MAIN-H2: give heal's revalidation a head it can bind — workflow_dispatch input + preflight, and repoint ci_heal_dispatch off the deleted ci.yml

[gunbai-bot]

The gap

A heal that repairs a branch pushes a new head H1 with the Actions job credential, and GitHub creates a pull_request run for that push and then withholds its execution — 4/4 created, 0/4 started a single job on attempt 1 (see Executed receipts). So nothing judges H1, and it arrived carrying H0's receipts, receipts about a tree that no longer exists.

Created-and-held is not never-created, and the distinction is load-bearing: a held run has a release path (POST /actions/runs/<id>/approve) and a nonexistent one does not. The job printed SupersededByHealedHead and exited nonzero, which is honest, but it is only a signal to a human reading a red job. Nothing re-admitted H1.

The modeled half of closing that already existed and was deliberately left unconsumed. #10118 refused to wire tools.ci_heal_dispatch because witnesses.yml declared no dispatch inputs, so a dispatched run could not check which head it got — it would have reported a verdict about a tree it cannot identify. That is a fabricated revalidation, worse than the honest gap. And ci_heal_dispatch_workflow_id read the literal "ci.yml", a workflow the 2026-08-15 floor cut deleted: the dispatcher pointed at a file with no existence, and for a fortnight nothing said so.

So the binding lands first here, and the dispatch depends on it.

What this builds

1 — the binding. gunbc.witness_floor_workflow declares ci_heal_expected_healed_sha_input, projected into on: workflow_dispatch: inputs:. The ordinary checkout selects ${{ inputs.expected_healed_sha || github.sha }}, and a preflight step runs immediately after checkout in every ordinary-checkout lane, refusing unless both github.sha and git rev-parse HEAD equal the expected head.

Selection and comparison are different claims over two different races, and both are kept separately authorable:

race	what goes wrong	which arm catches it
branch advances before GitHub resolves the dispatch ref	the check is attached to a commit nobody named	expected != github.sha
checkout diverges afterwards	right subject, wrong tree	expected != git rev-parse HEAD

A preflight carrying only the first passes the second while the job builds the wrong tree. The script is v2.workflow.ci_heal_revalidation_preflight_emit — orchestration intent that was already modeled and had no consumer — so the refusal arms are modeled control flow, not hand-authored YAML. An absent input is an ordinary manual dispatch and discharges no heal obligation; a hand-triggered run cannot impersonate a revalidation.

2 — the repoint. ci_heal_dispatch_workflow_id now reads artifact_name(a: WitnessFloorYamlArtifact). Deleting that variant would refuse this module at compile time; swapping "ci.yml" for "witnesses.yml" would have closed a stale citation by authoring the next one.

3 — the wire. The heal terminal invokes tools.ci_heal_dispatch inside the produced-a-heal arm, after the push and before the nonzero exit, because $HEALED_HEAD is a variable of that script. actions: write and GITHUB_TOKEN land with that consumer and nothing else widens. The job still exits nonzero, deliberately — it judged the prior head and has no standing to speak for H1 whatever it dispatched. H1 earns its own admission; H0's verdict is not rewritten.

The heal job carries no preflight: it checks out the triggering branch head in order to produce a healed one, and binding that checkout would refuse the job that creates the subject. And heal is not added to the required aggregate's needs:.

Two defects found by reading the emission rather than trusting it

Both are now permanent arms in the battery:

• the dispatch invocation and the SupersededByHealedHead echo emitted on one line — the echo would have become argv of gunbc;
• $ROOT is a per-step variable and this step never stamped it, so the composed invocation resolved to /target/release/gunbc, a path that exists nowhere. The dispatch would never have run. gunbc_invoke_root_stamp_script now carries its own terminator so no caller can forget it.

The emitted YAML looked entirely plausible in both cases, which is the shape a witness is for.

Evidence

Ten witnesses in test.claim.heal_revalidation_binding_witness, all executed green.

Discriminating RED, executed. Deleting the preflight from prepared_bound_steps (four lanes lose it, rust-unit-tests keeps its own copy) reddened the per-lane adjacency row — and the whole-file text row stayed green, because one surviving lane keeps every one of those strings somewhere in the file. So those two rows are measured non-redundant rather than assumed so, and that measurement is recorded in the annotation above them. Two other rows stayed green as the positive control that the battery does not refuse everything. The mutation was reverted and the confirming regeneration reproduced the byte-identical tree digest.

• Regeneration is at a byte-grain fixed point: two rounds, identical sha256 over the full diff.
• v1_src_dag_parse: 4572 files parse-clean, citation debt 39 — identical to origin/main's 39.
• Post-merge regeneration against a binary rebuilt from the merged tree: zero drift.

Executed receipts

Predictions were written down before every run.

Refusal arm — run 33706912902, dispatched with a stale SHA. All four ordinary-checkout lanes failed at step 4; every adjudicating step after it skipped, including Required CI: witnesses lane and all five uploads.

##[error]heal revalidation refused: workflow run subject e83526b7efbe...
         does not equal expected healed head 996b2d89f852...

Exactly one arm fired. The checkout arm stayed silent because ref: selection had already put HEAD at the expected SHA — the two-race split visible in a single run.

