The dual denominator: a file the index cannot classify blocks instead of vanishing by gunbai-bot[bot] · Pull Request #9231 · gunb-ai/gunbc

gunbai-bot · 2026-08-25T20:08:10Z

Stacked on #9213. Closes the second of the two holes that PR declared, and it is the precondition for enrolling the ratchet anywhere — while it was open, emit_ratchet_gating_admission refused every enrolment by construction.

The hole

The universe was discovered from the parsed declaration index alone. A .dag file the index could not classify was not a subject at all: the fold was never asked about it, and its disappearance read as a smaller universe rather than as a problem. A regression rendering as improvement — the empty-observation narrow, which DESIGN calls strictly worse than the widen §5 forbids. Identity grain does not save it, because a subject that vanishes has no identity left to compare against.

The mechanism was measured, and the obvious statement of it was wrong

#9213's first revision said "a module that stops parsing vanishes." That is false for nearly every real module, and the correction is recorded in the carrier rather than quietly applied.

module_path_index parse_module_binding returns a typed, located refusal when a file fails to parse and its first non-comment line begins with module ; refuse_unparseable_module_sources stops the line on it. Almost every module leads with that header, so the common case is loud.

The silent arm is narrower: ModuleBindingUnclassified, which that module's own source documents as a conflation it cannot resolve — fragments and parse failures land there together. A file reaches it when the leading-header scan recognizes no module declaration: a fragment, a header preceded by any non-comment text, or an empty module name.

The discriminating measurement held "the file is broken" constant and varied only whether the header scan recognized it — both fixtures carried the same parse error:

header recognized      -> module index refused: 1 unparseable .dag source(s) + span, exit 1
header not recognized  -> exit 0, zero refusal lines, the file simply absent

A well-formed control compiled clean in the same harness, so the silence is a fact about classification and not a probe that never reached the compiler.

The fix, and why the inventory is not just a second count

RatchetUniverse carries a second denominator — a file inventory (shell.Find.FilesByNameSorted, sorted so traversal order never reaches the digest). A file present on disk and absent from the index becomes a subject, with outcome EmitSubjectBlocked { cause: UnclassifiedByModuleIndex }. It blocks instead of vanishing.

The inventory is not a more careful index. It answers a question the index cannot ask at all. The unclassified arm is inseparable from the index, because fragments and parse failures look identical there — but they do not look identical from the file system, where presence on disk is a fact independent of whether the header parsed.

It blocks rather than reading as NotEvaluated, and that distinction is what the closure turns on: "the instrument did not reach it" and "nothing can reach it at all" are different facts. Nothing can name an unclassified file as an entry, so there is no compile to run, and calling that an unreached measurement would invite someone to go and take one.

The denominator is now derived, not passed

RosterDenominators is no longer a caller-supplied field. The dual value is reachable only by holding a DualUniverse, which is reachable only by supplying an inventory — so the field is a consequence of having the inventory rather than an assertion about having it.

That closes the fold-time-vs-mint-time observation from review 55831, which smart-ram-730 reached independently from the other direction ("the field is only honest if it is derived from the inventory existing, not set beside it"). A caller can no longer assert a denominator it has not earned.

An intermediate revision of this PR had roster_identity_from_index_and_inventory(policy, roster, inventory) — which ignored inventory entirely, two lines below a comment condemning exactly that shape. Restructured into the universe coproduct so the inventory is load-bearing.

A second finding, from the producer's author, and it lands on the ratchet's load-bearing arm

deep-ant-102 relayed a finding from bold-stag-236, who owns emit_diagnostic_observation: EmittedFileCount does not ASSERT the emitted/not-written distinction. FilesNotWritten is what the absence of the compiler's compiled: summary line decodes to, and the compiler prints that line only when a tree was written. So the distinction is inherited from the producer's printing discipline, which nothing pins.

That lands hardest here, because NotEvaluated is this ratchet's load-bearing row — an upstream refusal turning blockers into absence, with absence reading as zero, is the failure it exists to prevent. Verified against the code rather than taken on faith: FilesEmitted { count: 0 } did derive EmitPopulationComplete, and therefore Clean. So if the seed ever printed a summary on a path that wrote nothing, a run that emitted nothing would have read Clean.

Fixed by not depending on that convention for the dangerous direction. A zero-file tree is now EmittedNothing, a third distinct NotEvaluated cause, so the hypothesised misprint lands in a refusal either way. The convention now only decides which cause is reported — a rendering difference, not a verdict difference.

What that does not close, at its honest size (corrected by the decoder's author after I overstated it): a probe emitting no tree and asserting the summary line is absent pins one path, and v1 has more than one, so it raises confidence without closing the class. What closes it is the summary line emitted from a single site that cannot run without a tree — present-with-zero having no producer rather than no observed instance. That is a v1 change, blocked under the seed freeze, so it is the class's next-rung trigger rather than work anyone is declining.

Refusals added

an unreadable root REFUSES rather than contributing an empty list. A failure that shrinks the denominator is precisely the defect this denominator closes; folding it into "no files here" would commit that defect inside the thing fixing it.
a measurement cannot overwrite a classification. Classification readings are folded ahead of measured ones and lookup takes the first match, so the ordering is the enforcement rather than a check.

Evidence

The hole-2 pin is flipped, not deleted — §4b(4): the climb deletes the production handling it obsoletes, never the evidence that the higher rung is real. a_file_the_index_cannot_classify_vanishes_from_the_universe_instead_of_blocking was green while the hole was open; it is now a_file_the_index_cannot_classify_blocks_instead_of_vanishing, and its control is the index-only universe still losing the file, so the pair shows the second denominator doing the work rather than some other difference between two runs.

Also asserted: the enrolment wall now permits a dual-denominator carrier and still refuses an index-only one, both arms over a real folded artifact.

Measured: both entries compile 0 blocking; 27/27 claims PASS, 0 FAIL via claim_batch --hermetic, with the declared-vs-executed join empty.

Defects I introduced in this PR and caught before it left draft

Recorded because each was caught by execution rather than by reading the diff, which is the argument for running things:

A wholesale deletion. The dual-denominator edit replaced a range from the fold to the enrolment wall, and the entire standing section lived between those anchors — ratchet_failing_verdicts, ratchet_failing_rows, EmitRatchetStanding, emit_ratchet_standing, emit_ratchet_standing_text, deleted by an edit naming none of them. The tell was function 'map' not found in scope — a builtin — which is what a cascade looks like when a module loses declarations later ones depend on. Nine reported errors, one deletion.
An accepts-and-ignores parameter. An intermediate roster_identity_from_index_and_inventory(policy, roster, inventory) ignored inventory entirely, two lines under a comment condemning that exact shape.
A §4c violation. A // inside a match body — the form that refuses at strict preparation, and the one DESIGN records as having masked runs for three hours.
A stale assertion. Renaming the refusal string from "module inventory" to "file inventory" broke the claim that asserts it. That claim asserting the string rather than just "it refused" is what made the rename visible; a shape-only check would have stayed green through a change that broke what the refusal tells a human.

DESIGN's Building-&-checks section carries a declared rung drop titled THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS. It states its own restoration trigger: a .dag entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population. This is that entry point. It is the INSTRUMENT, not a board -- it produces numbers and stores none. tools.emission_entry_instrument measure_entry_emission runs the spine the deleted probe script ran (gunbc compile --entry -> cssl_assemble -> cargo under --message-format=json) and returns EmissionMeasurement, in which "refused before the emitter ran" has no spelling in the same shape as "emitted with zero diagnostics": an unreached stage is its own variant naming the stage. That is DESIGN's execution-provenance-loss row applied to the instrument that most needed it. extdeps.cargo_diagnostic decodes the rustc coded-diagnostic population -- one member per finding, identity (E-code or the named uncoded state) and location (the primary span, selected by is_primary rather than by position), so two runs can be joined rather than only differenced. A line it cannot read, and an empty stream, refuse with a located cause instead of reporting an empty population. It is a sibling of extdeps.cargo_message rather than a widening of it, which that module's own boundary note asks for. gunbc.emit_diagnostic_observation decodes the emit-stage population from what the CLI already prints. No v1 capability is added: emission is 05_emit territory and the seed is frozen with maintenance active, so this reads the existing surface rather than widening the seed for an instrument's convenience. What makes a prose decode admissible is the cross-check -- the compiler states its own total on the `compiled:` line and again in the renderer's severity summary, and a population disagreeing with either, or the two disagreeing with each other, refuses and names both numbers. NOT A GATE. No workflow invokes it, no phase enrols it, and the exit status reports whether the INSTRUMENT completed, never whether the subject was clean. Evidence: witness claims carry greens and discriminating reds for both decoders and for the carrier's own distinction. Measured at c271b75: the entry compile of the instrument itself is 0 blocking / 138 files emitted, and dag/extdeps/cpu/ampere.dag refuses at emit with 9 blocking / 119 advisory -- re-derived here, not carried from a brief. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Two corrections from review on #9190, both narrowing. ONE -- THE CARRIER NAMED ITS STAGES AND NOT ITS COMPILER. Splitting the phase states is state-space de-conflation; it is not provenance, and the prose claimed provenance. DESIGN separates the two deliberately: conflation is repaired by splitting states, execution-provenance loss by BINDING A RECEIPT to the value. Without one, the carrier could report the same-looking population from two different compilers -- the same defect one level down from the one the stage split closes. Every outcome that carries a population now carries an EmissionMeasurementSubject: entry, source revision, working-tree standing, and the sha256 of the two binaries actually invoked. It is established BEFORE the emitter runs, and a component that cannot be observed refuses the run rather than being recorded as absent -- an unobserved digest is not the digest of nothing. The one arm without a subject, EmissionSubjectUnestablished, is the one that took no measurement, so an unattributable population has no representation. The identity vocabulary is REUSED, not re-coined: CommitSha from extdeps.git.inspect, Digest from extdeps.crypto.hash. Minting a parallel identity vocabulary inside the instrument built to enforce single authority would be the violation it exists to measure. extdeps.tools.sha256sum gains one operation, DigestFile: CheckFile answers "does this file match this digest", which cannot be used to LEARN one. TWO -- A KILLED BUILD'S PREFIX READ AS A POPULATION. The decoder returned a population from any nonempty parseable prefix, so cargo emitting seventeen messages and then being SIGKILLed reported those seventeen as the answer. That is the truncated-observation-rendered-as-complete failure that created this lane, reproduced inside the instrument built to end it. cargo closes every run it performed with build-finished; a stream without one now refuses and says how far it got. Its `success` member is also now the authority on whether the build was clean, replacing the transport exit status observed beside the stream -- the terminal message is emitted BY the run being measured. Executed: PASS on the truncated-stream red, the terminal-message verdict in both polarities, and both provenance claims (a measurement names its compiler; an unestablished subject carries neither provenance nor population), with an existing green re-run as a regression control. Entry compile of the instrument after both corrections: 0 blocking, 145 files emitted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Requirement from smart-ram-730, relayed from deep-ant-102's finding, and it is a level finer than the phase split already in the carrier. THE FINDING, verified here by reading the emitter rather than taken on report: v1.05_emit_rust emit_rust is a sequence of early returns. Measured on the live file there are exactly two, both `return EmitResult { files: [], diagnostics }`, and while the first fires the checks after it NEVER EXECUTE -- two workflow-parameter diagnostics were observed masking eight anonymous-record ones, which had been standing the whole time. So any count taken over emit can be a PREFIX of the truth rather than the truth: not an undercount anyone can bound, but a count that stops silently at whichever earlier check fired. WHY THE EXISTING ARMS DID NOT COVER IT. They distinguish WHICH PHASE the instrument reached. This is finer: within one EmissionMeasured, emit itself may have returned before a later check ran, so two results that both honestly report "emit ran" can differ in whether a check even executed. A consumer reading the first concludes the entry has two blocking diagnostics; it has at least ten. THE DERIVATION IS EXACT, not a guess, which is what makes this a construction rather than a warning. Both early returns write NO FILES, and the CLI prints its `compiled:` line only where a tree was written. So a compile reporting emitted files ran the emit body to its end and its population is Complete; one reporting none is CompletenessUnestablished. That second arm is named for IGNORANCE rather than truncation on purpose: a refusal caused outside emit also lands there, and claiming such a population IS truncated would answer a question this observation cannot answer. Over-stating ignorance is safe; the opposite is the defect. AND THE COUNT NEVER TRAVELS ALONE. The size and the extent are rendered by ONE expression, so a report stating a population size always states the standing of the set it counted -- a separate optional row would let the number travel by itself, which is the entire failure. Executed: PASS on a refused population never reported as complete, a completed one reported as complete (so the extent is a real discriminator and not a constant), no report stating a population without its extent, and the existing carrier claim re-run as a regression control. Entry compile: 0 blocking. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…, where an unmeasured subject is neither clean nor suspect tools.emission_entry_instrument answers one question about one entry and stores nothing -- it says so itself, and says gating is a separate decision with a separate argument. This is the consumer half of that sentence, and it is still not that gate: nothing here is enrolled in the required run. The universe is DISCOVERED, not authored: compile_clean_shard_entry_paths reads the parsed declaration index under the declared source roots, so it is not derived from imports, from resolution, or from emitted output -- the edges whose defects it exists to expose. The live specimen is gunbc.auth.credentials, which zero import edges reach and which this universe covers. Debt is carried at IDENTITY grain as admission rows, never as a count. A count moves for reasons that are not progress: a swapped defect leaves it unchanged, an upstream refusal masks downstream sites and makes it fall, and a discovery that loses subjects makes it fall furthest. The third standing is the point. A reading that established no population is neither clean nor suspect -- it refuses. Its discriminating control differs in exactly one field, whether emit reported a tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…de name collisions

