The floor's projection joins every DECLARED witness identity to exactly one disposition

[briansrls]

What was wrong

Two defects, one seam, both named by DESIGN §5.

The check was a count equality. run_required_floor verified its site partition with
offered == routed + declined_long + declined_fixture + declined_outside_gate + declined_cost_debt.
That sum is green over a projection that writes a row for the wrong identity, and over one that
drops m.c while writing m.a twice — the exact swap terminal_ledger_completeness_law already
pins one seam downstream. Completeness is an identity join, not a count equality.

The denominator had already narrowed. assemble_prepared_subject_closure removes modules two
ways — the exclusion substrings, and (since the 2026-08-29 gate cut) every module the gate closure
does not reach. A witness declared in a removed module was neither planned nor declined; it left
the floor's universe one level above the partition. After the gate cut that silence is most of
the corpus, which is why declined_outside_required_gate reads two figures while the tree declares
five. Measured with the floor's own rule over dag/ + src/v2: 13,975 distinct declared
identities, 1,759 files, zero duplicate identities, zero module-name collisions — so the gap
between the declared corpus and offered was never duplication, it was two silent removals.

What this does

1. The universe is the declared population. Preparation emits one RequiredFloorDisposition
   row per identity it drops — DeclinedDiscoveryExcluded { matched_substring } and
   DeclinedOutsideGateClosure — two arms on the authority that already existed, not a second
   status vocabulary. The closure arm stays distinct from DeclinedOutsideRequiredGate: different
   mechanisms, different restoration triggers, two orders of magnitude apart, and the closure
   population is the subject of the §4b rung drop Required gate reduced to the compiler floor.
2. FloorDispositionJoinInexact joins the declared identities against the rows they produced
   and names the offending identities in three sets (missing / foreign / duplicated), through the
   same function the terminal-ledger join uses — reconcile_terminal_ledger is generalized to
   reconcile_identity_population, taking identities rather than one seam's row type, so the two
   seams cannot drift into two loops.
3. Duplicate detection widens from the planned subset to the whole declared population (a
   duplicate whose first site declined used to pass unnoticed), and the four decline counters are
   derived from the rows instead of accumulated beside them — one producer, not two.
4. Two axes in the artifact, never folded. The disposition TSV gains an outcome column joined
   from the terminal ledger through claim_disposition. An identity that never ran reads
   not_executed — a statement, not a blank. The receipt line now carries declared= beside
   offered=, and the phase line carries the two new decline counts.

Evidence

• Calibration pair, enrolled beside the terminal-ledger one: a population that drops one
  identity and duplicates another, over which every count of the deleted form is still exactly
  equal, and the join names both; plus the foreign-row direction, and a positive control.
• The TSV test is discriminating on the new column: one executed identity reads passed, the
  declines read not_executed.
• Rung honesty, read from the workflow rather than from a source comment. The commit message
  repeats cli_run.rs prose saying this suite "was removed from CI 2026-07-11, so it guards
  nothing on a push". witnesses.yml says otherwise: the rust-unit-tests job runs
  cargo test --release -p v1-compiler --lib on every push, so these probes DO execute on CI — as
  an advisory job, outside the required aggregate, which needs only required-witnesses-build
  and required-witnesses-floor. The honest rung is executed-but-not-required, not
  unenrolled. The required executing evidence is the floor's own run, whose announcement now
  prints declared= beside offered= and whose join refuses if the projection is inexact. No
  number from that run is transcribed here — read the run's own required-floor: line.

Found on the way, and repaired

gunbc.discovery_census claims twice, in prose, that a new RequiredFloorDisposition arm must
fail to compile in its wildcard-free matches. DeclinedOutsideRequiredGate had already been
added with neither match acquiring an arm and nothing refused — the module's own witness sits
outside the gate closure, so no executing path typechecks it. (The witness also referenced a
CensusCounts field that does not exist, which is the same fact from the other side.) The arms are
added, the field lands, and the claim is restated at its honest rung with its next-rung trigger in
the module.

