Give the SCM object store two kinds of object, so a file has somewhere to live

[gunbai-bot]

Why this is a model change and not a wiring one

gunbc scm add <file> was blocked, and the blocker was the object model. ObjectStore held
List<ObjectRecord> — a NodeKind plus labelled children — so a file's bytes had exactly one route
in: intern them as an Atom's Symbol. That makes the symbol table a content store and gives one name
two materially different meanings (DESIGN §3's meaning fork). It is the same wrong model I already
rejected for the srv2 mirror, so building add on it would have cemented it.

What lands

ScmObject = SemanticNodeObject(ObjectRecord) | AuthoredSourceObject(AuthoredSourceRecord), under
one content identity family — a store holding two identity kinds would make store_contains
ambiguous about what it contains. The authored identity is derived from the bytes by
content_hash_atom under a family tag, so a caller supplies content and never an identity: the same
wall store_node and insert_from_structure already stand behind, reached by a third producer rather
than a second identity authority.

AuthoredSourceContent = AuthoredSourceEmpty | AuthoredSourceText(NonEmptyStr). content_hash_atom
takes a NonEmptyStr, so the degenerate empty file is a constructor rather than a checked special
case.

A node requirement is a proposition; only the store answers it

A child edge carries SemanticNodeTarget { locator } — a plain, publicly constructible record,
because stating a requirement forges nothing. Whether a store satisfies it is an observation, and
observations do not live inside an object whose identity is derived from its content.

This PR shipped the wrong carrier first, and the correction is the substance of the branch. An
earlier revision made the target a two-armed Resolved | Unresolved sum, on the reasoning that a
partial closure must reference an object it does not carry. The premise was right and the carrier was
wrong: the hash ignored the arm, records_equal had to ignore it, the wire had no spelling for it,
and every consumer re-resolved it anyway. A dimension that identity, equality, serialization and every
consumer all erase is not record content — it is transient store-relative provenance.

Carrying it there produced a real §5 defect. store_contains_node_target answered Bool, and false
meant both "nothing is here" and "a file is here" — states whose remedies are incompatible, since
no fetch repairs an occupied locator. Completeness put wrong-kind locators into the fetchable
population; the encoder's position index was over objects, so it found the file and emitted the
contained spelling. An admitted partial closure produced bytes this same build refuses at decode.

ClosureCensus now separates absent from source_occupied in one traversal and keeps them apart
all the way up: unresolved_identities projects absent only, closure_is_complete requires both
empty, and admission grew ClosureRequiresNodeAtAuthoredSource naming the whole population.

What is and is not unwritable — stated precisely, because an earlier version of this description got
it wrong and a review then restated the error back as the guarantee. A child edge naming a file's
locator is writable. Branding the target would need a mint recording a claim rather than
evidence — the exported forge factory that reopens a sole_constructor wall — and a partial closure
must be able to reference an object it does not carry. So this class sits at §4b rung 3
(structurally guaranteed), not rung 4. Three real defects were found in this exact seam after the
brands landed; had the state been unwritable, none of them could have existed.

Two things are unwritable, and they are the constructions that matter:

• A contained wire reference to a file. The encoder carries two position indexes; targets resolve
  against a node-only map, so there is no entry to find.
• A wrong-kind closure reaching any writer. encode_closure_document takes a WellKindedClosure
  — sole_constructor, mintable only through admit_well_kinded_closure, which runs the census.
  Guarding the entry points was tried and was not enough: .dag has no module privacy, so the raw
  encoder stayed importable and the bad state stayed representable through it. The carrier seals
  kind, not completeness — an absent population is legitimate inside it, preserving partial
  closures. The seal broke three fixture call sites that had been handing the raw encoder a bare
  store and root, which is the shape a production caller could have used.

Every consumer that could act on the wrong-kind state is closed to it, but by three different
dispositions, which are not the same guarantee and should not be flattened into one verb. An earlier
version of this description said every consumer "refuses it by name"; that was true of only one group.

• Unconstructible — the raw and admitted closure writers cannot RECEIVE a wrong-kind carrier at
  all. WellKindedClosure is sole_constructor, so there is no refusal to execute: the state has no
  constructor at the call site. This is the rung-4 arm and the only one that is.
• Answers false — closure_is_complete returns a Bool. It reports the closure as not complete;
  it does not name why, and it is not a refusal.
• Named refusal outcome — partial admission (ClosureRequiresNodeAtAuthoredSource), the complete
  writer (ClosureDocRequiresNodeAtAuthoredSource), encode_repository_checked
  (RepositoryEncodeTargetIsAuthoredSource), the commit-root boundary
  (RepositoryEncodeCommitRootIsAuthoredSource), and loaded_closure_standing
  (LoadRequiresNodeAtAuthoredSource, for which standing_loaded answers false — the document read
  fine, but what it asserts is unsatisfiable and no fetch repairs it). These return a typed, named
  cause rather than making the state unwritable, and they sit at rung 3.

The distinction is the point of the model: the writers got construction, the classifiers got typed
refusal, and completeness stayed a predicate. Reporting all three as "refuses by name" would overstate
the first and misdescribe the second.

This IS a format version, not a strict extension

An earlier version of this description claimed the codec was a strict extension. That was wrong and
is retracted. The closure tag is gunbc-scm-commit-closure-v3 and the repository tag is
gunbc-scm-repository-v2; the module's own stated policy is that a schema which grows a member grows
a new format tag. The repository dispatch arm and codec functions are named …V2 / …_v2 to match
the tag they implement — they read v1 under a v2 tag, which was a meaning fork in the names.

commit_closure_json_v2.dag still carries a _v2 suffix while emitting the v3 tag. The tag is the
contract; the rename is deferred with a stated dissolve-on because it costs 41
NAMESPACE_TRANSITION_ADMISSIONS rows that every unrelated open branch would inherit and pay for.

Executed, with mutation receipts

Every defect below was executed before it was fixed, not argued from the call graph:

claim	before	after
a_node_requirement_over_a_file_is_not_a_fetchable_absence	FAIL	PASS
re_writing_the_same_bindings_in_another_order_is_idempotent	FAIL	PASS
scm_rl_a_frozen_v1_document_is_a_protocol_gap_not_damage	FAIL (mutant)	PASS
a_complete_closure_spells_its_child_contained	FAIL (mutant)	PASS
a_completed_parent_first_graft_has_the_naturally_built_image	FAIL	PASS
scm_image_a_requirement_over_a_carried_file_is_not_partial	FAIL (mutant)	PASS

Each ships with a control one fact apart, because each fix has a cheaper wrong version: rejecting all
unresolved targets, collapsing different label-to-target associations, never emitting uncontained,
or classifying everything as a protocol gap. The controls forbid those and stayed green throughout.

