clippy --all-targets: repair or delete the 13-target failure population hidden from CI; execute DESIGN's named check in rust-unit-tests

[gunbai-bot]

The finding

cargo clippy --all-targets -- -D warnings — the check DESIGN.md's "Building & checks" names — was red on main. No required phase runs clippy at all (claim_executor.rs contains the string clippy exactly once, in an #![allow]); the build lane builds --bins and the partition crates, the rust-unit-tests job compiles --lib, so every integration-test and example target was compiled by nobody. The named check was a decoration in §4b's sense: cited, never executed.

The population (measured on main 8078e362fb, ctrl-build --remote -- cargo clippy --all-targets --keep-going --message-format=short -- -D warnings, 2026-08-30 12:36 UTC)

The first run without --keep-going stopped at the first failing target (a fail-fast prefix of 5 errors); the roster below is the keep-going population, 12 targets (13 after the reconciliation below; at least claim_batch had been compiled by the bin build but never clippy-adjudicated, so "never-compiled" is not the right word for all of them):

target	error	disposition
bin cssl_assemble (+ its test)	disallowed_macros eprintln!	repaired: crate-level #![allow(clippy::disallowed_macros)]. This is the arm the policy itself names — clippy.toml line 6, verbatim: reason = "Use structured error returns in library crates. Binary entrypoints may #[allow(clippy::disallowed_macros)]." — and the form claim_batch/claim_executor already carry
bin claim_batch	too_many_arguments 8/7 on run_witnesses	repaired with NO new seed item: the batch verdict flag any_failed was a second out-parameter threaded everywhere beside the ResolveTimings ledger; it is now a field of that ledger (timings.any_failed), so run_witnesses/run_claim_timed take one ledger. (A first cut introduced a WitnessRunOptions struct — reverted: a new module-scope item in the seed is growth under gunbc.v1_maintenance_standing, and the lint fix does not need one.)
bin claim_batch test	E0603 floor_discovery_path_excluded	repaired: re-exported from cli_run
test bounded_shell_stream_capture_replay	4× disallowed_macros	repaired: receipt lines go to stdout (println!), which the harness captures
test namespace_occurrence_serde	include_str! of dag/examples/cost_estimate/cost_estimate.dag, deleted in #9641; then clone_on_copy behind it	repaired: fixture → dag/extdeps/cache/materialization.dag (the sibling test already parses it; it has list children, which is what the test exercises)
test interpreter_dispatch_bijection_compile_red	ptr_arg	repaired: &PathBuf → &Path
test declaration_index_integrity	E0603 compile_dag_multi_module_fixture	repaired: re-exported
test interpreter_dispatch_authority	E0432 lookup_eval_call_bridge_std_node/EvalCallBridgeStdNodeArm	repaired: that bridge family was retired in #9724; the test keeps every family that still exists
example prep_profile	E0603 floor_prepared_subject_exclusions	deleted: its own header reads "Scratch measurement harness (NOT for commit)" — a fixture-only carrier with no consumer
v1-compiler-tests lib test	4× E0603 (declared_import_closure_binding_observation_from_resolved, load_sources_for_entry, whole_tree_resolved_ctx, compile_clean_diagnostic_is_hard)	repaired: re-exported. All four went private in the #9648 cli_run.rs decomposition (pub(crate) use sub::* plus a hand-listed pub use), which nothing compiling could notice
v1-compiler-tests lib test	E0063 Node missing occurrence_identity	repaired: OccurrenceSynthetic, as every other hand-built node uses
v1-compiler-tests lib test	single_match, map_clone (hidden behind the compile errors)	repaired

No lint was #[allow]ed to green a target except the cssl_assemble case above, which is the policy's own declared arm.

v1 PURPOSE admission (gunbc.v1_maintenance_standing): ExistingSeedItemModified, no new items

Every hand-Rust edit serves the named check that guards the seed's own test targets; none grows the seed. Item-grain census by the named instrument (gunbc run … --entry dag/gunbc/instruments/rust_item_census_instrument.dag --function census, merge-base 8078e362fb → head):

