XL-0-CITE follow-up: key prose-citation retirement by qualified identity (review 58234 repairs to merged #9940)

[gunbai-bot]

Why this exists

#9940 merged at 15:35:36Z as 4c6e5dfcd41 while the repairs for codex review 58228 / review 58234 were still local. Main therefore carries the pre-fix content and this branch carries it plus the repairs. Squash carries content, not ancestry, so both sides presented as add/add on merge; resolved to ours after checking that main's side is byte-identical to c88e4541, the commit that was squashed — so ours is a strict superset and the resolution discards nothing.

Both findings in review 58234 stood as REQUEST_CHANGES against the merged version.

Finding 1 — retirement was keyed on a bare name

The review called this a false-negative risk. It is worse than that, and the census's own argument is why.

A row retired from its module while the same spelling survives in another module read as "still live" and left the census entirely. But a prose citation of that name still resolves — to a declaration the prose did not mean. That is exactly the state the module's no-sweep section calls worse than dangling, because a resolving citation is never re-examined. A census whose thesis is "a citation that resolves and lies is worse than one that dangles loudly" cannot be built so that precisely those sites are the ones it cannot see.

Retirement is now module_path + decl_name, with baseline module lines read at the same revision through the same GrepMatchesAtRevision operation. Both sides of the join are the authored unstripped module name — checked against v2.std.decl_index, which documents module_path as authored-and-unstripped, rather than assumed; a silent v2. mismatch would have made every src/v2 row read as retired.

A baseline path with no module line establishes no identity and is not judged either way. Defaulting it to retired would enrol every unparsed file's rows into the population.

The site now carries ProseCitationResolution = CitedNameAbsentEverywhere | CitedNameSurvivesElsewhere, both counted — the two states the old key collapsed by dropping the second.

Finding 2 — hand-rolled coproduct predicate

prose_citation_site_is_annotation was an is_* -> Bool matching ProseCitationCarrier. Deleted; matched inline at its two consumers. Same class as review 58038 on #9874 (rung_drop_is_standing) — a lesson I had already been given and then regressed on.

The same error one level up, which finding 2 exposed

cross_file: Bool had no spelling for "the name was retired from several paths, so which file this citation is local to is not decidable from the site". A Bool must answer true or false: ignorance rendered as an answer.

• ProseCitationLocality = InRetiringFile | InAnotherFile | RetiringFileAmbiguous
• ProseRowOrigin = RetiredFromOnePath { path } | RetiredFromSeveralPaths, replacing a name-keyed map whose map_insert was silent last-write-wins over distinct origins.

Measured before building

Neither fix is priced on a hypothetical:

	at the pre-sweep baseline
retired rows / distinct names	4002 / 4002
sites in the survives-elsewhere class	0
colliding retirement origins	0
prose-row names declared in >1 file	38, across 119 rows

The spelling already collides in this corpus; only the retired subset happens not to. A realized n of zero is a fact about this tree, not about the construction.

Evidence

26 controls green by execution under --claim-run, five new, each a pair the old bare-name or Bool-valued version could not satisfy:

• the same bare name, retired in one module and live in its own → one retired, one not
• a cited name declared nowhere vs. surviving elsewhere → different arms
• one origin vs. several → resolves vs. refuses to pick
• the same path seen twice → still one origin (without this, any duplicate degrades every site to ambiguous)
• a baseline row whose module is unknown → not judged

Live run, every figure predicted before it was observed:

retired-rows=4002 sites=397 names=298 annotation=314 prose-row=83
another-file=249 ambiguous-origin=0 absent-everywhere=397 survives-elsewhere=0

survives-elsewhere=0 and ambiguous-origin=0 match the populations measured above, so this is construction for a real-but-unoccupied class, not repair of a live miscount. Sites 394 → 397 is this branch's own newly-tracked prose citing retired names — the census seeing itself.

Carried forward from #9940

The operator ScaffoldAdmitted record (scope, boundary, renewal triggers, dissolution) and the required_gate_prefixes enrolment are already on main via the squash and are unchanged here. The enrolment appears exactly once after the merge.

Predecessor: #9940 (merged).

🤖 Generated with Claude Code

[gunbai-bot]

Review 58281 addressed at d1ae0c0 — the finding is correct, and it is my own named failure mode reintroduced while fixing the previous one.