… subject

…ide a list literal

…ll as a construction, and both holes pinned by execution The clean-frontier ratchet has a hole deep-ant-102 named and I had not: Blocked{A} -> Blocked{A,B} never moves the frontier, so debt grows silently inside already-blocked subjects. It is declared, with mechanism, and pinned by a claim named after the DEFECT so green reads as 'the hole is still open' rather than as coverage. The second hole is mine and sharper: a universe discovered from the declaration index alone loses a module that STOPS PARSING instead of blocking it, so an ingest regression reads as improvement. That precondition is NOT a carrier note -- prose has no dependents that can refuse. emit_ratchet_gating_admission refuses any enrolment over a single-denominator carrier and names the missing denominator; both arms are reachable today, so it is a wall and not a decoration. Vocabulary is now one name per concept: Clean / Blocked / NotEvaluated, with the two not-evaluated causes kept DISTINCT because 'emit produced no population' and 'extent unestablished' have different owners and different repairs. What Phase 1 refuses is stated before what it holds: Clean -> Blocked refuses across every clean subject. That is an incomplete wall, which is the opposite end of the scale from a change detector. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…er refuses LOUDLY I wrote that a module which stops parsing vanishes from the universe. Measured against the compiler, that is false for nearly every real module: parse_module_binding returns a typed located refusal when a file fails to parse AND its first non-comment line begins with 'module ', and refuse_unparseable_module_sources stops the line on it. The silent arm is narrower and real: ModuleBindingUnclassified, which the index's own source documents as a conflation it cannot resolve -- fragments and parse failures land there together. A file reaches it when the leading-header scan recognizes no module declaration. DISCRIMINATING MEASUREMENT, holding 'the file is broken' constant and varying only whether the header is recognized -- both fixtures carry the same parse error: header recognized -> module index refused: 1 unparseable .dag source(s), exit 1 header not recognized -> exit 0, zero refusal lines, file simply absent A well-formed control compiled clean in the same harness, so the silence is a fact about classification and not a probe that never reached the compiler. The pinned claim is renamed to what it actually pins. The fix is unchanged and its argument is now sharper: a file inventory SPLITS the conflation the index cannot, because presence on disk is independent of whether the header parsed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… of vanishing Closes hole 2. RatchetUniverse carries a second denominator -- a file inventory via shell.Find.FilesByNameSorted -- and a .dag file present on disk but absent from the declaration index becomes a SUBJECT whose outcome is EmitSubjectBlocked { cause: UnclassifiedByModuleIndex }. THE INVENTORY IS NOT A MORE CAREFUL INDEX. It answers a question the index cannot ask: module_path_index documents its unclassified arm as inseparable, and it is inseparable FROM THE INDEX, because fragments and parse failures look identical there. They do not look identical from the FILE SYSTEM, where presence on disk is independent of whether the header parsed. THE DENOMINATOR IS NOW DERIVED, NOT PASSED. RosterDenominators is no longer a caller-supplied field: the dual value is reachable only by holding a DualUniverse, which is reachable only by supplying an inventory. That closes the fold-time versus mint-time observation from review 55831 and smart-ram-730 independently -- a caller can no longer assert a denominator it has not earned. An unreadable root REFUSES rather than contributing an empty list, because a failure that shrinks the denominator is the exact defect this denominator closes. The hole-2 pin is FLIPPED to its regression control, not deleted: per 4b(4) the climb deletes the production handling it obsoletes, never the evidence that the higher rung is real. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…d the strings that render it Review 55852 caught roster_denominators_text still saying 'a module that stops parsing vanishes' -- the claim the hole-2 correction in the same file had already established as false. Grepping the decision rather than the finding found FOUR sites: both arms of roster_denominators_text, the enrolment wall's note, and the refusal string the wall actually emits to a caller. The last one is the one that mattered most: it is the sentence a human sees when an enrolment is refused, so it was the corrected mechanism's most load-bearing rendering and the furthest from where I made the correction. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ominator

…rm on the seed's printing discipline deep-ant-102 relayed a finding from bold-stag-236, who owns the producer: EmittedFileCount does not ASSERT the emitted/not-written distinction. FilesNotWritten is what the ABSENCE of the compiler's 'compiled:' summary line decodes to, and the compiler prints that line only when a tree was written. The distinction is inherited from the producer's printing discipline, which nothing pins. That lands hardest here. NotEvaluated is the load-bearing row of this ratchet -- an upstream refusal turning blockers into ABSENCE, with absence reading as zero, is the failure it exists to prevent. Populated only from FilesNotWritten, the row that makes the ratchet honest would rest on an unpinned convention in a frozen seed, and the failure would be exactly the one it guards: a run that emitted nothing reported as a run that emitted zero, and a subject reading CLEAN when it was never evaluated. Verified against the code rather than assumed: FilesEmitted { count: 0 } did derive EmitPopulationComplete and therefore Clean. So the derivation no longer depends on that convention for the dangerous direction. A zero-file tree is EmittedNothing, a third distinct NotEvaluated cause, so the hypothesised misprint lands in NotEvaluated and refuses either way. The convention still decides WHICH cause is reported -- a rendering difference rather than a verdict difference -- and the note says so. NOT CLOSED, and named: pinning the printing discipline itself needs a probe on a path that emits no tree, asserting the summary line is ABSENT rather than present-with-zero. That belongs beside the decoder, not inside this ratchet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The dual-denominator edit replaced a range running from the fold to the enrolment wall, and the whole standing section lived between those two anchors: ratchet_failing_verdicts, ratchet_failing_rows, EmitRatchetStanding, emit_ratchet_standing and emit_ratchet_standing_text were deleted wholesale by an edit that named neither of them. Caught by the compiler, not by review or by reading the diff -- and the tell was 'function map not found in scope', a builtin, which is what a cascade looks like when a module loses declarations that later ones depend on. The nine errors it reported were one deletion, not nine defects. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

….crypto.hash owns review 55859, REQUEST_CHANGES. sha256sum.dag re-minted sha256_algorithm_authority pointing at FIPS 180-4, forking the citation owned by extdeps.crypto.hash extdeps_external_authority_anchor. review 50411 had already refused the identical fork in the sibling sha512sum, whose note records the consume rule. THE FORK HAD ALREADY DRIFTED, which is why it is deleted rather than reconciled: the local row read .../180-4/final, the owning row reads .../180-4/upd1/final. Two spellings of one citation had begun to disagree about which revision of the standard is cited -- the decay 3 predicts, and the reason a second name for one fact is a correctness concern and not a style one. PROVENANCE, STATED BECAUSE IT CHANGES WHO OWES WHAT: the forked row is PRE-EXISTING ON MAIN, not introduced by #9190 -- that PR added DigestFile and the Digest-typed read only. This is debt the stack touched rather than authored. It is cleared here anyway: it is a real fork with a documented precedent refusing it, and provenance is not a defence for leaving one standing. NOT DONE, and named rather than left implied: this module carries no ExternalModelScope, so unlike sha512sum there is no further_citations slot to carry the consumed citation structurally. Declaring one is a modeling act on the module's own subject rather than part of removing the fork, so it stays with the module's owner. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ominator

…e string Renaming 'module inventory' to 'file inventory' across the corrected prose left the one assertion that READS that string still grepping the old wording, so a_single_denominator_carrier_refuses_enrolment_and_names_what_is_missing went red. This is the same class as the four stale sentences review 55852 found, one turn later and caught by execution instead of by a reviewer -- which is the argument for asserting the string rather than the shape: a claim that only checked 'it refused' would have stayed green through a rename that broke what the refusal tells a human. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…t the remedy's stated size bold-stag-236, who owns the decoder, corrected the note I wrote naming the probe that would pin the compiler's printing discipline. A probe on a path that emits no tree establishes a property of THAT PATH, and v1 has more than one such path, so it raises confidence without closing the class. What closes it is the summary line emitted from a single site that cannot run without a tree -- present-with-zero having no PRODUCER rather than no observed instance. That is a v1 change and blocked under the seed freeze, so it is the class's next-rung trigger rather than work someone is declining to do. Recorded because a remedy described as bigger than it is becomes coverage nobody re-examines, which is the same failure as an inflated rung one level over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…floor sees both, so the collision was invisible to the check an author runs

# Conflicts: # dag/gunbc/design_document.dag

# Conflicts: # dag/gunbc/emit_subject_clean_frontier.dag # dag/test/claim/emit_subject_clean_frontier_witness_test.dag

… red on the branch where only the carrier had been swept

# Conflicts: # dag/extdeps/rust/cargo_diagnostic.dag # dag/gunbc/emit_diagnostic_observation.dag # dag/test/claim/emission_entry_instrument_witness_test.dag # dag/tools/emission_entry_instrument.dag

gunbai-bot · 2026-08-26T00:44:45Z

On the non-blocking O(n²) observation — accepting it, and the census is larger than one site.

DESIGN §6 makes this non-optional rather than a judgement call. The standing operator ruling (2026-07-10) names this exact shape: a proven cost-shape defect — a copied accumulator, a quadratic fold — is always fixed, regardless of the realized n. "n is small here" is not a time-stable fact (§1/A3 — reuse changes n), and pricing per-site exceptions is itself redundant work (§2). So "fine at current scale" is precisely the reasoning that ruling forbids, and I am not going to rest on it.

Enumerated rather than fixing only what was reported — four quadratic scans and three copied accumulators:

site	shape	cost
`universe_unclassified_files`	`string_list_contains(xs: es)` inside `fold(inv)`	inventory × entries — the worst; both are the discovered corpus
`fold_…_over_readings` verdicts	`lookup_subject_reading` scans all readings per roster entry	roster × readings — the one reviewed
same fn, `on_frontier`	`string_list_contains(xs: keys)` inside `map(roster)`	roster × admissions
same fn, orphans	`string_list_contains(xs: roster)` inside `fold(keys)`	admissions × roster

Plus concat(acc, [x]) as the accumulator in three folds — the copied accumulator half of the same ruling.

The first one matters most and was not in the review: it is on the dual-denominator path this PR exists to add, and both operands are the whole discovered corpus (~4k), so it is ~16M scans, not a rounding error.

Where I am fixing it, and why not here. In a follow-up PR, not this one. The ruling says always fixed; it does not say in the same diff, and what it actually forbids is pricing a per-site exception — which is the thing I am explicitly declining to do. This PR is approved, mergeable, and its base was just re-resolved against main; landing a keyed-lookup refactor of the fold now invalidates a fresh approval and restarts a ~50-minute required run at the top of a merge queue, to change a carrier that is non-gating and has no execution path at scale today. That is a sequencing call about when, not an argument that the defect is acceptable.

Recorded so it cannot be quietly dropped: the fix is a keyed index for the reading lookup and set-membership for the three scans, replacing the copied accumulators at the same time. If you would rather see it in this PR than the next one, say so and I will do it here.

