From 7754e124581b2ab36dd58078122222fb9d857f95 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Tue, 1 Sep 2026 11:13:46 +0000 Subject: [PATCH 1/4] The wall covers a spelling, not a boundary: correct the population and restate the trigger so aliasing cannot satisfy it The row bounds its subject to destinations whose exact identity is v2.std.text.String. Measured on a four-arm fixture, that bound holds only for the unaliased spelling: a kernel String refuses at a parameter declared v2.std.text.String, admits at a locally-authored structure-identical alias, and admits at a local alias whose target IS the guarded declaration, against a cross-module control refusing in the same file. So the peel is not reached once an alias stands in the position, which is a different defect from the peel keying on the wrong identity. The subject is every structural-text boundary in the corpus, unbounded because it is authored on demand, and an exact-spelling census is a lower bound rather than a size. That makes the trigger load-bearing: its A/B is stated over fixtures at the exact spelling, so it could be satisfied while an aliased boundary of the same class still admits -- a corpus loss against a spelling-shaped trigger. The A/B now requires an aliased boundary to refuse alongside the unaliased one. Also records that one sentence of the row is falsified: kernel precedence beats locals too, so v2.std.text's own operations take the kernel String. --- dag/gunbc/rung_drop.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/rung_drop.dag b/dag/gunbc/rung_drop.dag index 55ed43a33d1..fce45a5a0f9 100644 --- a/dag/gunbc/rung_drop.dag +++ b/dag/gunbc/rung_drop.dag @@ -122,7 +122,7 @@ data text_boundary_identity_wall: RungDrop = RungDrop { subject: "Non-literal kernel-String refusal at the structural text boundary", declared: "2026-08-30", standing: Standing, - authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.", + authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for.\n\nAND ONE SENTENCE OF THIS ROW IS FALSIFIED BY THE SAME MEASUREMENT, recorded rather than edited away: v2.std.text is not a module whose bare String spellings resolve to its own line-7 declaration. Kernel precedence is uniform and beats LOCALS as well as imports, so that module's own operations take the kernel String — string_head, declared s: String one line below type String = FreeMonoid, refuses a scalar sequence with declared Primitive(String), produced Container(List, Primitive(Int)). No module gets its own spelling back, including the one that declares the alias.", } data fabric_evidence_gating: RungDrop = RungDrop { From 1b7ad88006d8d8b0f1e784e3cdf9128631540099 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Tue, 1 Sep 2026 11:18:40 +0000 Subject: [PATCH 2/4] The scope axis: a callee parameter type is re-resolved in the caller environment Replaces the locals-over-kernel paragraph, which was inferred from one foreign-scope observation and is falsified by the in-module arm. The observation was right and the explanation was not: the scope resolving string_head's signature was the observer's, not the declarer's. Measured on two arms that force the refusal with an Int actual, so the diagnostic names the destination and no peel-admission can be mistaken for agreement. In a module declaring type String = FreeMonoid, a call to its own function taking s: String refuses with expected Node(String) -- locals do beat kernel in-module. From a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). So coverage depends on how the destination was spelled AND which scope resolved it, and a wall keyed on the guarded declaration can be defeated by a caller without touching the destination at all -- a different escape from aliasing, which rewrites the destination. This is also the mechanical cause of the integer.dag specimen: the caller-side reading types the parameter host, and the emitter follows it. Records the two questions a climb must answer: whether return types re-resolve too, and whether a qualified spelling in the callee declaration is immune. --- dag/gunbc/rung_drop.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/rung_drop.dag b/dag/gunbc/rung_drop.dag index fce45a5a0f9..0a7723334f1 100644 --- a/dag/gunbc/rung_drop.dag +++ b/dag/gunbc/rung_drop.dag @@ -122,7 +122,7 @@ data text_boundary_identity_wall: RungDrop = RungDrop { subject: "Non-literal kernel-String refusal at the structural text boundary", declared: "2026-08-30", standing: Standing, - authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for.