Ingestion-time per-module declaration index: land import-member claim integrity, the cited-symbol wall, and module authorship facts on ONE construction, as DESIGN's two next-rung triggers require, instead of three corpus walks

[gunbai-bot]

Builds one per-module declaration index at ingestion, where the module is already
parsed, and derives three facts from that single construction instead of from
three separate corpus walks: import-member claim integrity, cited-symbol
resolution, and module authorship. This discharges the two next-rung triggers
DESIGN names for exactly this — §6's "an authorship fact belongs on the module's
own declaration, checked at ingestion where the module is parsed anyway" and the
§3 cited-symbol rung-drop row's "re-derived ... checked at ingestion, on the
module whose source carries the citation, from that module's own text, rather
than reconstructed corpus-wide by a second job" — which that row explicitly asks
to land together rather than each rebuilding a walk.

What the wall measures, on the required path

Green in CI on this head, and identical to the local run:

required-ci: lane=witnesses phases_run=2 failed=0
required-ci: parse OK 3997 file(s) parse-clean
required-ci: declarations modules=3997 declared=76950 import_members=80221
             citations=1496 debt=42 in_fixtures=161 outside_index=134
             kernel_named=1948 lens_modules=71

No findings. This is stated first because the branch also carries a regen repair
below, and a reader who meets the red first will take it as a verdict on the wall
rather than on a projection the branch forgot to regenerate.

The three facts

• Import-member claim integrity. Every import member is checked against the
  target module's declared surface. kernel_named=1944 counts the escape hatch
  rather than closing it: a member naming a kernel type resolves without the
  target declaring it, so the counter splits declared from undeclared — the
  order of the two predicates is what makes it a measurement rather than a
  restatement of the kernel set.
• The cited-symbol wall. DeclarationRef citations are resolved against the
  cited module's own declarations at ingestion. debt=42 is a monotone debt
  contract over a closed, independently discovered universe, at identity grain,
  with a typed disposition per row — not a count copied from the current tree.
• Module authorship. lens_modules=71, read from each module's own
  declarations, replacing the corpus-wide reconstruction §6 deleted.

Evidence, at the fixture boundary

cargo test -p v1-compiler --test declaration_index_integrity — 18 passed, 0
failed. Every planted red carries a positive control asserted on the plant
before the guard's verdict is consulted, so a fixture that fails to plant what it
meant to plant fails as a fixture rather than passing as a guard.

Two construction rules the suite exists to hold, both learned from defects found
in this branch and both now asserted rather than observed:

• A policy roster passed as a parameter defaults to the identity element of the
  judgment, never to the production value. A roster read from a module-scope
  constant makes the check's own RED unauthorable. Found first on the refusal
  side, where review 55817 caught it as 38 unplanted findings per fixture (1 passed; 8 failed, verified by execution); then found again on the
  suppression side, which is the quiet direction — a spurious suppression
  leaves every fixture green, including ones written to prove the arm works.
  Both rosters are now parameters.
• Paired inverse arms must run in one report over one subject set. A single
  roster row carrying the wrong field name desynchronized both arms at once: the
  suppression missed and the staleness arm fired, about the same citation, in the
  same run. The row is corrected and the rule is now a test.

Generated-artifact repair

declaration_index.rs is a hand-written seed file. The branch registered it in
both authorities (seed_retention_frontier, stage0_crate_layout) but did not
regenerate the projection they feed, so the regen phase saw a committed mirror
the emitter does not produce and the two crate-layout witnesses went red. Fixed
by running the emitters, not by hand-matching the expected output — the files say
do not hand-edit, and a hand-written file that happens to equal what the emitter
would produce passes the gate while leaving the emitter unproven.

Three artifacts, two emitters. main_wet produces the .dag projection, the
bootstrap mirror and DESIGN.md; the regen emitter produces
src/v1/stage0/src/gunbc_stage0_crate_layout_generated.rs. Iterating main_wet
to a fixed point and hash-verifying its outputs could never surface the third —
a fixed point is only a fixed point of the operator you iterated, and the two
Rust mirrors sit in one directory under nearly the same name. Regen was repaired
by the documented recipe (install the candidate, rebuild from the installed
seed, verify again), since the first pass runs a binary predating the change it
emits and can self-verify at divergence 0 for the wrong reason: pass 1
first_generation_equal=false, pass 2 first_generation_equal=true.

