namespace-structural-observations: the closing check first, then one ordinary compiled file answering all four through it

[gunbai-bot]

Closes the roadmap row namespace-structural-observations in the order its own first slice prescribes: the closing check first, then one ordinary compiled file producing all four in-file visibility observations through it.

The closing check (written before the production that satisfies it)

gunbc.namespace_structural_observations_contract requires four capabilities, each ESTABLISHED only by assessing a typed production observation through the single authority that already owns that judgement (gunbc.namespace_reference_derived_closure_admission assess_reference_binding_observation) — never by counting variants, so four StructuralBindingProductionRefused observations green nothing. The set difference is the parent row's own fold, parameterized in its required population rather than copied, so this row cannot drift from the parent's dominance rule and the parent's closing predicate is unchanged.

Subject provenance is the half the 2026-08-04 retraction named as missing. Every admission carries the module path THE PARSE DECLARED — read out of ParsedOccurrenceBindingSourceReady.module_path, never echoed from the caller's file argument — and the check refuses unless all four name the one declared subject. Four admissions from four hand-built sources satisfy the capabilities and fail this check, which is exactly the difference between the row as written and the fixture suite that preceded it.

One ordinary compiled file

The four hard-coded per-clause fixture sources in the v1 producer are deleted. It now takes one subject plus four probe spellings from its caller and reads all four observations out of a single parse; it knows no fixture text. One ordinary module carries all four cases: an earlier neighbour called from a later sibling, one let name in both arms of a decision, a callee declared further down, and a parameter plus a let of one spelling at two positions.

Each case shown failing on its own

Four red controls, each a single replace on the accepted subject text, so a control cannot quietly become a different program. Each asserts the missing-capability set is EXACTLY the capability whose rule the edit broke — a control asserting only "the contract is false" would pass equally well if the bridge returned nothing at all. A fifth control changes only the module declaration: all four capabilities still establish and the row still refuses, which is the provenance clause failing on its own.

The typed subject carrier, and the two ruled controls that came with it

The compiled-module result was a String with EMPTY standing for "the parse refused" — the empty-observation narrow, in a carrier that had a typed absence available. git grep nrdfc_compiled_module is absent at this PR's merge base and absent on main, so this PR introduces it; fixing an inherited defect in a follow-up is ordinary, landing a new one knowingly and scheduling its repair is not. It is now StructuralObservationSubjectModule = SubjectModuleProduced { module_path } | SubjectModuleProductionRefused { gap }, declared in std.reference_binding_observation — the neutral carrier both sides already import, so there is one authority rather than a v1 spelling and a dag spelling of one concept — with the refusal reusing ReferenceBindingProductionGap rather than a second gap vocabulary. "Fail-closed today" was not sufficient: "" never equalling the declared subject was a property of what the one current consumer did with the string, not of the carrier.

Two further controls, each discriminating by construction — delete the conjunct it targets and it reds:

• a_row_nobody_produced_does_not_close_this_row. Stated honestly: this is the authorable projection of the ruled control "bridge registration removed → closing witness cannot execute", not that control itself. A witness cannot unregister a host builtin, so it asserts what that state looks like to this contract — no rows offered — and that a contract closing on zero rows would be green for a row nothing produced. Weaker than the ruled version, and discriminating: it is the only thing that fails if count(rows) > 0 is deleted.
• established_capabilities_with_an_unproduced_subject_still_refuse. The carrier-shape control. Flattening the result to Bool keeps the capability half and loses the subject half, so the discriminating input is rows whose four capabilities all establish over a subject identity that was not produced.

A third ruled control is deliberately absent, and reading the producer made the reason stronger than "wrong owner". The ruled control is "live-tree acquisition introduced → SubstrateInputsOnly refuses". v2.std.live_tree live_tree_disposition_note states in the tree, at length, that a row declaring SubstrateInputsOnly while actually reading live state is re-checked by nothing — the enforcement it used to name (the nightly affected-set falsifier's predict-only cold run) died with falsifier.yml in the 2026-08-15 floor cut, and its re-add sits on DESIGN's unguarded list. So the control would not be testing a wall I do not own; it would be asserting a wall the corpus documents as absent, which is worse than the permanently-green decoration it superficially resembles, because it would be cited as coverage of a known no-wall.

One qualification, because "nothing checks it" is very slightly too strong and the difference is load-bearing: v2.std.effect_reach reads_live_tree_effective takes the declared answer first and falls through to a derivation only when the row says SubstrateInputsOnly — so a partial backstop does fire on exactly the lying case. Its ceiling is declared at effect_reach_detection_ceiling and executed by a planted fixture pair: it classifies a closure as host-reading only when a repository path literal and a host-sink call shape both occur, so a closure performing a real read while naming no path derives NOT-live. That is a declared, executed ceiling — not an enforcement a control could stand on, and not nothing either.

A control asserting merely that the disposition field reads SubstrateInputsOnly is not written here on purpose: its red is unreachable by construction, which §4b calls worse than absent. The disposition of this gap is an obligation, not a ceiling — the named next-rung capability is call-reachability-grade classification (fn-arrow DependencyView over lowered bodies), and it is unbuilt.

The host bridge, and why it exists

The observations come from v1.compiler.parse, and the required floor resolves dag and src/v2 only; measured over the corpus, no dag module imports v1, so a dag witness cannot name the producer. namespace_structural_observation_admissions is a hermetic transport across that boundary — one in-memory source, no repository file read, no module index — so the witness declares SubstrateInputsOnly truthfully and executes in the floor rather than landing in its DeclinedLiveTree arm. It decides nothing: subject from the caller, observations composed in .dag, judgement by the shared authority. Declared and enrolled as seed growth (gunbc.namespace_structural_observation_bridge_seed_growth, 2 hand items), with a trigger naming the CAPABILITY it must be sufficient for rather than an artifact that would contribute to one.

The two rejected alternatives are recorded in that row: a witness under src/v1/tests would bind the contract to evidence no required run executes (coverage by illusion), and rebuilding the observations on the v2 pipeline would put a second resolution authority beside the P2a/P1 kernel.

Measured

• All six witnesses PASS through the bridge from a dag-only witness (--source-root dag --source-root src/v2), and independently on both architectures via the direct v1 route before the bridge existed.
• claim_executor --required-regen: first_generation_equal=true, EXIT=0.
• Generated artifacts converged via generated_artifact_gate main_wet (ROADMAP.md, the dispatch surface).

One substrate limitation found by execution and recorded rather than routed around

A .dag record embedding a sole_constructor-bearing coproduct emits Serialize-only with a private field, so the seed does not compile (E0277 on the record, E0616 on the receipt field). That is why the producer exports the compiled module and the admissions separately; both are pure functions of (file, source), so one pair of strings cannot pair a module path with admissions from a different subject.

Note for review

Four emitted mirrors (v1_compiler_emit_{core_support,go,python,rust}.rs) are not this change's — they are a pre-existing regen drift on main that my regen correctly picked up, already in flight as #9537. Measured by hash, all four are byte-identical to #9537's (6317702515, e4e4fd9bd2, 705cfab2ca, 8abac9e235), so this change contributed no qualification of its own; had it, the bytes would differ. Its cause (established by smart-ram-730 and clever-boar-140) is a composition of #9486 and #9461, merged three minutes apart from an identical base with no textual conflict for any gate to see. Identical bytes cannot conflict, so #9554 and #9537 may land in either order. Installed from the regen candidate, never hand-edited; --required-regen is the adjudicator and it is green.

🤖 Generated with Claude Code

https://claude.ai/code/session_012nRBJLauCBLwBH8inAFHje