP_HOME, which removes the collision by giving each job
-// its own toolchain and registry -- paying a cold build on EVERY run to avoid a collision on one
-// in five, and making the duplicated build more expensive rather than less.
-//
-// THE DIRECTION IS LOAD-BEARING: census FIRST, floor second. The census is minutes and the floor
-// is ~30, so a citation failure surfaces early; the other order reports the same failure half an
-// hour later for no gain.
-//
-// WHAT THE EDGE COSTS, named rather than buried: a red census now leaves the floor SKIPPED, so
-// that run yields no floor verdict. That is a real loss of information on a red census run, and
-// it is accepted deliberately -- the floor still runs on every green, and a red census is a
-// stop-the-line condition rather than a state to keep measuring around.
-
-fn cited_symbol_run_script() -> String {
-  concat(
-    concat("ROOT=", concat(ci_repo_root_shell(), "\n")),
-    concat(
-      "cd \"$ROOT\"\n",
-      concat(shell_command_render(command: cited_symbol_run_command()), "\n")
-    )
-  )
-}
-
-fn cited_symbol_run_step() -> Step {
-  RunStep {
-    name: Present { value: "Cited-symbol census (every authored DeclarationRef resolves)" },
-    id: none,
-    run: cited_symbol_run_script(),
-    shell: none,
-    env: none,
-    working_directory: none,
-    if_condition: Present { value: witness_floor_precondition() },
-    continue_on_error: none,
-    timeout_minutes: none
-  }
-}
-
-fn cited_symbol_bound_steps() -> List<WitnessFloorBoundStep> {
-  append(
-    prepared_bound_steps(),
-    items: [
-      WitnessFloorBoundStep {
-        step: cited_symbol_run_step(),
-        role: capability_neutral,
-        step_name: "Cited-symbol census (every authored DeclarationRef resolves)",
-      },
-    ],
-  )
-}
-
-fn cited_symbol_step_annotations() -> List<CapabilityAnnotatedStep> {
-  list_map(
-    xs: cited_symbol_bound_steps(),
-    f: fn(b) { CapabilityAnnotatedStep { step_name: b.step_name, role: b.role } },
-  )
-}
-
-fn cited_symbol_capability_closure_holds() -> Bool {
-  capability_closure_is_closed(
-    v: workflow_job_capability_closure(steps: cited_symbol_step_annotations()),
-  )
-}
-
-data cited_symbol_job_id: String = "cited-symbol"
-
-// 30 rather than the floor's 180. The census measured 1m39s-2m13s on a remote runner; a bound is
-// not derived from those, but it is chosen so that a wedged run reports within the same working
-// hour instead of holding a self-hosted runner for three hours to say nothing.
-fn cited_symbol_job() -> Job {
-  Job {
-    id: cited_symbol_job_id,
-    name: none,
-    runner: gunbc_ci_selected_runner_spec(),
-    steps: list_map(xs: cited_symbol_bound_steps(), f: fn(b) { b.step }),
     needs: [],
     env: none,
     outputs: none,
     if_condition: none,
-    timeout_minutes: 30,
+    timeout_minutes: 180,
     continue_on_error: none,
     concurrency: none,
     permissions: none
@@ -885,7 +765,7 @@ data witness_floor_workflow: Workflow = {
       id_token: none
     }
   },
-  jobs: [cited_symbol_job(), witness_floor_job()]
+  jobs: [witness_floor_job()]
 }
 
 // THE CLOSURE HAS A PRODUCTION CONSUMER, which is the difference between a check and a claim.

dag/test/claim/workflow_capability_closure_witness_test.dag

@@ -11,7 +11,7 @@ import gunbc.workflow_capability_closure {
   workflow_job_capability_closure,
   capability_closure_is_closed,
 }
-import gunbc.witness_floor_workflow { cited_symbol_capability_closure_holds, witness_floor_capability_closure_holds }
+import gunbc.witness_floor_workflow { witness_floor_capability_closure_holds }
 import gunbc.fleet_converge_workflow { fleet_converge_build_job_capability_closure_holds }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
@@ -157,10 +157,3 @@ test fn a_capability_outside_the_provided_list_still_refuses() -> Bool {
 test fn the_live_fleet_converge_build_job_closes_its_capabilities() -> Bool {
   fleet_converge_build_job_capability_closure_holds()
 }
-
-// THE SECOND LIVE JOB. The cited-symbol census is a separate check-run, so it is a separate job,
-// so it carries its own toolchain->build ordering and its own way to be broken. Asserting the
-// floor job closes says nothing about it: the two jobs share no steps, only a shape.
-test fn the_live_cited_symbol_job_closes_its_capabilities() -> Bool {
-  cited_symbol_capability_closure_holds()
-}