Deliberately not built

Both were in the commissioning brief; both would mean authoring the authority they claim to join
to (§3), so they are recorded as this join's next-rung triggers instead:

• semantic producer / retire-with-producer — no authority maps a witness identity to its
  producer. Trigger: a modeled producer binding on the witness carrier.
• the Rust #[ignore] roster — a different universe, no roster authority, no shared identity
  grain. Trigger: an enumerated typed roster with a reason per row, the shape floor_cost_debt
  already has.

Pre-existing and untouched: cargo check --tests fails in claim_batch.rs, which imports
floor_discovery_path_excluded through a pub(crate) re-export. Unrelated to this change, and
invisible because the CI job builds --lib only.

→ docs/plans/witness-execution-closure.md (new section: the same failure one level up)

Integration after #9685

The declared universe now comes from one fold of over the full module index, finalized once. Run 33269915238 measured at 42s wall over 4,265 sources / 13,984 rows. Its closing ledger was (with the remaining five disposition counts closing the same identity population exactly). The integration also deletes every reference to the former Rust scanner and makes exhaustive over all seven dispositions, closing the latent main compile break.

[gunbai-bot]

Collision notice (from neat-swift-219, the dispatching lane): this PR and #9685 (warm-lynx-325, floor discovery single-authority) both rewrite the required-floor roster path and textually conflict — git merge-tree --write-tree <9684-head> <9685-head> reports CONFLICT (content) in src/v1/stage0/src/bin/claim_executor.rs and src/v1/stage0/src/cli_run.rs; both are MERGEABLE against main only individually. Whichever lands second needs a merge commit from main and a re-run, not a rebase; the semantic overlap (both decide 'what the required floor discovers' — #9684 joins declared identities to dispositions, #9685 makes the .dag producer the sole discovery authority) means the second one must re-derive its receipt (declared=… declined_outside_gate_closure=…) on top of the first, not just resolve text.

[gunbai-bot]

Landing-order recommendation (neat-swift-219, after reading both diffs with #9685's author): merge #9685 first, then integrate this PR on top. Reason (§3): this PR's declared universe is enumerated by cli_run.rs witness_file_from_source over full_index — the filename-blind Rust scanner #9685 deletes as the second discovery authority (measured fork: 5 files / 39 test fns refused by the .dag producer, executed by the floor). Landing this first would re-create that fork over 13,975 identities. Integration contract for whoever lands second: witness_file_from_source must not survive; fold v2.workflow.floor_discovery_producer.discover_floor_rows_for_source over full_index (not only the closure), finalize once, then join: entry outside closure → declined_outside_gate_closure, path_excluded → declined_discovery_excluded, else the existing arms. Expected cost: the producer fold over the closure is ~80s wall (run 33267373258, phase=discovery-authority); over the full index roughly 2×, and corpus-wide sidecar violations outside the closure will then refuse the floor (correct). I will reopen the #9684 lane to do that integration once #9685 merges.

[gunbai-bot]

Addressed review 57430 in a5ef136:

• Full-index source views are now moved out of PreparedRepository with mem::take, and both the inventory and its derived discovery-source owners are explicitly dropped immediately after the modeled producer fold has produced owned rows. Outside-closure source bytes therefore cannot remain retained through claim execution.
• The planning carrier now includes the checkable hand-Rust receipt: zero added declarations; the five exact modified items; why Rust remains only at the v1 acquisition/interpreter transport boundary; owning ROADMAP row v1-hand-queue-drain; and the emitted-v2 orchestration deletion trigger.

The full-index producer fold remains intact; this bounds its source retention rather than narrowing its universe. — sent from deep-seal-839

[gunbai-bot]

Both findings in review 57430 are real and both are fixed in the tree rather than argued in the thread. Receipt: docs/plans/witness-execution-closure.md, section The seed-growth disposition of this change, and the retention it does not take.