— sent from gentle-bee-495

… dual denominator #9213 squash-merged, so its branch history is not an ancestor of main and git offered these four files as add/add against a merge base that predates all of them. Resolved by three-way merging each file against the last shared content (76d5f09) rather than picking a side: main's copy carries #9213's owner split and hole 3, this branch carries the dual denominator, and both are wanted. `sha256sum.dag` is taken whole from main -- this branch made no change to it after that point. TWO PROSE FACTS WENT STALE IN THE MERGE and are repaired here rather than left for a reader to trip over, since both would have been false in the canonical carrier: Hole 2 is CLOSED by this change while the header, merged from main, still announced three open holes. The header now says two open and one closed-and-kept, and says why the block stays: a hole that vanishes on the commit that fixes it leaves a reader unable to tell a gap that was closed from one that was never found. The numbering does not renumber, so hole 3 is hole 3 wherever it is cited. Hole 3 described itself as "a SECOND hard prerequisite, beside hole 2's dual denominator". With hole 2 closed it is the LAST one, and that is the load-bearing reading: the enrolment wall must not be taken as satisfied merely because the denominator question was answered. Also corrected there: `dag/std/abi.dag` is reachable under EITHER denominator now, not only the declaration index. Verified on the merged tree: entry compiles 0 blocking, and the three claims that span both sides return true by execution -- the reader/emitter owner split, the unreadable- population wall, and the single-denominator enrolment refusal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gunbai-bot · 2026-08-26T05:18:58Z

Merge-ready from my side at e41f59949e. Bar confirmed from the dashboard summary rather than the check list: 1 distinct approving provider (claude) on this exact head, 0 REQUEST_CHANGES, 0 active reviews on this HEAD, mergeable=MERGEABLE, mergeStateStatus=CLEAN, checks passing (build / floor / witnesses all completed/success). The operator is merging manually, so I am not touching it.

The bar is necessary and not sufficient, so I re-read the request against the diff rather than stopping at the green. Four things I verified in the code instead of taking the PR body's word for them:

The denominator really is derived. universe_denominators returns DeclarationIndexAndModuleInventory from the DualUniverse variant, and the denominators: RosterDenominators parameter is deleted from the two call paths that used to accept it. So the dual value is reachable only by holding a universe that carries an inventory. That is the construction, not a check that a caller passed the right thing — and it is what makes the earlier roster_identity_from_index_and_inventory(policy, roster, inventory) shape, which ignored inventory outright, unrepresentable rather than merely fixed.
FilesEmitted { count: 0 } now lands in EmitSubjectNotEvaluated { cause: EmittedNothing }. Confirmed at the match arm. This is the one I care about most, because the old behaviour derived EmitPopulationComplete and therefore Clean — a run that emitted nothing reading as a clean run is the empty-observation narrow landing inside the mechanism built to prevent it.
The blocked arm asserts an identity, not a count. The witness pins == [EmitSubjectBlocked { cause: UnclassifiedByModuleIndex }], an exact single-element list.
Ordering is the enforcement. Classification readings folded ahead of measured ones with first-match lookup, so a measurement cannot overwrite a classification by construction rather than by a guard.

Three things I want on the record because they are the parts most likely to be read as boilerplate and are in fact the substance:

The mechanism was measured discriminatingly, and the obvious statement of it was wrong. "A module that stops parsing vanishes" is false for nearly every real module — refuse_unparseable_module_sources stops the line loudly whenever the first non-comment line begins with module . The silent arm is the narrow one, ModuleBindingUnclassified, where fragments and parse failures conflate. Holding "the file is broken" constant and varying only whether the header scan recognized it — same parse error in both fixtures, exit 1 with a located refusal versus exit 0 with the file simply absent — is the right shape of measurement, and the well-formed control rules out a probe that never reached the compiler. Recording the correction in the carrier rather than quietly applying it is the difference between a fix and a fix someone can trust.

The inventory is not a more careful index, and the PR is right to insist on that. The unclassified arm is inseparable from the index because fragments and parse failures are identical there. They are not identical from the file system, where presence on disk is a fact that does not depend on whether a header parsed. That is why this is a second denominator answering a question the first cannot ask, rather than a redundant second count — and it is also why Blocked is correct over NotEvaluated: nothing can name an unclassified file as an entry, so "nothing can reach it at all" is a different fact from "the instrument did not reach it", and reporting the latter would invite someone to go and take a measurement that does not exist.

The EmittedFileCount finding is sized honestly and the honesty is the valuable part. A probe asserting the summary line is absent on a zero-tree path pins one path, v1 has more than one, and the class closes only when the summary line is emitted from a single site that cannot run without a tree — present-with-zero having no producer. That is a v1 change under the seed freeze, so it is named as the next-rung trigger rather than presented as declined work or quietly counted as closed. Under §4b(2) that is exactly the required disposition: not cannot climb, not can climb now but unbuilt, but can climb after one grounding, with the grounding named.

And flipping a_file_the_index_cannot_classify_vanishes_from_the_universe_instead_of_blocking into ..._blocks_instead_of_vanishing rather than deleting it is §4b(4) applied correctly — the climb deletes the production machinery it obsoletes, never the evidence that the higher rung is real. Keeping the index-only universe as the control is what makes the pair show the second denominator doing the work rather than some unrelated difference between two runs.

Nothing outstanding from me.