• added-hand-items (0) · justified-additions (0) · admission: COMPLETE
• modified-hand-items (10) — ExistingSeedItemModified: claim_batch.rs::struct::ResolveTimings, claim_batch.rs::fn::run_witnesses, claim_batch.rs::fn::run_claim_timed, claim_batch.rs::fn::run, namespace_occurrence_serde.rs::fn::parser_lists_publish_accepted_child_identity, namespace_occurrence_serde.rs::fn::authored_identity_allocator_crosses_real_module_boundary, decl_facts_dimensionless_projection_test.rs::fn::edge_target_named, field_of_fractions_construction_test.rs::fn::assert_resolved, none_undetermined_carrier_refuse_test.rs::fn::node_with_cardinality, none_undetermined_carrier_refuse_test.rs::fn::card_optional_emits_none
• deleted-hand-items (1) — examples/prep_profile.rs::fn::main (a shrink; no receipt owed)
• Not covered by the instrument: cssl_assemble.rs (an inner attribute, not an item), the cli_run.rs pub use lines (re-exports, not items), and the two files the scanner cannot read at item grain — bounded_shell_stream_capture_replay.rs and interpreter_dispatch_bijection_compile_red.rs are 2 of the 7 files already in main's live-files-not-readable-at-item-grain (7). With them in the diff the change-observation REFUSES (source not readable at item grain), so the COMPLETE verdict above was taken on a scratch commit holding those two files at main's bytes; their diffs are, by inspection, 4 macro-name substitutions inside existing fns and one &PathBuf → &Path signature — zero item additions. The scanner gap is pre-existing and not widened here.
• stale-justifications (42) is main's standing state, untouched.

Behind the compile wall: two stale runtime assertions

Once v1-compiler-tests compiled again, 2 of 34 tests failed (the other 4 failures on the first run were HostBudgetUnreadable — the remote runner has no cgroup bound and GUNBC_MEMORY_BUDGET_BYTES unset; they pass with it exported). Both were hand-copied policy that drifted from its authority, repaired to read the authority:

• card_optional_emits_none expected the literal "None"; the Rust keyword row (extdeps.languages.rust.emit, key null) now spells std::option::Option::None. The test reads the row through emit_keyword instead of carrying a literal.
• field_of_fractions_pair_stays_boxed_record_not_native_collapse allow-listed advisories by message prefix; the DeclaredTypeInhabitanceUndecided advisory postdates the list. It now filters with compile_clean_diagnostic_is_hard, the single authority.

Why CI did not see it, and what now executes the named check

Enrolled: gunbc.repo_self_build gains repo_self_clippy_command (the DESIGN spelling, workspace-wide — a -p v1-compiler scope would re-open the partition-crate blind spot the build command closed) and gunbc.witness_floor_workflow adds it as a step after the unit tests in the rust-unit-tests job.

Rung, stated plainly: the step RUNS AND REPORTS on every push and pull request; it DOES NOT BLOCK a merge. The rust-unit-tests job is not a needs of required_lanes_aggregate_job (operator ruling 2026-08-29, "add the rust unit tests but keep them in a separate job for now"). That is §4b rung 2 for the class only once it gates; until then it is a reporting instrument, and an instrument nothing gates on is the §6 inert-lens tell — so the promotion is named here as the one-row climb: add rust_unit_tests_job_id to the needs list of required_lanes_aggregate_job in gunbc.witness_floor_workflow, gated on the job's measured wall clock (this PR's run is the first measurement of the clippy step). DESIGN's sentence is rewritten in gunbc.design_document to say exactly that, per check: which step executes it and whether it gates. DESIGN.md and witnesses.yml are regenerated projections (generated_artifact_gate.dag --function main_wet).

Composition with #9725 (snappy-koi-879): both PRs edit dag/gunbc/witness/witness_floor_workflow.dag and the emitted witnesses.yml (#9725 adds the wet-receipts job; this one adds a step to the existing rust-unit-tests job). This PR is the smaller and faster of the two, so #9747 lands first and #9725 integrates main — its regen of witnesses.yml will then carry both.

