File the emitted-record Deserialize gap as its own class row

[gunbai-bot]

The class

A .dag record embedding a coproduct whose variant carries a sole_constructor type emits a Rust record deriving Deserialize over a Serialize-only, private-field struct. Both emitter rules are individually correct — an unforgeable carrier must not be reconstructible from wire bytes, and ordinary records derive Deserialize — and they compose into a shape the author cannot write.

Found by execution while building #9554, where the obvious single row { compiled_module: String, admission: ReferenceDerivedClosureAdmission } was unavailable. It was recorded there only as a note inside the producer that worked around it, which is found solely by someone already editing that producer. DESIGN §4b asks every discovered error class to file one row; this is that row.

Measured, not recalled

code	lands on	why
E0277	the emitted outer record's derived Deserialize	the embedded coproduct does not implement it, because the sole_constructor type inside one variant is Serialize-only
E0616	a read of that type's carried field from outside its emitted module	the field is emitted private — the wall behaving correctly; the accessor is the sanctioned route

Two rows rather than one: they land on different constructs and either can appear without the other.

What is claimed, and what is not

Rung: mitigatable, stated as such. Nothing in the ordinary .dag compile path refuses the shape — the .dag is accepted, and the refusal arrives as a generated-Rust build failure at maximum distance from its cause.

No executing RED is enrolled, and the reason is the fixture boundary rather than a saving. The only way to author this shape today is inside the seed's emit closure, where it stops the required build for every subject at once rather than going red on its own. Per §4b(2) that missing harness is the class's next-rung trigger, not a ceiling, and per the 2026-08-26 rule the trigger names the capability — emitting and compiling a candidate module the seed does not import — explicitly refusing the artifact form (an entry point that emits and compiles one module is insufficient unless it can carry a non-seed module).

The carried predicate asserts only that the finding is recorded with its codes and its shape. A predicate asserting the gap is closed would be satisfiable by editing this file, which is the validation-standing-where-construction-was-available tell.

Scope

One new gunbc/ module, imported by nothing. It does not enter the seed's emit closure, so it produces no mirror — confirmed against the analogous finding carrier gunbc.fabric_capacity_class_gap, which likewise has none. Parsed and evaluated green from the tree-built binary over --source-root dag --source-root src/v2.

🤖 Generated with Claude Code

https://claude.ai/code/session_012nRBJLauCBLwBH8inAFHje

[gunbai-bot]

review 57088 — thank you, the objection was fair and it found a false sentence.

The rung stays at mitigatable; the comment that made it look contradictory is deleted, not softened. That comment read "the only way to author this shape today is to put it in the seed's emit closure", which would indeed make the seed build a gate over the whole population. It is false.

Measured over the 4234 modules indexed under src/v1 + dag + src/v2: the seed closure is 134, the emit-compile roster's eight entries add 5 more, so 139 are covered and 4095 are not. On those 4095 the shape is accepted, the bad state is written, and no build ever fails — nothing refuses it. Under §4b(1), a class's rung is the minimum across its in-scope paths, and that is the path that sets it.

And on the 139 covered modules the refusal is still not prevention. §4b reserves mechanically preventable for a mechanism that exposes and blocks the invalid state. What happens there is a build break at a distance from its cause, in generated code the author did not write, with no typed located diagnostic naming the source construct — containment after failure, which is the definition of the rung below it. The invalid state remains writable on every path, including that one.

The no-executing-red justification now follows from the same split rather than from the deleted claim: on the 4095 there is no signal for a probe to observe, and on the 139 the shape stops the required build for every subject at once rather than asserting a red on its own. Neither half yields an enrollable red — which is exactly the capability the trigger already names (an expected-red compile arm).

Pushed as 3214c09732b, carrying the measurement as its own data row so the claim is re-derivable rather than asserted.

— sent from quick-swift-434