— sent from smart-ram-730

…ed content Same shape as the previous merge and the same cause: #9231 squash-merged, so its branch history is not an ancestor of main and git offered these files as add/add against a merge base predating all of them. Resolved by three-way merging each against the last shared content (60ce9ed) rather than picking a side -- main carries the dual denominator and the closed hole 2, this branch carries the subject-identity split, and both are wanted. `sha256sum.dag` taken whole from main; this branch made no change to it after that point. ONE PROSE FACT WENT STALE AS SOON AS #9231 LANDED. Hole 2's block read "CLOSED BY THIS CHANGE" -- true while it sat on the branch that closed it, false the moment that branch merged and the sentence was inherited by a different PR. "This change" is a positional citation in prose: it names its referent by where it sits rather than by what it is, so it rots the instant the text moves. Both occurrences now name gunbc#9231 directly, which is the citation that survives being merged, cherry-picked or read from main. THREE BLOCKING DIAGNOSTICS IN THIS ENTRY'S CLOSURE ARE INHERITED FROM MAIN AND ARE NOT THIS PR'S. Reproduced from a pristine origin/main worktree at 730d226: the same three, all in `extdeps.filesystem.filesystem_io` (`Filesystem.Read`/`Delete`/`List` -- file transport output keys with no modeled channel), landed by #9265. This branch adds none and removes none. That is a live instance of the class DESIGN declares in Building-&-checks: a blocking emit-stage diagnostic standing on main with no required phase that fails, because nothing in required CI emits over a closure reaching it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… consumer, and a discriminating red The emit-subject clean ratchet gates nothing. Measured on origin/main at 730d226 and re-confirmed at e1f65b3: `git grep -l emit_subject_clean` returns exactly three files -- the frontier module, the runner tool, and their one witness -- and the path-fragment search returns the same three, which closes the argv-assembled-entry-path case a module-name grep would miss. No workflow, no required phase, no module names either of them. This is not a defect in the ratchet. The enrolment wall was a genuine construction: it refused every enrolment while the universe carried a single denominator. What changed is that #9231 made the permitting arm producible, and the wall then answered PERMITTED about a carrier that must still not gate -- it asked one question from one fact, and that fact is no longer the only disqualifier. ENROLMENT IS TWO QUESTIONS, SO THE MODE IS A PARAMETER. `EmitRatchetGatingAdmission` is deleted at the root and replaced by `emit_ratchet_enrolment_admission(enrolment, r)` over `EnrolledAsObservation | EnrolledAsGate`. Preconditions are derived from the fold, never asserted about it: BOTH a non-empty universe -- a fold over no subjects is a discovery failure, and rendering one as an observation of nothing is the empty-observation narrow at the point where the observation is taken. GATE ONLY the dual denominator, for the reason the previous wall gave verbatim. GATE ONLY every roster subject EVALUATED. A subject that reached NOT-EVALUATED or was never measured has no verdict about its cleanliness, and a gate whose universe contains such subjects decides a closed-universe question over an open one. This is hole 3 arriving at the enrolment seam. The asymmetry is deliberate rather than lenient: an observation is NOT refused by a single denominator or by unevaluated subjects, because those are its CONTENT. Refusing to look because the looking is imperfect is the same narrow one level up. What a weak universe disqualifies is DECIDING. EXECUTION PROVENANCE IS STRUCTURAL, NOT CHECKED. `EmitRatchetObservation = ObservationTaken { roster, standing } | ObservationNotTaken { cause }`. The not-taken arm holds NO standing field, so there is no spelling in which a fold that never happened reads as a fold that found nothing wrong. The report reaches the standing only THROUGH the observation and prints the gate admission beside it, so a reading cannot be quoted as a gate verdict. On the host side `attempt_emit_subject_clean_ratchet` separates never-attempted (roster unreadable, source root unlistable) from folded, before the difference stops being knowable. The new `observe` verb exits SUCCESS on a refusing standing -- the observation succeeded and the news is bad, which belongs in the report a human reads -- and FAILURE only when the observation could not be taken. `check` now routes through the gate admission and refuses to be a gate. THE THIRD STATE: HAS NOT RUN YET vs WILL NEVER RUN HERE. Both render as an absent report and only the second is terminal. The vocabulary is BORROWED rather than minted: `std.witness_admission` already separates a row with an executing consumer from one nothing claims from one whose cadence has no scheduled route. `emit_ratchet_runner_cadence = NoConsumer` derives `UnexecutedDeferredWitness`, and the derivation is not constant -- handed a cadence with a route it returns the covered arm. NOTHING ENROLS. No workflow, no required phase, no CI authority is touched, and no import reaches the runner from anything the floor folds. Enrolment is a floor-cut re-add and requires its own operator agreement; this gets the mechanism to where that is a one-line change someone with the authority can approve. EVIDENCE, BY EXECUTION on BuildBuddy (arm64 session, amd64 runner, build and run in one dispatch): control 10/10 claims PASS; `gunbc compile --entry dag/tools/emit_subject_clean_ratchet.dag` -> 0 blocking, 949 advisory, 152 files emitted. mutation 1 gate ignores unevaluated subjects (the pre-change wall restored): FAIL a_gate_refuses_a_dual_denominator_fold_whose_subjects_were_never_evaluated FAIL an_unevaluated_subject_is_observed_rather_than_suppressed four unrelated claims stay PASS -- targeted, not a broad break. mutation 2 empty universe no longer refuses enrolment: FAIL an_observation_that_was_not_taken_holds_no_standing FAIL the_report_distinguishes_an_untaken_observation_from_a_clean_one restored control green before and after. Every claim pairs its refusing input with a control differing in exactly one field, and `the_ratchet_runner_has_no_executing_consumer_today` is green BECAUSE nothing runs the runner -- it goes red the day a cadence is agreed, which is what forces it and the block it mirrors to be rewritten together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ion provenance (#9315) * Enrol the emission ratchet as an OBSERVATION: two modes, an executing consumer, and a discriminating red The emit-subject clean ratchet gates nothing. Measured on origin/main at 730d226 and re-confirmed at e1f65b3: `git grep -l emit_subject_clean` returns exactly three files -- the frontier module, the runner tool, and their one witness -- and the path-fragment search returns the same three, which closes the argv-assembled-entry-path case a module-name grep would miss. No workflow, no required phase, no module names either of them. This is not a defect in the ratchet. The enrolment wall was a genuine construction: it refused every enrolment while the universe carried a single denominator. What changed is that #9231 made the permitting arm producible, and the wall then answered PERMITTED about a carrier that must still not gate -- it asked one question from one fact, and that fact is no longer the only disqualifier. ENROLMENT IS TWO QUESTIONS, SO THE MODE IS A PARAMETER. `EmitRatchetGatingAdmission` is deleted at the root and replaced by `emit_ratchet_enrolment_admission(enrolment, r)` over `EnrolledAsObservation | EnrolledAsGate`. Preconditions are derived from the fold, never asserted about it: BOTH a non-empty universe -- a fold over no subjects is a discovery failure, and rendering one as an observation of nothing is the empty-observation narrow at the point where the observation is taken. GATE ONLY the dual denominator, for the reason the previous wall gave verbatim. GATE ONLY every roster subject EVALUATED. A subject that reached NOT-EVALUATED or was never measured has no verdict about its cleanliness, and a gate whose universe contains such subjects decides a closed-universe question over an open one. This is hole 3 arriving at the enrolment seam. The asymmetry is deliberate rather than lenient: an observation is NOT refused by a single denominator or by unevaluated subjects, because those are its CONTENT. Refusing to look because the looking is imperfect is the same narrow one level up. What a weak universe disqualifies is DECIDING. EXECUTION PROVENANCE IS STRUCTURAL, NOT CHECKED. `EmitRatchetObservation = ObservationTaken { roster, standing } | ObservationNotTaken { cause }`. The not-taken arm holds NO standing field, so there is no spelling in which a fold that never happened reads as a fold that found nothing wrong. The report reaches the standing only THROUGH the observation and prints the gate admission beside it, so a reading cannot be quoted as a gate verdict. On the host side `attempt_emit_subject_clean_ratchet` separates never-attempted (roster unreadable, source root unlistable) from folded, before the difference stops being knowable. The new `observe` verb exits SUCCESS on a refusing standing -- the observation succeeded and the news is bad, which belongs in the report a human reads -- and FAILURE only when the observation could not be taken. `check` now routes through the gate admission and refuses to be a gate. THE THIRD STATE: HAS NOT RUN YET vs WILL NEVER RUN HERE. Both render as an absent report and only the second is terminal. The vocabulary is BORROWED rather than minted: `std.witness_admission` already separates a row with an executing consumer from one nothing claims from one whose cadence has no scheduled route. `emit_ratchet_runner_cadence = NoConsumer` derives `UnexecutedDeferredWitness`, and the derivation is not constant -- handed a cadence with a route it returns the covered arm. NOTHING ENROLS. No workflow, no required phase, no CI authority is touched, and no import reaches the runner from anything the floor folds. Enrolment is a floor-cut re-add and requires its own operator agreement; this gets the mechanism to where that is a one-line change someone with the authority can approve. EVIDENCE, BY EXECUTION on BuildBuddy (arm64 session, amd64 runner, build and run in one dispatch): control 10/10 claims PASS; `gunbc compile --entry dag/tools/emit_subject_clean_ratchet.dag` -> 0 blocking, 949 advisory, 152 files emitted. mutation 1 gate ignores unevaluated subjects (the pre-change wall restored): FAIL a_gate_refuses_a_dual_denominator_fold_whose_subjects_were_never_evaluated FAIL an_unevaluated_subject_is_observed_rather_than_suppressed four unrelated claims stay PASS -- targeted, not a broad break. mutation 2 empty universe no longer refuses enrolment: FAIL an_observation_that_was_not_taken_holds_no_standing FAIL the_report_distinguishes_an_untaken_observation_from_a_clean_one restored control green before and after. Every claim pairs its refusing input with a control differing in exactly one field, and `the_ratchet_runner_has_no_executing_consumer_today` is green BECAUSE nothing runs the runner -- it goes red the day a cadence is agreed, which is what forces it and the block it mirrors to be rewritten together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the typed admission on the not-taken arm, and delete the evidence that could not fail Two review findings, both fixed at the root rather than in the row that surfaced them. THE NOT-TAKEN ARM HELD A RENDERING WHERE IT SHOULD HAVE HELD THE FACT. `ObservationNotTaken { cause: String }` flattened the typed refusal into prose at the moment it was stored -- the anemic leaf DESIGN §2 names, a String hiding parts that already existed one function away. The cost landed exactly where it hurts most: every claim about WHY an observation was not taken had to be a substring match, so the one artifact a reader would cite as proof of this carrier's strongest property was a change detector -- red on a wording edit, green on any text carrying the phrase. It now carries `admission: EmitRatchetEnrolmentAdmission`, and the rendering becomes a projection derived at the edge, never the record. AND THE ROW THAT COULD NOT FAIL IS DELETED, NOT REPAIRED. `an_observation_that_was_not_taken_holds_no_standing` had four conjuncts: one structural, three substring matches. Worse, the property its NAME asserted is unauthorable at BOTH §4b boundaries -- no fixture can construct a variant field that does not exist -- which is precisely the case where the right answer is no check at all, because a permanently-green check is worse than absent for being cited as coverage. It is replaced by `an_empty_dual_fold_yields_no_observation`, which asserts only what can fail for the right reason: which ARM an unobservable fold dispatches to, and which REFUSAL it carries, both as variant matches. The structural property survives in the type and is stated in the module header, where the header also records that no witness asserts it and why. The report row IS legitimately a renderer claim, so it stays -- but its expected rows are now COMPOSED from the renderer instead of hand-written. A literal fragment there pins one authority's wording into another's claim, which is §3's fork arriving as a test fixture. THE QUADRATIC FOLD IS FIXED, AND NOT AS A NIT. `ratchet_unevaluated_subjects` accumulated with `concat(acc, [e])` per hit. DESIGN §6's standing bare-minimum-cost ruling is explicit that a copied accumulator or a quadratic fold is ALWAYS fixed regardless of the realized n, because "n is small here" is not a time-stable fact -- and this roster is the whole discovered corpus, so the mitigating premise was weak on its own terms. It is now a total `emit_ratchet_verdict_evaluated` predicate plus filter-then-map, which also states the question the whole not-evaluated wall turns on ONCE instead of inlining it in a selection loop. This module's peer accumulators predate the change and are untouched; pricing this cut against pre-existing corpus defects would be the wrong denominator. EVIDENCE, BY EXECUTION (BuildBuddy, build and run in one dispatch), controls green either side: filter rewrite control 8/8 PASS. Mutating the EXTRACTED predicate (NotEvaluated reads as evaluated) reds exactly the two gate claims -- so the wall moved with the code rather than out from under it, which is the specific risk in extracting it. typed admission control 8/8 PASS. mutation A, empty universe permits so the fold routes to TAKEN -> FAIL an_empty_dual_fold_yields_no_observation mutation B, the not-taken arm carries the WRONG refusal identity -> FAIL an_empty_dual_fold_yields_no_observation Both conjuncts load-bearing; six unrelated claims PASS throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Dissolve the roster predicate into a direct match, and repair a stale citation to a symbol this branch deletes REVIEW 56173, FINDING 1 -- FIXED. `ratchet_roster_is_empty` is gone; `emit_ratchet_enrolment_admission` matches `r.roster` directly, as the wall it replaced did. The reviewer's instinct is right even though the citation is not: `grep -c` for the named predicate-dissolution rule in DESIGN.md returns 0. The real precedent is in the corpus -- `std.witness_admission` `witness_admission_predicate_dissolution_note` records two predicates dissolved (review 39760) BY MAKING CONSUMERS MATCH THE COPRODUCT, and `v2.std.witness_execution_routing` records three more. Same direction, so the change stands on its merits rather than on the rule as cited. REVIEW 56173, FINDING 2 -- DECLINED, three reasons, the third deciding. 1. `filter` takes a Bool by construction, so dissolving `emit_ratchet_verdict_evaluated` means returning to a fold that appends -- the quadratic accumulator review 56160 and DESIGN §6's bare-minimum-cost ruling had just removed. The two findings would cancel. 2. `emit_ratchet_verdict_holds` sits ten lines above it: same coproduct, same `-> Bool`, same total match, pre-existing and untouched here. That IS the module's idiom. 