hermetic mock fidelity: name the seed capability as the trigger, and record the class as structural

[gunbai-bot]

What this is

A census lane's landing. The brief asked for the population of hermetic witnesses made vacuous
because a mock's success does not depend on the request. The census found the population is
small, and that the class points the opposite way from the hypothesis it was dispatched on.
This PR records the mechanism; it adds no rows and repairs no witnesses.

The census, in one line each

• PublishedMockCase is an enrolment roster, not a response. The response is the
  mock_response property on the operation. The two populations overlap only in part, and
  reading one as an answer to the other mis-sizes the class in either direction.
• The unconditionality is structural: eval_mock_response evaluates a mock arm in an
  empty environment, so an arm cannot refer to its operation's declared inputs at all. An
  input-varying arm is not unwritten in this corpus — it is unwritable in this seed.
• Failure-asserting witnesses over a live mock arm: effectively none. Every refusal-shaped
  candidate decides its refusal before any mocked operation is consulted. The one known live
  instance is already enrolled in v2.workflow.floor_expected_red — held red and visible.
• What is actually vacuous runs the other direction: success-asserting witnesses that assert
  a mock constant back to itself.

The finding, measured rather than read

One witness, one binary, one tree, four runs.
witness_os_id_uid_realizes_hermetically asserts r.value == "1000" against an arm answering
"1000".

	hermetic (--dry-run)	wet (no --dry-run)
perturb the mock arm literal	RED	green
perturb the realization argv	green	RED

The realization perturbation is not subtle: argv: ["id","-u"] became argv: ["id","-G"], so
the operation asks for the group list and calls the answer a uid. Hermetically the witness
cannot see it. The arm perturbation is the positive control proving the harness was live for
that green.

So the witness is fixture-determined in the mode CI runs, and realization-determined in the mode
nobody runs. Its name, "realizes hermetically", is true only of the column that carries no
information about the operation.

The sudo grant-list row is the neighbouring shape and behaves differently under the same
treatment — its fixture conjunct reds on the arm perturbation and its discriminating
conjunct survives to red independently on a production perturbation. Not vacuous; over-specified.
Different remedy, so it is recorded separately.

What changed

• The two unsatisfiable triggers. ExitStatus and CapturedOutput named a state of the
  world ("a mock_response whose value varies with the operation's declared input") that no
  author could reach. §4b(3) retires a row by its trigger and by nothing else, so both now name
  the seed capability and state what it must be sufficient for. TransportReachability is
  untouched — its refusal-not-a-better-mock answer was already right, and for a reason the other
  two are not.
• This file's own trigger, likewise named as a missing capability rather than left as unbuilt
  work. hermetic_mock_fabricating_count is zero by construction while it folds a hand list, and
  counting the corpus is blocked: no channel exposes an operation's mock_response property to
  a .dag lens. v2.lens.extdeps_shape_transport_policy is named as the neighbour and
  ExtdepsOperationInputFact / ExtdepsTransportArgvFact as the precedent, so whoever holds the
  seed budget can size it without re-deriving it.
• A third witness category, named: a witness whose whole assertion is the arm's own literal
  is not a decoration — it has an authorable red — but it establishes enrolment, never
  behaviour. The names invite the wrong reading, which is the actionable part.
• A methodology note, because two of its three hazards fail toward false confidence rather
  than toward a visible error:
  • The exit code is not the verdict. gunbc run refuses a Bool witness at the CLI boundary
    (returned true, not ProcessExit) with the same status whether it returned true or false.
    The printed value is the readout. A wrapper scoring arms by exit status — echo $?,
    especially after a pipe — reports success for every arm and publishes the opposite of the
    truth with no error shown. This is the one a reader cannot rediscover by reasoning: a wrong
    mode announces itself as a strange result, an identical exit code announces nothing.
  • State the mode beside every verdict. Without --dry-run the run is wet and really
    executes, inverting both perturbation answers. Grep the trace for [hermetic:mock] <op>.
  • Venue is local-only today. A runner with no cgroup memory limit makes gunbc refuse with
    HostBudgetUnreadable before reaching any witness — every arm returns one identical refusal
    and zero verdicts.

What deliberately did not happen

• No new failure-mode row. gunbc.recurring_failure_mode.transport_mock_success_independent_of_request
  (Remove the raw-script arm from HostEffect and preserve typed gate witnesses #10509) is the single authority for the class. One class, one row.
• No 35-row roster. The arms are not 35 facts; they are one structural cause observed 35
  times. Enumerating them would mint one dissolution obligation per observation — net concepts
  growing by re-invention — each unretirable until the seed changes, and stale on the next arm
  with nothing going red.
• No counts transcribed. The population is derivable from the operation declarations, so it
  is named by its derivation.
• No witness deleted. A probe that cannot go red is evidence of a modeling gap.
• No seed growth. The capability is named as a trigger, not built. That ruling belongs to
  the seed budget holder.

Evidence

Four existing witnesses over this authority stay green under --dry-run:
hermetic_mock_live_roster_is_diagnosed, hermetic_mock_undiagnosed_fabricating_row_is_rejected,
hermetic_mock_honest_row_needs_no_fabrication_list, hermetic_mock_reachability_trigger_is_distinct.

Comment-only change to one .dag module plus two trigger strings; no type, function signature,
or row changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TX3LxjxyNjcAoS9bq5tMbU