\n\nAND ONE SENTENCE OF THIS ROW IS FALSIFIED BY THE SAME MEASUREMENT, recorded rather than edited away: v2.std.text is not a module whose bare String spellings resolve to its own line-7 declaration. Kernel precedence is uniform and beats LOCALS as well as imports, so that module's own operations take the kernel String — string_head, declared s: String one line below type String = FreeMonoid, refuses a scalar sequence with declared Primitive(String), produced Container(List, Primitive(Int)). No module gets its own spelling back, including the one that declares the alias.", + authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's.", } data fabric_evidence_gating: RungDrop = RungDrop { From c2e8a18c93eb14ca36de70e450d0c80e581cd719 Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Tue, 1 Sep 2026 11:20:58 +0000 Subject: [PATCH 3/4] The trigger must survive caller re-resolution as well as aliasing Aliasing rewrites the destination; caller re-resolution rewrites nothing and still changes what the destination means. A trigger satisfied by one and not the other retires the row against a single escape, which is the grain mismatch one level out. The A/B now requires a foreign-called bare-spelling boundary to refuse alongside the aliased and unaliased ones. --- dag/gunbc/rung_drop.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/rung_drop.dag b/dag/gunbc/rung_drop.dag index 0a7723334f1..e952f195ea7 100644 --- a/dag/gunbc/rung_drop.dag +++ b/dag/gunbc/rung_drop.dag @@ -122,7 +122,7 @@ data text_boundary_identity_wall: RungDrop = RungDrop { subject: "Non-literal kernel-String refusal at the structural text boundary", declared: "2026-08-30", standing: Standing, - authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's.", + authored: "**A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class.\n\nPOPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses.\n\nSO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size.\n\nCONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes.\n\nAND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature.\n\nSO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident.\n\nTWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed.\n\nCORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's.", } data fabric_evidence_gating: RungDrop = RungDrop { From de5abd9b13a91cb1f6470352d4d644fb56fd67fc Mon Sep 17 00:00:00 2001 From: gunbc-ci-auto-heal Date: Tue, 1 Sep 2026 11:55:27 +0000 Subject: [PATCH 4/4] Regenerate the projection the authority edit left stale The three commits on this branch edit `gunbc.rung_drop`'s `text_boundary_identity_wall` row and never regenerated `docs/design-ledgers.md`, which is a committed projection of that authority. The required build lane caught it exactly as designed: required-ci: generated-artifact rostered=35 adjudicated=35 matches=34 drifted=1 required-ci: generated-artifact drifted docs/design-ledgers.md required-ci: FAILED PHASE generated-artifact (1 projection(s) not derived) Regenerated through the modeled route -- `tools.generated_artifact_gate` `main_wet_one` with the artifact path -- rather than by hand, so the projection is derived from the authority and not a second author of the same sentences. Whole-roster `main_wet` would have rewritten all 35 and could sweep in unrelated drift; the one-path entry writes exactly the file named. The instrument was rebuilt for this run rather than reused. A native gunbc from 03:07 was present, but ten commits touched src/v1/stage0/src on main since; the prior binary was deleted before rebuilding so no stale build could serve, and the two differ in size (28725344 -> 28783272 bytes), which is the receipt that the staleness was real and not assumed. The diff is 14 insertions and 0 deletions: the seven paragraphs this branch authored, each rendered on its own line, and nothing else in the file moved. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WJAqfo1UK4zkzcM7cQ8oj6 --- docs/design-ledgers.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 2fe205fb376..260fa657ab7 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -97,6 +97,20 @@ Producer: `tools.emission_entry_instrument::measure_entry_emission` **A NON-LITERAL KERNEL-STRING VALUE AT AN EXACT `v2.std.text.String` BOUNDARY DOES NOT REFUSE, AND THIS ROW DECLARES THAT RUNG (2026-08-30, the structural-text landing).