The roadmap plan authority becomes a parameter so a caller can supply its own plan

dag/gunbc/recurring_failure_mode/a_prerendered_body_carries_no_identity_of_its_source.dag

@@ -0,0 +1,34 @@
+module gunbc.recurring_failure_mode.a_prerendered_body_carries_no_identity_of_its_source
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_prerendered_body_carries_no_identity_of_its_source: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_prerendered_body_carries_no_identity_of_its_source" as NonEmptyStr,
+
+  receipts: [
+    "**a pre-rendered body carries no identity of its source** (one deployment parameterizes a fold by the authority it should answer from, and the parameter reaches every surface that renders at REQUEST time -- but a surface rendered EARLIER, by a different process, and merely read back at request time, answers from whatever authority THAT process was given. The request-time parameter is real and the read-back is real; what does not exist is any record, on the bytes, of which authority produced them. ",
+
+    "INVALID STATE: two processes of one deployment serving a response set derived from two different authorities, with no typed refusal and no observable at either end that distinguishes it from the coherent case. ",
+
+    "WHY IT SURVIVES REVIEW, and why it is worth a row rather than a note: the parameterization is genuinely complete on both entries. Each half is individually correct, each is individually witnessed, and the seam is not inside any fold a reviewer reads -- it is between two processes that never exchange the parameter. A reviewer checking that the plan reaches every consumer finds that it does. A reviewer checking that the read-back is faithful finds that it is. The defect is that FAITHFUL TO WHAT is unanswerable from the artifact. ",
+
+    "SPECIMEN (PR #10987). gunbc.roadmap_serve roadmap_serve_handle_over takes the roadmap plan as a parameter and every request-time surface reads it. The daily workspace page at path / does not render at request time: gunbc.roadmap_served_observation writes it at the belt tick through served_observation_observe_and_write_over, and the route serves the stored body. Supply a plan at the serve entry alone and / answers from the tick's plan, 200, no refusal. The two entries are both parameterized -- that is what makes this a seam rather than a missing parameter. ",
+
+    "DISTINGUISHING FACTS, so the row discriminates rather than warning generally. It requires all three: a value parameterized at an entry; a consumer materialized by a DIFFERENT entry ahead of time; and a stored artifact whose schema omits the parameter it was derived under. Remove the third and the mismatch is detectable. A cache keyed by its inputs is NOT this class -- the key is exactly the identity this class lacks. A surface that recomputes per request is not this class either, because there is one process and one parameter. ",
+
+    "NOT THE ABSORBING FALLBACK, and not a stale cache: nothing degrades and nothing widens. The stored body is a correct, current render of a coherent authority. What is false is only the implied claim that it is the authority THIS reader's entry was given, and that claim is made by juxtaposition rather than by any statement a fold could refuse. ",
+
+    "RUNG: FOUND below the ladder -- a reader served a page derived from an authority they did not select, with no typed diagnostic anywhere -- and DESIGN 4b does not admit that as a low rung: silent wrongness is outside the ladder and forbidden outright. The specimen diff was the thing that created the constructor, so it could not file the row and ship the state. ",
+
+    "RUNG NOW 1, mitigatable, and the split matters. The agreement is a DECLARED fact of the call (gunbc.roadmap_serve ServedDailyBodyAuthority): a caller that cannot state it gets a located refusal on that one route instead of a 200 from an unknown authority, so the UNDECLARED case is no longer silent and no longer reachable -- the coproduct has no third variant that serves. What remains is the DECLARED-BUT-FALSE case, where a caller asserts agreement its own tick does not honour. That is contained rather than prevented, because nothing on the serving side can check the assertion, and it is the residual the ceiling below is about. Stating rung 1 for the whole class rather than 3 for its refusing half is the 4b(1) rule that a class sits at the MINIMUM across its paths. ",
+
+    "CEILING 3, structurally guaranteed, and NOT 4. The mismatch is a relation between two independently launched processes, so it cannot be made unconstructible -- nothing stops an operator from starting a tick on one authority and a server on another. What CAN be derived is the refusal: if the stored artifact carries the identity of the authority it was rendered under, the read-back compares it to the identity the serving entry was given and refuses with a located cause instead of answering 200. That replaces a TRUSTED declaration with a CHECKED one, which is the whole distance between rung 1 and the ceiling. ",
+
+    "NEXT-RUNG TRIGGER, a capability rather than an artifact: a materialized-surface identity that binds a stored body to the authority it was derived under, sufficient for a read-back to decide agreement with the authority its own entry holds and to refuse on disagreement. Stamping a field into one snapshot type is not the trigger unless the read-back is obligated to consult it -- an identity nothing compares is the decoration DESIGN 4b names, and would leave the class exactly where it is while appearing to retire it. ",
+
+    "REVIEW TELL: a diff that parameterizes an authority and then explains, in prose, that one surface is served from a body rendered elsewhere. Ask what the stored bytes say about which authority produced them. If the answer is nothing, the seam is undetectable, and the two wrong answers are to document it or to file it at a low rung -- both leave the forbidden state reachable. The available arm is refusal at a declared boundary, today, and the row is what carries the debt from there to the checked version.",
+  ],
+
+  evidence: [],
+}

