Factor the emitter's per-candidate import decision into a four-armed typed disposition and count it

[gunbai-bot]

What

v1.compiler.emit_rust reference_derived_use_lines decided, per candidate, whether to synthesize a missing use line — inline in a flat_map whose every non-surviving arm returned the empty list. Three different reasons for dropping a candidate were indistinguishable from each other and from having asked nothing.

That decision is now reference_derived_candidate_disposition: one function, one call per candidate, four arms.

arm	meaning
CandidateSurvived { provider_module }	cross-module, registry-resolved, export-proven → a use-line is synthesized
CandidateOwnModule	not-applicable — the module provides the name itself, no import was ever owed
CandidateRegistryAbsent	the reference resolves to nothing — emitted crate carries an unqualified path (E0425)
CandidateExportProofFailed { provider_module }	provider found, provider_proven_exports_symbol refused — same consequence

Four arms, not the three the brief named. CandidateOwnModule is not-applicable and the two drop arms are genuine missing imports — opposite owners, opposite repairs. Folding them is the not-applicable-rendered-as-malformed conflation DESIGN records as its most-repeated failure.

Two consumers, one decision

reference_derived_use_line_plan returns { lines, rows } from a single pass: the use-lines are the survived arm's names, and reference_derived_census counts the same rows. A census that disagrees with the emitter is unrepresentable, not merely unlikely — there is no second copy of the decision to drift from. emit_module_full carries the rows out beside the TextFile, so no consumer can obtain the bytes without the decisions behind them existing.

Byte-identity — measured, and the first cut failed it

The structural argument ("the use-lines are the survived arm, so bytes cannot move unless the decision moves") is true and was insufficient. It covers the decision and is silent about everything the refactor touched around it.

Measured on a scoped emit of src/v2/compiler/00_compile.dag (175 files, roots dag + src/v2), each arm emitted by a gunbc built from its own stage0 mirror:

• same source, two independent builds → identical (the instrument is stable, so a diff means something)
• baseline vs first cut → one file differed: v2_lens_enforcement_vocab.rs, two pub use lines swapped in order, same set, nothing added or dropped. Reproduced across three builds.

The cause was not the decision — it was the evaluation order of emit_rust's preamble, which the factoring had rearranged. Restoring the original order restored byte-identity.

That order-sensitivity is recorded, not buried: an annotation on the preamble carries the specimen, the reproduction, the suspect (a shared memo or interner upstream of the import-line stream — not established here), and its next-rung trigger, and names the ordering as order-preserving-by-necessity so a later "simplification" does not reproduce it.

Verified

• --required-regen: first_generation_equal=true (regenerated mirrors included)
• --required-ci --required-lane build: phases_run=3 failed=0, v2-emission blocking=0, partition-crates 14/14
• baseline-vs-change scoped emit: BYTE-IDENTICAL

What is deliberately not here

No corpus figure is quoted anywhere, because none is producible. Reaching the census needs a resolved graph, and the only .dag route is a nested compile the interpreter refuses — NoSuchField { type_name: "Node", field: "ident" }, measured on three subjects. That is why gunbc.compile_diagnostic_census and tools.multi_module_compile_fixture both route through a host builtin. An instrument was written and then deleted rather than landed and cited: one that cannot execute is the decoration DESIGN calls worse than absent.

reference_derived_census_rung_note declares the rung as mitigatable with three independent next-rung triggers — the class joining the fail-closed wall, an executing home for src/v1 witnesses, and a nested-compile route to a figure — and states plainly that the population is countable by construction and uncounted in fact.

A second annotation records why this carries no completeness envelope: v2.workflow.legacy_binding_observation is the right shape but joins against an independent expected denominator, which this census does not have. It makes no completeness claim, so it wears no completeness envelope — and names that module as where the join belongs if a denominator ever lands.

Nothing about the repair changed. The same candidates survive and the same use-lines are synthesized; the deficit's frequency is now observable instead of zero.

Evidence

v1.tests.claim.reference_derived_disposition_census_witness_test — five rows, four naming the four arms (two differing only in whether the export set proves the symbol, so no constant or disabled mechanism satisfies both), one pinning the census to being a projection of retained rows. All five pass when run directly on 2026-08-27. They are declared NOT run by CI, with the reason checked by grep in both directions: src/v1/tests/claim is outside witness_discovery_scan_dirs, and the scoped batch died in the 2026-08-15 floor cut. Direct execution is evidence the assertions hold, never evidence that CI runs them.

🤖 Generated with Claude Code

[gunbai-bot]

Both findings from review 56613 addressed in 166296567a7. One accepted as a defect, one accepted as a wording defect over substance I'm refusing — with the reason, so you can push back.

1. §4c violation — ACCEPTED AND FIXED.

You're right and the row was the anti-pattern §4c names. reference_derived_census_rung_note carried a declared rung, three next-rung triggers, a dated receipt and a dissolution condition through a data … : String — the §4c list verbatim, in the #6262 shape where intent is mechanically indistinguishable from program data.

It is now a leading // annotation. You offered the typed rung carrier first and that is the right destination; it does not exist to route to today. DESIGN's own declared rung drops sit as prose in Building-&-checks, and the executable claims carrier that would hold them is Stage 1 of the compiler-guarantee recovery plan and is unbuilt. The annotation states that and names the migration to that carrier as its own dissolution, so this doesn't quietly become permanent.

Worth noting the conversion also removes a pub fn from the emitted seed (mirror −9 lines) — the seed shrinks rather than grows. I did not touch the other 30 data …_note rows in this file; that's the pre-existing convention and widening into it is a separate change, not this PR's to make.

2. Self-authorized scaffold — SUBSTANCE REFUSED, WORDING FIXED.

The order-dependence is pre-existing. It is a property of the emitter as it stood before this change, not something introduced here; the ordering kept below is the ordering that was already there. No artifact is added that must later be deleted, so there is no admitted debt for an operator to approve — what is preserved is the status quo, and what is new is only the knowledge that preserving it was necessary. The 2026-08-10 ruling governs creating temporary work ("a dissolution condition … does not authorize creating the debt"); §4b(2) separately requires a discovered class below its ceiling to name its next-rung trigger, so the trigger there is an obligation, not a permission. Without it, a measured defect sits recorded with no way to tell "cannot climb" from "nobody has".

That said, your reading was invited by my own word choice. I called the kept ordering a "workaround", which is wrong twice over: it isn't debt, and DESIGN's workaround rule is about routing around an obstacle without diagnosing it — the opposite of what happened. The line was stopped, the bytes were measured, the cause was located to the preamble, and the original order was restored. The word is gone and the annotation now says all of this explicitly, so the next reader doesn't re-derive your objection.

Also fixed a citation detail: the line range in the finding (05_emit_rust.dag:10–41) points at an import block, not the annotation. I addressed the substance rather than the coordinates.

Re-verified after both edits (annotations are §4c-erased and free; deleting the data row is not, so this was measured rather than assumed):

• --required-regen: first_generation_equal=true planned=137 executed=137
• scoped emit of src/v2/compiler/00_compile.dag against a main baseline fetched at 9917d4a9b3f: BYTE-IDENTICAL, with a same-binary two-run control confirming the instrument discriminates

One process note on that last point, since it bears on how much the measurement is worth: three intermediate attempts at this diff produced apparent byte moves that were artifacts of a broken baseline — the remote runner's checkout is shallow, so HEAD~1 does not exist and the baseline restore died silently. I did not report any of those as findings. The result above is from the first run where both arms built successfully and the baseline was a genuine fetched main.

— sent from clever-boar-140