Bind floor witnesses to owner-qualified declarations

dag/extdeps/standards/rfc_8118.dag

@@ -23,7 +23,7 @@ import extdeps.uri {
 }
 import std.decl_ref { DeclarationRef, WholeDeclaration, decl_field_ref }
 
-data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+data rfc_8118_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
     scheme: Https
     locator: "www.rfc-editor.org/rfc/rfc8118#section-3"
@@ -37,10 +37,10 @@ data iso_32000_2_authority: ExternalAuthority = ExternalAuthority {
   }
 }
 
-data rfc_8118_normative_relationship_note: String = "RFC 8118 (Informational, March 2017) specifies PDF Open Parameters for fragment identifiers and OBSOLETES RFC 3778. Where RFC 8118 and ISO 32000-2 disagree on PDF document semantics, ISO 32000-2 controls — cited as iso_32000_2_authority in extdeps_model_scope.further_citations. This module models the upstream RFC 8118 section-3 vocabulary and wire semantics only. gunbc product admission policy lives in gunbc.citation.pdf_safe_profile."
+data rfc_8118_normative_relationship_note: String = "RFC 8118 (Informational, March 2017) specifies PDF Open Parameters for fragment identifiers and OBSOLETES RFC 3778. Where RFC 8118 and ISO 32000-2 disagree on PDF document semantics, ISO 32000-2 controls — cited as iso_32000_2_authority in rfc_8118_model_scope.further_citations. This module models the upstream RFC 8118 section-3 vocabulary and wire semantics only. gunbc product admission policy lives in gunbc.citation.pdf_safe_profile."
 
 // RFC 8118 section 3: PDF fragment parameters are an ORDERED sequence separated by ampersand; later parameters override earlier ones. Parameter values may be URI-encoded (RFC 8118); wire serialization routes through extdeps.uri uri_percent_encode_component.
-data citation_cit1_witness_split_note: String = "CIT-1 witnesses split across citation_cit1_witness_test and citation_cit1_consumer_witness_test because extdeps_external_authority_anchor is not module-scoped in v1-seed. dissolve-on: namespace-only resolution lane gives declarations module-scoped identity so one witness file can import both rfc_8118 and sysv_amd64 without homonym shadowing."
+data citation_cit1_witness_split_note: String = "CIT-1 witnesses split across citation_cit1_witness_test and citation_cit1_consumer_witness_test because the former generic external-authority anchor was not module-scoped in v1-seed. dissolve-on: namespace-only resolution lane gives declarations module-scoped identity so one witness file can import both rfc_8118 and sysv_amd64 without homonym shadowing."
 
 type NavigableUriRefusalCause
   = BaseLocatorAlreadyCarriesFragment { locator: NonEmptyStr }
@@ -58,15 +58,15 @@ data rfc_8118_section_3_locator: NonEmptyStr = "www.rfc-editor.org/rfc/rfc8118#s
 
 data rfc_8118: NonEmptyStr = "RFC 8118"
 
-data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+data rfc_8118_model_scope: ExternalModelScope = ExternalModelScope {
   subject: ExternalSubjectRef {
     declaration: DeclarationRef {
       module_path: "extdeps.standards.rfc_8118",
       decl_name: "rfc_8118",
       field: WholeDeclaration,
     }
   },
-  first_citation: extdeps_external_authority_anchor,
+  first_citation: rfc_8118_external_authority_anchor,
   further_citations: [iso_32000_2_authority],
 }
 