What was wrong. prose_citation_census_live checks exit_code on the first git query and argues about it at length in an annotation, then consumes the second query — the ^module read added during the qualified-identity rework for review 58234 — inline as .matches with no outcome check. A failed module read yields an empty index, every baseline row misses in lookup, the Absent => false arm drops it silently, and the function returns ProseCitationCensusObserved with zero retirements. An acquisition failure rendered as a reassuring census.

Two arms, both fail-closed.

• The module read's exit_code is checked and only 0 is accepted. Unlike the declaration read, where exit 1 is an honestly empty match set, a baseline with no module lines at all is not a corpus this census can say anything about.
• prose_citation_retired_rows becomes prose_citation_retirement_scan, returning ProseCitationRetirementScan { retired, unidentified }. Rows with no module identity are still not judged — but they are no longer dropped, and the caller refuses with the count when any exist. "Not judged" and "not counted" were the two states the single-list return conflated, which is what made the drop invisible.

Named the population before building the arm. Measured at baseline 2afe322f: 4807 prose rows against 4412 module lines, and zero rows without a module identity — every .dag source declaring a row also declares its module. So the new refusal cannot fire on a healthy read; it fires exactly when the acquisition is broken, which is what makes it a wall rather than a nuisance.

Evidence, by execution.

• 28/28 controls PASS on the real recogniser (was 25; three new).
• Discriminating RED: restoring the dropping arm turns a_baseline_row_whose_module_is_unknown_is_carried_not_dropped and a_partial_module_index_splits_the_rows_across_both_lists RED, while the counter pair a_populated_module_index_leaves_nothing_unidentified and both retirement controls stay PASS. The controls catch this defect, not any change.
• Live re-run at 2afe322f is identical to the pre-fix census — retired-rows=4002 sites=397 names=298 annotation=314 prose-row=83 another-file=249 ambiguous-origin=0 absent-everywhere=397 survives-elsewhere=0 — so neither new arm fires on the real corpus.

The nit in review 58279 is already resolved: the comment naming the retired cross_file field is gone. The one surviving mention names cross_file as the rejected Bool design that ProseCitationLocality replaced, which is rationale about why the construction has its shape rather than a stale field reference.

— sent from gentle-bear-446

[gunbai-bot]

Baseline side closed at 3e00e318, per the ruling to not ship the module arm alone. Both stated conditions were checked before building, and one of them changed the design.

Condition 1 — same shape? Yes, but at a finer grain than expected. prose_citation_baseline_row returned none for three materially different reasons, not two:

• a data NAME: String row the frontier declines — program data, 3058 at the baseline. Refusing on these refuses on every healthy run.
• the blank trailing element split yields for the final newline. It reaches the no-separator test, so a naive "refuse on unparsed" would have fired on every run via the trailing newline alone.
• output not shaped like git grep output — the acquisition misreporting its own format. The only arm that is a refusal.

So BaselineLineReading is a four-arm sum and prose_citation_baseline_scan returns { rows, non_prose_count, blank_count, unparsable }, with the caller refusing on unparsable. Same mechanism as the module arm — the state leaves the population with a diagnostic.

Condition 2 — RED reachable, GREEN not accidental? Both by execution:

• Mutation A (collapse Unparsable into the non-prose arm — the original defect) reds a_baseline_line_with_no_path_separator_is_unparsable_not_merely_empty and every_baseline_line_lands_in_exactly_one_arm, while the program-data and accepted-row controls stay green.
• Mutation B (drop the blank arm) reds the blank control and the partition control — so the arm that keeps the wall shippable is itself guarded.
• Live re-run at 2afe322f unchanged: retired-rows=4002 sites=397 names=298 annotation=314 prose-row=83 another-file=249 ambiguous-origin=0 absent-everywhere=397 survives-elsewhere=0. The wall does not fire on the real corpus.

every_baseline_line_lands_in_exactly_one_arm is the executable form of the measurement that admitted this wall — 4807 + 3058 = 7865, zero unparsable. A count gap and a mass silent drop are indistinguishable from the gap alone, so the control asserts the four arms exhaust the input rather than asserting a filter exists. No future arm can quietly absorb a line without reddening it.

31/31 controls PASS (was 28). Review 58292 approved d1ae0c09, which settled green on all six checks; this commit adds the symmetric arm on the baseline side and nothing in that review is outstanding.

— sent from gentle-bear-446