Two findings worth naming because they falsified my own work:

• records_equal / insert_from_structure. store_node canonicalizes before persisting;
  insert_from_structure derived the locator from canonicalized children and then stored them as
  supplied. Writing [alpha, beta] then [beta, alpha] derives one locator, so the second write
  reported a LocatorCollision — a fabricated refusal for an ordinary write.
• Dependency order. store_records_in_dependency_order returned insertion order on the argument
  that store_node maintains it. True for store_node, false for the graft route: copy_object
  appends a record without its children, so a complete closure emitted a partial spelling. Now
  derived by post-order walk.

The durable-text leg carries its own correction: the reviewer proposed a newline payload, and mutating
the newline escape left both source claims green — this parser tolerates a raw newline in a string.
With a quote-bearing payload, mutating the cp == 34 escape takes both red.

One arm ships without a discriminating RED and is declared rather than hidden:
RepositoryEncodeCommitRootIsAuthoredSource. Reaching it needs a store where a SemanticNodeObjectRef's
locator holds a file — a 64-bit digest collision — and no fixture can construct that without the forge
factory the module refuses to export. Its next-rung trigger is a fixture capability that can seed a
store at a chosen locator. No coverage is claimed for it.

SCM suite: 323 pass, 0 fail.

Not in this PR

The add and commit verbs — they need CorpusManifestObject and a staging authority, not just
ScmWriteOutcome. And merge remains model-blocked: gunbc.scm.merge is roles/requirements/
supersession, not two-commit merging with a derived common ancestor. That needs a design first.

[gunbai-bot]

Recording an answer to a question I raised myself rather than leaving it for a reviewer: are the three new refusal arms reachable from production, or only from witnesses? Measured by call site, not by reading:

• checkout_object's ObjectIsAuthoredSource — production-reachable. Callers are checkout.dag's own recursion, the checkout verb, and merge.dag's binding read.
• target_roles' TargetRootIsAuthoredSource — production-reachable, called from merge.dag's engine.
• The cross-kind LocatorCollision — production-reachable through insert_object, which every producer routes through.

The path that actually delivers an authored object into those readers today is the decoder: store_authored_source ← decode_authored_source ← decode_object_step ← decode_object_table ← the closure/repository document load. So a repository document carrying a {source} entry, loaded and then checked out or merged, reaches these arms from production — and an external document is the right kind of input to reach them from, since it is the one input this repository does not control.

The honest gap, stated rather than left implied: there is no production WRITER of an authored-source object. The decoder is the only non-witness caller of store_authored_source. That is not an oversight in this PR — it is precisely what add is for, and add is deliberately not here because it needs the one modeled ScmWriteOutcome. Until it lands, the write side of this model is exercised by witnesses only, and I would rather say so than let "the arms are production-reachable" stand unqualified.

— sent from deep-carp-676

[gunbai-bot]

Follow-up to my previous comment: the reachability answer there was a call-graph argument, and side-chat review flagged that its two halves might not meet — authored objects decode, but a checkout might never be able to land on one, since every edge the encoder emits was derived from a node record. That caution is right about the encoder and wrong about the decoder, and it deserved execution rather than more reasoning.

921a90c enrolls the witness. The decoder resolves {"target": {"at": "<n>"}} through the position map, and that map now holds authored entries beside node entries — so a document may name a file as a node's child. The fixture builds exactly that: position 0 is the file, position 1 is a node whose only child targets position 0, root is position 1. Children-before-parents is the order the decoder requires, so this is not a malformed image; it is a well-formed one that says something the model must refuse to reconstruct.

The document loads — that is what makes this a checkout claim rather than another decoder claim — and the checkout then refuses naming the authored source. It goes red against a checkout that reports MissingObject for a file that is present (opposite remedies), and red against one that reconstructs the node with the child silently dropped.

Paired with the control that makes it a claim about the file rather than about the document shape: the identical shape with a node at position 0 checks out. Without that, a decoder refusing this shape for any reason would satisfy the claim.

So my previous comment's qualifier stands and is now narrower than it was. What is executed: the consumer refusal on a production decode path. What remains witness-only: the authored-source write path, because the decoder is still the only non-witness caller of store_authored_source — which is what add is for.

I also found and fixed a bug in my own fixture while writing it: the parent node initially targeted position 1, itself, rather than position 0.

— sent from deep-carp-676

[briansrls]

REQUEST_CHANGES at exact head 71a5c49.

The central recut is right: one locator family, sealed SemanticNodeObjectRef / AuthoredSourceObjectRef brands, and an explicit ScmObjectRef join. I also accept keeping the name ObjectId in this PR; its authority note already states the local 64-bit locator rung, and a 170-site rename would add no wall. ObjectTableEdgeTargetIsAuthoredSource is the right current two-arm cause. The old-writer evidence reshape is also right in principle: once support is deliberately not carried, the predecessor must be classified as unsupported protocol, never malformed.

Four blockers remain.

1. NodeTarget's premise is right; its placement is not.

An uncontained target cannot honestly carry SemanticNodeObjectRef. But the alternative is not to put store-relative evidence state inside the canonical object. A node edge always states a REQUIREMENT: this locator is expected to denote a semantic node. That claim can be publicly constructible without forging evidence. The store join then produces the evidence-bearing total result:

ResolvedNode { reference }
| NodeAbsent { locator }
| NodeLocatorOccupiedByAuthoredSource { source }

SemanticNodeObjectRef remains sealed. A SemanticNodeTarget/NodeTargetClaim containing a locator is not a forged reference; it is the proposition the edge or partial document states.

The current Resolved/Unresolved sum is ignored by the identity fold, ignored by the codec, and re-resolved by every safe consumer. It therefore puts a non-content, store-relative axis inside ObjectRecord and requires quotient patches such as records_equal. Worse, one current path collapses the two negative resolution results:

• store_authored_source stores a source at locator L;
• insert_from_structure stores a parent whose child is NodeTargetUnresolved(L);
• store_contains_node_target answers false for both absent and authored-source-present;
• unresolved_identities reports L as a fetchable missing object, so admit_partial_commit_closure admits it;
• encode_target consults a kind-blind locator→position map, sees the source at L, and emits {"at": ...};
• decode resolves that position to AuthoredSourceRef and refuses ObjectTableEdgeTargetIsAuthoredSource.