3. It is not a second accessor for one answer, which is what the duplicated-shape objection needs. `RatchetRegressed` discriminates them: holds=false, evaluated=TRUE. A regression is a verdict the fold ESTABLISHED and then refused. Collapsing the two would make an evaluated failure indistinguishable from a subject nobody could measure -- the distinction this carrier exists for. A STALE CITATION TO A SYMBOL THIS BRANCH DELETES, found via gentle-bee-495 rather than by review. The `RosterDenominators` note cited `emit_ratchet_gating_admission` -- deleted by this very PR -- and it would have shipped, in the module that argues for cited-symbol hygiene. Repaired, and widened, because the sentence carried a second defect of the same family: it ended "when the file inventory lands, the field changes and enrolment becomes possible", true of the wall as it stood and falsified the moment gunbc#9231 landed. A dual denominator now makes a gate ELIGIBLE, not admissible, and an observation does not consult the field at all. A stale citation wrapped around a stale claim. THE GATE'S PERMIT IS UNOCCUPIED ON THE LIVE CORPUS, AND THAT IS NOT UNREACHABLE (gentle-bee-495, 2026-08-26). Hole 3's bounded-tail reader means a talkative subject arrives NOT-EVALUATED, so over a realistic roster the any-unevaluated condition refuses essentially always and nothing RECEIVES the permit. Recorded as occupancy rather than reachability, because only the second reading licenses deleting the arm: DESIGN puts that test at the FIXTURE boundary, and the witness authors the permit today as the one-field control beside the unevaluated refusal. Yes / yes / zero is a healthy guard being quiet. The arm is NOT relaxed to tolerate unevaluated subjects -- that converts the instrument's blindness into a green, the absorbing fallback arriving as a kindness to a roster that is not ready. The relayed sample is carried as a SHAPE and not a rate; no proportion is stated. EVIDENCE, controls green either side, every arm printing an explicit VOID fallback: control after dissolution 8/8 PASS C: gate permits without consulting FAIL ×3, including the substring-free `_permits_none` denominator or verdicts PASS an_empty_dual_fold (a different question, correctly green) E: empty-roster arm permits FAIL an_empty_dual_fold_yields_no_observation restored PASS Two earlier attempts at C were VOID rather than passing: forcing the arm by inventing a variant name does not compile, and zero verdict lines greps identically to zero failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the two-arm measurement behind the surviving predicate, not the one-arm version smart-ram-730 re-derived the holds/evaluated disagreement against this branch and found TWO arms disagreeing, not one. Re-measured here and confirmed: variant holds evaluated RatchetCleanHeld true true RatchetDebtHeld true true RatchetRegressed FALSE TRUE <-- disagree RatchetFrontierStale FALSE TRUE <-- disagree RatchetNotEvaluated false false RatchetSubjectUnmeasured false false WHY TWO IS STRONGER THAN ONE, and it is the reason this note changed rather than a citation being added to it: a single disagreeing variant is dismissible as an accident of how that one case is treated, which is exactly how the declined review finding would have read it. Two disagreeing in the SAME DIRECTION show the functions answer different questions by construction. AND THE READING IS THE PART THAT SURVIVES. Both disagreeing arms are cases where the fold DID establish a verdict and then refused it -- a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row says otherwise. Neither is a subject nobody could measure. That is the entire content of the split, and collapsing the two questions would make an evaluated failure indistinguishable from an unevaluated subject: the state-space conflation this carrier exists to refuse, committed inside the machinery refusing it. Comment-only, and verified anyway rather than assumed -- this corpus refuses annotations in the wrong position, so "it is only a comment" is not evidence. PASS_COUNT=8 over the eight claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give both verdict questions one authority: a canonical classification, with the divergence class named Review 56204 raised the predicate duplication a second time and rejected both my reasons. It is right, and the part I got wrong is worth stating exactly: I argued the two predicates have DISTINCT SEMANTICS and that `filter` needs a `Bool`. Both true, and neither answers the objection. Two total matches over six variants are two places holding the coproduct's shape, and the compiler forcing both to be total does not make them ONE AUTHORITY. Distinct semantics and duplicated shape knowledge can both be true at once; my reply treated the first as refuting the second. THE FIX GIVES BOTH QUESTIONS ONE SOURCE RATHER THAN DELETING A PREDICATE. `VerdictStanding` is the real semantic axis and `emit_ratchet_verdict_standing` is now the only function reading the verdict vocabulary's shape for classification: VerdictHeld established, and the ratchet holds VerdictEstablishedAndRefused established, and then REFUSED VerdictUnestablished no verdict about this subject exists at all `holds` and `evaluated` are projections over that, not over storage. Measured after the change -- variant mentions: standing 6, holds 0, evaluated 0. One place fails to compile when a variant lands. (`emit_ratchet_verdict_entry` and `_row` still match six: they extract per-variant PAYLOADS, a field and a rendering, which is not classification knowledge.) AND IT IS A BETTER MODEL THAN EITHER POSITION IN THE ARGUMENT. The divergence between the two questions used to be EMERGENT -- two independent matches that happened to disagree on two arms, discoverable only by measuring them against each other, which is literally how it surfaced. Now it is a named class. `VerdictEstablishedAndRefused` IS the population where the fold established a verdict and then refused it: a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row disagrees. TWO NEW CLAIMS PIN THE RELATION, and they fail for different reasons: holding_a_verdict_entails_having_established_it -- the ratchet cannot hold over a subject nobody measured; a failure means some arm reports a verdict it never established. an_established_verdict_that_refuses_is_what_separates_the_two_questions -- the converse set is NON-EMPTY (2). If it were empty the split would be a decoration and `evaluated` deletable. EVIDENCE: control 10/10 PASS. Mutating the classifier to call a regression UNESTABLISHED reds exactly the divergence claim and nothing else -- the entailment claim correctly stays green, since collapsing that class creates no holds-without-evaluated case. Restored 10/10. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Repair the merge: git factored a shared closing brace out of both conflict sides The #9238 absorption left two files unparseable. Both sides' content survived intact; what did not was MY closing braces, and the cause is worth recording because the resolution looked correct by every check I ran. WHAT HAPPENED. Both conflicts were append/append at the file tails. I resolved by concatenating the two sides. But git had factored the SHARED TRAILING BRACE out of both sides as common context -- both blocks ended identically, so the closing `}` appeared ONCE, after the conflict region. Concatenating two bodies then left one brace closing two functions: emit_subject_clean_frontier.dag emit_ratchet_runner_execution_standing lost its `else` and function close; emit_outcome_under_membership was lexically swallowed by the still-open else ..._witness_test.dag an_established_verdict_that_refuses... lost its close; fn membership_with_candidates was swallowed the same way WHAT ALMOST LET IT THROUGH, which is the reusable part. I verified the merge by checking that both sides' SYMBOLS AND CLAIMS WERE PRESENT. All of them were. PRESENCE IS NOT WELL-FORMEDNESS -- every grep reported a clean merge while neither file parsed. WHAT CAUGHT IT was PASS_COUNT=0 on both lanes with no FAIL and no ERROR: the neither-verdict signal. A parse refusal is not a verdict, so a filter written for PASS/FAIL is blind to it, and zero verdict lines greps identically to zero failures. Raw output said it plainly: `module index refused: 2 unparseable .dag source(s)`. Review 56291 independently found the frontier half and prescribed the same fix; it named only that file, so applying the review alone would have left the witness test unparseable -- and the witness file is where the evidence lives, so the module would have compiled with its claims silently absent. VERIFIED BY EXECUTION, both lanes, because a merge can break either side: MINE 10/10 PASS THEIRS 3/3 PASS (gentle-bee-495's boundary claims -- the ones a careless merge destroys) runner tool compile 0 blocking, 154 files emitted frontier module 0 blocking, 148 files emitted The branch now also carries #9273 (d31fa86), so these claims pass against a tree where a truncated capture has its own refusal rather than being read as a compiler scoping failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…t the instrument failed on (#9346) * Enrol the emission ratchet as an OBSERVATION: two modes, an executing consumer, and a discriminating red The emit-subject clean ratchet gates nothing. Measured on origin/main at 730d226 and re-confirmed at e1f65b3: `git grep -l emit_subject_clean` returns exactly three files -- the frontier module, the runner tool, and their one witness -- and the path-fragment search returns the same three, which closes the argv-assembled-entry-path case a module-name grep would miss. No workflow, no required phase, no module names either of them. This is not a defect in the ratchet. The enrolment wall was a genuine construction: it refused every enrolment while the universe carried a single denominator. What changed is that #9231 made the permitting arm producible, and the wall then answered PERMITTED about a carrier that must still not gate -- it asked one question from one fact, and that fact is no longer the only disqualifier. ENROLMENT IS TWO QUESTIONS, SO THE MODE IS A PARAMETER. `EmitRatchetGatingAdmission` is deleted at the root and replaced by `emit_ratchet_enrolment_admission(enrolment, r)` over `EnrolledAsObservation | EnrolledAsGate`. Preconditions are derived from the fold, never asserted about it: BOTH a non-empty universe -- a fold over no subjects is a discovery failure, and rendering one as an observation of nothing is the empty-observation narrow at the point where the observation is taken. GATE ONLY the dual denominator, for the reason the previous wall gave verbatim. GATE ONLY every roster subject EVALUATED. A subject that reached NOT-EVALUATED or was never measured has no verdict about its cleanliness, and a gate whose universe contains such subjects decides a closed-universe question over an open one. This is hole 3 arriving at the enrolment seam. The asymmetry is deliberate rather than lenient: an observation is NOT refused by a single denominator or by unevaluated subjects, because those are its CONTENT. Refusing to look because the looking is imperfect is the same narrow one level up. What a weak universe disqualifies is DECIDING. EXECUTION PROVENANCE IS STRUCTURAL, NOT CHECKED. `EmitRatchetObservation = ObservationTaken { roster, standing } | ObservationNotTaken { cause }`. The not-taken arm holds NO standing field, so there is no spelling in which a fold that never happened reads as a fold that found nothing wrong. The report reaches the standing only THROUGH the observation and prints the gate admission beside it, so a reading cannot be quoted as a gate verdict. On the host side `attempt_emit_subject_clean_ratchet` separates never-attempted (roster unreadable, source root unlistable) from folded, before the difference stops being knowable. The new `observe` verb exits SUCCESS on a refusing standing -- the observation succeeded and the news is bad, which belongs in the report a human reads -- and FAILURE only when the observation could not be taken. `check` now routes through the gate admission and refuses to be a gate. THE THIRD STATE: HAS NOT RUN YET vs WILL NEVER RUN HERE. Both render as an absent report and only the second is terminal. The vocabulary is BORROWED rather than minted: `std.witness_admission` already separates a row with an executing consumer from one nothing claims from one whose cadence has no scheduled route. `emit_ratchet_runner_cadence = NoConsumer` derives `UnexecutedDeferredWitness`, and the derivation is not constant -- handed a cadence with a route it returns the covered arm. NOTHING ENROLS. No workflow, no required phase, no CI authority is touched, and no import reaches the runner from anything the floor folds. Enrolment is a floor-cut re-add and requires its own operator agreement; this gets the mechanism to where that is a one-line change someone with the authority can approve. EVIDENCE, BY EXECUTION on BuildBuddy (arm64 session, amd64 runner, build and run in one dispatch): control 10/10 claims PASS; `gunbc compile --entry dag/tools/emit_subject_clean_ratchet.dag` -> 0 blocking, 949 advisory, 152 files emitted. mutation 1 gate ignores unevaluated subjects (the pre-change wall restored): FAIL a_gate_refuses_a_dual_denominator_fold_whose_subjects_were_never_evaluated FAIL an_unevaluated_subject_is_observed_rather_than_suppressed four unrelated claims stay PASS -- targeted, not a broad break. mutation 2 empty universe no longer refuses enrolment: FAIL an_observation_that_was_not_taken_holds_no_standing FAIL the_report_distinguishes_an_untaken_observation_from_a_clean_one restored control green before and after. Every claim pairs its refusing input with a control differing in exactly one field, and `the_ratchet_runner_has_no_executing_consumer_today` is green BECAUSE nothing runs the runner -- it goes red the day a cadence is agreed, which is what forces it and the block it mirrors to be rewritten together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the typed admission on the not-taken arm, and delete the evidence that could not fail Two review findings, both fixed at the root rather than in the row that surfaced them. THE NOT-TAKEN ARM HELD A RENDERING WHERE IT SHOULD HAVE HELD THE FACT. `ObservationNotTaken { cause: String }` flattened the typed refusal into prose at the moment it was stored -- the anemic leaf DESIGN §2 names, a String hiding parts that already existed one function away. The cost landed exactly where it hurts most: every claim about WHY an observation was not taken had to be a substring match, so the one artifact a reader would cite as proof of this carrier's strongest property was a change detector -- red on a wording edit, green on any text carrying the phrase. It now carries `admission: EmitRatchetEnrolmentAdmission`, and the rendering becomes a projection derived at the edge, never the record. AND THE ROW THAT COULD NOT FAIL IS DELETED, NOT REPAIRED. `an_observation_that_was_not_taken_holds_no_standing` had four conjuncts: one structural, three substring matches. Worse, the property its NAME asserted is unauthorable at BOTH §4b boundaries -- no fixture can construct a variant field that does not exist -- which is precisely the case where the right answer is no check at all, because a permanently-green check is worse than absent for being cited as coverage. It is replaced by `an_empty_dual_fold_yields_no_observation`, which asserts only what can fail for the right reason: which ARM an unobservable fold dispatches to, and which REFUSAL it carries, both as variant matches. The structural property survives in the type and is stated in the module header, where the header also records that no witness asserts it and why. The report row IS legitimately a renderer claim, so it stays -- but its expected rows are now COMPOSED from the renderer instead of hand-written. A literal fragment there pins one authority's wording into another's claim, which is §3's fork arriving as a test fixture. THE QUADRATIC FOLD IS FIXED, AND NOT AS A NIT. `ratchet_unevaluated_subjects` accumulated with `concat(acc, [e])` per hit. DESIGN §6's standing bare-minimum-cost ruling is explicit that a copied accumulator or a quadratic fold is ALWAYS fixed regardless of the realized n, because "n is small here" is not a time-stable fact -- and this roster is the whole discovered corpus, so the mitigating premise was weak on its own terms. It is now a total `emit_ratchet_verdict_evaluated` predicate plus filter-then-map, which also states the question the whole not-evaluated wall turns on ONCE instead of inlining it in a selection loop. This module's peer accumulators predate the change and are untouched; pricing this cut against pre-existing corpus defects would be the wrong denominator. EVIDENCE, BY EXECUTION (BuildBuddy, build and run in one dispatch), controls green either side: filter rewrite control 8/8 PASS. Mutating the EXTRACTED predicate (NotEvaluated reads as evaluated) reds exactly the two gate claims -- so the wall moved with the code rather than out from under it, which is the specific risk in extracting it. typed admission control 8/8 PASS. mutation A, empty universe permits so the fold routes to TAKEN -> FAIL an_empty_dual_fold_yields_no_observation mutation B, the not-taken arm carries the WRONG refusal identity -> FAIL an_empty_dual_fold_yields_no_observation Both conjuncts load-bearing; six unrelated claims PASS throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Dissolve the roster predicate into a direct match, and repair a stale citation to a symbol this branch deletes REVIEW 56173, FINDING 1 -- FIXED. `ratchet_roster_is_empty` is gone; `emit_ratchet_enrolment_admission` matches `r.roster` directly, as the wall it replaced did. The reviewer's instinct is right even though the citation is not: `grep -c` for the named predicate-dissolution rule in DESIGN.md returns 0. The real precedent is in the corpus -- `std.witness_admission` `witness_admission_predicate_dissolution_note` records two predicates dissolved (review 39760) BY MAKING CONSUMERS MATCH THE COPRODUCT, and `v2.std.witness_execution_routing` records three more. Same direction, so the change stands on its merits rather than on the rule as cited. REVIEW 56173, FINDING 2 -- DECLINED, three reasons, the third deciding. 1. `filter` takes a Bool by construction, so dissolving `emit_ratchet_verdict_evaluated` means returning to a fold that appends -- the quadratic accumulator review 56160 and DESIGN §6's bare-minimum-cost ruling had just removed. The two findings would cancel. 2. `emit_ratchet_verdict_holds` sits ten lines above it: same coproduct, same `-> Bool`, same total match, pre-existing and untouched here. That IS the module's idiom. 