XL-0-SERVICE: the service-emission path in 05_emit_rust binds stdout to every declared output field and does not box the error arm — it emits non-compiling Rust

DESIGN.md

@@ -228,6 +228,7 @@ One row per class, each carrying its recognition rule and its receipts, in [docs
 - `accepted_source_emits_uncompilable_target`
 - `incidental_denominator_as_wall`
 - `compensating_errors_cancel_in_the_aggregate`
+- `one_refusal_two_destinations`
 
 ## Building & checks
 

dag/gunbc/instruments/generated_artifact_gate.dag

@@ -113,11 +113,33 @@ func generated_artifact_drift_failure_receipt() -> String {
 // would fit. The first half is true; THE SECOND IS FALSE AND WAS MEASURED FALSE BEFORE THIS
 // LANDED, which is why the corrected version is recorded rather than the tidy one.
 //
-// THE CEILING, stated at the grain that is actually true (measured 2026-08-31, this tree, by
-// polling VmHWM to completion):
-//   main_wet      -- all 35 artifacts -- peak RSS 7.55 GiB
-//   main_wet_one  -- exactly one      -- peak RSS 7.54 GiB
-//   ctrl-build --remote runner VM     -- 7.86 GB TOTAL
+// THE CEILING, stated at the grain that is actually true (by polling VmHWM to completion):
+//   main_wet      -- all 35 artifacts -- peak RSS 7.55 GiB   (2026-08-31)
+//   main_wet_one  -- exactly one      -- peak RSS 8.37 GiB   (2026-09-01, SUPERSEDES 7.54)
+//   ctrl-build --remote runner VM     -- 7.86 GB TOTAL       (= 7.32 GiB)
+//
+// THE ONE-ARTIFACT FIGURE ROSE 0.83 GiB IN ONE DAY AND THE OLD ONE IS NOT AMENDED IN PLACE,
+// because a ceiling that moves with the corpus is a different fact from a ceiling that was
+// mismeasured, and only the dated pair shows which this is. 8.37 GiB was measured on
+// 2026-09-01 by the same method as the row above it -- polling VmHWM, the kernel's own
+// high-water mark, to completion -- so the two are comparable and the growth is real rather
+// than an artifact of instrumentation. Re-derive it rather than trusting it: the poller is
+// two lines of shell over /proc/<pid>/status, and the figure belongs to the tree it was
+// measured on.
+//
+// WHY THE SUPERSESSION MATTERS MORE THAN THE 0.83: at 7.54 against a 7.86 GB VM the margin
+// reads as thin-but-conceivable, which invites the "maybe with a tighter budget setting"
+// attempt whose only outcome is an rc=137 twenty minutes in. At 8.37 GiB against 7.32 GiB
+// the requirement is a full gigabyte OUTSIDE the whole VM and the question stops being
+// tempting. A documented ceiling that UNDERSTATES the measured peak is worse than an
+// unmeasured one, because it gets cited as the reason a thing is safe to try -- the §4b
+// decoration shape pointed at a resource limit rather than at a check.
+//
+// gunbc.memory_stall_refusal bounds the same runner class from the other two sides: a
+// TRUTHFUL budget declaration thrashes without completing, an OVERSTATED one is SIGKILLed at
+// rc=137. With this figure the honest range there is not merely narrow, it is EMPTY, and the
+// remedy is a runner exposing a real cgroup limit rather than any value of the budget
+// variable.
 // Regenerating one artifact costs what regenerating thirty-five costs. The generation fold is NOT
 // where the memory goes: the shared WHOLE-TREE RESOLUTION is, and every path reaching the
 // generation stage pays it in full, so ROSTER SIZE IS NOT THE VARIABLE. main_wet is SIGKILLed on

dag/gunbc/language_source_scaffold_index.dag

@@ -434,6 +434,12 @@ data ct_row_ct_call_deficit_red_witness_test: LanguageSourceScaffoldRow = Langua
   disposition: compiler_tests_rust_hand_assertion_scaffold_trigger
 }
 
+data ct_row_ct_function_value_adapter_bound_alignment_control_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow {
+  carrier_module: "v1.compiler.compiler_tests_rust",
+  blob_decl: "ct_function_value_adapter_bound_alignment_control_test",
+  disposition: compiler_tests_rust_hand_assertion_scaffold_trigger
+}
+
 data ct_row_ct_function_value_named_application_controls_witness_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow {
   carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_function_value_named_application_controls_witness_test",
   disposition: compiler_tests_rust_hand_assertion_scaffold_trigger
@@ -512,6 +518,7 @@ data language_source_scaffold_roster: List<LanguageSourceScaffoldRow> = [
   ct_row_ct_shell_service_output_projection_known_hole_probe_test,
   ct_row_ct_call_shape_wall_witness_test,
   ct_row_ct_call_shape_duplicate_wall_witness_test,
+  ct_row_ct_function_value_adapter_bound_alignment_control_test,
   ct_row_ct_call_deficit_red_witness_test,
   ct_row_ct_function_value_named_application_controls_witness_test,
   ct_row_ct_function_value_field_method_known_hole_probe_test,

dag/gunbc/v1/v1_maintenance_standing.dag

@@ -441,3 +441,9 @@ data v1_seed_standing: SeedLifecycleStanding = SemanticsFrozen { maintenance: Ma
 // the carrier that actually governs v1 admissions.
 