So an AdmittedPartialCommitClosure can currently produce bytes this same build refuses to decode. The source is not missing and fetching a node cannot repair the store: L is occupied by another kind. This must be a wrong-kind/collision disposition, not membership in the missing-object list.

Close the join at logical completeness and encoding, not only checkout. The encoder's position map must retain ScmObjectRef, so a semantic target resolves to node-position / absent-and-uncontained / occupied-by-source, never merely present / absent. I recommend replacing StoredEdge.target and partial roots with one SemanticNodeTarget claim and moving Resolved/Absent/WrongKind to the store-specific resolution outcome. Keeping NodeTarget is acceptable only if it is no longer used to collapse these states and its evidence axis is removed from canonical object equality/serialization.

Required discriminator: construct the source-at-L plus node-target-L closure above. It must refuse before partial admission or encoding with the authored-source/wrong-kind cause. A genuinely absent L remains admissible and round-trips as uncontained.

2. records_equal still disagrees with the identity quotient.

You found the brand-state dimension correctly: Resolved(r) and Unresolved(r.locator) must not collide merely because the identity ignores that arm. But the same mismatch remains for named-child order.

content_hash_of_children canonicalizes labeled children before hashing. records_equal compares labeled_children_of_stored in their supplied list order. Therefore:

• insert_from_structure alpha,beta;
• insert_from_structure beta,alpha into the SAME store;
• both derive one locator;
• records_equal reports different payloads;
• insert_admission fabricates LocatorCollision.

The current permutation test compares the two derived locators from separate insertions. The store_node insertion-order test also cannot catch this because store_node canonicalizes before inserting. Neither reaches the present-and-equal arm with two wire orders.

Compare the exact canonical preimages using v2.std.node's canonicalization authority, or store only the canonical representative. Do not compare only the final digest, because that would erase the honest hash-collision refusal. Add the same-store insertion test, with a positional-order control that must remain different.

This sharpens the general finding you named: adding a field dimension that identity ignores requires equality to quotient that dimension too. Named-edge order is another already-ignored dimension, and the repair must cover the whole quotient, not only the newly branded axis.

3. store_records_in_dependency_order does not establish its name after a late graft.

It returns store.objects and justifies that by store_node inserting children before parents. copy_object deliberately permits a parent-only graft, however, and a later copy can append the missing child after that parent:

• copy parent into empty store;
• copy child into that store;
• closure_is_complete now answers true;
• encode_complete_closure_document admits;
• encode_object_table visits the parent first, has no child position yet, and emits an uncontained target;
• the same document then carries the child in a later object entry.

That contradicts the wire arm's declared intrinsic meaning: uncontained says this document does not carry the payload. It also means the complete encoder can emit a partial spelling.

Either maintain dependency order as objects are grafted or derive a real topological order at encoding. Add a complete-after-late-graft witness that inspects the emitted target arm and requires a contained position, paired with the parent-only control requiring uncontained.

4. Protocol naming and independent evidence are not finished.

The generic commit_closure_json rename is correct. One layer up, repository_envelope now emits gunbc-scm-repository-v2 but still names the implementation encode_repository_v1, RepositoryFormatV1, decode_repository_v1, and says “EXACTLY v1.” That is the same active meaning fork the generic module rename just removed. Rename those to v2/current.

The comment saying a future manifest branch joins scm-object-identity-v1 unchanged is also wrong. It should join the SAME identity authority, but adding a branch and derivation changes the total rule. The whole protocol version must advance; it must not get a third per-kind authority, and it must not silently widen v1.

The predecessor-evidence reshape is accepted for closure v2: the literal is independent, the exact format cause is pinned, and LoadUnsupportedProtocol is the load-bearing standing. Repository v1 needs the same treatment. The checked-in v1 fixture was overwritten in place with v2, so retain a frozen v1 document separately and assert RepositoryFormatUnrecognized plus repository_envelope_load_standing == LoadUnsupportedProtocol, never LoadDocumentMalformed.

Empty and nonempty authored-source encode→serialize→parse→decode round trips block approval. The decoder-only malformed/source fixtures do not execute encode_authored_source_content. An encoder that emitted "" for every source could leave the present matrix green. Assert both content and derived locator survive, with the two cases separating each other.

Finally, rewrite the PR body. It still says “strict extension, not a format version,” describes the pre-brand shape, and reports only the original five claims. At this head those statements contradict the code and the now-explicit v3/v2 protocol cut.

Accepted without further objection:

• no ObjectId→ObjectLocator rename in this slice;
• one locator family with arm-specific sealed references;
• ScmObjectRef as the generic join;
• ObjectTableEdgeTargetIsAuthoredSource at the current two-arm store;
• closure-v2 unsupported-protocol evidence instead of silently decoding it;
• the merge root/child cause split and its node controls;
• the discovered brand/equality failure as a real general class.

Re-review bar:

1. Separate semantic-target claim from store-specific resolution evidence, or otherwise prove the current carrier cannot admit source-occupied locators as missing.
2. Make partial admission and encoding consume the three-way node-target resolution; use kind-bearing encode positions.
3. Align records_equal with the full canonical preimage and add the same-store named-order discriminator.
4. Make dependency order true after late graft and prove complete encoding emits no uncontained target.
5. Remove the repository-v1 names under the v2 tag and correct the manifest identity-version claim.
6. Add frozen repository-v1 unsupported-protocol evidence.
7. Add empty and nonempty source encoder round trips.
8. Update the PR description and obtain complete exact-head CI after these changes.

The architecture is materially closer. The remaining objections are not to branded references; they are three places where the old untyped-locator behavior has survived behind a new carrier: completeness, equality, and serialization order.

[gunbai-bot]

Re review 58182 (codex/gpt-5.6-sol), on store_holds_node_at. Verified against the current code and the authority docs; not fixing, because the cited prohibition does not exist.

The citation is fabricated. The finding says this is "the mechanical predicate-dissolution pattern prohibited by DESIGN.md" and that "substrate predicates must route through a canonical fold/query surface or carry a concrete disposition receipt." Grepping DESIGN.md and docs/design-ledgers.md for predicate.dissolution, canonical fold/query, query surface, disposition receipt and substrate predicate returns nothing. The only occurrence of "predicate" in DESIGN.md is §4b's "does not lift arbitrary predicates to proof", which is about not overclaiming a rung — the opposite subject. There is no such rule to violate, and no §-reference was given for one.

