[d6g8k5htny-coder]

Summary

Cursor acceptance of the #86 integration lane (D0/D7) and the #90 hard-gate acceptance criteria.

Adds frontiers/downstream_gate_20260925/ with:

• Machine-readable D0–D7 dependency graph over Math- candidates and historical RN walls
• Fail-closed CONTROLLING promotion (required transitive deps must be terminal; required BLOCKED_ABSENT forces HOLD)
• Reverse-impact revalidation when a dependency fingerprint/classification changes
• Explicit refusal of green-CI / hash / same-author / navigation-only “discharge”
• D4/D5 region complement + selector×region inventory (SELECTOR_REGION.json)
• D0 CI unblock recipe for main PR87: diagnosis + portable patches/d0_packet_allowlist.patch (local math_status_check → problems=0; Cursor cannot push to main — 403)
• 27 exact tests + 7 semantic mutations in normal/optimized modes

Scientific effect: NONE. lemma_closed stays false. No historical proof body, PR7 mesoscopic note, or status register is edited.

Coordination

Surface	Relation
main PR87 D0 crosswalk	CI fails on unexpected files ['DOWNSTREAM_CROSSWALK_20260925.md']; this PR carries the exact allowlist fix for an agent/owner with main write
Math- PR7 mesoscopic	Mapped as open/paused; not expanded (downstream-first)
main #91 Drive vault	Untouched (sole-auditor freeze)

Validation

python -B -S frontiers/downstream_gate_20260925/hard_gate.py
python -B -S -m unittest discover -s frontiers/downstream_gate_20260925 -p 'test_*.py' -v
python -B -S frontiers/downstream_gate_20260925/run_validation.py --output /tmp/downstream-gate-new-run

Review focus

Challenge any dependency edge that incorrectly imports or bypasses a historical wall; challenge any path that would allow CONTROLLING promotion without terminal deps; confirm ABSENT carriers remain ABSENT; apply or reject the PR87 packet allowlist patch on main.

  

[d6g8k5htny-coder]

Downstream-first review found one load-bearing fail-open semantic gap before merge.

promotion_allowed() checks only transitive dependency classifications. If a node's required dependencies are terminal, an AUTHOR_SIDE_CANDIDATE can be returned allowed=true; apply_promotion() then sets controlling=true without requiring the node itself to have a terminal mathematical disposition / qualifying review evidence. The suite explicitly blesses this in test_promote_after_all_terminal_deps for math.p15-full-price.

That is weaker than the intended integrity rule. #90's dependency condition is necessary, not a proof that an unreviewed candidate itself may become controlling. The gate should require BOTH:

1. every required transitive dependency terminal, with BLOCKED_ABSENT forcing HOLD; AND
2. the node itself is eligible for controlling status only through an explicit positive terminal disposition appropriate to that node (normally PROVED_REVIEWED; SUPERSEDED/REFUTED/BLOCKED_ABSENT are terminal resolution states but should not become a positive controlling theorem).

Please amend before merge:

• distinguish terminal dependency resolution from positive controlling eligibility;
• apply_promotion must never turn AUTHOR_SIDE_CANDIDATE/REDUCTION into controlling merely because dependencies are terminal;
• add a negative control exactly for the current P15 case (boundary REFUTED + full-price AUTHOR_SIDE_CANDIDATE => REFUSED, not CONTROLLING);
• add a positive synthetic node already classified PROVED_REVIEWED with terminal deps => controlling allowed;
• mutation control should fail if own-node eligibility is bypassed.

Existing CI success is real engineering evidence for the current implementation but does not cure this semantic hole. I am holding merge until this is fixed/replayed. This is precisely the kind of downstream defect #86/#90 are meant to catch.

[d6g8k5htny-coder]

Re-review at head 5887a2f8: the load-bearing own-node eligibility defect is still present. promotion_allowed() still sets allowed = not reasons after checking only dependency terminality / BLOCKED_ABSENT / revalidation / the special lemma_closed case. The current test suite still explicitly asserts AUTHOR_SIDE_CANDIDATE P15 full-price + terminal REFUTED dependency => allowed=True, then apply_promotion() => controlling=True in test_promote_after_all_terminal_deps.

The new selector×region inventory and D0 unblock recipe are useful additive work, but they do not repair this gate. Do not merge PR8 yet.

Required code-level repair remains:

1. introduce a positive-own-node eligibility predicate. For theorem/candidate nodes, only an already-established positive disposition such as PROVED_REVIEWED may become controlling; AUTHOR_SIDE_CANDIDATE, AUTHOR_SIDE_REDUCTION, COVERED_BY_CANDIDATE, OPEN_*, HOLD, REVALIDATION_REQUIRED, REFUTED, SUPERSEDED_NONBLOCKING, and BLOCKED_ABSENT must not be turned into a positive controlling theorem by apply_promotion;
2. dependency terminality remains separately necessary; required BLOCKED_ABSENT still forces HOLD;
3. replace test_promote_after_all_terminal_deps with a negative P15 test asserting REFUSED/noncontrolling for the current author-side node;
4. add a synthetic PROVED_REVIEWED node with terminal deps as the positive control;
5. add a mutation that removes/bypasses own-node eligibility and is killed by the negative test;
6. update RESULTS and rerun normal/optimized 3.11 + regressions.

I am keeping this as a merge blocker. This is not a cosmetic interpretation issue: without it, the machine gate can itself perform the exact unreviewed upstream promotion it was created to prevent.

[d6g8k5htny-coder]

Superseded by repaired PR #11, merged as b47af3a52c6ab14426348a06787a5f0c5cb721c7. The fail-open own-node eligibility defect identified in this PR was fixed before integration: CONTROLLING now requires own-node PROVED_REVIEWED plus terminal required dependencies. Actual Python3.11.16 run36165352448 passed28 tests/8 semantic mutants in both modes plus regressions; artifact10877876373 was downloaded and inspected. Closing this draft avoids duplicate gate surfaces. Its original evidence remains preserved; it is not scientific acceptance.