XL-5 model-work: v1 consumer census and claim conservation wall on the exact cut's vocabulary

[gunbai-bot]

XL-5's sequencing is census → disposition → delete, and until the XL-N gate releases this lane is model-work only. Schema landed; XL-N gate not satisfied. No Symbol representation pinned. This PR is the census half: two .dag carriers plus fixtures, every assertion executed, no transport implemented, no collision-zone file touched. Merging marks SchemaLanded only (XL-N Manager ruling): the live consumer population is a lower bound with blocking rows, the live claim roster is unmeasured, and v1_bankruptcy_transaction_admitted over the live population is asserted FALSE by an executing witness (consumer_census_live_gate_refuses_even_with_every_successor_realized) — even when every successor the census claims is handed to the gate as realized. Every DiscoveryProducer carries a typed CommitSha and FloorDiscoveryTreeId, so the population reads as an observation of the tree it was measured on, not as a current fact.

Live measurement binding (post-merge, per the RELEASED ruling). v1_census_revision / v1_census_tree in gunbc.v1_consumer_census are bound to 0bdb8dc3a22cd4cb7736b7e83d4df6c132051259 / tree 168f313cdd9562ff01334c3ac2d154f4c5db6d96 — the merge of this branch with main including #9676 (a1a40a0) and the Symbol authority (24fc4a3). The seven producers were re-run on that head: identical rows; the only count that moved since the first measurement is the .dag argv sweep (85 → 88 files; still un-joined, still hole (1) of missing_basis). floor_standing_is_fixture_member now eliminates the two RequiredFloorDisposition arms #9676 added (DeclinedOutsideGateClosure, DeclinedDiscoveryExcluded). Focused rerun after the merges, remote: consumer census 12/12, witness census 10/10, rust_item_host_observation 22/22, stage0_rust_product_reachability 7/7, stage0_rust_source_lifecycle_scaffold 46/46 PASS.

Gate enrollment (by identity, not by CI colour). The witness modules are test.claim.self_host_v1_consumer_census_witness_test (13 test fns) and test.claim.self_host_v1_witness_census_witness_test (10) — named under the self_host_ seed of v2.workflow.required_floor required_gate_prefixes, because the floor prepares by module name and the earlier test.claim.v1_* names were declined_outside_gate_closure (0 executed, run 33288728871). The one host-observation falsifier I had added to the main-owned rust_item_host_observation_witness_test moved into the consumer-census module as consumer_census_tooling_tree_projects_to_the_assembled_package_namespace; that main module is now untouched. Run 33289815744 (c59f675) required-floor-disposition artifact: 23 rows planned/passed, 0 declined, old names absent; summary planned 2855 → 2878.

What lands

gunbc.v1_consumer_census — the population that must be EMPTY before the bankruptcy transaction runs.

• Rows are gunbc.replacement_cut BoundaryConsumer relations (consumer × consumed-authority, DeclarationRef both sides) carrying the authority's own ConsumerDisposition. No minted disposition vocabulary: replaced-by-native-v2 = ReplacedByY; retired-with-deleted-subject = Retire; still-required-and-blocking = RetainSameContract { coverage: CoverageOpen } — exactly what admit_replacement_cut_plan refuses as UncoveredSurvivingConsumer, so the blocking column here and the refusal there cannot disagree. This is the remeasurement gunbc.interpreter_replacement_cut registered as RegisteredCutRemeasureRequired; that registration stays until the population is Complete.
• Every row carries medium (8 arms — the floor cut measured a 5-in-8 false-positive rate from asking one medium), subject, and a DiscoveryProducer with instrument + command + revision. A row with no producer has no constructor.
• The four self-host shims are v1 consumers slated for a disposition, not infrastructure. Their citability is DERIVED: v1_shim_partition runs item_declaration_ref_in over the four items against a supplied namespace table. Under the live table all four are BoundaryConsumer rows (v1_compiled.<crate>.lib → v1_compiler.v1_rt) and the uncitable list is empty by construction; with the tooling row removed all four return to V1UncitableConsumer. Both halves are executed (consumer_census_tooling_row_decides_shim_citability).
• Population is honestly PopulationMeasuredLowerBound with its three remaining holes named (unclassified .dag argv rows, the deletion-set blind spot, unmeasured reachability); the admission gate reads completeness, so the transaction refuses today by construction. v1_boundary_census() projects into the exact carrier's BoundaryCensus.

gunbc.rust_item_host_observation — the namespace row (XL-N Manager decision):

