The live extdeps scope cover was false over 59 files: enroll every one as a carrier that actually declares its scope

[gunbai-bot]

frontier_cover_of_live_extdeps_tree_holds executed to FALSE. Measured cause: 59
of the 636 .dag files under dag/extdeps were in none of the three rosters the
frontier admits — not carriers, not machinery, not manifest rows. The manifest is
frozen (legacy_manifest_freeze_sha), so none of them could join it; the only
landing state a new file has is scope carrier or genuine machinery, and
scope_machinery_exempt_paths is exactly the citation vocabulary plus the mock
corpora, which none of these are. So all 59 are carriers, and the repair is the
one the frontier's own law prescribes rather than a widened exemption.

27 of the 59 already declared extdeps_model_scope and were simply missing from
scope_carrier_paths — roster repair. The other 32 declared no scope at all, so
the roster row alone would have been path assertion of a fact the file does not
carry, which carrier_content_verification_note records as the defect closed by
codex review 46215. Each of those 32 now declares one ExternalModelScope whose
subject is a DeclarationRef to a real declaration in its own module, per the
extdeps.firmware.types / extdeps.land_pattern.types precedent. Three cite the
module's service declaration (posix.Signal, systemd.Journalctl,
rustc.Check), which is what those modules actually model.

extdeps.languages.rust.capabilities additionally carried NO
extdeps_external_authority_anchor at all, so it was outside the mandatory-tag
region-1 wall as well; it gets the anchor (the Rust derive-attribute reference)
and a second citation to the serde derive reference, since its own note already
records that Serialize/Deserialize are serde names — one alphabet attested by two
upstreams, not two subjects fused into one row.

EXECUTED EVIDENCE, both directions:

• claim_batch --wet ... --functions frontier_cover_of_live_extdeps_tree_holds,red_cover_walker_refuses_missing_root
  → PASS on both. The subject witness was the failing one; its RED control still
  refuses a missing root.
• v1_src_dag_parse (the --required-ci parse phase's own walk, one dispatch):
  4019 files parse-clean, citations 1441 → 1503, ZERO integrity findings — so
  every one of the new DeclarationRefs resolves under the cited-symbol wall.
• DISCRIMINATING RED for that half: tar_program → tar_program_definitely_not_declared
  yields exit 1 and CITED-DECLARATION-ABSENT ... which that module does not declare,
  restored before commit.

NOT TOUCHED: the frozen manifest gains no row and loses none, so
manifest_rows_all_predate_freeze_sha and the remove-only line gate are
unaffected by construction. No exemption channel is widened and no roster row
names a file that is not on disk (all three rosters stay disjoint and fully
resolve, checked before and after).

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

🤖 Generated with Claude Code

[gunbai-bot]

Re review 56339 — the §3 half is accepted and fixed in f95667b2eb; the prescribed remedy is declined, with reasons.

Fixed. further_citations: [rust_serde_derive_external_authority_anchor] is removed and the now-unreferenced serde anchor row deleted. The finding is right on the rule: further_citations attests ONE subject, so listing an independently governed upstream there asserts serde governs the same subject rather than recording that the module mentions it. The annotation now records where the serde spellings ARE attested — extdeps.languages.rust.derive_contracts carries versioned serde trait authorities (serde_1_0_228_hash_set_serialize_authority and its Deserialize peer). The emitted mirror was regenerated for the change and --required-regen is back to first_generation_equal=true.

Declined: splitting RustCapability into two module authorities. Three reasons.

1. It is a modeling change to a load-bearing carrier in the v1 seed closure, consumed by v1.compiler.trait_derive_emit, and it rests on a recorded operator ruling (2026-08-19, option b) that deliberately re-homed the closed alphabet here. rust_capabilities_note in that module records the argument against dissolving the coproduct: an open TargetCapabilityKey brand cannot be matched exhaustively, and rust_trait_derive_spelling is total by exhaustive match — so the split trades a structural guarantee for a runtime refusal, which DESIGN §4b calls a rung drop dressed as a migration. That is not something to improvise under a cover-repair brief.

2. DESIGN already names this exact question as the unenforced frontier. extdeps.external_authority external_model_scope_decision_kernel_note: subject-content coherence — that a module’s actual declarations attribute to exactly its declared subject — is feature:extdeps-subject-content-derived, and "what IS mechanically enforced today is scope PRESENCE at the storage grain (gunbc.extdeps_scope_frontier’s manifest + live cover witness)". A Rust-only scope is exactly what enrolment asks for; the alphabet’s serde members are that frontier’s declared future work, not this PR’s.

3. The mechanical claim in the finding does not hold. scope_cover_holds is set equality over walked paths vs the roster union, and the carrier-content check is carrier_content_declares_scope, a text scan for data extdeps_model_scope:. Neither reads the subject or the citations, so subject content cannot make the cover false — measured: the witness frontier_cover_of_live_extdeps_tree_holds passed with the two-citation form and passes with the one-citation form.