@@ -437,7 +437,7 @@ fn pdf_open_fragment_selector(sequence: PdfOpenParameterSequence) -> PdfOpenFrag
       }
     PdfOpenParameterSequenceWired { wire: fragment } =>
       match fragment_selector(
-        conforms_to: extdeps_external_authority_anchor,
+        conforms_to: rfc_8118_external_authority_anchor,
         value: fragment as NonEmptyStr,
       ) {
         CitationSelectorConstructed(selector) => PdfOpenFragmentSelectorConstructed(selector)

dag/gunbc/design/instrument_bob.dag

@@ -128,7 +128,7 @@ fn bob_amplitude_milli(s: BobState) -> Int {
   }
 }
 
-fn advance(s: BobState, dt_ms: Milliseconds) -> BobState {
+fn bob_advance(s: BobState, dt_ms: Milliseconds) -> BobState {
   let next_elapsed = s.elapsed_ms + dt_ms
   let next_amp = amplitude_at(initial_milli: s.initial_milli_px, elapsed_ms: next_elapsed)
   if next_amp < bob_visibility_floor_milli_px {
@@ -148,7 +148,7 @@ fn advance_descent_evidence(s: BobState, dt_ms: Milliseconds) -> DescentEvidence
     BobSettled => Strict
     BobRinging => {
       let before = bob_amplitude_milli(s: s)
-      let after = bob_amplitude_milli(s: advance(s: s, dt_ms: dt_ms))
+      let after = bob_amplitude_milli(s: bob_advance(s: s, dt_ms: dt_ms))
       if after < before {
         Strict
       } else if after == before {
@@ -305,7 +305,7 @@ fn bob_frames_from(s: BobState, interval_ms: Milliseconds, budget: Int, budget_a
       budget_allowed: budget_allowed,
     }
   } else {
-    let next = advance(s: s, dt_ms: interval_ms)
+    let next = bob_advance(s: s, dt_ms: interval_ms)
     let frame = bob_frame_of(s: next)
     match next.phase {
       BobSettled => BobSequenceSettled { frames: [frame] }
@@ -394,4 +394,3 @@ fn frames_max_abs_between(fs: List<BobFrame>, from_ms: Int, to_ms: Int) -> Int {
 fn frames_last_displacement(fs: List<BobFrame>) -> Int {
   fold(fs, init: 0, f: (acc, x) => x.displacement_px)
 }
-

dag/gunbc/host_effect_realize.dag

@@ -62,7 +62,7 @@ import std.realization_reconcile {
   ReadObserved, Grounds, DoesNotGround,
   reconcile_grounded
 }
-import v2.std.algebra { fold_list, list_snoc_item, list_append }
+import v2.std.algebra { fold_list, list_snoc_item, list_append, list_map }
 import extdeps.shell
 import extdeps.shell { posix_command_v_check_argv, shell_test_is_executable_argv }
 import extdeps.shell.exec

