The cost-debt roster's outside-gate arm was a name test, so an enrolled identity that does not exist refused nothing

[gunbai-bot]

The defect

The cost-debt roster's reverse (staleness) join already had an outside-the-gate arm — added with the 2026-08-29 gate cut, already counted rather than silent. What it could not do is tell two populations apart.

Its filter, identity_inside_required_gate, takes an identity's module path and prefix-matches it against required_gate_prefixes. It is a name test consulting nothing else. So for any enrolled row that did not execute, it asked only whether the string starts with a gate prefix.

A module name cannot distinguish "declared, but this run's gate never loaded it" from "no such declaration anywhere." So an enrolled identity that does not exist — a typo, a renamed or deleted witness, a fabricated line — prefix-missed the gate, was counted as outside-the-gate, and refused nothing.

That is precisely the hole the reverse join exists to close, in its own words:

that also closes the cheapest way to fake a green run: enrolling an identity that does not exist would otherwise cost nothing.

The gate cut reopened it across the whole non-gate namespace, which is now the majority of the corpus. 122 enrolled rows sat in that arm on the first gate-bounded fold, and nothing could tell a real one from a fabricated one.

This is a fail-open in the roster's anti-fabrication wall, not only in its debt accounting.

Why it is fixable now

gunbc#9684 makes every declared identity carry exactly one disposition, so preparation's own account of what it loaded is available here as a population rather than as a name test.

The change

partition_cost_debt_roster puts every enrolled identity in exactly one arm:

arm	meaning	refuses?
Withheld	discovered and withheld — the operative debt	no
OutsideThisRunsUniverse	declared, but preparation never offered it (gate closure / discovery exclusion) — kept as record, not counted as debt	no
Undeclared	the tree declares no such identity	yes ← the new arm
DeclaredButNotWithheld	declared and offered, but not withheld — renamed, or declined for a home reason outranking cost debt	yes (pre-existing arm, unchanged)

The discriminator is the disposition, and only the disposition — derived from what preparation actually loaded, never the spelling of a name and never a second structure's opinion.

Reworked after review. The first draft consulted the fold's withheld set first and fell back to the disposition. That made two structures answer one question — the §3 defect this PR exists to close, rebuilt inside the repair — and its test asserted that a withheld identity with no disposition row is Withheld, blessing exactly that divergence. The disposition is now the sole classifier. The declared-set parameter is gone too: since #9684 every declared identity carries exactly one disposition, so "no disposition" is "not declared", and a separate declared set would have been a third representation.

The withheld set is still computed for execution accounting, and it is now reconciled against the classification rather than consulted by it: reconcile_withheld_against_dispositions reports both directions of the difference, and any disagreement refuses the run with CostDebtWithholdDispositionDisagreement. Two observations of one act may disagree loudly; they may not be silently resolved in favour of either.

It is a free function beside reconcile_identity_population, for that function's own stated reason: "the test that proves it must call THE PRODUCTION CODE" — an earlier draft of that test carried its own copy of the loop and would have passed while production drifted.

The discriminating RED

A pair that differs only in declaration: two enrolled identities in the same non-gate module, neither withheld, one declared and one not. The undeclared one must refuse; its declared sibling must not.

That pairing is the point. A fix that refused both would close the hole by breaking the 122 legitimate rows, and nothing but the declared join separates them.

Verified by mutation, not by assertion, twice:

• absorbing the undeclared arm back into outside-universe (the old semantics) reds 3 of the 6 tests;
• dropping one direction of the reconciliation reds the disagreement test while the agreement test stays green.

One test is deliberately the reverse of one the first draft carried: a_missing_disposition_refuses_and_is_never_overridden_by_another_structure.

Reporting

Identity grain, replacing a bare count of an arm that silently mixed legitimate rows with unrefusable fabrications:

[floor-cost-debt] roster standing: enrolled=N withheld=N outside_this_runs_universe=N undeclared=N declared_not_withheld=N
[floor-cost-debt] outside this run's universe, kept as record and NOT counted as debt (...): <identities>

Preserved deliberately

Both refusing arms stay guarded by reverse_joins_answerable, exactly as before. A halted run's population is truncated, and answering "delete the row" over it is the empty-observation narrow this file already refuses to commit for the sibling rosters. The partition's inputs are planning-time facts and survive an execution halt — but a halt during preparation truncates them too, and this arm must not be the one place that assumes otherwise.

No roster edits. No row released, no row added.

Seed-growth receipt

gunbc.floor_cost_debt_standing_seed_growth enrols all three new hand declarations (partition_cost_debt_roster, CostDebtRosterStanding, reconcile_withheld_against_dispositions), with one entry in seed_growth_justification_roster().

It is a sibling of floor_cost_debt_seed_growth rather than an edit to it: that row justifies the forward direction (declining a rostered site at build) and retires when the self-emitted claim executor consumes required_floor_site_disposition directly. This one justifies the reverse direction, which reads different inputs and retires on a different condition. Folding them would give one trigger two capabilities, so whichever was satisfied first would retire an obligation it does not cover — the grain mismatch §4b(3) names. One row per capability is already the pattern here.

No LOC or item deltas are typed: the policy note rules them derivable from the diff and drops them from the enumeration.

Also: the held live_deploy population's trigger

Recorded on the carrier, and it is a capability, not a PR: restoration of the §4b(3) rung drop "Required gate reduced to the compiler floor" by a change-derived required population.

Those 45 identities cannot take the roster's ordinary exit ("delete the line, let the floor run it"), because the floor does not run them — they are outside the gate closure, and no full-corpus floor remains in CI (witnesses.yml invokes claim_executor --required-ci twice, once per lane, and nothing else runs a floor). Their marginal cost is unobservable by any instrument this repository currently runs, so releasing them would be bookkeeping rather than a measured shrink.

floor_cost_debt's roster is a bare List<String> with no per-row field, so the trigger is a paragraph beside it rather than on the rows — a real limitation of the carrier, stated rather than worked around.

Verification

• cargo test --release -p v1-compiler --lib (what CI's rust-unit-tests runs): 541 passed, 0 failed; all four new tests confirmed present in that release profile, not just locally in debug.
• Mutation: old semantics → 3 of 4 red, then green again on restore.
• cargo clippy -p v1-compiler --lib -- -D warnings: clean. (--all-targets fails on main already, in tests//examples//bins/ I did not touch.)
• cargo fmt --all --check: clean.
• gunbc compile on the changed .dag: 0 blocking errors.