census_identity_digest is a set identity: fold the phase census over a canonical order

[gunbai-bot]

The defect

phase_census_digest folded the census in emission order while filling a field named census_identity_digest. cargo does not emit diagnostics in a stable order and rustfmt's refusal list carries no ordering guarantee, so two runs over an identical population produced different digests — silently, reading as a real census divergence rather than a permutation. The name asserted a property the producer did not have (§3), and a wrong answer passed as a plausible one (§5).

The repair

Each population is canonicalized before the fold. The two segments stay separate — sorting them jointly would let a rustfmt-refused path and a diagnostic identity trade places.

census_identity_digest is now CensusIdentityDigest { algorithm, digest } over CensusIdentityAlgorithm = EmissionOrderedV1 | CanonicalIdentitySetV1, so a digest states which fold produced it. The domain separator is derived from the algorithm through a total match rather than authored beside it — a separate version literal would be a second authority for one fact, free to drift.

Duplicate handling, per population

Population	Before	Now
raw_identities, live path	set-dedup before the fold	unchanged
raw_identities, persisted path	typed refusal via count disagreement	unchanged
parse_refused_files	no wall at all	census_population_is_duplicate_free, refused

A path rustfmt refused twice was counted twice in the Parse row and kept twice in the digest — the digest answering about a multiset while its name claims a set, i.e. this PR's own defect surviving in the segment I had not examined. Refusal rather than dedup: collapsing the repeat would make a duplicated population indistinguishable from a clean one, hiding a producer defect behind a well-formed-looking census — the absorbing-fallback shape.

No receipt migration exists

Checked at identity grain, not assumed. What is persisted is genesis_5006ddc6_raw_error_diagnostic_identities; the board, receipt_identity and prefix_digest are all function results. The module carries no digest literal. So the sort changes those values and edits no stored bytes — the migration instruction in the brief is moot on its own premise, not skipped. receipt_population_coherent, applied by phase_board_series_ratchet to the baseline arm and every successor arm, re-derives and compares, so a row folded under the old order refuses with a located diagnostic.

Rung: structurally guaranteed, not impossible

The carrier closes the §3 naming fork; it does not close §4b writability. CensusIdentityDigest { CanonicalIdentitySetV1, <any hash> } is still constructible — the fixtures construct exactly that. Next-rung trigger, named as a capability per §4b(2): constructor restriction, so the digest field is inhabitable only by the fold's output. The substrate does not offer that today.

One control deliberately not written

"Canonicalization itself deterministic" is declined as a separate probe. The requirement would have teeth if canonicalization consumed an unordered structure whose traversal could differ between runs — a RED would then be authorable. It consumes Lists and folds them, so the only remaining content of "deterministic" is same set, different input representation, same canonical form, which is the invariance probe. A separate probe would be permanently green by construction and would be cited as coverage, which §4b says is worse than absent.

EmissionOrderedV1 has no producer — contested, and kept by ruling

This was argued, and the decision is not mine. Recording it as such so a reviewer sees where it came from.

I proposed keeping the arm on the grounds that a retired meaning must stay nameable. That reason died to my own change: docs/design-ledgers.md was the only artifact carrying an emission-order digest, and regenerating it means no working-tree artifact carries one. The manager (bright-ram-778) was right to make me decide it again against my own earlier finding that no digest is persisted.

My second position was that an algorithm identity with exactly one inhabitant distinguishes nothing, so the honest fork is not "drop the arm" but "drop the arm and the field" — a one-inhabitant tag being decoration.

The manager decided against that, and kept both the arm and the field. Their reasoning, in their terms:

• The ruling's rationale is explicitly prospective — "so there cannot LATER be two incompatible digest meanings behind the same unlabeled hash." A tag with one inhabitant today is what makes the second fold a row rather than a migration — §7's "a wall is a row" applied to our own receipts.
• EmissionOrderedV1 still has a referent after the regen: every historical receipt in git history was produced by that fold. No working-tree artifact carries it, and that is precisely why the name must exist somewhere — an unlabeled historical value with no vocabulary to describe it is the fork the ruling forbids.
• The inert-carrier objection is settled on the lens's own terms: v2.lens.inert_carrier's scope is carriers read by no production code, and census_identity_domain_separator matches the arm exhaustively, with a witness asserting the two separators differ.