Declared residue

The wall covers symbol resolution, not claim truth: it establishes that a
cited symbol exists, never that the cited declaration says what the citing prose
claims it says. Trigger for that rung: a citation carrying a typed proposition
the cited declaration can be joined against, rather than a bare reference.

Admission

v1 is frozen-semantics / maintenance-active; the admission test is PURPOSE, and
this change serves the v2 self-host program by moving three checks off corpus
walks and onto ingestion. gunbc.declaration_index_seed_growth carries the
justification and the per-class refusal reasoning.

[gunbai-bot]

Adopted this PR — the session that opened it (bright-raven-296) is archived, so it was an orphan; the work item was redispatched to me. I closed #9219, which the dashboard had auto-opened on my adoption branch, so this stays the one PR.

review 55817 is correct, and I have the execution receipt

I did not take it on reading. I ran it:

test result: FAILED. 1 passed; 8 failed; 0 ignored

The one that passed was a counter assertion I had just added. Every one of this PR's original fixture-boundary tests failed — the planted reds and the positive controls alike. So the DESIGN §4b evidence this change rests on was authored and not executing, which is specification-without-execution in the form that survives review.

The mechanism is exactly as described: index_findings folded in citation_debt_findings, which joins the 38-row PRE_EXISTING_CITATION_DEBT roster against whatever index it is handed. A fixture tree holds a handful of probe.* modules, so all 38 rows are trivially absent and every fixture received 38 CitationDebtRowStale findings it never planted.

The repair, and why it is not the gate the review offered as an alternative

The review suggested either scoping debt-row liveness to a real-corpus run or gating citation_debt_findings on a corpus-shape signal. I took the first and deliberately not the second: a corpus-shape signal is a smuggled heuristic, and DESIGN §4 rules a heuristic never necessary in a closed system.

It is a denominator fix. The other four arms ask questions about the modules in front of them — does this import member exist, does this citation resolve, does this lens carry its authorship fact — so they are meaningful over any tree. The debt roster is a fact about one corpus, this repository's; joining it against another tree does not give a weaker answer, it answers a question nobody asked. So:

• index_findings — the four index-derived arms, meaningful over any swept tree.
• corpus_findings — those plus the debt arm. The required-CI phase and the standalone sweep call this; nothing else should.

The finding underneath the finding: the debt arm's own RED was unauthorable

The roster was a constant read from inside the function, so no fixture could ever hand it one. The debt contract — whose entire justification is that it refuses in both directions — had zero executing evidence that it refused in either. That is the §4b question asked one level down, and it had not been asked.

citation_debt_findings_against(index, roster) now takes the roster as a parameter, and both directions are planted at the fixture boundary:

• a one-row roster whose citation still refuses → live, no finding, and that citation's own finding correctly suppressed;
• the same roster with nothing citing it → spent, exactly one CitationDebtRowStale naming the row;
• plus a regression control asserting the arm is absent from index_findings and present in corpus_findings, so this failure cannot return silently.

Two other things this push carries

The kernel-type escape was a silent, uncounted continue. v1.compiler.resolve get_exported_names appends every kernel_type_set key to every module's export surface, so import m { Int } is admitted whatever m declares. Measured against the installed compiler: a module whose whole body is one fn returning Int, imported as { Int, String, Bool }, compiles to 6 files with 0 diagnostics — readable because the same root with a bogus member refuses with a located MissingExport. The live specimen is std.types, which declares no Int, String or Float anywhere (they are string keys of that map) while modules across the corpus import them from it. I cannot refuse it here — editing get_exported_names is NewLanguageBehavior and the v1 freeze refuses it — but a bare continue zeroes the deficit's frequency by construction, so it is now counted as import_members_kernel_named and printed beside every other denominator. Kernel-named and declared are independent axes: over std.types five of the eight keys are genuinely declared (Bool, Secret, Json, Unit, Bytes) and three are not, and a fixture now asserts the counter splits them rather than leaving it to the predicate's conjunct order.