dag/gunbc/namespace_wave_admission.dag

@@ -73,6 +73,21 @@ data namespace_wave_admission_seed_growth_justification: SeedGrowthJustification
       decl_name: "TransitionAdmission",
       field: WholeDeclaration
     },
+    DeclarationRef {
+      module_path: "v1_compiler.namespace_wave_admission",
+      decl_name: "AdmissionSubject",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.namespace_wave_admission",
+      decl_name: "admission_subject_matches",
+      field: WholeDeclaration
+    },
+    DeclarationRef {
+      module_path: "v1_compiler.namespace_wave_admission",
+      decl_name: "admission_subject_render",
+      field: WholeDeclaration
+    },
     DeclarationRef {
       module_path: "v1_compiler.namespace_wave_admission",
       decl_name: "NAMESPACE_TRANSITION_ADMISSIONS",
@@ -219,7 +234,7 @@ data namespace_wave_admission_seed_growth_justification: SeedGrowthJustification
       field: WholeDeclaration
     },
   ],
-  reason: "THE OPERATOR RULED THAT A REQUEST TO ADD HAND RUST IS THE OCCASION TO MIGRATE OR DELETE HAND RUST (2026-08-26, relayed by warm-hawk-909: `yes we need to stop adding hand rust asap` and `use it as an opportunity to migrate/delete hand rust`). So this row answers at DECLARATION grain rather than as a count, and it records what the growth request bought back.\n\nWHAT THIS CHANGE DELETES OR AVOIDS, MEASURED, NOT ARGUED. (i) leaf_of was DELETED: it was a nickname for v1.00_core qualified_last_segment, which v1.05_emit_rust rust_fn_sig_leaf_name_dotted_note names as THE single authority for taking an authored spelling to its last segment. The wall now calls that mirror. That is a section 3 fork this change had introduced and removed before landing, and it is also the stronger construction, because the reduction the wall keys on is now the corpus authority rather than a local respelling. (ii) render_set was DELETED and inlined at its two call sites. (iii) claim_executor carried a BYTE-IDENTICAL PRIVATE COPY of git_stdout; the wall needed the same helper, and rather than land a third spelling the lib now owns the one copy, the bin`s copy is DELETED and its call sites read it. That is a NET REDUCTION of one pre-existing hand declaration and one fork.\n\nWHAT WAS NOT DELETED AND WHY, PER CLASS, BECAUSE `THESE ARE IRREDUCIBLE` IS A CLAIM AND A REASON PER DECLARATION IS AN ARGUMENT.\n\nCLASS A -- THE PURE FOLD, twenty-eight declarations: adjudicate, binding_rows, binding_disposition, declaring_candidates, declarer_of, closure_of, membership_map, direct_membership, module_prefix_of, membership_supported, blast_radius, disposition_label, disposition_auto_admitted, delta_subject_render, report_unadjudicated, render_delta, vocabulary_findings, and the types and constants they fold over. Every one is a pure function of two indexes and needs NO host effect. They are host Rust for exactly ONE reason and it is not effort: their INPUT TYPE is host-only. ModuleDeclarationRecord and DeclarationIndex are Rust types produced by a host walk, and there is no .dag carrier for a per-module declaration record. Authoring one now would be a SECOND REPRESENTATION of a type gunbc.declaration_index_seed_growth already owns -- the section 3 violation this wall exists to refuse elsewhere -- so the correct move is to FOLLOW that carrier`s migration rather than fork it. Its trigger already names this class: when the record derivation is modeled, `the record builder and every finding function follow it`. This roster is one of those consumers.\n\nCLASS B -- THE ACQUISITION, four declarations: git_stdout, in_sweep_scope, base_records, run_required_wave_admission. These are blocked on a DIFFERENT grounding, which is why they are named separately rather than swept into class A: there is no typed repository-read transport a .dag fold can call to obtain the text of a file AT A REF. That is the scm lane`s subject, not a missing surface this change could have authored. base_records additionally needs the frontend`s own per-source parse, which is the same acquisition boundary.\n\nONE THING THIS ROW WILL NOT DO: shrink the wall`s coverage to lower the count. A smaller wall that adds less Rust would spend correctness to buy a metric, which is the ratchet failure DESIGN names in the other direction.\n\nAND THE COUNT WENT UP RATHER THAN DOWN, WHICH IS THE HONEST DIRECTION. This roster was authored at 25 rows and is now 33, because it was JOINED against the module`s actual declaration population instead of listed from memory: leaf_of, binding_rows, vocabulary_findings and three constants were missing from the first draft. gunbc.seed_growth already warns that hand_authored_declarations is an authored obligation roster rather than a derived denominator; this is that warning firing on its own first use. Four methods were also converted from inherent impl blocks to free functions, because std.decl_ref names WholeDeclaration or NamedField and neither names a method on an impl block -- so as methods they would have been UNCITABLE items the roster structurally cannot enumerate. The module now carries no impl block, and every declaration in it is enumerated here.",
+  reason: "THE OPERATOR RULED THAT A REQUEST TO ADD HAND RUST IS THE OCCASION TO MIGRATE OR DELETE HAND RUST (2026-08-26, relayed by warm-hawk-909: `yes we need to stop adding hand rust asap` and `use it as an opportunity to migrate/delete hand rust`). So this row answers at DECLARATION grain rather than as a count, and it records what the growth request bought back.\n\nWHAT THIS CHANGE DELETES OR AVOIDS, MEASURED, NOT ARGUED. (i) leaf_of was DELETED: it was a nickname for v1.00_core qualified_last_segment, which v1.05_emit_rust rust_fn_sig_leaf_name_dotted_note names as THE single authority for taking an authored spelling to its last segment. The wall now calls that mirror. That is a section 3 fork this change had introduced and removed before landing, and it is also the stronger construction, because the reduction the wall keys on is now the corpus authority rather than a local respelling. (ii) render_set was DELETED and inlined at its two call sites. (iii) claim_executor carried a BYTE-IDENTICAL PRIVATE COPY of git_stdout; the wall needed the same helper, and rather than land a third spelling the lib now owns the one copy, the bin`s copy is DELETED and its call sites read it. That is a NET REDUCTION of one pre-existing hand declaration and one fork.