Positive arm — run 33706925651, same step, same code path: all four lanes step4=success, proceeding into the machinery; three fully green end to end.

heal revalidation preflight: checkout names expected healed head e83526b7efbe...

This arm is mandatory, not decoration: a preflight that refused everything would satisfy the refusal arm permanently and is only ruled out by this.

End to end — run 33709653544, heal job:

8a6761f403..958f743f9e  HEAD -> session/fierce-ram-670
HealProduced prior_head=8a6761f403... healed_head=958f743f9e...
             changed_artifacts=docs/plans/input-envelope-roadmap.md
[rest] POST .../actions/workflows/witnesses.yml/dispatches
SupersededByHealedHead prior_head=8a6761f403 healed_head=958f743f9e; revalidation-required
##[error]Process completed with exit code 1

Exactly one changed path, no blast radius. The POST went to witnesses.yml — the workflow the variant derives; the literal it replaced would have POSTed at ci.yml, a file that does not exist. That is the repoint demonstrated rather than argued. H0's verdict was not rewritten: the job still exits nonzero, after the dispatch rather than instead of it.

Run 33711101968 — event=workflow_dispatch, headSha=958f743f9e = H1, created one second after the POST — bound the healed head in its preflight.

That closes the revalidation gap, and deliberately claims nothing about the merge gate. The ordinary pull_request run on a healed head is created and then held: measured across every heal push since #10118, 4/4 created and 0/4 started a single job on attempt 1. The hold keys on the event, not the identity — 0 of 500 sampled workflow_dispatch runs are action_required (151 of them under the same bot), while all 17 action_required runs in the repo are pull_request. But releasing a held run is POST /actions/runs/<id>/approve on that run, and branches/main/protection is 403 to these sessions, so whether a dispatched green clears protection is unmeasured. The measured populations are owned by gunbc.rung_drop floor_cut_heal; this PR's carrier cites them rather than restating them.

The probe netted to zero by machine, not by hand: the healed file is byte-identical to the target derived locally before the run, and its diff against main is empty.

One defect this found, in my own change

Two witnesses called expected_witness_floor_yml() and BUDGET-REFUSED the floor's 500ms CPU ceiling at 503ms and 506ms, going INTERRUPTED-BEFORE-VERDICT — undecided is no verdict, so the floor went red. Fixed by decomposing the whole-file fold into two composed rows (192ms / 200ms — four-fold under, not shaved to fit), with what the pair cannot catch named in the carrier: both read the model, so a dropped step or a mangled block scalar would leave them green. That blind spot is not hypothetical — workflow_dispatch_yaml once discarded the entire inputs list while the model carried it.

Still not claimed

The checkout-mismatch arm has no live receipt and is not live-authorable through the production surface: checkout is bound to the input, so expected != github.sha trips the run-subject arm first and expected == github.sha forces HEAD to equal it. Inducing it means winning a force-push race; making it dispatchable would mean decoupling ref: from the input — weakening the selection that closes that race. Its discriminating RED runs at the fixture boundary instead. The carrier says this, so a later reader sees an unreachable arm rather than an untested one.

🤖 Generated with Claude Code

https://claude.ai/code/session_016dC4KDh8D8fTSaqpkfzBh8

[gunbai-bot]

Addressed in f30f18d.

The substance is real and is fixed. dispatch_input_is_declared_string folded a mapping's entries and matched every YamlValue variant, then did it again one level down and again below that — forty lines whose actual subject was "descend three keys". That is now yaml_key, the descent named once and applied three times, and the predicate reads as the three keys it walks.

The prescription names something that does not exist, measured rather than assumed:

• extdeps.languages.yaml.types exports constructors (yaml_string, yaml_mapping, kv) and yaml_value_kind — no lookup, getter, or query of any kind.
• The only two carriers in the corpus with this shape are this file and the pre-existing test.claim.workflow_dispatch_input_witness on main, which hand-rolls the identical walk for the identical question.

So "route the query through a canonical YAML accessor" reduces to add an accessor to a shared extdeps module — which reaches lanes with no stake in this PR while it sits under an active path hold. The accessor is therefore local, the carrier says that is not its correct final home, and it carries an explicit dissolution: it collapses into the shared accessor the moment one exists, taking the older triple-nested twin with it.

Two things deliberately unchanged, because the cheaper-reading form is the worse one. The leaf type check stays an exhaustive match over a closed coproduct — DESIGN §4's own idiom — and Optional<YamlValue> is the honest shape of a lookup that can miss. A wildcard arm would read shorter and silently answer false when a YamlValue variant is added, instead of failing to compile; that is the absorbing fallback §5 forbids.

On the cited authority. The finding grounds itself in "the ctrl review policy, not a DESIGN.md rule". This lane's brief is explicit that ctrl is not to be cited as authority here, so I have resolved the finding against DESIGN rather than against that policy. That is not a dismissal — the observation was correct on its own merits, which is why it is fixed — but the reasoning above is what the change stands on.

Evidence. All ten rows execute green. The reworked row reports 1712ms locally; that is not a cost this change introduced. The ~1.6s is the one-time witness_floor_workflow materialization paid by whichever row runs first, established by varying the order rather than reading one number: listed first it costs 1712ms while every_ordinary_checkout_lane costs 11ms; listed second it costs 0ms while that row pays 1644ms. Regen exit 0, no projection drift, parse clean.

— sent from fierce-ram-670