** The literal path is walled: a kernel string LITERAL at that boundary elaborates through the one declared homomorphism row (`gunbc.structural_realization_bindings` `literal_homomorphism_rows`, `UnicodeScalarSequenceUnfold`) or refuses, keyed by occurrence, and the elaboration is carried on the typed tree into emission. What is NOT walled is the non-literal case: a kernel-String VALUE — a variable, a call result — reaching an exact `v2.std.text.String` position is still admitted by same-leaf-name compatibility in the corpus-wide type-compatibility relation (`v1.compiler.infer_types` `node_type_equals_core` and the `type_name_compatible` last-segment arm), so compat-by-leaf-name REMAINS ADMITTED at that boundary and a host-representation value can flow into a structural-carrier position with no homomorphism and no diagnostic until emission or runtime. PREVIOUS RUNG, STATED HONESTLY: none stood. An identity wall was authored into the four comparison arms and EXECUTED ONCE as an experimental wall on this branch, then WITHDRAWN for a fabricated refusal before reaching main — it is recorded as an attempted wall withdrawn, never as a guarantee that stood, because a rung is established by evidence executing on the acceptance path and this one's first execution was its falsification. TEMPORARY STANDING, AT TWO PATHS THAT MUST NOT BE AVERAGED: on the emitted-Rust self-host path the class is *mechanically preventable* — a host-representation value flowing into a structural-carrier position renders as a Rust type mismatch and the mandatory emitted-crate cargo check refuses it; on the generic source-acceptance path the class is presently UNGUARDED — an open conformance defect, not a mitigated one, since no executing mechanism observes it there and review diligence is not a rung. REASON FOR THE WITHDRAWAL, measured not argued: the wall's first required-floor run refused GROUNDED-IDENTITY code — `dag/gunbc/roadmap_page.dag` line 386's if-join red with `Node(String) vs Primitive(String)` — because the corpus-wide relation cannot distinguish 'same declaration reached through the String = FreeMonoid identity that operator Ruling 3 (2026-07-15) grounds in std.coercion' from 'two unrelated declarations sharing a leaf name'. A wall that refuses code the design rules correct is a fabricated refusal, which §5 forbids in the same breath as a fabricated green. POPULATION, BOUNDED BY IDENTITY WITH A NAMED PRODUCER: the subject rows are non-literal values whose actual declaration is the kernel/native String offered at a destination whose exact identity is v2.std.text.String, on the current tree; the producer is the withdrawn wall itself re-applied as a measurement — the identity-wall patch on the four comparison arms, executed by `gunbc compile --source-root dag --source-root src/v2 --entry src/v2/compiler/00_compile.dag` over the emitted-compiler closure and by the required floor's strict preparation — with each refusal row carrying its boundary identity and a disposition. Grounded std.string_type.String pairings (the roadmap_page if-join class, admitted under Ruling 3's declared identity) are a SEPARATE disposition and are not counted in the gap; literal rows are discharged by the homomorphism and are not in the subject. Any actual undispositioned row inside the emitted compiler closure blocks the parent class's closure; zero is a valid measured answer and 'unknown' is not a bound. RESTORATION PROBE, KEPT RATHER THAN DELETED: a planted non-literal fixture stands enrolled whose PRESENT observation is that the compiler accepts the row-less non-literal boundary — deleting it would turn a bounded gap into an unobserved one; on restoration it flips to the discriminating refusal control. RESTORATION TRIGGER, naming the capability: the declared-boundary conformance PEELING capability — the compatibility relation answering 'does this value's declared type reach that boundary's declared type through a DECLARED identity or homomorphism row' by peeling declared identities (String = FreeMonoid per Ruling 3) rather than by leaf-name spelling. That capability is SUFFICIENT only as a two-direction A/B in ONE required-floor run: the planted non-literal fixture REFUSES; roadmap_page's grounded if-join stays ADMITTED; an ordinary grounded-identity non-literal control stays ADMITTED; and the literal homomorphism fixtures stay admitted and still emit scalar sequences. Passing the refusal direction by restoring the roadmap_page false positive is NOT the trigger. Re-landing the wall under that A/B retires this row; nothing else does — in particular, the literal-path witness battery going green does not, because its subject is the other half of the class. +POPULATION CORRECTION, 2026-09-01, MEASURED: THE SUBJECT IS WIDER THAN THE PARAGRAPH ABOVE STATES, AND THE RESTORATION TRIGGER AS WRITTEN IS SATISFIABLE WHILE THE HOLE STAYS OPEN. The population above is bounded to destinations whose EXACT identity is v2.std.text.String. That bound holds only for the unaliased spelling. Measured by session bold-carp-449 on a four-arm fixture, one file and one resolve per pair so no arm is attributable to a different tree state or binary: a kernel String actual at a parameter declared v2.std.text.String REFUSES (declared