\n\nWHAT WAS NOT DELETED AND WHY, PER CLASS, BECAUSE `THESE ARE IRREDUCIBLE` IS A CLAIM AND A REASON PER DECLARATION IS AN ARGUMENT.\n\nCLASS A -- THE PURE FOLD, thirty-one declarations: adjudicate, binding_rows, binding_disposition, declaring_candidates, declarer_of, closure_of, membership_map, direct_membership, module_prefix_of, membership_supported, blast_radius, disposition_label, disposition_auto_admitted, delta_subject_render, report_unadjudicated, render_delta, vocabulary_findings, and the types and constants they fold over. Every one is a pure function of two indexes and needs NO host effect. They are host Rust for exactly ONE reason and it is not effort: their INPUT TYPE is host-only. ModuleDeclarationRecord and DeclarationIndex are Rust types produced by a host walk, and there is no .dag carrier for a per-module declaration record. Authoring one now would be a SECOND REPRESENTATION of a type gunbc.declaration_index_seed_growth already owns -- the section 3 violation this wall exists to refuse elsewhere -- so the correct move is to FOLLOW that carrier`s migration rather than fork it. Its trigger already names this class: when the record derivation is modeled, `the record builder and every finding function follow it`. This roster is one of those consumers.\n\nCLASS B -- THE ACQUISITION, four declarations: git_stdout, in_sweep_scope, base_records, run_required_wave_admission. These are blocked on a DIFFERENT grounding, which is why they are named separately rather than swept into class A: there is no typed repository-read transport a .dag fold can call to obtain the text of a file AT A REF. That is the scm lane`s subject, not a missing surface this change could have authored. base_records additionally needs the frontend`s own per-source parse, which is the same acquisition boundary.\n\nPR #9436 CHECKABLE HAND-RUST RECEIPT (review 56812). The 53 exact transition admissions are DATA consumed by the already-rostered NAMESPACE_TRANSITION_ADMISSIONS declaration; they add no compiler function, type, or admission mechanism. Measured against origin/main after rebasing: `git diff --numstat origin/main -- src/v1/stage0/src/namespace_wave_admission.rs` reports 559 added / 7 removed. `git show origin/main:src/v1/stage0/src/namespace_wave_admission.rs | grep -cE '^(pub )?(fn|struct|enum|const|static) '` reports 34 declarations, and the same grep on the worktree file reports 37. The anchored added/removed forms over `git diff` report 4 and 1 respectively: the unchanged roster declaration moves from the old `DeltaSubject` element type to `AdmissionSubject`, while `AdmissionSubject`, `admission_subject_matches`, and `admission_subject_render` are the three net additions. All three are enumerated in this justification. The initializer is a literal authored roster, not a scan, file read, environment read, or computed predicate. Each row is exact on subject and disposition; stale rows refuse, so the roster has its own deletion trigger: any absorbed or vanished delta makes required CI red until that row is removed. This is an expansion in maintained lines, not in declarations or host capability, and it dissolves row-by-row with the transition it names.\n\nONE THING THIS ROW WILL NOT DO: shrink the wall`s coverage to lower the count. A smaller wall that adds less Rust would spend correctness to buy a metric, which is the ratchet failure DESIGN names in the other direction.\n\nAND THE COUNT WENT UP RATHER THAN DOWN, WHICH IS THE HONEST DIRECTION. This roster was authored at 25 rows and is now 36, because it was JOINED against the module`s actual declaration population instead of listed from memory: leaf_of, binding_rows, vocabulary_findings and three constants were missing from the first draft. gunbc.seed_growth already warns that hand_authored_declarations is an authored obligation roster rather than a derived denominator; this is that warning firing on its own first use. Four methods were also converted from inherent impl blocks to free functions, because std.decl_ref names WholeDeclaration or NamedField and neither names a method on an impl block -- so as methods they would have been UNCITABLE items the roster structurally cannot enumerate. The module now carries no impl block, and every declaration in it is enumerated here.",
   owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
   trigger: "Delete these in TWO steps, one per class above, and a PARTIAL migration is the expected shape rather than a failure. Class A follows gunbc.declaration_index_seed_growth`s first step: the moment a per-module declaration record is a .dag carrier, every one of those twenty-eight moves with it, because they are pure folds over it and nothing else. Class B follows the scm lane: when a typed repository-read transport can supply a file`s text at a ref. adjudicate, binding_disposition, declaring_candidates, declarer_of, closure_of, membership_map, direct_membership, module_prefix_of, membership_supported and blast_radius are pure functions of two indexes and move to .dag the moment the per-module record derivation does -- they need no host effect at all, so they follow gunbc.declaration_index_seed_growth's first step rather than waiting for its second. git_stdout, in_sweep_scope, base_records and run_required_wave_admission stay behind until a typed repository-read transport can supply a file's text at a ref, which is the scm lane's subject. A PARTIAL migration is the expected shape. What does NOT dissolve them is the phase moving to another host entry point, and what does NOT dissolve them is a hermetic witness over a fabricated pair of indexes -- the fixture suite already does that, and it is the evidence rather than the dissolution.",
   current_boundary: "src/v1/stage0/src/namespace_wave_admission.rs; src/v1/stage0/src/declaration_index.rs dotted_chain and ModuleDeclarationRecord.referenced; src/v1/stage0/src/bin/claim_executor.rs phase namespace-wave-admission; src/v1/stage0/tests/namespace_wave_admission.rs; dag/gunbc/namespace_wave_admission.dag"

