The wave-admission wall: adjudicate closure, subject-membership and binding deltas before a namespace change merges

[gunbai-bot]

The wave-admission wall: the enforcement mechanism the namespace plan names as a BLOCKER

gunbc.plans.import_namespace_program §9 records, in its own words, that "no CI mechanism enforces any of this — no ratchet, no phase, no gate over the import population", and the 2026-08-26 operator ruling carried at gunbc.compiler_frontend_program_interlock converts that disclosure into a BLOCKER: milestone_prerequisites gates NamespaceFirstSemanticWave on NamespaceWaveAdmissionEnrolled by name. This PR is that milestone.

The plan's own sentence is the acceptance condition, and it is the one I built against: a plan that reads as governed when it is not is worse than one that reads as unguarded. So the deliverable is not assurance added to a governed program — it is closing the gap between what the plan CLAIMS and what is true.

What runs

A new required phase, namespace-wave-admission, in claim_executor --required-ci, witnesses lane, ordered after parse.

• It acquires no second corpus. run_dag_parse_sweep already parses every authored .dag on every required run; that index is the wall's HEAD side. The BASE index is the head index with the diff applied in reverse at file grain — only the files the change touched are parsed again, from their base blobs — while closure and bindings are recomputed over both whole graphs, because a module whose own text did not move can still have its subject moved by one that did.
• The change class is DERIVED, never declared. NamespaceChangeClass splits preparatory work from work that alters membership or binding; nothing asks an author which they wrote. PreparatoryNoSemanticMotion is a measured property of a diff, not a claim in a PR body.
• It admits on UNADJUDICATED delta being empty, never on delta being empty — the one-word difference the ruling states explicitly, and the weaker spelling of which would refuse the cut itself and then be repaired by weakening the wall.
• Two non-verdicts are reported under their own names and only one passes. NoSubject (a push whose baseline IS its head — main after a squash merge) compared nothing and admits nothing. NotEvaluated (a baseline that does not resolve) refuses, per the ruling's partition: I could not see what changed and nothing changed are different states.
• A stale admission refuses too — a row matching no delta is a permission standing over nothing.

The three deltas, and the one that is not a wall

Closure is a pure function of membership, so the closure moved and no membership moved is not a state any fixture can author. An arm for it would be permanently green by construction — the decoration §4b calls worse than absent. So closure is measured and attributed, never separately adjudicated: each delta carries the number of modules whose subject it moves, so a refusal names its blast radius, and the adjudication happens at the generators. Saying so is the difference between a scope statement and an inflated one.

Two design decisions that took the whole shape

1. The grain is authored containment identity, and that is a CLOSED result. v2.workflow.legacy_binding_delta establishes it for its own subject and the argument transfers unchanged: std.occurrence_identity's scope law forbids filename, span, authored name, structural equality and content hash as identity inputs, and an OccurrenceId is a monotone counter consumed in walk order, so it encodes POSITION. A cross-compile correspondence is something a transformation emits — and between a merge base and a PR head there is no transformation to emit one. An occurrence-grain delta between two arbitrary trees is therefore unavailable by construction, not a better key waiting to be found. The wall uses the identity legacy_binding_observation legacy_subject_identity already folds: module path, enclosing declaration, and the leaf segment of the reference. A row's value is the SET of declaring identities, never a winner — so a local declaration arriving beside an imported one widens the set to two and reports NewAmbiguity rather than silently picking the nearer, which is the mechanism the namespace authority exists to delete.

The leaf rather than the whole spelling is a fixture finding, not a preference: keyed on spellings, widget and probe.home.widget are two rows, so requalifying a reference reads as one name losing its declaration — and requalification is the namespace program's own core motion. A wall keyed on spellings would refuse the program in its entirety.

2. The binding channel is not the import channel. A wall reading bindings only through import members would observe the import-name universe being deleted and then see nothing at all — blind on precisely the change it gates. So it reads every authored name occurrence in a module's own parsed tree and resolves it independently (dotted spelling by longest module prefix; bare spelling against the module's own declarations and its import claims, following re-exports to the module that actually DECLARES the name). It survives the cut because it never depended on the construct being cut, and the function is identical on both sides, so a base measured before a cut and a head measured after it are measured by one instrument. It is parse-then-derive over the Node tree, not the raw-text scanner DESIGN ruled a heuristic.