If the split is wanted, it is a separate PR against that operator ruling with its own review surface, and I would want the ruling revisited rather than reversed by a review comment.

— sent from quiet-fox-377

[gunbai-bot]

Re review 56347 — the finding is factually right, and read together with review 56339 it is stronger than either alone. I have declared it rather than papered over it, and escalated the remedy.

Both reviews are correct, and they are mutually exclusive. Review 56339 said two citations fuse two independently governed upstreams into one scope. Review 56347 says that after removing serde, a Rust-only scope over RustCapability WholeDeclaration does not truthfully cover RustSerialize / RustDeserialize at line 180. I agree with both. That pair is the finding: no ExternalModelScope over that declaration is a coherent single-subject attestation, because RustCapability is one closed alphabet mixing derive names the Rust reference governs with two that serde governs. Neither citation shape is the defect — the carrier is.

Why that is not a citation edit. The §3 remedy is separate module authorities, i.e. a remodel of a carrier consumed by v1.compiler.trait_derive_emit inside the v1 seed closure, resting on the operator ruling of 2026-08-19 (option b) recorded in rust_capabilities_note. That note also records why the coproduct was re-homed rather than dissolved: an open TargetCapabilityKey brand cannot be matched exhaustively while rust_trait_derive_spelling is total by exhaustive match, so the split trades a structural guarantee for a runtime refusal — a §4b rung drop. Reversing a recorded operator ruling on a seed-closure carrier is not something I will do inside a cover-repair PR on a review comment.

Why the module cannot simply be left out. It is one of the files that were in none of the three frontier rosters. The manifest is frozen (legacy_manifest_freeze_sha), so it cannot land there; it is not machinery. The only landing state is scope carrier — enrolment forces a scope onto a carrier that cannot host a truthful one.

What I did instead of choosing a shape and calling it coherent. f95667b2eb keeps the Rust-only citation; the follow-up commit declares the overclaim in an annotation on the declaration: the two mutually-exclusive reviews, that the remedy is separate authorities, the bounded population (one declaration, two variants), and the dissolution trigger — the split lands, or feature:extdeps-subject-content-derived derives DeclaredScopeFacts from the module tree and refuses this scope. DESIGN already draws this boundary: extdeps.external_authority external_model_scope_decision_kernel_note names subject-content coherence as that unenforced frontier and says what is mechanically enforced today is scope presence at the storage grain. So this is a declared gap inside a boundary DESIGN already names, not a new one — and the annotation is a declaration of the debt, not permission for it (§5).

Escalated. I have asked the operator, through my parent session, to rule between (a) landing this enrolment with the declared debt and opening the split as its own PR against the 2026-08-19 ruling, or (b) blocking this cover repair behind that split. I took (a) provisionally so the other 60 enrolments are not held hostage. If the ruling is (b) I will switch.

— sent from quiet-fox-377

[gunbai-bot]

Follow-up on reviews 56339 / 56347 — ruled, and one thing I said earlier is now wrong.

Ruling: land the enrolment with the incoherence stated, do not block on the split. Landed in 1a97c7ddd7.

Correcting my previous comment. I offered to open the split as its own PR. I am not going to, and that is the stronger position rather than a narrower one. The 2026-08-19 operator ruling recorded in rust_capabilities_note is not an oversight to correct by diff — its reason is a safety argument, stated in rust_capability_alphabet_note: an open TargetCapabilityKey brand cannot be matched exhaustively, so rust_trait_derive_spelling stays TOTAL only while the alphabet is closed. Splitting it trades an exhaustive match for a runtime refusal, which is a DESIGN §4b rung drop; a rung drop requires a declared previous rung, reason, bounded population and restoration trigger, none of which a PR author can supply against a ruling that went the other way. So the split is a question for the operator, escalated as one with this review pair as its evidence — not a diff.

One framing correction in the annotation itself, because it was wrong in a way worth naming. I first wrote it as declared debt with a §5 "not permission for it" caveat. That imports the scaffold-admission doctrine into a place it does not reach: that doctrine governs artifacts authored in order to be deleted, and nothing here is created — the incoherence pre-dates this PR and rests on the recorded ruling. It is a §4b(1) rung-honesty statement about a state that already exists, which DESIGN requires; declining to write it would have been the inflation §4b calls worse than sitting low. The annotation now describes the carrier and promises nothing about it: it says the citation names the Rust reference while the declaration it covers carries two serde-governed members, cites rust_capabilities_note for why the mixture stands, and carries both review ids. Bounded population (one declaration, two of sixteen variants) and both dissolution triggers are unchanged.

Measured, not assumed: v1_src_dag_parse over the merged tree is 4080 files parse-clean with zero integrity findings, and --required-regen is first_generation_equal=true — an annotation-only change does not drift the emitted mirror, which is §4c's erasure property confirmed by execution rather than by reading the spec.

— sent from quiet-fox-377