3. It is not a second accessor for one answer, which is what the duplicated-shape objection needs. `RatchetRegressed` discriminates them: holds=false, evaluated=TRUE. A regression is a verdict the fold ESTABLISHED and then refused. Collapsing the two would make an evaluated failure indistinguishable from a subject nobody could measure -- the distinction this carrier exists for. A STALE CITATION TO A SYMBOL THIS BRANCH DELETES, found via gentle-bee-495 rather than by review. The `RosterDenominators` note cited `emit_ratchet_gating_admission` -- deleted by this very PR -- and it would have shipped, in the module that argues for cited-symbol hygiene. Repaired, and widened, because the sentence carried a second defect of the same family: it ended "when the file inventory lands, the field changes and enrolment becomes possible", true of the wall as it stood and falsified the moment gunbc#9231 landed. A dual denominator now makes a gate ELIGIBLE, not admissible, and an observation does not consult the field at all. A stale citation wrapped around a stale claim. THE GATE'S PERMIT IS UNOCCUPIED ON THE LIVE CORPUS, AND THAT IS NOT UNREACHABLE (gentle-bee-495, 2026-08-26). Hole 3's bounded-tail reader means a talkative subject arrives NOT-EVALUATED, so over a realistic roster the any-unevaluated condition refuses essentially always and nothing RECEIVES the permit. Recorded as occupancy rather than reachability, because only the second reading licenses deleting the arm: DESIGN puts that test at the FIXTURE boundary, and the witness authors the permit today as the one-field control beside the unevaluated refusal. Yes / yes / zero is a healthy guard being quiet. The arm is NOT relaxed to tolerate unevaluated subjects -- that converts the instrument's blindness into a green, the absorbing fallback arriving as a kindness to a roster that is not ready. The relayed sample is carried as a SHAPE and not a rate; no proportion is stated. EVIDENCE, controls green either side, every arm printing an explicit VOID fallback: control after dissolution 8/8 PASS C: gate permits without consulting FAIL ×3, including the substring-free `_permits_none` denominator or verdicts PASS an_empty_dual_fold (a different question, correctly green) E: empty-roster arm permits FAIL an_empty_dual_fold_yields_no_observation restored PASS Two earlier attempts at C were VOID rather than passing: forcing the arm by inventing a variant name does not compile, and zero verdict lines greps identically to zero failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the two-arm measurement behind the surviving predicate, not the one-arm version smart-ram-730 re-derived the holds/evaluated disagreement against this branch and found TWO arms disagreeing, not one. Re-measured here and confirmed: variant holds evaluated RatchetCleanHeld true true RatchetDebtHeld true true RatchetRegressed FALSE TRUE <-- disagree RatchetFrontierStale FALSE TRUE <-- disagree RatchetNotEvaluated false false RatchetSubjectUnmeasured false false WHY TWO IS STRONGER THAN ONE, and it is the reason this note changed rather than a citation being added to it: a single disagreeing variant is dismissible as an accident of how that one case is treated, which is exactly how the declined review finding would have read it. Two disagreeing in the SAME DIRECTION show the functions answer different questions by construction. AND THE READING IS THE PART THAT SURVIVES. Both disagreeing arms are cases where the fold DID establish a verdict and then refused it -- a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row says otherwise. Neither is a subject nobody could measure. That is the entire content of the split, and collapsing the two questions would make an evaluated failure indistinguishable from an unevaluated subject: the state-space conflation this carrier exists to refuse, committed inside the machinery refusing it. Comment-only, and verified anyway rather than assumed -- this corpus refuses annotations in the wrong position, so "it is only a comment" is not evidence. PASS_COUNT=8 over the eight claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give both verdict questions one authority: a canonical classification, with the divergence class named Review 56204 raised the predicate duplication a second time and rejected both my reasons. It is right, and the part I got wrong is worth stating exactly: I argued the two predicates have DISTINCT SEMANTICS and that `filter` needs a `Bool`. Both true, and neither answers the objection. Two total matches over six variants are two places holding the coproduct's shape, and the compiler forcing both to be total does not make them ONE AUTHORITY. Distinct semantics and duplicated shape knowledge can both be true at once; my reply treated the first as refuting the second. THE FIX GIVES BOTH QUESTIONS ONE SOURCE RATHER THAN DELETING A PREDICATE. `VerdictStanding` is the real semantic axis and `emit_ratchet_verdict_standing` is now the only function reading the verdict vocabulary's shape for classification: VerdictHeld established, and the ratchet holds VerdictEstablishedAndRefused established, and then REFUSED VerdictUnestablished no verdict about this subject exists at all `holds` and `evaluated` are projections over that, not over storage. Measured after the change -- variant mentions: standing 6, holds 0, evaluated 0. One place fails to compile when a variant lands. (`emit_ratchet_verdict_entry` and `_row` still match six: they extract per-variant PAYLOADS, a field and a rendering, which is not classification knowledge.) AND IT IS A BETTER MODEL THAN EITHER POSITION IN THE ARGUMENT. The divergence between the two questions used to be EMERGENT -- two independent matches that happened to disagree on two arms, discoverable only by measuring them against each other, which is literally how it surfaced. Now it is a named class. `VerdictEstablishedAndRefused` IS the population where the fold established a verdict and then refused it: a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row disagrees. TWO NEW CLAIMS PIN THE RELATION, and they fail for different reasons: holding_a_verdict_entails_having_established_it -- the ratchet cannot hold over a subject nobody measured; a failure means some arm reports a verdict it never established. an_established_verdict_that_refuses_is_what_separates_the_two_questions -- the converse set is NON-EMPTY (2). If it were empty the split would be a decoration and `evaluated` deletable. EVIDENCE: control 10/10 PASS. Mutating the classifier to call a regression UNESTABLISHED reds exactly the divergence claim and nothing else -- the entailment claim correctly stays green, since collapsing that class creates no holds-without-evaluated case. Restored 10/10. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Repair the merge: git factored a shared closing brace out of both conflict sides The #9238 absorption left two files unparseable. Both sides' content survived intact; what did not was MY closing braces, and the cause is worth recording because the resolution looked correct by every check I ran. WHAT HAPPENED. Both conflicts were append/append at the file tails. I resolved by concatenating the two sides. But git had factored the SHARED TRAILING BRACE out of both sides as common context -- both blocks ended identically, so the closing `}` appeared ONCE, after the conflict region. Concatenating two bodies then left one brace closing two functions: emit_subject_clean_frontier.dag emit_ratchet_runner_execution_standing lost its `else` and function close; emit_outcome_under_membership was lexically swallowed by the still-open else ..._witness_test.dag an_established_verdict_that_refuses... lost its close; fn membership_with_candidates was swallowed the same way WHAT ALMOST LET IT THROUGH, which is the reusable part. I verified the merge by checking that both sides' SYMBOLS AND CLAIMS WERE PRESENT. All of them were. PRESENCE IS NOT WELL-FORMEDNESS -- every grep reported a clean merge while neither file parsed. WHAT CAUGHT IT was PASS_COUNT=0 on both lanes with no FAIL and no ERROR: the neither-verdict signal. A parse refusal is not a verdict, so a filter written for PASS/FAIL is blind to it, and zero verdict lines greps identically to zero failures. Raw output said it plainly: `module index refused: 2 unparseable .dag source(s)`. Review 56291 independently found the frontier half and prescribed the same fix; it named only that file, so applying the review alone would have left the witness test unparseable -- and the witness file is where the evidence lives, so the module would have compiled with its claims silently absent. VERIFIED BY EXECUTION, both lanes, because a merge can break either side: MINE 10/10 PASS THEIRS 3/3 PASS (gentle-bee-495's boundary claims -- the ones a careless merge destroys) runner tool compile 0 blocking, 154 files emitted frontier module 0 blocking, 148 files emitted The branch now also carries #9273 (d31fa86), so these claims pass against a tree where a truncated capture has its own refusal rather than being read as a compiler scoping failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * One silence, two owners: split a subject nobody asked about from one the instrument failed on A roster subject arriving at the fold with no reading was RatchetSubjectUnmeasured whether the run had asked about it or not. The two facts share nothing but their silence and have opposite remedies -- fix the instrument, or widen the run -- so a reader handed one UNMEASURED count could not tell which they were looking at. This module already draws exactly this distinction correctly one axis over: an admission row naming a subject the roster lacks is reported as an ORPHAN rather than as a missing measurement, in its own words "because the two have opposite owners". The selection axis is the same shape and did not get the same treatment. WHAT LANDS SubjectSelection = SelectionWholeRoster | SelectionSubset { entries } A coproduct rather than a bare List<String>, deliberately: an empty list would mean both "a subset naming nothing" and "no subsetting at all", which is the state-space conflation the type exists to remove, reintroduced in the type that removes it. RatchetSubjectNotSelected joins the verdict vocabulary and is threaded through the four total matches over it. Both silences remain VerdictUnestablished, so a gate still refuses over either -- this splits OWNERS without promoting scope into evidence. The runner derives one selection and reads it twice (the measured list and the classified selection come from the same value), because two independent derivations could disagree and the disagreement would render as an UNMEASURED subject the run had in fact measured. EVIDENCE, and the reds are the point The pair is a ONE-FIELD control: identical roster, admissions and readings, only the selection differs. Mutated on BuildBuddy in both directions: A, selection ignored (the pre-change behavior): a_subject_the_run_never_selected... FAILS alone B, selection inverted: the two selected-side claims FAIL, that one passes restored: all four pass So claim A is the regression control for precisely the defect repaired here. Stated rather than counted: neither_silence_establishes_a_verdict passes in every arm. It guards a different property -- that neither silence is promoted to evidence -- and is NOT discriminating on the selection axis. a_partial_run_refuses_and_names_the_subjects_it_did_not_measure pinned the old UNMEASURED row text and is updated with it; it stays red under both mutations. Measured: 4 new/changed claims pass, the 12 pre-existing pass unchanged, and the runner compiles 0 blocking / 951 advisory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…reement, and a pricing receipt that cannot be unattached (#9348) * Enrol the emission ratchet as an OBSERVATION: two modes, an executing consumer, and a discriminating red The emit-subject clean ratchet gates nothing. Measured on origin/main at 730d226 and re-confirmed at e1f65b3: `git grep -l emit_subject_clean` returns exactly three files -- the frontier module, the runner tool, and their one witness -- and the path-fragment search returns the same three, which closes the argv-assembled-entry-path case a module-name grep would miss. No workflow, no required phase, no module names either of them. This is not a defect in the ratchet. The enrolment wall was a genuine construction: it refused every enrolment while the universe carried a single denominator. What changed is that #9231 made the permitting arm producible, and the wall then answered PERMITTED about a carrier that must still not gate -- it asked one question from one fact, and that fact is no longer the only disqualifier. ENROLMENT IS TWO QUESTIONS, SO THE MODE IS A PARAMETER. `EmitRatchetGatingAdmission` is deleted at the root and replaced by `emit_ratchet_enrolment_admission(enrolment, r)` over `EnrolledAsObservation | EnrolledAsGate`. Preconditions are derived from the fold, never asserted about it: BOTH a non-empty universe -- a fold over no subjects is a discovery failure, and rendering one as an observation of nothing is the empty-observation narrow at the point where the observation is taken. GATE ONLY the dual denominator, for the reason the previous wall gave verbatim. GATE ONLY every roster subject EVALUATED. A subject that reached NOT-EVALUATED or was never measured has no verdict about its cleanliness, and a gate whose universe contains such subjects decides a closed-universe question over an open one. This is hole 3 arriving at the enrolment seam. The asymmetry is deliberate rather than lenient: an observation is NOT refused by a single denominator or by unevaluated subjects, because those are its CONTENT. Refusing to look because the looking is imperfect is the same narrow one level up. What a weak universe disqualifies is DECIDING. EXECUTION PROVENANCE IS STRUCTURAL, NOT CHECKED. `EmitRatchetObservation = ObservationTaken { roster, standing } | ObservationNotTaken { cause }`. The not-taken arm holds NO standing field, so there is no spelling in which a fold that never happened reads as a fold that found nothing wrong. The report reaches the standing only THROUGH the observation and prints the gate admission beside it, so a reading cannot be quoted as a gate verdict. On the host side `attempt_emit_subject_clean_ratchet` separates never-attempted (roster unreadable, source root unlistable) from folded, before the difference stops being knowable. The new `observe` verb exits SUCCESS on a refusing standing -- the observation succeeded and the news is bad, which belongs in the report a human reads -- and FAILURE only when the observation could not be taken. `check` now routes through the gate admission and refuses to be a gate. THE THIRD STATE: HAS NOT RUN YET vs WILL NEVER RUN HERE. Both render as an absent report and only the second is terminal. The vocabulary is BORROWED rather than minted: `std.witness_admission` already separates a row with an executing consumer from one nothing claims from one whose cadence has no scheduled route. `emit_ratchet_runner_cadence = NoConsumer` derives `UnexecutedDeferredWitness`, and the derivation is not constant -- handed a cadence with a route it returns the covered arm. NOTHING ENROLS. No workflow, no required phase, no CI authority is touched, and no import reaches the runner from anything the floor folds. Enrolment is a floor-cut re-add and requires its own operator agreement; this gets the mechanism to where that is a one-line change someone with the authority can approve. EVIDENCE, BY EXECUTION on BuildBuddy (arm64 session, amd64 runner, build and run in one dispatch): control 10/10 claims PASS; `gunbc compile --entry dag/tools/emit_subject_clean_ratchet.dag` -> 0 blocking, 949 advisory, 152 files emitted. mutation 1 gate ignores unevaluated subjects (the pre-change wall restored): FAIL a_gate_refuses_a_dual_denominator_fold_whose_subjects_were_never_evaluated FAIL an_unevaluated_subject_is_observed_rather_than_suppressed four unrelated claims stay PASS -- targeted, not a broad break. mutation 2 empty universe no longer refuses enrolment: FAIL an_observation_that_was_not_taken_holds_no_standing FAIL the_report_distinguishes_an_untaken_observation_from_a_clean_one restored control green before and after. Every claim pairs its refusing input with a control differing in exactly one field, and `the_ratchet_runner_has_no_executing_consumer_today` is green BECAUSE nothing runs the runner -- it goes red the day a cadence is agreed, which is what forces it and the block it mirrors to be rewritten together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the typed admission on the not-taken arm, and delete the evidence that could not fail Two review findings, both fixed at the root rather than in the row that surfaced them. THE NOT-TAKEN ARM HELD A RENDERING WHERE IT SHOULD HAVE HELD THE FACT. `ObservationNotTaken { cause: String }` flattened the typed refusal into prose at the moment it was stored -- the anemic leaf DESIGN §2 names, a String hiding parts that already existed one function away. The cost landed exactly where it hurts most: every claim about WHY an observation was not taken had to be a substring match, so the one artifact a reader would cite as proof of this carrier's strongest property was a change detector -- red on a wording edit, green on any text carrying the phrase. It now carries `admission: EmitRatchetEnrolmentAdmission`, and the rendering becomes a projection derived at the edge, never the record. AND THE ROW THAT COULD NOT FAIL IS DELETED, NOT REPAIRED. `an_observation_that_was_not_taken_holds_no_standing` had four conjuncts: one structural, three substring matches. Worse, the property its NAME asserted is unauthorable at BOTH §4b boundaries -- no fixture can construct a variant field that does not exist -- which is precisely the case where the right answer is no check at all, because a permanently-green check is worse than absent for being cited as coverage. It is replaced by `an_empty_dual_fold_yields_no_observation`, which asserts only what can fail for the right reason: which ARM an unobservable fold dispatches to, and which REFUSAL it carries, both as variant matches. The structural property survives in the type and is stated in the module header, where the header also records that no witness asserts it and why. The report row IS legitimately a renderer claim, so it stays -- but its expected rows are now COMPOSED from the renderer instead of hand-written. A literal fragment there pins one authority's wording into another's claim, which is §3's fork arriving as a test fixture. THE QUADRATIC FOLD IS FIXED, AND NOT AS A NIT. `ratchet_unevaluated_subjects` accumulated with `concat(acc, [e])` per hit. DESIGN §6's standing bare-minimum-cost ruling is explicit that a copied accumulator or a quadratic fold is ALWAYS fixed regardless of the realized n, because "n is small here" is not a time-stable fact -- and this roster is the whole discovered corpus, so the mitigating premise was weak on its own terms. It is now a total `emit_ratchet_verdict_evaluated` predicate plus filter-then-map, which also states the question the whole not-evaluated wall turns on ONCE instead of inlining it in a selection loop. This module's peer accumulators predate the change and are untouched; pricing this cut against pre-existing corpus defects would be the wrong denominator. EVIDENCE, BY EXECUTION (BuildBuddy, build and run in one dispatch), controls green either side: filter rewrite control 8/8 PASS. Mutating the EXTRACTED predicate (NotEvaluated reads as evaluated) reds exactly the two gate claims -- so the wall moved with the code rather than out from under it, which is the specific risk in extracting it. typed admission control 8/8 PASS. mutation A, empty universe permits so the fold routes to TAKEN -> FAIL an_empty_dual_fold_yields_no_observation mutation B, the not-taken arm carries the WRONG refusal identity -> FAIL an_empty_dual_fold_yields_no_observation Both conjuncts load-bearing; six unrelated claims PASS throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Dissolve the roster predicate into a direct match, and repair a stale citation to a symbol this branch deletes REVIEW 56173, FINDING 1 -- FIXED. `ratchet_roster_is_empty` is gone; `emit_ratchet_enrolment_admission` matches `r.roster` directly, as the wall it replaced did. The reviewer's instinct is right even though the citation is not: `grep -c` for the named predicate-dissolution rule in DESIGN.md returns 0. The real precedent is in the corpus -- `std.witness_admission` `witness_admission_predicate_dissolution_note` records two predicates dissolved (review 39760) BY MAKING CONSUMERS MATCH THE COPRODUCT, and `v2.std.witness_execution_routing` records three more. Same direction, so the change stands on its merits rather than on the rule as cited. REVIEW 56173, FINDING 2 -- DECLINED, three reasons, the third deciding. 1. `filter` takes a Bool by construction, so dissolving `emit_ratchet_verdict_evaluated` means returning to a fold that appends -- the quadratic accumulator review 56160 and DESIGN §6's bare-minimum-cost ruling had just removed. The two findings would cancel. 2. `emit_ratchet_verdict_holds` sits ten lines above it: same coproduct, same `-> Bool`, same total match, pre-existing and untouched here. That IS the module's idiom. 