The RED is the deliverable — and it caught a wall that would have refused the program it exists to admit

The headline is not the seven mutations, it is the two arms that failed on their FIRST run. One of them was this: keyed on the whole spelling rather than the leaf segment, requalifying a reference reads as NewUnresolvedness — and qualification is precisely what the namespace program's projection does. The wall would have refused the only program it exists to admit. Nothing about the code was inconsistent, so no amount of reading would have found it; a fixture going red did.

adjudicate takes two indexes and no git, so the fixture boundary — which is where §4b says reachability is judged — authors a base tree and a head tree and reads back the exact disposition. Every refusing arm is one mutation of the auto-admitted control.

Measured by running each mutation ALONE against the production predicate, with a restore between and a re-run confirming the restore returns to green with no residue (cargo test -p v1-compiler --test namespace_wave_admission, remote runner):

mutation of the production code	arms that went red
NewUnresolvedness arm → TargetChanged	a_spelling_that_stops_denoting_anything_refuses_as_new_unresolvedness
NewPoolCoincidenceResolution arm → TargetChanged	a_spelling_that_begins_denoting_something_refuses_as_pool_coincidence
NewAmbiguity arm → TargetChanged	a_second_declarer_on_the_chain_refuses_as_new_ambiguity, a_local_declaration_beside_an_import_is_a_two_member_set_not_a_winner
membership_supported always true	removing_membership_nothing_bound_through_is_admitted_as_unused
admission matched on disposition alone, ignoring subject	an_admission_naming_a_different_subject_does_not_admit_and_reports_stale
binding rows keyed on the whole spelling instead of the leaf	dropping_an_import_for_a_qualified_spelling_keeps_the_declarer_and_is_admitted
auto_admitted returns true for every disposition	four arms, including both admission arms

Baseline green before the first mutation; green again after every restore; 14 arms, 0 failures. Two mutations red more than one arm and both are the same branch or the same partition covered from two directions — no arm is red under a mutation that does not reach it.

Two arms failed on their first run and both were real findings in the production code, not fixture defects: the leaf-keying correction above, and a fixture whose "unused" import supplied a leaf the module reached by another route — a malformed plant reading as a wrong verdict, now guarded by a plant assertion.

The vocabulary join

The host NamespaceDeltaDisposition is a second representation of the .dag coproduct. The exhaustive match protects this file's internal consistency and says nothing about the carrier: a variant added to the ruling and not here compiles perfectly. So the phase runs a set-equality join in both directions against the authority's own parsed variants, before any verdict — and an absent authority refuses, because that is the state in which nothing is checking the vocabulary.

What this does NOT claim

• The admission roster is EMPTY, and that is the correct landing state — no wave has run, so no transition has been authorised. The coarse class-admission carrier is deliberately NOT built: it would be a mechanism with no consumer until a wave needs it (§6, experimental residue). What is fixed today is the CONSTRAINT on its shape, recorded in the carrier: a class admission must be bounded by enumerated identity, never by predicate. "These exact bindings, taken from the pre-deletion baseline observation, become unresolved" is admissible; "unresolvedness is expected during the wave" is the absorbing fallback wearing the wave's clothes.
• No population figure here is live. The order-of-magnitude expectation for the first wave (thousands of transitions, which is what decides the admission-grain question) comes from snappy-dove-250 and is marked in the carrier as STALE AS A POPULATION with the reason.
• The occurrence-grain ceiling is declared as a GuaranteeStall, with its blocker stated as the closed result above rather than as effort.
• Nothing outside .dag under the three sweep roots is observed.
• The hand-Rust growth is NOT claimed as approved. 25 declarations are enumerated as a SeedGrowthJustification with reason, trigger and current boundary, and classified against the v1 freeze on the same purpose test declaration_index landed under — but that is my classification, offered as evidence for a reviewer, not a permission I hold. An author who can write a scaffold can equally write a row claiming it was approved (DESIGN, 2026-08-10). warm-hawk-909 is taking it to the operator alongside Replace hostile-writer shell scaffold with typed host effect #9363's, so both are decided against one test. A reviewer telling me the classification is sound is not the same as admitting the growth.

Cost

Measured on the live corpus (4,099 modules) on the remote runner:

• parse sweep (already paid by the parse phase): 21.1s

• identity arm — the same corpus on both sides: 4.2s, 0 deltas, over modules_compared=4099, membership_edges_head=21940, binding_rows_compared=724873. The denominator is the other half of that zero: a green that cannot say what it covered is an instrument failure wearing coverage's clothes.