Node(std.algebra.FreeMonoid), produced Primitive(String)); the same actual at a parameter declared with a locally-authored structure-identical alias, type Wrapped = FreeMonoid, is ADMITTED; and — the arm that decides the width — the same actual at a parameter declared LocalText where type LocalText = v2.std.text.String, an alias whose target IS the guarded declaration, is ALSO ADMITTED, against a cross-module control in the same file that refuses. + +SO THE PEEL IS NOT REACHED ONCE AN ALIAS STANDS IN THE POSITION, which is a different defect from the peel keying on the wrong identity. Naming the guarded declaration THROUGH an alias does not preserve the refusal. The coverage is therefore a property of HOW THE DESTINATION WAS SPELLED AT THE CALL SITE, not of the value crossing it and not of the declaration identity the spelling resolves to. The subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author can write without touching the value, the callee, or the guarded declaration — and that set is unbounded because it is authored on demand rather than enumerable from the current tree. A census of exact-spelling boundaries is therefore a LOWER BOUND on the subject and must not be read as its size. + +CONSEQUENCE FOR THE TRIGGER, which is why this correction is load-bearing rather than a widening for its own sake: the restoration trigger above names the peeling capability and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those fixtures can be satisfied while an aliased boundary of the same class still admits, so the trigger as written would retire this row with the hole open — the grain mismatch DESIGN 4b(3) names, a corpus loss against a spelling-shaped trigger. The trigger is therefore RESTATED to require the capability to survive aliasing: the A/B must include a boundary declared through a local alias whose target is the guarded declaration, and that arm must REFUSE alongside the unaliased one, with the grounded-identity controls still ADMITTED. A capability that refuses only the exact spelling is not the capability this row is waiting for. AND IT MUST SURVIVE CALLER RE-RESOLUTION TOO, which is the same grain mismatch one level out: the A/B must also include a boundary whose callee declares its parameter with a bare spelling that is structural IN THE DECLARING MODULE, called from a foreign module, and that arm must refuse as well. A trigger satisfied by aliasing but not by caller re-resolution would retire this row against one of its two escapes. + +AND THE SCOPE AXIS, WHICH IS A SECOND WAY THE SAME BOUNDARY GETS TWO MEANINGS AND IS NOT THE ALIASING ONE. A CALLEE PARAMETER TYPE IS RE-RESOLVED IN THE CALLER ENVIRONMENT, so one declaration presents different types to its own module and to a foreign caller. Measured by session bold-carp-449, both arms forcing the refusal with an Int actual so the diagnostic NAMES the destination and no peel-admission can be mistaken for agreement: inside a module declaring type String = FreeMonoid, a call to its own fn taking s: String refuses with expected Node(String), so the module DOES get its own spelling and locals do beat kernel in-module; from a foreign module with no import and no alias, a call to v2.std.text string_head refuses with expected Primitive(String). Same declaration, same parameter, two destination types, decided by whose scope resolved the signature. + +SO THE COVERAGE IS A PROPERTY OF HOW THE DESTINATION WAS SPELLED AND OF WHICH SCOPE RESOLVED IT. A wall keyed on the guarded declaration can be defeated by a CALLER without touching the destination at all, which is a strictly different escape than the aliasing one above: aliasing rewrites the destination, this rewrites nothing and still changes what the destination means. Every operation in v2.std.text whose parameter is spelled with the bare String -- string_head, string_tail, string_is_empty and their siblings -- is therefore structural to its own module and HOST to every foreign call site, which is the mechanical cause of the live specimen in src/v2/std/integer.dag: it calls string_head, the caller-side reading types the parameter as the kernel String, and the emitted Rust then calls a function whose real parameter is the structural carrier. One declaration, two meanings, with the emitter following the caller-side reading. That is a section 3 meaning fork with a mechanical cause rather than a spelling accident. + +TWO QUESTIONS THIS ROW DOES NOT ANSWER AND WHOEVER CLIMBS IT MUST: whether the re-resolution applies to RETURN types as well as parameters, and whether writing the QUALIFIED spelling in the callee declaration itself is immune to it. If it is immune, the repair for that module is one line per declaration and is worth