Required CI bankrupted to a declared compiler gate: the witnesses lane prepares the roster's closure, not the tree; rust unit tests in their own job; the un-required phases declared as a rung drop

[briansrls]

Summary

Required CI is bankrupted to a fixed, small compiler gate. The witnesses lane no longer prepares the whole tree (4,260 modules, ~87 min end to end); it prepares the closure of a declared roster — v2.test.* plus ~20 test.claim.* compiler modules, v2.workflow.required_floor.required_gate_prefixes — and folds only the claims inside it. Everything outside is DeclinedOutsideRequiredGate, counted, and left to receipts. Rust unit tests run in their own job. The probe / v2-emission / emit-compile / partition-crates / generated-artifact phases leave the required set (declared as rung drop required_gate_bankruptcy, 2026-08-29); regen stays.

Measured at 4c2beb5 on the GitHub runner — the first green run under the gate: witnesses lane 15m12s (job wall) = ~3 min build/setup, gate closure 45 s + 27 s (entry index built once, closure 2,021 modules, bare_pulled=50), strict preparation 6m33s over 2,019 modules, fold ~4.5 min over 2,830 planned claims (3,427 sites; 366 declined-long, 167 cost-debt, 64 outside-gate). planned=2830 executed=2830 passed=2754 known_red_held=27 route_gap_held=49 failed=0 interrupted_before_verdict=0 … verdict=FloorClean unexpected_failures=0. Build lane 11m03s, of which regen is ~10 min (the v1 emitter is 6 min of that). rust-unit-tests first ran on 4c2beb5 and was cancelled by its own timeout-minutes: 60 with 204 of 682 tests finished (compile 2m49s): ~126 of the lib "unit" tests each build a fresh multi-entry index over src/v2+dag (measured on srv2 under nextest: 97 tests over 60 s, ~197 single-thread minutes, self_compile_all_modules 505 s), the runner executed them serially, and 44 of them fail on rot no CI had ever run into (cargo test was never a CI step before this PR). Now: those tests carry #[ignore = "live-corpus: …"] (the crate's manual: convention; enumerated by cargo test -p v1-compiler --lib -- --ignored --list, named in the rung-drop row's population), and the unit population runs green in ~9 s after the compile (srv2: 535 passed / 0 failed / 140 ignored). The 15 failures inside the unit population are repaired at their authorities — see the second list below — including two real production defects and one v1 typecheck defect.

What the gate exposed (each fixed here, none hidden)

• The reference-closure index was a once-per-process cache keyed on module count; the gate prepares two subjects (policy closure → roster → gate closure). Now keyed by subject digest, bounded to 2.
• The floor evaluated gunbc.output_policy and floor_naming_hygiene by name from the policy module's frame; that only worked because the whole-tree reference closure happened to reach them. Each authority is now evaluated in its own module's scope; all three are explicit closure seeds.
• Loader/scope divergence: the entry loader bare-scans only import-free sources, while claim_scope_for follows bare references from every module. Under the whole tree the flat bare-name channel hid it; under the gate vacuity_test refused NoSuchFunction one hop per run. The gate closure now runs the loader's own bare scanner over every module to a fixpoint (bare_pulled=50). gunbc run on such entries is still broken on main for the same reason — not fixed here.
• Rosters (expected-red, route-gap + expectations, cost-debt) are joined only over identities inside the gate; outside-gate rows are withheld with the same accounting as cost-debt withholding (39 / 154+66 / 122 rows, printed).
• One route-gap row is now budget-refused before reaching its effect → cost-debt roster (cost debt wins). Three lens_module_gate_witness "live" rows PASS under the narrower corpus on both hosts → removed from expected-red; the narrowing is stated in the commits.
• A positional bill: the src/v2/lens pool-root module_path_index fill (~1.07 s) was charged to whichever lens_module_gate_witness live claim ran first, interrupting a different one in each of three consecutive runs. Preparation now evaluates the declared producer (v2.lens.registry.completeness.lens_registry_completeness_live_facts) once in its own module's scope and adjudicates the fill as a preparation warm (ModulePathIndexBuild/lens-pool-roots); no cost-debt row for a claim that only paid someone else's fill.
• Eleven claims that are interrupted before verdict on the gate-bounded subject on both hosts, run after run, plus the four bootstrap_footprint_anchor claims at 474–505 ms against the 500 ms ceiling, join the cost-debt roster as proven chunk 12 (with the reason annotated on the chunk).