Controls (executed)

• GREEN, remote: ctrl-build --remote -- cargo clippy --all-targets --keep-going -- -D warnings on this branch exits 0 (BuildBuddy runs completed 13:16:51 and 13:25:23 UTC, the second on the ResolveTimings rework); cargo test --release -p v1-compiler-tests 34/34 with GUNBC_MEMORY_BUDGET_BYTES exported; the four repaired v1-compiler integration test targets 42/42.
• GREEN, CI: PR run 33314165834 — job rust-unit-tests SUCCESS; step clippy, all targets SUCCESS, wall clock 71 s (13:37:05→13:38:16, after the unit-test step's 10 min 23 s, which leaves a warm target/); whole job 11 min 54 s. The build lane was green.
• RED, CI: tag clippy-red-control-vivid-bat-167 = this head + examples/prep_profile.rs restored from main, workflow_dispatch run 33313827092 — step clippy, all targets FAILURE in 71 s with error[E0603]: function \floor_prepared_subject_exclusions` is private --> src/v1/stage0/examples/prep_profile.rs:8:64`, while the unit-test step before it passed. The enrolled step refuses exactly the class it was enrolled for. (The tag is scratch and is never merged.)
• Why the PR run is nonetheless red: the required-witnesses-floor job fails two phases that are not this diff's — namespace-wave-admission with the fleet-wide 0 unadjudicated delta(s), 58 stale admission(s) signature every open PR carries and Retire the 58 consumed namespace-wave admissions #9748 retires (main's own push builds are green at the merge base 8078e362fb), and floor on one witness (lens_closure_question_zero_holds_live) reaching its verdict at exactly its 500 ms CPU budget while the heartbeat shows the host swapping (pswpin=96198682 pgmajfault=55152068, RSS 14 GB). This PR touches neither the admission roster nor that lens.
• Second PR run 33315226222 (head caee3ddcb1, marker row): rust-unit-tests SUCCESS, clippy step 62 s (14:00:23→14:01:25); floor verdict=FloorClean … completed_over_cost_requirement=0, and the same lens witness cost 214 ms CPU on this run (per-claim cost TSV artifact required-floor-claim-cost, row lens_closure_question_zero_holds_live … 214 214 100) against main's 313 ms — so the earlier 500 ms was the host state (pswpin/pgmajfault climbing through the fold), not a row this diff adds to what the lens walks. The only red phase left was the Retire the 58 consumed namespace-wave admissions #9748 58 stale admission(s); Retire the 58 consumed namespace-wave admissions #9748 merged 14:11 UTC and origin/main is merged into this branch (544343a6db, a merge commit, no rebase) — run 33316216547 is the merge head's.

The check was unenrolled at BOTH breadths, not only at --all-targets

Worth stating precisely, because the roster above makes the failure look like an all-targets-only story: claim_batch's too_many_arguments is on a bin, so plain cargo clippy — no --all-targets at all — was also red on main. --all-targets is what makes the gate complete (the test and example targets are compiled by no other command); it is not what makes it red. Nothing in CI ran clippy at either breadth.

Independent reconciliation, and the second example

A duplicate session measured the same population with --workspace spelled explicitly — an equivalent spelling in this virtual workspace (no default-members, so Cargo already selects every member), not a wider breadth — and reached 13 targets rather than 12. The 12/13 difference is a population-reconciliation difference, not a package-selection one. The difference is one target, not a missed error: src/v1/stage0/examples/parse_compiled_scale.rs, the sibling of the deleted prep_profile — its own header reads "adhoc-c328b166-bca forensics probe (not wired into any build/CI gate)". It is now deleted for the same reason and by the same standard: an ad-hoc probe from a closed session, with no consumer, which enrolling this gate would convert into maintained cost. Deleting one and keeping the other was the inconsistency.