establishing before anything larger is designed. + +CORRECTION NOTICE, recorded because the wrong version travelled: an earlier revision of this paragraph asserted that kernel precedence beats LOCALS and that v2.std.text does not get its own spelling back. That was inferred from a single foreign-scope observation (string_head refusing a scalar sequence with declared Primitive(String)) and the in-module arm falsifies it. The observation was correct and the explanation was not: the module resolving the signature was the OBSERVER'S, not the declarer's. + ### Fabric CI evidence lane as a required merge block — declared 2026-08-31 **THE FABRIC-CI EVIDENCE LANE STOPS BLOCKING MERGES AND KEEPS EXECUTING (2026-08-31).** #9704 added `fabric-evidence` as a fourth job and, in the same change, made it a `needs` of the aggregating `witnesses` job that the `passing CI` ruleset names as this repository's one required context. PREVIOUS RUNG: mechanically preventable — a defect in the FCI-EVIDENCE-0 run-boundary contract was exposed by an enrolled calibration and blocked the merge. TEMPORARY RUNG: mitigatable — the same calibration still runs on every push and pull request, still refuses loudly, and its log is still the record; what is gone is the block, so a red is now a signal a human must read rather than a wall. REASON, and it is wall clock rather than doubt about the evidence: the required context's wall is the MAX over its three lanes, and on run 33350499023 that max was `fabric-evidence` at 27 minutes against 20 for the floor lane and 10.5 for the build lane, having moved the required wall from ~13 minutes to ~28-40 within a day of #9704 landing. 1469 of those 1620 seconds are the calibration step, and its own logs put all ~18 of the plan's `gunbc run` host processes at 80-90 seconds each. That cost is not the evidence: the instrument's import closure is six modules, and per `cli_run.entry_resolve` an `--entry` run is scoped in what it EMITS but WHOLE-TREE in what it PARSES, so each process re-parses and re-censuses the entire 4414-module corpus to evaluate a handful of rows. The lane is paying eighteen whole-corpus censuses (DESIGN §2 duplicated work) for thirteen assertions. Batching them is NOT the repair and is not what this row defers: `gunbc.witness_floor_workflow` `fabric_ci_evidence_calibration_timeout_minutes` records that distinct host processes ARE the process-edge subject, so fewer processes would remove the boundary rather than observe it more cheaply. BOUNDED POPULATION: exactly one job, `fabric-evidence`, and exactly one lost edge — its `needs.fabric-evidence.result` binding into the aggregate's closed-vocabulary verdict fold. No other lane, phase, witness or claim changes rung; the build and floor lanes keep every edge they had, and the calibration keeps every assertion it had. The drop is countable from the emitted workflow: `test.claim.witness_floor_workflow_consolidation_witness_test` `w_RED_fabric_evidence_executes_without_gating` reds if the job stops executing, and reds again if either gating spelling returns while this row still stands. ONE OPERATIONAL CONSEQUENCE, recorded here because it is the kind of practice that quietly stops once the person who agreed to it moves on. With the needs edge withdrawn, a `fabric-evidence` failure no longer reaches the aggregate verdict, so any lane that was reading the required context as a proxy for that lane's health is now reading a context that cannot see it. The FABRIC-CI program (warm-seal-35) accepted the drop on that basis and will check `fabric-evidence` EXPLICITLY on every head rather than inferring it from `witnesses`. Anyone else joining on the required context owes the same explicit check for as long as this row stands; that obligation ends when the trigger below is met and not before. RESTORATION TRIGGER: the CAPABILITY of a single fabric evidence process resolving its entry against the source roots at a cost that fits the required wall budget — concretely, the whole-tree parse and name census being paid once per tree state rather than once per host process, so that the 13-row plan executes its full process-edge roster inside the lane's share of a ~10-minute required wall. THIS IS NOT RETIRED BY THE MEMO PR MERGING. It is retired by a measured `fabric-evidence` job wall that leaves the required context at or under its budget with the needs edge and the FABRIC_EVIDENCE binding restored, which is the only thing that makes the block affordable again. Reducing the plan's process count, relaxing what a row asserts, or moving the calibration to a cadence does not satisfy this trigger — the first removes the subject, and the other two are different drops that would need their own rows.