3. It is not a second accessor for one answer, which is what the duplicated-shape objection needs. `RatchetRegressed` discriminates them: holds=false, evaluated=TRUE. A regression is a verdict the fold ESTABLISHED and then refused. Collapsing the two would make an evaluated failure indistinguishable from a subject nobody could measure -- the distinction this carrier exists for. A STALE CITATION TO A SYMBOL THIS BRANCH DELETES, found via gentle-bee-495 rather than by review. The `RosterDenominators` note cited `emit_ratchet_gating_admission` -- deleted by this very PR -- and it would have shipped, in the module that argues for cited-symbol hygiene. Repaired, and widened, because the sentence carried a second defect of the same family: it ended "when the file inventory lands, the field changes and enrolment becomes possible", true of the wall as it stood and falsified the moment gunbc#9231 landed. A dual denominator now makes a gate ELIGIBLE, not admissible, and an observation does not consult the field at all. A stale citation wrapped around a stale claim. THE GATE'S PERMIT IS UNOCCUPIED ON THE LIVE CORPUS, AND THAT IS NOT UNREACHABLE (gentle-bee-495, 2026-08-26). Hole 3's bounded-tail reader means a talkative subject arrives NOT-EVALUATED, so over a realistic roster the any-unevaluated condition refuses essentially always and nothing RECEIVES the permit. Recorded as occupancy rather than reachability, because only the second reading licenses deleting the arm: DESIGN puts that test at the FIXTURE boundary, and the witness authors the permit today as the one-field control beside the unevaluated refusal. Yes / yes / zero is a healthy guard being quiet. The arm is NOT relaxed to tolerate unevaluated subjects -- that converts the instrument's blindness into a green, the absorbing fallback arriving as a kindness to a roster that is not ready. The relayed sample is carried as a SHAPE and not a rate; no proportion is stated. EVIDENCE, controls green either side, every arm printing an explicit VOID fallback: control after dissolution 8/8 PASS C: gate permits without consulting FAIL ×3, including the substring-free `_permits_none` denominator or verdicts PASS an_empty_dual_fold (a different question, correctly green) E: empty-roster arm permits FAIL an_empty_dual_fold_yields_no_observation restored PASS Two earlier attempts at C were VOID rather than passing: forcing the arm by inventing a variant name does not compile, and zero verdict lines greps identically to zero failures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Carry the two-arm measurement behind the surviving predicate, not the one-arm version smart-ram-730 re-derived the holds/evaluated disagreement against this branch and found TWO arms disagreeing, not one. Re-measured here and confirmed: variant holds evaluated RatchetCleanHeld true true RatchetDebtHeld true true RatchetRegressed FALSE TRUE <-- disagree RatchetFrontierStale FALSE TRUE <-- disagree RatchetNotEvaluated false false RatchetSubjectUnmeasured false false WHY TWO IS STRONGER THAN ONE, and it is the reason this note changed rather than a citation being added to it: a single disagreeing variant is dismissible as an accident of how that one case is treated, which is exactly how the declined review finding would have read it. Two disagreeing in the SAME DIRECTION show the functions answer different questions by construction. AND THE READING IS THE PART THAT SURVIVES. Both disagreeing arms are cases where the fold DID establish a verdict and then refused it -- a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row says otherwise. Neither is a subject nobody could measure. That is the entire content of the split, and collapsing the two questions would make an evaluated failure indistinguishable from an unevaluated subject: the state-space conflation this carrier exists to refuse, committed inside the machinery refusing it. Comment-only, and verified anyway rather than assumed -- this corpus refuses annotations in the wrong position, so "it is only a comment" is not evidence. PASS_COUNT=8 over the eight claims. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give both verdict questions one authority: a canonical classification, with the divergence class named Review 56204 raised the predicate duplication a second time and rejected both my reasons. It is right, and the part I got wrong is worth stating exactly: I argued the two predicates have DISTINCT SEMANTICS and that `filter` needs a `Bool`. Both true, and neither answers the objection. Two total matches over six variants are two places holding the coproduct's shape, and the compiler forcing both to be total does not make them ONE AUTHORITY. Distinct semantics and duplicated shape knowledge can both be true at once; my reply treated the first as refuting the second. THE FIX GIVES BOTH QUESTIONS ONE SOURCE RATHER THAN DELETING A PREDICATE. `VerdictStanding` is the real semantic axis and `emit_ratchet_verdict_standing` is now the only function reading the verdict vocabulary's shape for classification: VerdictHeld established, and the ratchet holds VerdictEstablishedAndRefused established, and then REFUSED VerdictUnestablished no verdict about this subject exists at all `holds` and `evaluated` are projections over that, not over storage. Measured after the change -- variant mentions: standing 6, holds 0, evaluated 0. One place fails to compile when a variant lands. (`emit_ratchet_verdict_entry` and `_row` still match six: they extract per-variant PAYLOADS, a field and a rendering, which is not classification knowledge.) AND IT IS A BETTER MODEL THAN EITHER POSITION IN THE ARGUMENT. The divergence between the two questions used to be EMERGENT -- two independent matches that happened to disagree on two arms, discoverable only by measuring them against each other, which is literally how it surfaced. Now it is a named class. `VerdictEstablishedAndRefused` IS the population where the fold established a verdict and then refused it: a regression is a subject measured and found dirty, a stale frontier row is a subject measured and found CLEAN while its admission row disagrees. TWO NEW CLAIMS PIN THE RELATION, and they fail for different reasons: holding_a_verdict_entails_having_established_it -- the ratchet cannot hold over a subject nobody measured; a failure means some arm reports a verdict it never established. an_established_verdict_that_refuses_is_what_separates_the_two_questions -- the converse set is NON-EMPTY (2). If it were empty the split would be a decoration and `evaluated` deletable. EVIDENCE: control 10/10 PASS. Mutating the classifier to call a regression UNESTABLISHED reds exactly the divergence claim and nothing else -- the entailment claim correctly stays green, since collapsing that class creates no holds-without-evaluated case. Restored 10/10. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Repair the merge: git factored a shared closing brace out of both conflict sides The #9238 absorption left two files unparseable. Both sides' content survived intact; what did not was MY closing braces, and the cause is worth recording because the resolution looked correct by every check I ran. WHAT HAPPENED. Both conflicts were append/append at the file tails. I resolved by concatenating the two sides. But git had factored the SHARED TRAILING BRACE out of both sides as common context -- both blocks ended identically, so the closing `}` appeared ONCE, after the conflict region. Concatenating two bodies then left one brace closing two functions: emit_subject_clean_frontier.dag emit_ratchet_runner_execution_standing lost its `else` and function close; emit_outcome_under_membership was lexically swallowed by the still-open else ..._witness_test.dag an_established_verdict_that_refuses... lost its close; fn membership_with_candidates was swallowed the same way WHAT ALMOST LET IT THROUGH, which is the reusable part. I verified the merge by checking that both sides' SYMBOLS AND CLAIMS WERE PRESENT. All of them were. PRESENCE IS NOT WELL-FORMEDNESS -- every grep reported a clean merge while neither file parsed. WHAT CAUGHT IT was PASS_COUNT=0 on both lanes with no FAIL and no ERROR: the neither-verdict signal. A parse refusal is not a verdict, so a filter written for PASS/FAIL is blind to it, and zero verdict lines greps identically to zero failures. Raw output said it plainly: `module index refused: 2 unparseable .dag source(s)`. Review 56291 independently found the frontier half and prescribed the same fix; it named only that file, so applying the review alone would have left the witness test unparseable -- and the witness file is where the evidence lives, so the module would have compiled with its claims silently absent. VERIFIED BY EXECUTION, both lanes, because a merge can break either side: MINE 10/10 PASS THEIRS 3/3 PASS (gentle-bee-495's boundary claims -- the ones a careless merge destroys) runner tool compile 0 blocking, 154 files emitted frontier module 0 blocking, 148 files emitted The branch now also carries #9273 (d31fa86), so these claims pass against a tree where a truncated capture has its own refusal rather than being read as a compiler scoping failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * One silence, two owners: split a subject nobody asked about from one the instrument failed on A roster subject arriving at the fold with no reading was RatchetSubjectUnmeasured whether the run had asked about it or not. The two facts share nothing but their silence and have opposite remedies -- fix the instrument, or widen the run -- so a reader handed one UNMEASURED count could not tell which they were looking at. This module already draws exactly this distinction correctly one axis over: an admission row naming a subject the roster lacks is reported as an ORPHAN rather than as a missing measurement, in its own words "because the two have opposite owners". The selection axis is the same shape and did not get the same treatment. WHAT LANDS SubjectSelection = SelectionWholeRoster | SelectionSubset { entries } A coproduct rather than a bare List<String>, deliberately: an empty list would mean both "a subset naming nothing" and "no subsetting at all", which is the state-space conflation the type exists to remove, reintroduced in the type that removes it. RatchetSubjectNotSelected joins the verdict vocabulary and is threaded through the four total matches over it. Both silences remain VerdictUnestablished, so a gate still refuses over either -- this splits OWNERS without promoting scope into evidence. The runner derives one selection and reads it twice (the measured list and the classified selection come from the same value), because two independent derivations could disagree and the disagreement would render as an UNMEASURED subject the run had in fact measured. EVIDENCE, and the reds are the point The pair is a ONE-FIELD control: identical roster, admissions and readings, only the selection differs. Mutated on BuildBuddy in both directions: A, selection ignored (the pre-change behavior): a_subject_the_run_never_selected... FAILS alone B, selection inverted: the two selected-side claims FAIL, that one passes restored: all four pass So claim A is the regression control for precisely the defect repaired here. Stated rather than counted: neither_silence_establishes_a_verdict passes in every arm. It guards a different property -- that neither silence is promoted to evidence -- and is NOT discriminating on the selection axis. a_partial_run_refuses_and_names_the_subjects_it_did_not_measure pinned the old UNMEASURED row text and is updated with it; it stays red under both mutations. Measured: 4 new/changed claims pass, the 12 pre-existing pass unchanged, and the runner compiles 0 blocking / 951 advisory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * WIP: observation context carriers (parked to unblock 9315/9346) * Observation context, binding agreement, persistence and pricing receipt (WIP: claims not yet executed) * Construct the fixture digest through sha256_digest rather than a bare record literal * Render the pricing receipt, and report what it does not speak for beside what it cost The unevaluated-subject count was a first-class field on EmitPricingDimensions and nothing rendered it, so it was carried and unreadable. A field nobody prints is a field nobody reads. WHY THIS ONE IS NOT BOOKKEEPING. Per-entry measurement mapped across a roster covers the union of those entries' closures, which is not the corpus -- a narrow run is on record reporting clean while twelve real sites sat outside what it looked at. So the number of roster subjects the receipt establishes nothing about is exactly the number saying how much it does not speak for. It is rendered BESIDE the five cost figures rather than below them, because a clean board printed without it reads as coverage while being precisely the shape that is not. A refused receipt renders as a named refusal and carries NO dimensions at all. Zeroed cost figures beside a refusal would read as a measured cheap run, which is the fabricated-plausible-output failure in the artifact whose whole job is provenance. Every refusal cause names which precondition failed, because a divergent binding, a dirty tree, an unbound coordinate and a persistence failure have four different owners. EVIDENCE: 13 claims pass, 8 prior claims unchanged, runner compiles 0 blocking. Mutation G drops the unevaluated count from the renderer and fails a_bound_receipt_reports_what_it_does_not_speak_for ALONE -- so the claim responds to that field and to nothing else. Restored: 13. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Ground the pricing quantities in std.measure: Nanosecond and ByteSize, not bare Int Review 56351, and the finding is this change's own thesis applied where I missed it. The PR grounds every provenance coordinate meticulously -- CommitSha, Digest, run coordinates, all through authorities that already own them -- and then minted wall_ms, cpu_ms, peak_rss_bytes and report_bytes as bare Int in the same file. Grounding provenance while re-minting the pricing scalars is inconsistent on its face, and gunbc.emit_diagnostic_observation had already recorded the identical finding one module over: "THE SIZES ARE ByteSize AND NOT Int". THREE DEPARTURES FROM THE REVIEW AS WRITTEN, each measured rather than assumed. NANOSECOND, NOT Duration. std.measure declares no Duration type; its carriers are Nanosecond, Millisecond and Second. Which one is not a preference -- the module states that Nanosecond is the canonical exact elapsed-time carrier, that Millisecond "remains a policy and presentation scale", and that measurement, ordering, joining and attribution must retain Nanosecond. A pricing receipt is measurement that later runs are joined against, so a millisecond field would have recorded a floor-rounded reading as though it were exact. ONE LINE THE REVIEW DID NOT NAME. ObservationPersisted.report_bytes was the same class on an added line and is now ByteSize. Fixing the flagged lines and leaving its sibling would have repaired the report and not the defect. TWO FIELDS DELIBERATELY LEFT Int. roster_size and unevaluated_subject_count are CARDINALS, not quantities in a unit system: no scale to convert, no dimension to check. Wrapping them in a measure would assert a structure they do not have. The _ms suffixes went with the types -- a unit spelled in the field name beside a unit spelled in the type is the same fact twice, and the two disagree the day the scale changes. MEASURED: 13 claims pass with the typed carriers, 6 prior claims unchanged, runner compiles 0 blocking. The seven mutation arms behind those claims are unaffected: none of them touched a unit field, so the discrimination they established still holds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * The gate refusal must say WHY, not only WHICH -- and derive each component's values once TWO FIXES, ONE OF THEM A DEFECT AND ONE A COST SHAPE. THE DEFECT. ratchet_unevaluated_subjects mapped the filtered verdicts to their entries and dropped the variant. I reported that as a convenience projection losing information; smart-ram-730 verified it in the tree and established it is worse: THAT LIST IS THE GATE REFUSAL'S PAYLOAD. EnrolmentRefusedUnevaluated.subjects carried entries with no reasons, so the refusal could name which subjects blocked enrolment and could not say why any of them did. DESIGN requires a refusal to be typed AND located AND to carry its cause; this one carried three causes as one. The three have different owners and different repairs -- a reading that established no population, an instrument asked about a subject that produced nothing, and a subject the run never asked about -- so a reader had to go find r.verdicts to learn which they were holding. It is the corpus's "total at the level examined, blind one level down", with the named tell present exactly as described: the payload-carrying position kept the entry and discarded the variant. The filter is exhaustive over evaluated-versus-not and says nothing about the distinction that decides who fixes it. WHERE THE FIX WENT, and it is the part worth arguing. The reason rides on the canonical classification's own VerdictUnestablished arm rather than in a second total match beside it. Review 56204 dissolved exactly that duplication once already, and recovering the reason through a parallel classifier would have reintroduced it. One authority over the verdict vocabulary, and the arm gains the payload it was missing. THE COST SHAPE. Review 56364 approved and called the double evaluation in component_agreement a non-blocking nit because the denominator is a handful of components. DESIGN's bare-minimum-cost ruling says a proven cost-shape defect is ALWAYS fixed regardless of the realized n, and names "n is small here" as not a time-stable fact. Same rule already applied to review 56160 this session. distinct_component_values evaluated subject_component_value twice per subject; component_agreement built the distinct values twice per component. Now: project once then deduplicate, and one extracted helper derives a component's values a single time. EVIDENCE: 19 claims pass. Mutation H flattens the reason back to one arm and fails BOTH new reason claims while leaving the pre-existing gate claim passing, since that one pins a reason H did not touch. Mutation I makes the extracted divergence helper always agree: 19 to 15. Mutation J makes the dedup keep duplicates: 19 to 16, and it fails the AGREEING control -- duplicates inflate the distinct count past one, so identical subjects read as divergent. Restored 19 after every arm, so neither extraction became decorative. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Brian Searls and others added 18 commits August 25, 2026 13:18