• The tooling tree dag/gunbc/instruments/ gets namespace_prefix: "v1_compiled." — the package tools.self_host_curated_seed_linked_harness assembles the shim crates into, so the root is the crate name by the same rule that gives src/v1/stage0/src/ the v1_compiler root. Deliberately not tools.: the citation gate (citation_is_outside_index) treats a .dag-declared root as in-index and would refuse every Rust citation under it.
• The four rust_source_prefix_* constants move here from the stage0 scaffold (importing them the other way closes the cycle scaffold → seed_growth_admission → this module); the scaffold and stage0_rust_product_reachability import them from here. The projection takes its table as a parameter (rust_module_path_for_repo_path_in, item_declaration_ref_in); the bare forms pass the live rows.

gunbc.v1_witness_census — the wall that stops the cutover greening by losing subjects.

• One ClaimCutoverDisposition per pre-cutover claim: Retired { deleted_subject, evidence } / ReplacedByStronger { replacement, covering_relation, executed_red } / StillRequired { surviving_subject, native_identity }. No undecided arm.
• Floor standing is a separate axis — v2.workflow.required_floor RequiredFloorDisposition, imported not re-spelled. Fixture/support modules are refused by structural relation (DeclinedFixtureMember), never dispositioned.
• The join is on DeclarationRef (declaration_ref_eq), not a rendered module::decl string — XL-1's producer keys on identity_ref: DeclarationRef, and two spellings on the join key is the hollow-alias class. v1_native_roster() is the derived List<DeclarationRef> XL-1 joins back.
• Projects onto EvidenceDisposition so the exact cut's evidence rows are derived. Five-direction identity-join conservation: lost subject, fabricated subject, merged native target, self-referential red control, fixture member dispositioned. Live roster declared ClaimRosterUnmeasured — its own witness goes red if anyone types a roster in.

Evidence (all claim_batch, built and run on BuildBuddy)

• test.claim.v1_consumer_census_witness_test — 11 PASS
• test.claim.v1_witness_census_witness_test — 10 PASS
• test.claim.rust_item_host_observation_witness_test — 6 PASS incl. the new the_tooling_tree_projects_to_the_assembled_package_namespace
• test.claim.stage0_rust_source_lifecycle_scaffold_witness_test — 46 PASS; stage0_rust_product_reachability_witness_test — 7 PASS (the relocation)

Every refusal is asserted as a PAIR (green on the clean fixture, red on the same fixture with one planted violation). All 24 live decl_ref citations grep-verified against their module headers.

Two red pushes on the required floor, both real and both fixed: (2) the namespace-wave-admission phase refused six TargetChanged binding deltas — the wall seeing the prefix-constant relocation; adjudicated by six exact rows in NAMESPACE_TRANSITION_ADMISSIONS (blast radius 0 each), which go stale by the roster's own rule the moment this merges. (1) CITED-MODULE-ABSENT — the declarations phase resolves every decl_ref in the corpus, and the fixtures cited invented modules. Every planted ref is now a self-citation of a real declaration: a plant may be absent from a roster, never from the tree.

Measured numbers (producer named per row in the carrier, at f1f9dd8a077)

16 v1-compiler bin targets · 7 generated stage0 crates (+ stage0_core, tracked but unenrolled — an open residue row this transaction discharges) · 59 src/v1/**/*.dag · 151 Generated by mirrors · 4 non-src/v1 Rust files reaching v1_rt · 4 TSV receipts · 3 workflows invoking v1 bins. Blocking relations: 13 of 21 members (9 static + 4 shims); Retired 5; Replaced 4 (the TSVs → the conservation gate).

Representation-agnostic w.r.t. Symbol

No carrier, fixture, or witness in this PR names v2.std.node.Symbol, a Rust spelling for it, or asserts on emitted bytes: grep -nw Symbol over the six new files and the two touched authorities returns nothing. Identities are std.decl_ref DeclarationRef and NonEmptyStr; the live standing depends on no target representation.

Not done here, on purpose

• No live claim rows — ClaimRosterUnmeasured until XL-1's producer (effect_demand_floor_join_live_default) is green and its digest re-derived here.
• No joined discovery instrument — the next-rung trigger names it; a per-medium sweep filed as Complete would be rung inflation. The tooling row was necessary for Complete, not sufficient.

🤖 Generated with Claude Code

https://claude.ai/code/session_01U7GG6M9N2p7dmqHn4tFtii