Test plan

• claim_executor --required-ci --required-lane witnesses and --required-lane build on srv2 (12 lanes, logs ~/gunbc-gate/witnesses-lane*.log) and on CI at every push; final CI run on this head is the acceptance.
• cargo test -p v1-compiler --lib in the new rust-unit-tests job (unit population only; the live-corpus class is --ignored).
• dag/test/claim/discovery_census_witness_test.dag: new w_site_outside_the_required_gate_is_declined arm.

What the first cargo test exposed (each fixed at its authority, none hidden)

• Real defect, Anchor a relative source root the same way in both module-index builders #9548: try_index_source_root_into_module_index keyed files by the walked path — absolute once the root was anchored — while the strict builder keys through module_index_path_key; the primary-precedence index disagreed with the strict one on every path. Same authority now; primary_precedence_pool_fills_only_absent_modules was the discriminating RED and stays.
• Real defect, Close the remaining receipt-continuity production bypass: parse merge-base event data, enforce exact append-only prefix, hash every field #7791: try_build_module_index carried if root_idx > 0 { continue; } ahead of its collision refusal, so a module declared in two roots shadowed silently in the builder named strict. Guard removed; overlay callers have build_module_index_primary_precedence. duplicate_module_path_across_roots_refuses_loudly was the RED.
• v1 typecheck defect, Compiler floor — one declared-type inhabitance authority, two grammar positions wired, ten declared #9194: declared_type_inhabitance reads params as generic type parameters, which is exactly what a callable formal carries, so every higher-order call produced a counted DeclaredTypeInhabitanceUndecided with a false reason. direct_call_argument_inhabitance_diags now excludes callable formals like its sibling relation. .dag edit + regenerated mirror (two regen passes: the test blob lives inside the emitter).
• Stale authority rows after the Reorganize dag/gunbc files into domain-specific subdirectories #9637 reorg: 12 entry literals in gunbc.ci_layer_roots, 2 in gunbc.offline_local_recipe repointed; the rows whose subjects 611fd02 / source_has_suspect renders an unreadable source as clean: typed not-established across both roster_gate twins #9206 deleted are gone. The three witness_deferral_freeze rows for relocated witnesses are deleted, not repointed — that gate defines relocation as growth (FrozenPathDeferralGrew, compared at the merge-base on CI) and the roster may only shrink. gunbc.non_fold_residue gains its 22 missing sites and loses 4 stale ones; its .dag twin then passes (leaves floor_expected_red) and sits at 629 ms against the 500 ms ceiling (joins cost-debt chunk 12).
• Deleted subjects: cli_run::floor_witness_a_prove (runner, prove test and fixtures left with FLOOR-Y); the docs/probes/census_extra_excludes.txt pin tests and helpers (Bankrupt the measurement corpus: delete docs/probes whole, boards and instruments alike #9132).
• Test rot: a revision-addressed git show literal the reorg rewrote to the post-reorg path; a method-existence witness anchored on a Primitive() frontier row that no longer exists.
• Runner-only collision (first CI run of the unit population, dc3ca52: 533 passed / 2 failed / 9.59 s): resolve_host_tool_program_tests wrote a fixed-name directory under temp_dir(), which is the host's shared /tmp on a self-hosted runner; a directory another runner slot's uid left behind made the write PermissionDenied. The probe root now carries the process id.
• Early aborts: four tests were "fast" only because they died on a missing path; repaired, they read the live tree for 2–4 minutes and join the live-corpus class. One of them (merge_base_authority_projection_matches_jsonl_carrier) still fails after 210 s with unknown RoadmapAcceptanceEvent variant <invalid-symbol> — receipts-lane rot, recorded here.

Not done here: the receipts workflow for the un-required phases (push-to-main, non-blocking) and the roster narrowing that would drop the ~250 gunbc.* modules v2.test.* drags in. Program issue for the next step: #9664. Also left for follow-ups: test.claim.expectation_frontier_witness_test names the deleted long-lane file (outside the gate); the affected-set kernel (floor_diff_edits_from_diff_text, rerun_frontier_nodes_for_entry, …) has had no production consumer since FLOOR-Y and should go with its remaining fixture-dependent tests.