Hash the discovery policy into the roster digest; avoid two corpus-wi…

fe4a98c

…de name collisions

Give the verdict-entry accessor its consumer: every verdict names its…

3b62c9e

… subject

Fix the one blocking diagnostic: a renamed fixture binding missed ins…

fc06819

…ide a list literal

Merge branch 'session/gentle-bee-495' into session/gentle-bee-495-den…

fa36687

…ominator

Merge branch 'session/gentle-bee-495' into session/gentle-bee-495-den…

de373ca

…ominator

gunbai-bot Bot changed the title ~~Ratchet consumer: EmitSubjectCleanFrontier over a roster, consuming measure_entry_emission~~ The dual denominator: a file the index cannot classify blocks instead of vanishing Aug 25, 2026

gunbai-bot Bot marked this pull request as ready for review August 25, 2026 21:32

gunbc-ci-auto-heal added 3 commits August 25, 2026 21:35

roster_identity had two declarers: a per-entry compile sees one, the …

80c479e

…floor sees both, so the collision was invisible to the check an author runs

Merge main

bdbd401

# Conflicts: # dag/gunbc/design_document.dag

Merge the roster_identity de-collision and main

98c284f

# Conflicts: # dag/gunbc/emit_subject_clean_frontier.dag # dag/test/claim/emit_subject_clean_frontier_witness_test.dag

gunbai-bot Bot mentioned this pull request Aug 25, 2026

The emission ratchet's subject is { root, kind, resolution policy }, and membership is observed beside it rather than folded into it #9238

Merged

gunbc-ci-auto-heal added 4 commits August 25, 2026 22:44

The enrolment claim still asserted the pre-rename wording, so it went…

ae4c4d5

… red on the branch where only the carrier had been swept

Merge the enrolment-assertion fix from the base branch

5824ab9

Merge main

76d5f09

# Conflicts: # dag/extdeps/rust/cargo_diagnostic.dag # dag/gunbc/emit_diagnostic_observation.dag # dag/test/claim/emission_entry_instrument_witness_test.dag # dag/tools/emission_entry_instrument.dag

Merge main via the base branch

60ce9ed

briansrls merged commit 730d226 into main Aug 26, 2026
3 checks passed

briansrls deleted the session/gentle-bee-495-denominator branch August 26, 2026 05:22

gunbai-bot Bot mentioned this pull request Aug 26, 2026

Restore the stage0 arm of the generated-projection merge-attribute population, as a complement rather than a roster #9284

Merged

gunbai-bot Bot mentioned this pull request Aug 26, 2026

Separate emission-ratchet observation from gating and preserve execution provenance #9315

Merged

Navigation Menu

Repository navigation

The dual denominator: a file the index cannot classify blocks instead of vanishing - #9231

The dual denominator: a file the index cannot classify blocks instead of vanishing#9231
briansrls merged 26 commits into
mainfrom
session/gentle-bee-495-denominator

gunbai-bot Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

gunbai-bot Bot commented Aug 26, 2026

Uh oh!

gunbai-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gunbai-bot Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The hole

The mechanism was measured, and the obvious statement of it was wrong

The fix, and why the inventory is not just a second count

The denominator is now derived, not passed

A second finding, from the producer's author, and it lands on the ratchet's load-bearing arm

Refusals added

Evidence

Defects I introduced in this PR and caught before it left draft

Uh oh!

gunbai-bot Bot commented Aug 26, 2026

Uh oh!

gunbai-bot Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gunbai-bot Bot commented Aug 25, 2026 •

edited

Loading