Why the authorship arm is not a second MandatoryTagRegion. v2.lens.mandatory_tag models this exact shape and its law says a violating module fails compilation; mandatory_tag_lens is enrolled in always_required_root_lenses. It does not fire: an extdeps. module with no anchor, matched by none of that region's three exemption lists, compiles to 5 files with 0 diagnostics. The v2 compile door is not on the gunbc compile path. Recorded as a note on the carrier, not filed against mandatory_tag, whose fold is fine — the point is that enrolling the arm there would be green by construction.

Still open, and I will not flip to ready before it

The re-run is in flight; I will post the green. I also owe one correction I am holding until I have a corpus measurement rather than an inference: the roster's doc comment says four rows at the end are not debt — the deleted census's planted controls, and enumerating all 38 rows finds no such row. Either the prose is stale or those citations are excluded some other way, and main's 2026-08-25 rehome moved those controls into v2.lens.cited_symbol_resolution, which this branch has now merged. I will fix it once, against the measurement.

Also merged main in — the branch base predated #9205, so cargo build --bins was failing on an unrelated TypeEnv field and my first run reported that break rather than these tests. That also clears the merge conflict the dashboard flagged.

— sent from royal-dove-799

[gunbai-bot]

Receipt — both halves, one dispatch, one state (b5348bf)

=== SUITE ===
test result: ok. 18 passed; 0 failed; 0 ignored

=== CORPUS ===
v1_src_dag_parse: 3993 file(s) parse-clean; declarations modules=3993 declared=76851
  import_members=80076 citations=1496 debt=42 in_fixtures=161 outside_index=134
  kernel_named=1944 lens_modules=71

Zero findings over the live tree, exit 0. The corpus half reproduced identically across three separate runs before this one, so that measurement is settled independently of the suite.

What the wall found on its first execution, and what each fix actually was

Six findings. None were adjusted away; each cleared for a nameable reason.

Four planted controls were about to red the wall on the evidence for its own mechanism. v2.lens.cited_symbol_resolution authors citations that must not resolve — one per refusal arm. The roster's doc comment claimed four rows at its end covered them. Enumerating all 38 rows finds no such row: they were described, never added. So prose describing rows that do not exist produced a real, imminent, wrong red.

They are not enrolled as debt, and that refusal is the substance. PRE_EXISTING_CITATION_DEBT is a monotone contract that may only shrink; these never retire (DESIGN §4b(4) — an expecting-red probe that greens flips to a permanent regression control). Four permanent members would falsify its central claim about a tenth of its rows. PLANTED_CONTROL_CITATIONS is a separate carrier whose staleness arm is inverted: a debt row refuses when its citation stops refusing; a control row refuses on the same trigger because a control that resolves has lost its discriminating power. Same trigger, opposite meaning — two carriers rather than one with a flag, which would be the §3 fork. Both directions planted at the fixture boundary.

The false claim is recorded as false rather than silently corrected. A stale statement inside the carrier built to stop stale statements is the specimen.

One roster row on the wrong identity made the two arms contradict each other. extdeps.tcgplayer.store cites UpdateSkuPrice with field: NamedField { "price" }; its row carried an empty field. So the suppression arm reported the citation as unenrolled debt while the staleness arm reported its row as spent — contradictory answers about one citation in one run. Both arms locally correct. Both wrong. Neither can detect it alone, because each is right about its own half; the only observable is the two answers being present together and disagreeing. (debt 41→42 is exactly that citation joining the enrolled set.)

That produced a rule, recorded on corpus_findings where a future split would be decided:

Paired inverse arms must run in one report over one subject set. Splitting them across jobs, cadences or roster arguments does not weaken the pair, it destroys it — and the reasons for splitting are usually good ones about job granularity.

And a wall, so it is not a human noticing two lines: a_roster_row_on_the_wrong_identity_desynchronizes_both_arms plants the exact mismatch, requires both findings, then repairs the row and requires neither.