The corpus falsifies it independently. A census of fn … -> Bool whose body is a match with true/false arms finds 2,523 such functions across 908 files, of which 52 are in this branch's SCM slice. Its nearest sibling, store_contains, has exactly this shape, is on main today, and predates this branch (landed via #9238, 2026-08-26). A rule prohibiting this pattern would be a corpus-wide REQUEST_CHANGES, not a finding against one new three-line function.

There is a real question adjacent to it, and I want to answer that one rather than the invented rule: should a Bool be allowed to discard NodeRecordLookup's three-arm distinction, given that this PR's whole argument is that "nothing is here" and "a file is here" have different remedies and must not be collapsed?

The distinction is preserved everywhere it has a remedy, and this is not such a place:

• Where the difference is actionable, it is a typed cause, not a Bool: ObjectTableEdgeTargetIsAuthoredSource vs ObjectTableEdgeTargetUnresolved at decode, ClosureDocRootIsAuthoredSource vs ClosureDocRootPositionUnresolved for a root, RepositoryCommitRootIsAuthoredSource vs RepositoryCommitRootNotInObjectTable for a commit root, MissingObject vs ObjectIsAuthoredSource at checkout, and TargetChildMissing vs TargetChildIsAuthoredSource in merge. Splitting those apart is most of this PR.
• store_holds_node_at has exactly two consumers, store_contains_node and store_contains_node_target, and both feed closure completeness — a fold whose contract is "which identities do not resolve to a program here". That surface answers with the identities themselves; the per-identity question genuinely is yes/no, and a caller wanting the cause calls find_node_record, which is public and returns all three arms.
• The collapse is fail-closed in the safe direction: both negatives answer false, so a file at a node-child locator is reported unresolved. The defect this replaced was the opposite — kind-agnostic store_contains answering true and counting a file as a contained child.

So the three arms exist and are consumed; this predicate is one total projection of them at the one site whose question is a membership test, not a state-space conflation.

Happy to be shown a §-reference if one exists and I have missed it — I would rather rework than argue. But I am not going to restructure against a rule that is not in the authority docs and that 2,523 functions on main already contradict.

— sent from deep-carp-676

[briansrls]

Exact-head carry-forward — 9fefe5537dd016beb9b83bbb9180da4ff05e372c

REQUEST_CHANGES

I reviewed the one-commit delta from 71a5c498b669c55848fe3a43dad94a0e7307e9f7. Restoring the silently dropped rung row, repairing CommitLogRow to carry SemanticNodeObjectRef, and regenerating the ledger are correct. I accept reverting the module rename as a scoped operational deferment: the measured 41-row namespace-admission externality is real, the emitted format tag remains the executable authority, and the header explicitly says the name is a fossil rather than pretending it is correct. That acceptance does not make the name true, and it does not discharge the separate live RepositoryFormatV1/encode_repository_v1 names under the v2 repository protocol.

The substantive review bar is unchanged because this delta does not touch it.

NodeTarget ruling

The model needs an unresolved semantic-node target claim for a partial closure. It does not need store-relative Resolved/Unresolved provenance inside canonical StoredEdge.

A public SemanticNodeTarget { locator } is not a forged SemanticNodeObjectRef; it states the proposition an edge makes. The store owns the evidence-bearing join:

• ResolvedNode { reference }
• NodeAbsent { locator }
• NodeLocatorOccupiedByAuthoredSource { source }

The present sum is not harmless stale provenance. Its arm is erased by the identity fold, erased by records_equal, absent from the wire grammar, and re-resolved by every safe consumer. More importantly, it currently collapses two materially different negative states: a source at locator L is reported by completeness as a fetchable missing node, admitted as partial, then encoded positionally because the kind-blind position map sees L; this build subsequently refuses its own bytes when decode discovers the contained object is an authored source. Fetching cannot repair that store. The closure is wrong-kind, not incomplete.

Do not require insert_from_structure to resolve every target; that would destroy the honest absent-target state partial closures exist to carry. Remove resolution provenance from the record, and make partial admission and encoding perform the three-way store join. A raw object bag may contain a node target claim whose requirement is unsatisfied; it may not classify source-occupied as missing or emit it as a contained node.

Re-review bar

1. Separate the semantic-node target claim from store-specific resolution evidence, or otherwise make source-occupied locators impossible to admit as missing.
2. Make partial admission and encoding consume the three-way resolution result; make encode positions kind-bearing.
3. Align records_equal with the full canonical identity preimage, including named-child order, and add the same-store reversed-named-order discriminator plus a non-overquotiented positional control.
4. Make dependency order true after a parent-first/child-later graft, and prove complete encoding emits a contained target while the parent-only control emits uncontained.
5. Remove the repository-v1 implementation names under the repository-v2 tag and correct the claim that a future manifest branch could leave the total identity-rule version unchanged.
6. Add an independently frozen repository-v1 document that refuses as unsupported protocol, never malformed.
7. Add empty and nonempty authored-source encode → serialize → parse → decode round trips; assert both content arm and derived locator survive and distinguish the cases. This item blocks approval.
8. Rewrite the stale PR body and obtain complete green exact-head CI.

Current exact-head CI is still in progress. No approval carries to this head.

[briansrls]

Exact-head re-anchor — 5ba7ade703b98246b68dba097b46a2b9b8060079

REQUEST_CHANGES

I reviewed the complete 9fefe55..5ba7ade delta. It is exactly one additive test-file change, +148/-0, in scm_commit_closure_json_v2_witness_test.dag; no production SCM module moved.

Item 7: the substantive codec discriminator is accepted, but the durable-text leg is still missing

The two new claims are real, not decorative. They store both AuthoredSourceContent arms, encode the actual closure document, decode it, look the rebuilt objects up under the original derived locators, require exact content, and explicitly require AuthoredSourceEmpty versus AuthoredSourceText. Collapsing the text encoder arm to "" necessarily takes them red: the decoded text object no longer exists at the original text locator, the object population shrinks, and the arm check fails. I accept that discriminator and the reported 304/0 SCM sweep.

But my exact bar was encode → serialize → parse → decode. These claims currently call:

decode_closure_document(v: encode_closure_document(...))

They never call serialize_json or parse_json_document. The nonempty fixture even contains a newline, which is the right payload for the missing boundary, but at present it remains an in-memory JsonString; JSON escaping and reparsing are not exercised. A defect in durable text emission/parsing can leave both new claims green.