 data v1_maintenance_typecheck_progress_admission_note: String = "AN ADMISSION UNDER THE 2026-08-20 PURPOSE TEST, recorded in the same PR as the change it admits, because an admission written afterwards is indistinguishable from an author's own classification. THE RULING, verbatim and relayed through the requesting session's parent (snappy-dove-250, import/namespace manager) on 2026-08-25: 'ah yeah - we need to fix the typecheckmoduleresult issue'. There is no PR review or transcript to point at; the relay is the record and this row is the citation, stated plainly rather than dressed up as pointing at a document that does not exist -- the same shape as v1_maintenance_purpose_ruling_note above.\n\nTHE DEFECT, at the grain that makes it a defect rather than an improvement. v1.compiler.infer typecheck_module has an early return: when build_type_env yields error diagnostics it hands back a TypedModule whose items list is EMPTY and never reaches item analysis. The seed therefore renders two different facts as one value -- a module that COMPLETED item checking and legitimately has no items, and a module that was ABANDONED before item checking started. Every downstream reader of TypedModule.items receives the same empty list for both, so a consumer wanting the distinction must infer it from 'items is empty AND there are error diagnostics', and that inference is unreliable in the direction that matters: a module that completed and has item-level errors presents identically. This is the state-space conflation DESIGN names, in the seed, on a carrier read by the whole back end.\n\nWHY THE FIELD LANDS ON TypedModule AND NOT ON TypecheckModuleResult, since the ruling names the result type and the change does not edit it. realize_module destructures the result and inserts only .typed into the module index; a progress field on the result alone would be discarded one line after it was set, which is this same defect one level out. The result type is where the issue was NOTICED; the carrier that survives the destructure is where the fact has to live.\n\nTHE EXHIBITED COST, because a defect with no demonstrated victim is a preference. A demand oracle built in this lane to score resolution producers read TypedModule.items to derive per-module demand, and was found DEAD as a scoring instrument for exactly this reason: an abandoned module reports total_arm1=1, which is indistinguishable from a genuine single-ask module, so the instrument's error is ANTI-CORRELATED with the defect it was built to find -- the modules most likely to abandon are the ones whose demand it most understates. That oracle was discarded rather than repaired, which is the measured price of the conflation and is why this is not speculative hardening.\n\nWHY IT SERVES THE V2 SELF-HOST PROGRAM, which is the whole admission test. The v2 resolution work this lane exists to do reads seed-produced TypedModule values to measure and compare producers. An instrument that cannot tell 'not checked' from 'nothing to check' cannot score a producer, and the program's next steps (one closure authority, exact denotation) are measurement-gated. This repairs the seed's report of its own progress; it adds no language behavior, no compatibility obligation, no escape hatch, and completes no seed feature.\n\nTHE SCOPE LIMIT, stated because this row will be cited and its limit is the part most likely to be dropped in the citing. THE RULING ADMITS THIS CHANGE ONLY. It does NOT settle whether PublicSurfaceGrowth means a NEW EXPORTED DECLARATION or ANY CHANGE TO EXPORTED SURFACE -- this change adds a coproduct and a record field to a type the seed exports, so it sits squarely on that unresolved boundary and was ruled admissible without the boundary being drawn. Nobody may cite this row as the answer to that question. A later proposal that needs the boundary decided must route it for its own ruling; treating this admission as precedent for a general reading of PublicSurfaceGrowth would be the authority-substitution failure DESIGN names -- borrowing one authority's answer to settle a question it never addressed. The five refused classes are untouched and still dominate every admission, including this one."
+
+// The 2026-09-02 authorized exception. Recorded as ONE declaration, not a category: the first form of
+// this ruling added a fifth MaintenanceAdmissionInstance variant and was reversed by its own author,
+// because a category exemption arriving as a coproduct row is still a category exemption.
+