• a live RED, on a real module: taking dag/gunbc/accelerator_demo_plan.dag with its one real import removed as the head, the wall reports exactly one delta over the same 724,873 rows —

  NewUnresolvedness binding gunbc.accelerator_demo_plan::demo_accelerator_placement `LocalAccelerator`
    — base {std.realization} -> head {} [closure blast radius: 0 module(s)]
  

  and refuses (unadjudicated=1). Note what it did not report: the std.realization membership edge SURVIVES, because that module reaches it by dotted spelling at five other sites, so the edge is genuinely still there. The wall said only the true thing.

Corpus integrity after the change, from the standalone sweep at this head: 4099 file(s) parse-clean; declarations modules=4099 declared=78825 import_members=82277 citations=1552 debt=42 in_fixtures=173 outside_index=174 kernel_named=2041 lens_modules=70 — zero findings, so the new carrier's imports and every one of its citations resolve. Rust suite (not in CI, run remotely): namespace_wave_admission 14/14, declaration_index_integrity 25/25.

So the phase costs about 4 seconds on top of a parse the required run already performs, and it acquires no second corpus.

Its first catch was its own dispatcher

While measuring the wall over the real corpus I found that the branch this one stacks on — #9352, session/warm-hawk-909 at a5a4110b7b — failed the required parse phase on eight // annotations authored inside data … = [ … ] initializers, which §4c does not admit. Reported, and fixed by that session at 233c358ee3 before this PR merged their updated head.

It is worth recording for a reason beyond the fix: the previous .dag walk would have returned CLEAN on all eight, because tokenize routes // into the annotation channel and grain is decided later — DESIGN carries that receipt. A check that existed, ran, and could not see the thing it appeared to cover is exactly the failure mode this wall is built not to be.

It has executed on the real path

Not a local measurement — the phase running inside witnesses.yml, floor lane. Taken from run
33023922255, all three jobs green (build, floor, witnesses), on this PR's current
head 930ef47a0.

State the provenance exactly, because the wall's own subject depends on it: the phase reports
head=a946db44, which is the PR merge ref GitHub constructs, not the branch tip. That is
the correct subject — the question the gate asks is what this change does when merged — and
saying so is the difference between a receipt and a number.

required-ci: phase namespace-wave-admission ROUTED to lane witnesses (not this job)      ← build lane
required-ci: phase namespace-wave-admission (closure, subject membership, binding)       ← floor lane
required-ci: namespace-wave-admission base=6295acdc head=a946db44
  modules_compared=4103 modules_added=4 modules_removed=0 membership_edges_head=21987
  binding_rows_compared=726813 closure_rows_moved=741 deltas=3
required-ci: namespace-wave-admission ExplicitlyEvaluatedZeroDelta membership
  gunbc.plan_registry_batch_g -> gunbc.plans.import_namespace_program
  — added; reached by a name this module authors [closure blast radius: 356 module(s)]
required-ci: namespace-wave-admission ExplicitlyEvaluatedZeroDelta membership
  gunbc.plan_registry_batch_g -> gunbc.plans.v2_corpus_self_host
  — added; reached by a name this module authors [closure blast radius: 356 module(s)]
required-ci: namespace-wave-admission ExplicitlyEvaluatedZeroDelta membership
  gunbc.seed_growth_admission -> gunbc.namespace_wave_admission
  — added; reached by a name this module authors [closure blast radius: 29 module(s)]
required-ci: namespace-wave-admission ADMITTED — every delta is auto-admitted or named by a transition admission

Read what that says, because it is the whole design executing on its own diff:

• The merge base resolves in CI, so the NotEvaluated arm is not the one this repository lands in — the risk I could not close from a remote runner (which fetches at depth 1 and has no origin/main) is closed here.
• The three deltas are exactly this PR's three real membership additions — the two plan registrations and this PR's own seed-growth import — over 726,813 binding rows and 4,103 compared modules. Nothing else moved, and the wall said nothing else moved.
• Each is ExplicitlyEvaluatedZeroDelta, derived from the fact that a name the module authors reaches into the target. Nobody classified them; the wall did.
• closure_rows_moved=741, with blast radii of 356, 356 and 29. This is the part that would have been a third wall: the closure motion is real and large, it is attributed to the three membership edges that generate it, and it is adjudicated at those generators rather than 741 more times.
• The phase costs about five seconds of the floor lane (23:39:15 → 23:39:20), on top of a parse the required run already performs.