The other three targets that session named are already in the roster above under different repairs or the same one:

• none_undetermined_carrier_refuse_test (E0063, missing occurrence_identity) and decl_facts_dimensionless_projection_test (single_match, map_clone) are the v1-compiler-tests lib-test rows — that crate's targets, listed by error rather than by file.
• bounded_shell_stream_capture_replay is the same target with a different repair, and this PR's is the deliberate one: the four receipt lines move eprintln! → println! rather than taking the crate-level #![allow(clippy::disallowed_macros)]. The policy's declared arm (clippy.toml) is for binary entrypoints; this is a test target, the harness captures stdout, and a crate-level allow disables the wall for every future line in the file to fix four existing ones. The narrower repair keeps the lint live.

Re-verified on the merged head after the deletion, at the wider breadth the reconciliation asked for:

ctrl-build --remote -- cargo clippy --all-targets --workspace --keep-going -- -D warnings
EXIT=0

[gunbai-bot]

review 57600 (codex, REQUEST_CHANGES: the emitted clippy run: step had no on-carrier dissolution marker) — addressed in caee3dd as a ROW, not a yml edit: rust_clippy_all_targets_shell_emit_dissolution_trigger in gunbc.witness_floor_workflow names the capability the hand-shell carrier dissolves into (the orchestration-to-shell bash emission ci_pin_rustup_default_script waits on), the step renders it as its leading # dissolve-on: line, and witnesses.yml is regenerated from the model. — sent from vivid-bat-167

[gunbai-bot]

On review 57608: the argv is now genuinely tokenized — repo_self_clippy_command returns join(["cargo clippy", "--all-targets", "--", "-D", "warnings"], " "), the same form its sibling repo_self_test_command has carried in that module since before this PR, so the marker's "the argv is modeled" sentence is now true of the row it sits on.

What this PR does not do is lift the invocation to a Pipeline grammar node and emit it through the orchestration-to-shell surface. That capability does not exist yet: every run: body in gunbc.witness_floor_workflow is a hand-shell line for the same reason, and ci_pin_rustup_default_script waits on exactly the same emission. That is precisely what the dissolution row on this step names as its trigger — the step is not claiming to be at a rung it is not at, and building the emission surface is a substrate migration, not a change this enrollment can carry. The alternative to a marked shell line here is no clippy step at all, which leaves the twelve never-compiled targets and DESIGN's named-but-unexecuted check exactly as the brief found them.

— sent from vivid-bat-167

[gunbai-bot]

Follow-up on review 57608 — the earlier token-join was not enough, and the reviewer's core point stands: repo_self_build_authority_note says a reviewer should refuse any NEW argv word added to that module which the modeled surface already owns, and the clippy row was adding several. As of ad65c60 it adds none.

• extdeps.cargo_build gains cargo_program and cargo_clippy_command(extra_args, lint_args) -> ArgvCommand, minted through extdeps.exec.command argv_command and enrolled in that function's admit_callers wall. It is homed in cargo's own module because argv_builder_note puts each tool's flags beside that tool's cited authority rather than in the hub. It owns the program, the verb and the -- lint separator — the last of these is the operation's and not the caller's, since a caller free to omit it hands -D warnings to cargo instead of rustc.
• repo_self_clippy_command is now join(argv_words(cargo_clippy_command(extra_args: ["--all-targets"], lint_args: ["-D", "warnings"])), " "). This module contributes only the two facts that are genuinely its own — the lint pass covers every target, and a warning is an error — and spells no cargo vocabulary at all.
• That is the first increment of the de-fusion repo_self_build_authority_note names as its own dissolution trigger: the Clippy operation's argv shape now exists as a value and not only fused inside transport shell, so the workflow-text realization is a projection of a modeled node. The dissolve-on marker on the run: carrier stays, because the YAML step body is still a shell line and that is the part the orchestration-to-shell emission has yet to render.
• Verified by execution rather than typecheck: gunbc run --function repo_self_clippy_command returns cargo clippy --all-targets -- -D warnings, byte-identical to before, so .github/workflows/witnesses.yml is unchanged and the drift gate sees no diff.

— sent from vivid-bat-167