+data v1_maintenance_adapter_alignment_control_exception_note: String = "AN EXACT AUTHORIZED EXCEPTION UNDER THE 2026-08-20 PURPOSE TEST -- deliberately NOT a new admission category. THE AUTHORIZER: bright-ram-778 (XL-N manager), 2026-09-02, relayed to the authoring session; the relay is the record and this row is the citation. THE EXACT SUBJECT, named rather than described so this row cannot be stretched: the single declaration ct_function_value_adapter_bound_alignment_control_test in v1.compiler.compiler_tests_rust, a regression control asserting that the function-value adapter is emitted exactly where the impl Fn bound is emitted and NOT at a bare type-variable parameter.\n\nWHY NO NEW ADMISSION VARIANT, and this reverses the authorizer's own first instruction. The first form of this ruling added an EvidenceEnrollment variant to MaintenanceAdmissionInstance with prose saying every section 4b(4) climb in v1 has this shape. THAT IS A CATEGORY EXEMPTION ARRIVING AS A COPRODUCT ROW rather than as a sentence -- the very move the same ruling had just declined, because a category never comes up for review again while one exception does. Checked rather than assumed: the four existing instances were all introduced in ONE commit when this carrier was authored (f1f9dd8a07, gunbc#9671), so there is no practice of growing that list per admission, and a fifth would be a new row on a growth surface this carrier names three lines below it -- putting NewEscapeHatchOrAdmissionRow in play on top of the PublicSurfaceGrowth question. One declaration is authorized. No vocabulary is widened.\n\nWHY IT SERVES THE V2 SELF-HOST PROGRAM. The adapter/bound alignment is an emission property v2 must preserve, and nothing else in the tree would notice a fork in it -- the adapter's predicate and the bound's predicate are one expression on one node today, and this control is what fails if they are ever separated. Section 4b(4) requires that a class's discriminating evidence REMAIN ENROLLED after a climb, so enrolling it is an obligation the design document places on us rather than a discretionary addition.\n\nTHE FIVE REFUSED CLASSES. Four are untouched: no semantic change, no compatibility obligation, no escape hatch or admission row, and the seed is no more capable after it. PUBLICSURFACEGROWTH FIRES LITERALLY AND IS AUTHORIZED ANYWAY, stated plainly rather than argued away -- AND THE AUTHORING CARRIER READS PERMISSIVE HERE, WHICH IS THE TRAP: compiler_tests_rust.dag spells this and all 45 of its declarations as bare `fn`, with zero `pub fn` anywhere, so reading the .dag would say the class does not fire. It does. PublicSurfaceGrowth is a diff over THE EMITTED SEED'S exported declarations, and stage0 emits `pub fn ct_function_value_adapter_bound_alignment_control_test` -- THE EMITTER ADDS THE VISIBILITY. The exception is authorized because the class exists to stop the seed ACCUMULATING CAPABILITY, and a test emitter accumulates none: nothing is expressible after this change that was not expressible before, and the declaration's entire content is evidence about behavior that already exists. This cites the RcStr row's statement of WHAT THE CLASS IS FOR and explicitly NOT its outcome -- it is not 'RcStr was admitted, so this is'.\n\nTHE REVIEW THAT FORCED THIS ROW, and the separation that matters. Reviews 58359 and 58380 refused this change for lacking a hand-Rust receipt -- a deleted scaffold path, a census shrink, or a deferral naming a lane and a concrete ROADMAP row -- citing DESIGN.md as the authority. DESIGN.md contains no such rule; verified against origin/main by the authoring session and independently by the authorizer. THE RULE IS REAL BUT ITS PROVENANCE IS FALSE: it lives in the REVIEW PROMPT owned by gunb-ai/ctrl (scripts/chatgpt-reviewer/prompts/gunbc.md), which states it verbatim and ATTRIBUTES IT TO gunbc's DESIGN.md, and whose stricter form is still scoped to 'v3 hand-Rust' although v3 was removed and migrated into v1. So the class is AUTHORITY SUBSTITUTION IN A REVIEW PROMPT, not provider invention, and its repair belongs to ctrl. Correspondingly the two refusals are NOT two independent sightings: they are two executions of ONE shared prompt, one producer, corroborating nothing about each other. AND NONE OF THAT MAKES THE CHANGE ADMISSIBLE -- the review's authority citation is false and the v1 admission obligation is independently real, which is why this row exists at all.\n\nWHY THE RECEIPT COULD NOT LAND IN THE SCAFFOLD INDEX. gunbc.language_source_scaffold_index carries LanguageSourceScaffoldRow with exactly carrier_module, blob_decl and disposition, and Disposition is a Terminal carrying a reason, or a Scaffold carrying a dissolves_to and a bind. No field a lane or a ROADMAP row could occupy exists, and none of its rows names either; authoring them in as prose would be the section 4c violation of putting commentary into a typed carrier.\n\nTHE SCOPE LIMIT. THIS AUTHORIZES THIS DECLARATION ONLY. It does NOT resolve whether PublicSurfaceGrowth means a NEW EXPORTED DECLARATION or ANY CHANGE TO EXPORTED SURFACE -- that boundary is recorded as unresolved above and stays unresolved. It establishes NO category for section 4b(4) evidence in v1: a later control needs its own authorization. Citing this row for either would be the authority-substitution failure DESIGN names, which this row also documents one level out.\n\nTHE COUNTER-ARGUMENT, preserved so whoever overturns this need not reconstruct it: a new exported fn in the emitted seed is exactly what the class names; the capability-versus-evidence distinction is authored rather than derived; and nothing mechanically holds it. WHO CAN OVERTURN IT: the classification is authored, at the mitigatable rung this carrier already declares, so it is a reviewer's or the operator's to reject. It is written to be easy to overturn."