So item 7 is narrowed, not closed:

• closed: empty/nonempty source encoder branches, decoded content, derived-locator survival, arm separation;
• still required: route the encoded document through serialize_json and parse_json_document before decode_closure_document, with unreadable parse answering false. The current newline payload is a good discriminator; no new fixture is needed.

NodeTarget ruling: unchanged, and now stated as a direct exact-head trace

The unresolved semantic-node requirement is honest. The current Resolved | Unresolved carrier inside canonical StoredEdge is not.

At this head:

1. store_contains_node_target erases the arm and asks only whether the locator presently holds a node.
2. uncontained_in_record treats every false as a fetchable unresolved identity.
3. EncodePositions is kind-blind: it maps an ObjectId string to a position for every ScmObject.
4. encode_target emits {at: ...} whenever that locator occurs in the map.
5. Decode then recovers the position's ScmObjectRef and refuses when it is an authored source.

Therefore source-at-L plus node-target-L is still admitted as partial/missing and encoded as contained, producing bytes this same build refuses to decode. The source is not absent and fetching cannot repair the locator. That is a wrong-kind state, not an incomplete closure.

The right model is a publicly constructible semantic-node target claim carrying a locator, plus a store-owned resolution result:

• resolved node reference;
• genuinely absent locator;
• locator occupied by authored source.

Do not force insert_from_structure to resolve every child; genuine absence must remain representable. Remove store-relative resolvedness from the canonical record and make completeness, partial admission, and encoding consume the three-way resolution.

Carry-forward bar

Items 1–6 from review 5078222297 remain unchanged. Item 7 now requires only the serialize/parse leg above. Item 8—truthful PR body and complete green exact-head CI—also remains. The exact-head workflow run is currently in progress, so no approval carries.

[gunbai-bot]

Review 58194 (APPROVE) noted that the bundled direct_call_arg_seam_v2_exemption rung-drop row is unrelated to the object-store change and would normally be its own PR. That is fair, and it is now moot rather than declined: main landed the row itself in #9923, so after integrating main this branch carries no rung-drop delta at all — git diff origin/main HEAD -- dag/gunbc/rung_drop.dag is empty. The row was never a bundled feature; it was on main, an auto-merge dropped it from this branch with no conflict, and I restored it. Main has since re-landed it upstream and the restore has dissolved into a no-op.

Worth recording why the integration was done by hand rather than with the merge button, because GitHub reported MERGEABLE throughout. The generated-artifact merge driver refused DESIGN.md and docs/design-ledgers.md — both sides changed them since the merge base, so neither side is the projection of the merged authorities, and taking either side drops the other's authority-derived bytes silently. Both were regenerated from the merged authorities via the sanctioned actuator. The three rows at risk were then checked by identity rather than by reading the diff: sealing_property_erases_structure and merge_region_excludes_shared_tail in recurring_failure_mode, direct_call_arg_seam_v2_exemption in rung_drop — all present. This is the second time on this PR that merge_region_excludes_shared_tail described its own integration.

Verified locally on the merged tree, with a claim_executor rebuilt from that tree — the first run reported drift across 27 emitted files purely because the binary predated main's v1_compiler_infer.rs:

• build lane: regen first_generation_equal=true, generated-artifact rostered=35 adjudicated=35 matches=35 drifted=0
• witnesses lane: phases_run=3 failed=0, 4476 files parse-clean, namespace-wave-admission ADMITTED (3 deltas, all auto-admitted, blast radius 0/0/1)

One environment fact for anyone else running this lane: claim_executor --required-ci cannot run on the BuildBuddy runner. It refuses with HostBudgetUnreadable because no cgroup memory limit binds there, and it declines to plan against the machine-wide number instead — the §5 refuse-don't-widen arm working as designed, citing its own rc=137 receipt. It has to build and run locally.

— sent from deep-carp-676

[gunbai-bot]

Review 58294 is correct on the fact and wrong on the rule, and I have acted on the fact.

Fixed. store_contains_node has no caller anywhere in the tree. I verified it: whole-tree grep finds only the declaration, and git log -S confirms this PR introduced it — it is absent from origin/main. So it is dead surface I added, and it is deleted in e710a35.

The same deletion catches a second function the finding did not name. store_holds_node_at's only caller was store_contains_node, so removing the reported symbol alone would have left behind a dead function whose sole consumer had just been deleted in the same commit — fixing the finding rather than the fact. Both are gone.

Both are superseded by resolve_node_target, which answers the same question three ways rather than two. That is the point of the census this PR adds: a Bool at a node position cannot separate "nothing is here" from "an authored source is here", and those have incompatible remedies — no fetch repairs an occupied locator. Nothing should be asking for the two-valued form.

I do not accept the cited rule, and this is the second time it has been raised. There is no corpus-wide prohibition in DESIGN.md on Boolean projections over a coproduct, and none is quoted. The same claim was made in review 58182 and answered there with a census: 2,523 such functions across 908 files, including ones that predate this branch. A rule that would condemn a third of the corpus on sight is not the rule; if it exists, please cite the section text.

What makes these two deletable is narrower and does not need that rule: they are unused. DESIGN §2 — unnecessary work is redundant work — and dead API surface on a sole_constructor carrier is surface a later caller can reach for. That reasoning applies to exactly these two symbols and to no others.

SCM suite 311 pass, 0 fail.

For the record on merge state: this PR is not ready and I am not asking for it to land. Items 5, 6 and 8 of the SCM reviewer's bar are still open — live repository-v1 names beneath the repository-v2 tag, a frozen v1 document that must refuse as unsupported protocol rather than malformed, and a stale PR body. Approvals do not discharge those.

— sent from deep-carp-676

[briansrls]

Exact-head re-review — 837115a1db6254aea8b1942ff37de72fc7602936

REQUEST_CHANGES

I re-read the current tree rather than carrying the prior call graph forward. Exact-head workflow run 33556715919 is green. The central model split is accepted: SemanticNodeTarget is the canonical proposition, the old Resolved | Unresolved sum is gone, and reusing NodeRecordLookup through resolve_node_target is better than minting a duplicate resolution vocabulary. The canonical-equality repair and its named/positional pair are accepted; the post-order store traversal is the right implementation repair; the V2 codec names, frozen V1 standing evidence, and quote-bearing serialize/parse source round trip are accepted.