dag/gunbc/roadmap_sandbox.dag

@@ -19,7 +19,7 @@ import gunbc.roadmap_workflow_stage {
   GoalAuditWorkflowSegment,
 }
 import gunbc.worker_lifecycle { WorkerProcessExited }
-import gunbc.roadmap_style { roadmap_css }
+import gunbc.roadmap_style { roadmap_css, workspace_band_paints }
 import gunbc.design.material { BuildRule, StaticRule, CssDecl, decl, serialize_rules, Material, paint }
 import gunbc.design.theme {
   ThemeRole, theme_roles, role_key, role_var, role_decl,

dag/gunbc/roadmap_style.dag

@@ -1,5 +1,6 @@
 module gunbc.roadmap_style
 
+import std.types { List, String, Int, Bool }
 import gunbc.design.material {
   BuildRule, StaticRule, CssDecl, decl, css_block,
   serialize_rules, reduced_motion_block,

dag/gunbc/spark/bootstrap_provision.dag

@@ -14,6 +14,7 @@ import extdeps.cloud.gcp.secret_manager {
   secret_manager_effect_required_permissions
 }
 
+import std.types { List, String, Int, NonEmptyStr }
 import product.placement_supply { HostIdentity }
 import v2.std.operation_argv { OperationRef }
 import std.measure { Second, second }

dag/std/citation.dag

@@ -458,7 +458,7 @@ data citation_cit1_pdf_profile_scaffold: Disposition = Scaffold {
   dissolves_to: RealizationDispatch,
   bind: DeclarationRef {
     module_path: "extdeps.standards.rfc_8118",
-    decl_name: "extdeps_external_authority_anchor",
+    decl_name: "rfc_8118_external_authority_anchor",
     field: WholeDeclaration,
   },
 }