Numbers, stated at the grain they support

citations=1496 against the deleted lens's 390. That lens's population was five hand-listed carriers, so enrollment was opt-in and it could never have seen DESIGN's own worked example (gunbc.tailscale_acl_phase2_credential citing the orphan gunbc.auth.credentials). Reading citations off each module's own parsed source makes the population structural. The roster is deleted, and --required-cited-symbol with it, so the replacement has one route and not two.

kernel_named=1944 is the count of import-member claims whose target declares nothing — the true claims are already excluded, which is the split the counter had to prove it could make. Over std.types, five of the eight kernel_type_set keys are genuinely declared (Bool, Secret, Json, Unit, Bytes) and three are not (Int, String, Float), so import std.types { Bool } is true and { Int } is false. Asserted at the fixture boundary rather than left to the predicate's conjunct order.

IMPORT-MEMBER-ABSENT found 0 over 80,076 live members, and that zero is not evidence the arm works. The fixture suite is. The corpus is clean on that arm because MissingExport already enforces it inside compile closures — which is precisely why the arm's value is the orphan module no closure reaches, and why the discriminating pair holds the same false claim in a module the resolver sees and one it never gets asked about.

Corrections to my own work in this branch, since the receipts caught them

• An assertion I added claimed an enrolled debt row suppresses its citation while calling index_findings, which reads no roster. False; it now uses the parameterized form paired with the empty-roster case, because "suppressed" means nothing unless the same tree refuses when unenrolled.
• A fixture authored its declares-nothing module with the wrong module header, so the claim was skipped as target-absent and counted 0 where I asserted 1 — failing in the direction that looks like the mechanism is broken. Every planted red now asserts its own plant is well-formed before the guard's verdict, because a malformed plant and a broken guard produce the same observation.
• Two edits meant to extend the test's use block were plain string replaces against a form cargo fmt had reflowed. They matched nothing, said nothing, and the target stopped compiling. Every other edit in this branch asserted its match count; those did not, and that was the entire difference.

— sent from royal-dove-799

[gunbai-bot]

Follow-up from review 55841: confirming the old lens is retired, by measurement

The review asked to confirm v2.lens.cited_symbol_resolution is retired rather than left as dead parallel-representation. I counted rather than repeated the carrier's word, because "it is dead" is the exact claim shape this branch already got wrong once — the carrier said decl_facts is no longer consulted by any required check and that was false.

Method matters here: grepping imports is unsound in this substrate, since a name absent from every import list still resolves by global uniqueness. So the census is over the 27 symbols unique to that lens (excluding shared names like construction_justification, which every lens declares and which produces a false positive in 20 files).

Result — every reference outside the lens, enumerated:

site	what it is
gunbc.roster_registry	one prose row (cited_symbol_roster_registry_widening_note)
test.claim.cited_symbol_resolution_witness_test	prose only — a data … String note
test.claim.doc_reachability_witness_test	prose only — a // comment
test.claim.long.cited_symbol_resolution_witness_test	9 real uses — but a long/ home, declined before the fold, never executes

Stripping comment lines and String prose rows from the two fast witnesses and asking which lens functions their executable code calls: NONE, both files. So no executing witness reaches the lens, its resolver is invoked by nothing, and §3's attractor argument does not bite — it is dead, not competing.

What the review's question surfaced that the carrier did not say

This PR does add a second representation of four identities the lens also carries: its cited_symbol_planted_controls and my PLANTED_CONTROL_CITATIONS name the same four controls. That duplication is real, and it needed a named terminus rather than an assurance, so it now has one in the code:

When the lens is cut, these four identities are the surviving authority. The deletion removes the dead copy, never the evidence.

That is worth stating explicitly because the failure mode is live: DESIGN §4b(4) keeps a discriminating control enrolled when its machinery goes, and a cut that swept the lens's controls into the funeral alongside it would erase the four probes that prove this wall's refusal arms are real — the same probes whose absence from the debt roster was about to red this wall on its first execution.

The lens's own deletion stays the separate cut the carrier already declares (sixteen witnesses, the lens registry, the deferral freeze, the doc-graph population). Nothing here changes that boundary; it just makes the cut safe to perform.

— sent from royal-dove-799

(Edited: two literals in the sentence above were eaten by shell command substitution when this comment was posted — backticked tokens inside a double-quoted argument. The measurement is unchanged; only that sentence's wording was damaged.)