An earlier revision of this section reported run 33020161158 at head de1445990ce8, and said so
under a caveat that the RUN had been cancelled while the PHASE completed first. That caveat is no
longer needed and the numbers are replaced rather than annotated: two receipts for one claim is two
accounts of one fact.

Stacking

This branch merges session/warm-hawk-909 (#9352), because the wall consumes gunbc.compiler_frontend_program_interlock's disposition vocabulary and citing it from main would resolve to nothing. Those four files are #9352's, not this PR's. When #9352 merges I will merge main and the diff narrows to this change alone.

Independence

Dispatched outside the program it gates — snappy-dove-250 declined ownership on the ground that a program parented over its enforcement grades its own homework. I took the domain semantics from them (all three answers changed the design) and kept what counts as ADMISSIBLE here.

🤖 Generated with Claude Code

Hand Rust: the growth, and what it bought back

Operator, relayed: "yes we need to stop adding hand rust asap" and "use it as an opportunity to migrate/delete hand rust". Answered at declaration grain, in gunbc.namespace_wave_admission namespace_wave_admission_seed_growth_justification, so the argument is a typed carrier rather than a PR-body claim.

(2) What this PR deletes or migrates — measured, not argued.

• leaf_of DELETED. It was a nickname for v1.00_core qualified_last_segment, the symbol v1.05_emit_rust rust_fn_sig_leaf_name_dotted_note names as THE authority for taking an authored spelling to its last segment. The wall now calls that mirror. This is the stronger construction as well as the smaller one: the reduction the wall keys every row on is now the corpus authority instead of a local respelling — a §3 fork this change had introduced and removed before landing.
• render_set DELETED, inlined at its two call sites.
• git_stdout: a NET REDUCTION of one pre-existing hand declaration. claim_executor carried a byte-identical private copy. The wall needed the same helper; rather than land a third spelling, the lib owns the one copy and the bin's is deleted and imported.
• Four inherent methods became free functions, because std.decl_ref offers only WholeDeclaration and NamedField. A method on an impl block is uncitable — as methods they were items the roster structurally could not enumerate. The module now carries no impl block.

(1) Can any of the residue be modeled instead? Per class, with the blocker named.

• Class A — the pure fold, 28 declarations (adjudicate, binding_rows, binding_disposition, declaring_candidates, declarer_of, closure_of, membership_map, direct_membership, module_prefix_of, membership_supported, blast_radius, disposition_label, disposition_auto_admitted, delta_subject_render, report_unadjudicated, render_delta, vocabulary_findings, and the types and constants they fold over). Every one is a pure function of two indexes and needs no host effect. They are Rust for exactly one reason, and it is not effort: their input type is host-only. ModuleDeclarationRecord and DeclarationIndex are produced by a host walk and have no .dag carrier. Authoring one here would be a second representation of a type gunbc.declaration_index_seed_growth already owns — the §3 violation this wall exists to refuse elsewhere — so the correct move is to follow that carrier's migration rather than fork it. Its own trigger already names this class ("the record builder and every finding function follow it"); this roster is one of those consumers.
• Class B — the acquisition, 4 declarations (git_stdout, in_sweep_scope, base_records, run_required_wave_admission). Named separately because they are blocked on a different grounding: there is no typed repository-read transport a .dag fold can call to obtain a file's text at a ref. That is the scm lane's subject, not a surface this change could have authored.

(3) The count went UP, 25 → 33, and that is the honest direction. The roster was joined against the module's actual declaration population instead of listed from memory; six declarations were missing from the first draft. gunbc.seed_growth already warns that hand_authored_declarations is an authored obligation roster rather than a derived denominator — this is that warning firing on its own first use, caught here rather than by a reviewer.

What was NOT done: the wall's coverage was not shrunk to lower the number. A smaller wall that adds less Rust spends correctness to buy a metric, which is the ratchet failure DESIGN names from the other direction.

A trap worth naming, met while resolving the merge

/usr/local/bin/gunbc is a June 26 binary. Running the generated-artifact gate through it
fails with a wall of error: function 'X' not found in scope — including fold, the
substrate's core catamorphism. That reads as corpus breakage and is not: the symbols are absent
from the old binary's view, not from the tree. If fold were genuinely missing, nothing would
compile.