Four blockers remain.

1. Item 2 is not closed: the source-occupied requirement still reaches the complete, raw, and checked-repository writers

For a closure whose store contains an authored source at L and whose parent requires a semantic node at L, the new census correctly derives:

• absent = []
• source_occupied = [L]

But encode_complete_closure_document checks only unresolved_identities, which projects absent. It therefore sees an empty list and returns ClosureDocEncoded; it never consumes source_occupied or closure_is_complete.

The split position maps do not make this state unwritable. encode_target consults the node-only map and, when L is absent there, emits {"uncontained": L}. The authored-source object still appears in the same object table through the all-object map. Decode accepts that spelling, reconstructs the source plus the semantic-node requirement, and loaded_closure_standing maps every non-complete result to LoadPartial. An unsatisfiable wrong-kind closure has therefore changed from “contained then self-refused” into “uncontained then falsely called partial”; it has not become unrepresentable.

The raw bypass is live independently: the source comment before encode_complete_closure_document explicitly says encode_closure_document remains directly callable and the module front door is still ajar. That is exactly the seam I said I would trace at the pushed re-review.

The repository path has the same omission. encode_repository_checked asks only an_uncontained_target, which folds table_unresolved_identities; it has no source-occupied encode cause. Its commit-root presence check also uses the all-object position map, so a branded root resolved in another store can be satisfied here by a source at the same locator, encoded uncontained by the node map, and refused by this build’s repository decoder.

Close all publication surfaces, not only admission:

• encode_complete_closure_document must consume the full census and refuse source-occupied identities before returning bytes;
• the lowest callable closure encoder must either perform that three-way judgment itself or take a prepared/sealed carrier that cannot contain the state;
• encode_repository_checked must consume the table’s source-occupied population, and commit roots must be resolved as nodes rather than as generic occupied positions;
• a decoded document with source-occupied semantic targets must not be classified LoadPartial.

Required discriminator: drive the existing source-at-L fixture through encode_complete_closure_document, the raw callable surface, and checked repository encoding. It must produce no bytes and must name the wrong-kind population. The absent control remains admitted/uncontained; the node control remains complete/contained.

2. Item 4’s implementation moved, but its witness still does not prove the contained arm

The post-order traversal correctly repairs parent-first/child-later grafting. The new image-equality claim is nevertheless green under the cheaper wrong encoder that emits every target as uncontained:

• naturally built complete store: every target uncontained;
• grafted-then-completed store: every target uncontained;
• their images are equal, so one_closure_has_one_image_however_its_store_was_assembled passes;
• the parent-only image still differs from the complete image because the complete table contains an extra object, so the stated control also passes;
• the present-child round trip still reloads as complete because decode stores the child from the table regardless of how the parent spelled the edge.

This is the same blindness the first round-trip claim exposed, one level later. Inspect the emitted target arm directly, or prove by mutation that forcing encode_target always to uncontained takes the complete-after-late-graft claim red while the parent-only control stays green. Also narrow the claim name: emission remains insertion-history-sensitive for independent objects, so “one closure has one image however assembled” overstates what the encoder establishes.

3. Item 5’s second half is unchanged

The repository functions and dispatch arm now correctly say V2. The identity-rule authority still says: “A manifest branch joins this same tag when it lands.” That is the premise I rejected. A manifest branch must join the same authority, but adding another identity derivation changes the total object-identity rule and therefore advances the rule tag/version. Do not promise that scm-object-identity-v1 survives that widening unchanged.

4. Item 8 fixed the PR history, not all current authority text

The PR body now retracts the strict-extension claim, but it also says the two indexes make the wrong-kind class unwritable through the raw encoder; blocker 1 directly falsifies that sentence. Current source still contains several incompatible statements:

• commit_closure_json_v2: object-table growth is “a strict extension, not a format version”;
• immediately before encode_target: a missing position is “UNREACHABLE,” although genuine partial targets deliberately reach that branch and encode uncontained;
• object_store: every node-requiring position takes the sealed node brand and a file in a child edge is unwritable, although those positions now take public SemanticNodeTarget claims and wrong-kind is a census/refusal state;
• the witness says SemanticNodeTarget has a “resolved arm,” which was deleted;
• repository_envelope says dependency-order emission is insertion order, after the post-order repair.

These are not archival notes marked as retracted; they are present-tense explanations beside the current authorities. Sweep them with the functional repair so the tree no longer teaches both the deleted design and the current one.

Items 1, 3, 6, and 7 are accepted. Item 4’s code shape is accepted but its proof is not. Items 2, 5, and 8 remain open as above. The four dashboard approvals and green exact-head CI do not override these exact-head findings; no merge authorization carries.

[gunbai-bot]

Correcting review 58316, which is an APPROVE resting on a description of the code that is no longer true. I would rather lose the approval than let the stated safety property stand, because a later reader would plan against it.

It says:

sole_constructor brands on SemanticNodeObjectRef / AuthoredSourceObjectRef mean a child edge cannot syntactically point at a file

That is not what this branch does, and an earlier revision of it tried exactly that and was wrong. StoredEdge.target is SemanticNodeTarget { locator: ObjectId } — a plain record, publicly constructible on purpose. A child edge absolutely can name a locator an authored source occupies. That state is writable, and every witness in this PR that exercises the wrong-kind path constructs it directly.

The branded-reference version was tried and reverted for a load-bearing reason: a partial closure must be able to reference an object it does not carry, so a branded target would have needed a mint that records a claim rather than evidence — an exported forge factory, which is precisely how a sole_constructor wall gets reopened by the helper written to prove it.

What the model actually guarantees is narrower and is the honest statement:

• a child edge states a proposition — "a semantic node is required at locator L". Stating it forges nothing.
• whether any store satisfies it is an observation, produced only by resolve_node_target → find_node_record, whose three arms separate absent / occupied by a file / found.
• the wrong-kind state is therefore refused at every consumer that could act on it — partial admission, completeness, both closure encoders, encode_repository_checked, and loaded_closure_standing — not made unwritable.

So this class sits at §4b rung 3 (structurally guaranteed), not rung 4. Reporting it as rung 4 would be the rung inflation §4b(1) names, and the distinction is not academic: three real defects were found in this exact seam after the board first read ready: true, and every one of them was a consumer reading a two-valued answer where three facts existed. If the state were unwritable those defects could not have existed.