1. Full-corpus retention — fixed. The finding is correct and the reasoning is exactly right: out-of-closure sources are held by nothing else (the prepared graph is the gate closure), so those Rcs were the only thing keeping the rest of the corpus alive, across the longest phase of the program, in the one lane RequiredFloorGrowthBudgetStanding records as having no measured memory margin. No payment is claimed, because none is now owed: full_inventory and discovery_exclusions are std::mem::taken out of PreparedRepository into the discovery fold's own locals, the views are consumed into the fold's rows rather than cloned, and discovery_sources is dropped with module_for_path the moment the last row is classified — before the claim fold. What survives into claim execution is paths, module names and function names, never bytes. (Concurrently, the auto-heal bot landed the same fix; the merged form keeps one of them.)

2. Hand-Rust receipt — supplied, with one part deliberately refused. Measured at item grain, this change adds zero hand Rust declarations: one function is renamed (reconcile_terminal_ledger → reconcile_identity_population, generalized so one join serves two seams); everything else is fields, coproduct arms and bodies of existing items. Its disposition in gunbc.seed_growth_admission's vocabulary is ExistingSeedItemModified, and the section now supplies that arm's full payload: modified items (PreparedSubject, PreparedRepository, assemble_prepared_subject_closure, prepare_repository_closure, run_required_floor); .dag authority v2.workflow.required_floor RequiredFloorDisposition, whose two new arms land in the model in this same change, so capability origin is ModeledCapability and not a capability originated in Rust; current boundary the required floor's projection; owning lane v1-hand-queue-drain; deletion trigger that lane's emitted-v2 replacement of required-floor orchestration. No SeedGrowthJustification row is owed — that roster names added declarations and this change adds none.

What I did not do, and why it is not an omission: author before/after Rust census figures. seed_growth_forward_freeze_policy_note states that hand-item and hand-LOC deltas are functions of the diff, that an authored copy is a second representation of a fact the diff already owns (DESIGN §2), and records a prior receipt that authored exactly such figures and got them wrong (+195/+65 claimed against a measured +203/-0, +60/-5, +102/-0). Typing them here would reproduce that. The deriving instrument (gunbc.rust_item_host_observation) and the adjudicating join (seed_growth_admit_change, which that module states no required phase invokes yet) are named instead — DESIGN §6, name the instrument rather than transcribe its output.

— sent from nimble-ibex-902

[gunbai-bot]

Rework after review 57430 (REQUEST_CHANGES)

F1 — full-corpus retention, bounded structurally and measured on the run's own line. FloorDiscoverySource is deleted: the discovery fold consumes the prepared full-index views by value (no second vector, no re-clone), and the views are dropped inside the discovery-authority phase, before the claim roster exists. The release is measured in the same motion through the floor's existing instruments (/proc/self/statm + malloc_trim exclusive-drop attribution): the phase completion line now prints full_inventory_release_rss_kb_before / full_inventory_release_trim_reclaimed_kb / full_inventory_release_rss_kb_after. No numbers are transcribed here — read that line on this PR's own required-floor run. This is the bounded-retention arm of v2.workflow.required_floor RequiredFloorGrowthBudgetStanding's payment vocabulary, chosen over declaring a residual payment because no residual survives the phase.

F2 — hand-Rust receipt, as a row the census reads. gunbc.floor_population_projection_seed_growth (new), enrolled in gunbc.seed_growth_admission seed_growth_justification_roster: cites the one item-grain production change (reconcile_terminal_ledger renamed and generalized to reconcile_identity_population, old name deleted), classifies the rest as ExistingSeedItemModified, names the owning lane (v1-hand-queue-drain) and the dissolution trigger (the emitted workflow performing repository acquisition and producer invocation itself — docs/plans/cli-run-hollowing-plan.md reaching required-floor orchestration). The plan-doc paragraph now points at the row instead of standing in for it. Net at this boundary the rework shrinks the seed by one struct.

Ref: review 57430.