Completeness is an identity join: the count comparison accepted a stale row standing in for an unrostered blob

[gunbai-bot]

What was asked

compiler_tests_rust_blobs_are_all_rostered is RED on main (43 ct_ declarations vs 40 rostered): establish whether it is unenrolled or held known-red, disposition the unrostered blobs, and make the completeness claim honest.

It is enrolled, not unenrolled

The identity sits in floor_expected_red_chunk_live_tree_admission in v2.workflow.floor_expected_red — held known-red. Its entry declares ReadsLiveTree, which in entry_eligible_for_discovery_skip_before_resolve means it never predict-skips, so it genuinely executes and genuinely fails on every required run. Nothing was silently unenrolled.

The gap was not the four the counts suggested

The witness asserted declared_fn_count(ct_) == rostered_count_for(v1.compiler.compiler_tests_rust) — 44 against 40 on the current tree. Joined by identity, the residues are of two different kinds:

Five live blobs unrostered:

• ct_fixture_closure_rustc_discrimination_test
• ct_import_lines_follow_resolved_binding_identity_test
• ct_witness_carrier_declines_non_witness_expected_type_test
• ct_generic_param_declines_fail_closed_unwrap_test
• ct_shell_service_output_projection_known_hole_probe_test

One row that outlived its blob: ct_caret_parse_smoke_native_witness_tests, which #8532 deleted from the carrier while leaving the roster row standing.

This is the finding worth the PR. Rostering four of the five would have balanced the counts at 44 and greened the witness with one blob still unmarked and one row still naming a declaration that does not exist. The count was never the claim; it was a necessary condition of the claim being read as the claim. DESIGN §5 already says so outright: completeness is an identity join, not a count equality.

Disposition

All five are hand-authored Rust assertion blobs — the same class as their rostered neighbours — so they carry compiler_tests_rust_hand_assertion_scaffold_trigger. The stale row is removed. language_source_scaffold_roster_size stays derived; no literal moved.

The claim made honest

The witness now names the two residues separately — declared-not-rostered (a blob landed unmarked) and rostered-not-declared (a row outlived its blob) — and asserts each is empty, so the two directions red with distinct meanings and neither can pay for the other. Cardinality survives as a third conjunct answering the one question containment cannot: a duplicate within one side. The rt_ arm gets the same treatment and stays green.

head_before's structurally-unreachable Absent arm yields a spelling no roster row can carry rather than fabricating a plausible name — the failure arm refuses, it does not widen (§5).

The evidence does not stop at the repaired tree

A repaired population makes both live arms permanently green and the join indistinguishable from the count it replaced. So five discriminating controls run over authored fixtures, including the_join_refuses_equal_counts_with_different_identities — exactly the case the old form accepted (DESIGN §4b(1): a rung needs an executed RED plus an accepted positive control).

Delisted from the expected-red roster, since that roster self-empties on pass.

Executed evidence

gunbc run against the live tree. All ten witnesses in the file return true:

witness	result
compiler_tests_rust_blobs_are_all_rostered	true ← was RED on main
runtime_rust_blobs_are_all_rostered	true
language_source_scaffold_roster_is_fully_dispositioned	true
the_join_refuses_equal_counts_with_different_identities	true
the_join_refuses_an_unrostered_blob	true
the_join_refuses_a_row_that_outlived_its_blob	true
the_join_refuses_a_duplicate_row_masking_an_unrostered_blob	true
the_join_accepts_the_same_population_in_any_order	true
reasoned_terminal_is_accepted	true
pair_completion_spelling_binds_the_derivation_authority	true

The four the_join_refuses_* rows returning true means the join actively refuses those populations — a discriminating RED, executed rather than asserted.

A note for anyone running .dag witnesses: this had to run in a session container. BuildBuddy runners expose no cgroup memory limit, so gunbc run refuses there with HostBudgetUnreadable under gunbc.host_budget_source rather than admitting against a machine-wide reading. Remote is fine for check/clippy; it cannot execute the interpreter.

Generated projections

DESIGN.md and docs/design-ledgers.md are regenerated through dag/gunbc/instruments/generated_artifact_gate.dag main_wet — one line each — carrying a new recurring-failure-mode row, compensating_errors_cancel_in_the_aggregate, whose recognition rule is: for any check whose sentence contains "every", "all" or "covers", ask what it would report if one member were missing from one side AND one phantom stood on the other.

claim_executor --required-regen also ran clean (first_generation_equal=true, planned=149 executed=149).

🤖 Generated with Claude Code

https://claude.ai/code/session_01P7mphvNU1JoCbrowqDM5Zg