The one thing that is unwritable: a contained wire reference to a file. The encoder’s target index carries semantic nodes only, so there is no entry to find — that is construction, and a_complete_closure_spells_its_child_contained plus its uncontained control execute it.

No code change; the code is correct as written and the description was not. SCM suite 317 pass, 0 fail.

— sent from deep-carp-676

[briansrls]

Exact-head re-review — 9bdd976f501a2b14c8d35840b6ec101e677cddd6

REQUEST_CHANGES

I reviewed the complete two-commit delta from 837115a through 54cd2e4 and 9bdd976.

The central repair is accepted. WellKindedClosure is the right option-2 boundary: it seals KIND rather than completeness, its only construction routes are the full-census mint and the re-seal of an already-admitted partial closure, and encode_closure_document now accepts only that carrier. This closes the raw closure writer without destroying the legitimate absent-target state. The complete writer now consumes the full census and names the whole wrong-kind population. The checked repository writer now consumes the table's source-occupied population. LoadRequiresNodeAtAuthoredSource is the right standing. The direct target-arm witnesses close item 4: forcing every target to uncontained takes a_complete_closure_spells_its_child_contained red while the genuinely partial control remains green.

Four blockers remain.

1. Checked repository commit-root encoding still collapses wrong-kind into missing

unresolved_commit_root_step now asks node_position_of, which correctly refuses to treat a file position as a node position. But its Absent arm immediately returns the locator to RepositoryCommitRootNotInStore. It never asks whether the generic object index DOES contain that locator.

So this live residual is still misclassified:

• a SemanticNodeObjectRef was honestly minted against store A;
• a repository is rebuilt around store B, which holds an authored source at the same locator (the cross-store wrong-kind/collision state the reference comments explicitly preserve);
• the commit root is the only requirement at that locator, so the table-edge source-occupied scan does not see it;
• node_position_of is absent, while position_of is present;
• checked encode reports RepositoryCommitRootNotInStore for an object that is present and wrong-kind.

That is the same absent/wrong-kind conflation one level later. Preserve the three-way result at commit-root encoding: node position / no object / authored-source position. Add an encode-side wrong-kind cause (preferably RepositoryCommitRootIsAuthoredSource) and a discriminating witness paired with the genuinely absent-root control. A source at the root locator must never be reported as missing.

2. The new loaded standing has an implementation but no discriminating execution

loaded_closure_standing now reads both census populations, but the witness changes only add the new arm to imports, tags, and exhaustive matches. No claim drives a decoded source-occupied closure through closure_document_standing or loaded_closure_standing.

Execute the exact document state this arm exists for: carry an authored-source entry at L, then a node whose uncontained target names L, and root the document at that node. Decode must succeed; its standing must be exactly LoadRequiresNodeAtAuthoredSource, standing_loaded must be false, and it must never authorize supersession. The one-fact absent control remains LoadPartial; the complete control remains LoadComplete. Mutating the source-occupied branch back into absent/LoadPartial should take only the new claim red.

Without that, the new arm is currently specification plus exhaustive plumbing, not executed behavior.

3. The future-manifest identity-version statement is still unchanged

repository_object_identity_rule_tag = "scm-object-identity-v1" is correct for the current node-plus-source total law. The adjacent statement that a future manifest branch “joins this same tag when it lands” is not.

The manifest arm should join the SAME identity authority, not mint a peer authority, but adding an object arm and derivation changes that authority's total rule and must advance its version. Rewrite the statement to say exactly that; do not pre-bump the current tag for a branch that does not exist yet.

4. Item 8 still needs the exact-head narrative/source sweep

The PR body is still the 837115a account: it attributes raw unwriteability to the two indexes rather than the new WellKindedClosure carrier, reports 313/0, and omits the later standing and root-boundary repairs.

Several current-source statements remain false or stale:

• commit_closure_json_v2 still calls the authored-source addition “a strict extension, not a format version,” despite the v3 cut and frozen-v2 refusal.
• object_store still says every node-requiring position takes the sealed node brand and a file in a child edge is unwritable; canonical edges now carry public SemanticNodeTarget propositions and wrong-kind is a census/refusal state.
• repository_envelope says dependency-order emission is insertion order; the accurate statement is derived post-order with insertion-history tie order among independent components. It also still says “THIS FABRICATES NO v2” beside the live v2 encoder.
• supersession still audits loaded_closure_standing as producing only LoadComplete | LoadPartial; it now also produces the new wrong-kind standing.

The comment saying the partial-admission front door remains mechanically bypassable should stay: WellKindedClosure seals kind, not partial-write policy, and its public mint intentionally admits absent targets. That comment describes a different, still-honest rung.

Rename one_closure_has_one_image_however_its_store_was_assembled to the exact claim it proves, for example:

a_completed_parent_first_graft_has_the_naturally_built_image

That names the two exercised assembly routes without asserting global serialization canonicality for independently ordered components.

Exact-head GitHub CI was still in progress when this review was submitted. Fresh green CI remains required after the repairs above. No merge authorization carries on 9bdd976.

[briansrls]

Exact-head re-review — 103f2d529075eed47d4f8c07e720e795854faf46

REQUEST_CHANGES

The functional commit-root repair is correct. commit_root_standing now distinguishes node-present, object-absent, and authored-source-present; the checked encoder no longer reports wrong-kind occupancy as RepositoryCommitRootNotInStore.

Ruling on the unauthorable RED

Keep RepositoryEncodeCommitRootIsAuthoredSource.

I accept the declared mitigatable/unwitnessed disposition. Reaching it requires a SemanticNodeObjectRef honestly minted against one store and a second store holding an authored source at the same 64-bit locator. Without a real cross-kind hash collision, the only way to manufacture that state is a chosen-locator store forge. Exporting such a capability solely to exercise the backstop would weaken the construction wall the test is supposed to protect. Removing the arm would instead knowingly collapse a mathematically admitted wrong-kind state into absence.

Do not add a forge factory and do not count the arm as executed. The source/PR declaration and next-rung trigger are the right evidence ceiling.

The hand-authored source-occupied closure document is also the right producer-side witness, and the future-manifest identity-rule statement is corrected.

Four small but blocking items remain.

1. Carry the new standing to the real supersession destination

scm_image_a_requirement_over_a_carried_file_is_not_partial proves:

• decode reaches LoadRequiresNodeAtAuthoredSource;
• standing_loaded answers false.

It does not execute the downstream consequence required by the prior bar: the exact standing produced from that exact document never reaches supersede_head_slot. The existing supersession witness merely enumerates the new arm in exhaustive matches.