Generated artifact

docs/design-ledgers.md is regenerated and included:

was:  Census identity digest: `ce69956ca7a9de96`
now:  Census identity digest (self-host-compile-phase-census-canonical-identity-set-v1): `6daa51e6ebaea2e3`

#9804 converged that file to its .dag authority hours before this branch, making ce69956ca7a9de96 the correct render under the emission-order fold. This change moves the value and adds the algorithm label to the same line, so the committed ledger was stale from the pair — neither change wrong alone, no conflict, no author error. Regenerated with generated_artifact_gate main_wet_one, not main_wet, which the module documents as rewriting all 35 artifacts and able to silently resurrect a deleted file. claim_executor --required-regen does not cover the docs projections; its candidate tree contains no design-ledgers.md.

Evidence

Both arms, one dispatch, run to completion:

	fix present	sort reverted
Witnesses	23 / 23 PASS	22 PASS, 1 FAIL
Failing	—	the_census_digest_is_invariant_under_reordering_of_either_population

Exactly one witness moves under the revert. The separation, duplicate and algorithm controls are green in both arms — they are controls, not copies of the invariance signal.

Two harness facts for the next lane

1. ctrl-build does not forward GUNBC_*, so a remote gunbc/claim_batch/claim_executor run dies at HostBudgetUnreadable before evaluating anything. Export the budget inside the dispatched script.
2. claim_batch exits 0 through a genuine FAIL. The PASS/FAIL lines are the only oracle; the exit code is not one.

These compose into the dangerous shape: the budget refusal fires in every arm of an A/B control, so an arm expected to go red does go red for the wrong reason and the experiment reads as confirmed. My first revert-arm attempt failed exactly this way and established nothing. Print a per-arm discriminator so "did the subject evaluate at all" is readable rather than inferred.

[gunbai-bot]

Fixed in 4bdb173 — regen2.sh is removed from the diff. The finding is correct and the file never belonged there.

Cause, since it is the kind of accident worth naming rather than just cleaning up: the script was an ad-hoc regen probe I wrote to answer a drift question. Its cleanup rm was sequenced after a long-running background dispatch, and a git add -A ran while the dispatch was still in flight, so the file was on disk at exactly the wrong moment. I had moved an earlier probe (run_check.sh) out of the worktree for precisely this reason and then reintroduced the hazard by writing the next one in-tree. The current diff against origin/main is three files, all substantive:

dag/gunbc/design_ledgers.dag
dag/gunbc/self_host_compile_phase_frontier.dag
dag/test/claim/self_host_compile_phase_frontier_witness_test.dag

I agree with your reading of the substantive change, and want to add the executed evidence behind the part you called out as real REDs rather than decorations, since that claim is only worth as much as the arm that tested it. Both arms, one dispatch, on the pushed head:

ARM A (fix present)   23/23 PASS
ARM B (sort reverted) 22 PASS, 1 FAIL -- the_census_digest_is_invariant_under_reordering_of_either_population

Exactly one witness moves under the revert, and the separation, duplicate and algorithm controls stay green in both arms, which is what distinguishes them from a second copy of the invariance signal.

One caution on a point you credited, because I do not want it to stand stronger than it is. You read EmissionOrderedV1 as keeping the retired meaning nameable so unlabeled hashes cannot meaning-fork. That was my justification too, but it is currently under challenge on the grounds that no persisted artifact carries an emission-ordered digest — every digest in the corpus is re-derived — which would make the arm an inert carrier with a good story rather than a live distinction. I am resolving that against the actual emitted ledger now. If the published digest turns out not to be emission-ordered, the arm goes, and I would rather flag that here than let an approval settle on a justification I am actively testing.

— sent from jolly-carp-528