dag/gunbc/roadmap/roadmap_belt_actuate.dag

@@ -26,7 +26,7 @@ import gunbc.roadmap_dispatch_actuator {
 }
 import extdeps.git { shape_git_merge_base_args }
 import gunbc.roadmap_authority {
-  roadmap_authority_projection,
+  RoadmapAuthorityProjection, roadmap_authority_projection,
   RoadmapAuthorityProjected, RoadmapAuthorityProjectionRefused,
   authored_merged_prs,
 }
@@ -6054,9 +6054,16 @@ fn belt_page_sessions_need(standing: LaunchHostStanding, graph: LaunchGraphStand
   })
 }
 
-fn belt_launch_host_standing_for_page(instance: HostDashboardInstance) -> LaunchHostStanding {
+// The page's standing is decided against the plan the page is about to RENDER. Passing the plan in
+// rather than reading the public carrier here is what keeps the two halves of one response honest:
+// a caller rendering a different plan would otherwise get session-need decided from a roadmap its
+// reader never sees.
+fn belt_launch_host_standing_for_page_over(
+  instance: HostDashboardInstance,
+  plan: RoadmapAuthorityProjection,
+) -> LaunchHostStanding {
   let pre = belt_launch_host_standing(instance: instance)
-  match roadmap_authority_projection() {
+  match plan {
     RoadmapAuthorityProjectionRefused { detail: _ } => pre
     RoadmapAuthorityProjected { doc, accepted: _ } => {
       let graph = launch_graph_of_document(doc: doc)
@@ -6092,6 +6099,23 @@ fn belt_dispatch_node_for_instance(
   belt_dispatch_node_staged(instance: instance, standing: belt_launch_host_standing(instance: instance), node_id: node_id)
 }
 
+// The dispatch route reaches the SAME staged fold with a caller-supplied plan. belt_dispatch_node_staged_over
+// already took the graph as a parameter, so this adds no second decision path -- it only supplies
+// launch_graph_of_projection over the given plan instead of over the public one.
+fn belt_dispatch_node_for_instance_over(
+  instance: HostDashboardInstance,
+  plan: RoadmapAuthorityProjection,
+  node_id: String,
+) -> BeltSpawnOutcome {
+  belt_dispatch_node_staged_over(
+    instance: instance,
+    standing: belt_launch_host_standing(instance: instance),
+    graph: launch_graph_of_projection(proj: plan),
+    merged: authored_merged_prs(),
+    node_id: node_id,
+  )
+}
+
 // THE ROUTE'S DECISION PATH after the staged host observation, and the seam the hermetic
 // real-driver controls exercise: given a pre-session standing (sessions pending), the node's
 // model-only gates are decided first; only LaunchStageNeedsSessions lists tmux, so an unknown,

dag/gunbc/roadmap/roadmap_forecast.dag

@@ -43,10 +43,8 @@ import gunbc.roadmap_authority {
   declared_roadmap_nodes,
   active_roadmap_nodes_for_accepted,
   active_roadmap_edges_for_accepted,
-  roadmap_authority_projection,
+  RoadmapAuthorityProjection, roadmap_authority_projection,
   RoadmapAuthorityProjected, RoadmapAuthorityProjectionRefused,
-  accepted_roadmap_node_ids_projection,
-  AcceptedRoadmapNodeIdsProjected, AcceptedRoadmapNodeIdsProjectionRefused,
   roadmap_acceptance_receipts,
   RoadmapAcceptanceReceiptsProjected,
   RoadmapAcceptanceReceiptsProjectionRefused,
@@ -861,28 +859,40 @@ fn schedule_forecast(
   } }
 }
 