Pass the standing returned by closure_document_standing(decode_closure_document(doc)) through observe_generation and supersede_head_slot, with every non-standing precondition held at its admitting value. Require StandingDoesNotPermit { standing: LoadRequiresNodeAtAuthoredSource } (or an equally exact refusal), not only a false Boolean.

Also complete the one-fact third cell: a semantic node carried at L, referenced through the same uncontained spelling, must yield LoadComplete and standing_loaded == true. The current source and absent cells do not execute that join.

2. Narrow the item-4 consistency claim name

The old name still stands:

one_closure_has_one_image_however_its_store_was_assembled

It overclaims global byte canonicality while the repository authority explicitly permits independent-object insertion history to change positions. Rename it to:

a_completed_parent_first_graft_has_the_naturally_built_image

That is exactly what the fixture compares. Update the adjacent prose and PR mutation table with it.

3. Finish the authority-text sweep

The two comments repaired in this commit were real, but the prior exact-head sweep was broader. Current false present-tense statements still include:

• repository_envelope: store_records_in_dependency_order is called insertion order. It now derives dependency post-order; insertion history survives only as tie order among independent components.
• repository_envelope: “THIS FABRICATES NO v2” beside the live v2 codec.
• repository_envelope: the encode-refusal commentary says there is one producible cause and later exactly three unrepresentable cases, while the coproduct has several—including the explicitly unwitnessed commit-root arm.
• scm_repository_envelope_witness_test: the section says “one claim per cause” and “the three causes,” contradicting the declared unauthorable arm.
• commit_closure_json_v2: the two-index commentary still says the raw encoder accepts any store and that index splitting alone closes the raw route; it now takes WellKindedClosure.
• commit_closure_json_v2: “A missing position is UNREACHABLE” is false for an admitted partial closure. Absence is the deliberate uncontained route; only a missing position for a target the document claims to contain through complete dependency ordering is an ordering defect.
• supersession: the producer audit says loaded_closure_standing returns only Complete/Partial and says repository_envelope classifies nothing into LoadStanding. Both are now false; repository_envelope_load_standing is a live producer too.

These are authority comments, not cosmetic wording. Reconcile or delete them in one sweep so the next review does not discover the same moved premise one paragraph at a time.

4. Exact-head CI

GitHub workflow run 33571356933 is still in progress. Approval requires its complete exact-head green result after the changes above.

The remaining bar is therefore one downstream witness, one exact control, one claim rename, the already-enumerated authority cleanup, and terminal exact-head CI. No new object-model redesign is requested.

[briansrls]

Exact-head re-review — 689a2b5b56cf2cd59e12cd358eb2ee46d076acf5

REQUEST_CHANGES

The functional bar is closed. I accept the document-produced standing reaching the exact StandingDoesNotPermit { standing: LoadRequiresNodeAtAuthoredSource } actuator arm, the carried-node LoadComplete control, the scoped graft-image claim name, the commit-root three-way implementation with its explicitly unwitnessed collision arm, current-main ancestry, and terminal exact-head CI run 33577206580.

What remains is the authority-text reconciliation this delta says it completed. The sweep is still internally contradictory in four exact places.

1. The supersession census still carries the stale total

The audit still begins:

PRODUCERS, TOTAL: two, both in gunbc.scm.commit_closure_json_v2

but the same paragraph now correctly says repository_envelope_load_standing is another producer and that the producer count grew. A census cannot retain the old total beside its own correction. Recompute and state the actual denominator, or narrow and name a different denominator such as the permitting producer population; do not leave “total two” beside “the producer count grew.”

2. repository_envelope still describes an earlier encode coproduct

Above RepositoryEncodeRefusal, the current text still says “The single producible cause” and “the two sibling arms” beside an eight-arm coproduct.

Above encode_repository_checked, it still says:

The three ways a repository can be unrepresentable are exactly the three arms below

while the implementation separately adjudicates wrong-kind table targets, absent roots, wrong-kind roots, checkout, duplicate references, allocator range, and parent order.

Rewrite these as the current population. Preserve the deliberate no-RED disposition of RepositoryEncodeCommitRootIsAuthoredSource; do not restore a fictional one-claim-per-cause tally.

3. The witness header still asserts and retracts the same fact

scm_repository_envelope_witness_test.dag still opens the section with:

THE CHECKED ENCODER, with one claim per cause

and immediately says the roster is no longer one claim per cause. Make the heading truthful directly. The following explanation of the unauthorable collision arm is good and should remain.

4. The PR receipt still double-counts the renamed claim and overstates the dispositions

The mutation table lists both the retired one_closure_has_one_image_however_its_store_was_assembled name and a_completed_parent_first_graft_has_the_naturally_built_image as separate rows. This was one claim renamed to narrow its assertion; replace the old row rather than counting both.

The body also says every consumer “refuses it by name,” then includes completeness and both closure writers. closure_is_complete answers false; the sealed raw/admitted writers cannot receive the state; the complete writer and admission surfaces return named outcomes. State those different guarantees as different guarantees.

Final bar

1. Correct the four exact source-text contradictions above in one pass.
2. Correct the PR receipt table and disposition sentence.
3. Obtain terminal exact-head CI after the .dag comment edits.

No further model or witness redesign is requested. No approval carries on 689a2b5.

[briansrls]

Exact-head native ruling — aec3deb7cfe61a631c2f9207e3079f45d6f194eb

APPROVE

This native review mirrors the dashboard ruling recorded as review 58646 and supersedes my earlier REQUEST_CHANGES reviews for the SCM object-model content.

The complete bar is closed at this exact SHA: the object/carrier model, wrong-kind publication walls, commit-root three-way result and explicitly unwitnessed collision backstop, standing-to-supersession execution, carried-node control, canonical equality, post-order encoding, protocol versioning, frozen predecessor evidence, durable source round trips, mutation evidence, scoped census, eight-arm encode-refusal prose, witness exception, PR receipt, and disposition split are accepted.

Workflow 33620909083 is terminally green on this exact head: required-witnesses-build, required-witnesses-floor, rust-unit-tests, fabric-evidence, and the aggregate witnesses job all succeeded.

This is an exact-head content approval. Since this commit composed main@583ffd661c0037c0f3a10a8410d4cbeb5b4c5c07, and main has subsequently advanced, it does not by itself waive the standing current-main composition/regeneration requirement or authorize landing a different SHA. No substantive SCM redesign remains.