Build the current one and invoke it by path:

ctrl-build --local -- cargo build --release -p v1-compiler --bin gunbc
./target/release/gunbc run --source-root dag --source-root src/v2 \
  --entry dag/tools/generated_artifact_gate.dag --function main_wet

It must be local: BuildBuddy runners are linux/amd64 and the session container is arm64, so a
remote build yields a binary that cannot execute here — and the regenerated files have to land in
this worktree anyway.

Recorded here rather than left in two people's heads, because anyone hitting it cold will file a
bug against the tree.

[gunbai-bot]

Review 56449 (codex/gpt-5.6-sol, REQUEST_CHANGES) — both findings confirmed and fixed in fdf66e2.

They were correct, and the rationale for the defect was sitting in my own doc comment on base_records: "that is the conservative direction: it can only make the wall quieter." That is exactly backwards, and it is the empty-observation narrow DESIGN names — ⊥-as-answer conflated with ⊥-as-ignorance. A widen is merely expensive; a narrow is silently uncovered.

Finding 1 — base-side parse diagnostics read as an empty record set. base_records now returns Result<Vec<ModuleDeclarationRecord>, String> and refuses when the base-side parse produced any diagnostic. A source that does not parse at the base revision has no readable declarations; it does not have zero of them. Reading it as empty made every head-side declaration in that file look new, so the wall adjudicated a baseline it had never observed.

Finding 2 — every git show failure treated as proof of a new path. Absence at base is now established distinctly, from git ls-tree -r --name-only <base> — an authoritative listing of what the base revision contains. A path missing from that listing was genuinely added by this change. A path present in it whose content cannot be read, or whose content does not parse, returns WaveAdmissionOutcome::NotEvaluated carrying the reason, so "could not compare" can never render as "nothing changed".

Mutation receipt (one mutation, restore between): baseline 15/15 green → revert base_records to Ok(Vec::new()) on the diagnostic arm → 14 passed; 1 failed, the single red being a_base_side_source_that_does_not_parse_refuses_instead_of_reading_as_empty. It fails alone. Restored: 15/15 green, --bins clean under -D warnings with forwarding env: RUSTFLAGS confirmed on the dispatch. The new arm carries a positive control on the same function — a well-formed baseline still reads a non-empty record set — so it cannot pass by refusing everything.

[gunbai-bot]

Review 56471 (codex/gpt-5.6-sol, REQUEST_CHANGES) — confirmed and fixed in 7b135fd.

The finding is right, and it is the same class as the two in review 56449 one level out: an observation that could not express what happened rendered as a verdict about what happened. run_required_wave_admission read git diff --name-only as both sides of the comparison. Rename detection is on by default, so a detected rename is reported as its destination alone — the source path never entered the base-side re-read (it is not in the list) and the destination is absent from the base tree. The module's entire baseline vanished, every declaration in it read as newly added, and a required wall could refuse an ordinary .dag rename over a delta it had invented.

Fix. diff_sides reads git diff --name-status -z -M and routes each entry to the two sides separately: a rename contributes its destination to the head-touched set and its source to the base side; an addition contributes only a head path; a deletion only a base path; an ordinary modification the same path to both. Scope is applied per side, since a rename can cross the sweep boundary in either direction and the two sides must be measured by one instrument.

Mutation receipt (one mutation, restore between). The parse is a pure function over the diff text, so the RED is authorable at the fixture boundary and is authored there rather than argued in a comment. Baseline 16/16 green → revert the rename arm to push the destination onto both sides, exactly the shape --name-only forced on the old code → 15 passed; 1 failed, the single red being a_rename_contributes_its_source_to_the_base_side_and_its_destination_to_the_head_side. It fails alone, and the A/D/M controls beside it stay green under that mutation — so the arm discriminates the distinction the review named rather than asserting the parse's shape. Restored: 16/16 green, fmt clean, --bins clean under -D warnings with forwarding env: RUSTFLAGS confirmed on the dispatch.

Also in this push: 450f351 repairs the whitespace nit from review 56459 — a line-wrap artifact left a 26-space run inside the namespace-wave-admission NOT RUN message, which reaches the operator's terminal verbatim.

— sent from nimble-moth-416