-fn live_roadmap_schedule_forecast(
+// THE FORECAST'S PLAN IS A PARAMETER. The accepted set is carried BY the projection -- it is the
+// field roadmap_authority_projection fills from accepted_roadmap_node_ids_projection -- so the fold
+// reads it from the plan it was handed rather than re-deriving it from the public carrier. That is
+// what makes a caller-supplied plan forecastable at all: a second read would have answered about
+// the public roadmap while the nodes came from the caller's.
+fn roadmap_schedule_forecast_over(
+  plan: RoadmapAuthorityProjection,
   assumptions: ScheduleForecastAssumptions,
   anchor: ForecastAnchorObservation,
 ) -> ScheduleForecastResult {
-  match roadmap_authority_projection() {
+  match plan {
     RoadmapAuthorityProjectionRefused { detail: detail } =>
       ScheduleForecastRefused { refusals: [ForecastRoadmapAuthorityRefused { detail: detail }] }
-    RoadmapAuthorityProjected { doc: _, accepted: _ } =>
-      match accepted_roadmap_node_ids_projection() {
-        AcceptedRoadmapNodeIdsProjected { ids: accepted } =>
-          let builds = roadmap_cycle_time_observation_builds()
-          schedule_forecast(
-            nodes: active_roadmap_nodes_for_accepted(accepted: accepted),
-            edges: active_roadmap_edges_for_accepted(accepted: accepted),
-            observations: accepted_cycle_time_observations(builds: builds),
-            history_refusals: cycle_time_history_refusals(builds: builds),
-            population_exclusions: cycle_time_population_exclusions(builds: builds),
-            assumptions: assumptions,
-            anchor: anchor,
-          )
-        AcceptedRoadmapNodeIdsProjectionRefused { detail: detail } =>
-          ScheduleForecastRefused { refusals: [ForecastRoadmapAuthorityRefused { detail: detail }] }
-      }
+    RoadmapAuthorityProjected { doc: _, accepted: accepted } =>
+      let builds = roadmap_cycle_time_observation_builds()
+      schedule_forecast(
+        nodes: active_roadmap_nodes_for_accepted(accepted: accepted),
+        edges: active_roadmap_edges_for_accepted(accepted: accepted),
+        observations: accepted_cycle_time_observations(builds: builds),
+        history_refusals: cycle_time_history_refusals(builds: builds),
+        population_exclusions: cycle_time_population_exclusions(builds: builds),
+        assumptions: assumptions,
+        anchor: anchor,
+      )
   }
 }
+
+fn live_roadmap_schedule_forecast(
+  assumptions: ScheduleForecastAssumptions,
+  anchor: ForecastAnchorObservation,
+) -> ScheduleForecastResult {
+  roadmap_schedule_forecast_over(
+    plan: roadmap_authority_projection(),
+    assumptions: assumptions,
+    anchor: anchor,
+  )
+}

dag/gunbc/roadmap/roadmap_page.dag

@@ -971,20 +971,6 @@ fn v1_exit_program_progress_view_for_accepted(accepted_ids: List<RoadmapNodeId>,
   }
 }
 
-fn v1_exit_program_progress_view(ready_count: Int) -> ProgramProgressView {
-  match accepted_roadmap_node_ids_projection() {
-    AcceptedRoadmapNodeIdsProjectionRefused { detail: _ } =>
-      ProgramProgressView {
-        name: "v1 exit (acceptance carrier refused)",
-        completed: 0,
-        total: 0,
-        ready_obligation_count: ready_count,
-      }
-    AcceptedRoadmapNodeIdsProjected { ids: accepted_ids } =>
-      v1_exit_program_progress_view_for_accepted(accepted_ids: accepted_ids, ready_count: ready_count)
-  }
-}
-
 fn program_progress_markup_of(v: ProgramProgressView) -> Fragment {
   el_class("section", "program-progress", [
     el_class("span", "program-progress-name", [ txt(v.name) ]),
@@ -1090,29 +1076,6 @@ fn daily_workspace_view_of_for_accepted(
     members: live_work_family_members_for_accepted(accepted: accepted_ids))
 }
 
-fn daily_workspace_view_of(doc: RoadmapDocument, merged: List<Int>, attempts: List<WorkflowAttemptProgress>, attempts_refused: String?, standings: RoadmapStandings, launch: LaunchHostStanding) -> DailyWorkspaceView {
-  match accepted_roadmap_node_ids_projection() {
-    AcceptedRoadmapNodeIdsProjectionRefused { detail: _ } =>
-      daily_workspace_view_of_for_accepted(
-        doc: doc,
-        merged: merged,
-        accepted_ids: [],
-        attempts: attempts,
-        attempts_refused: attempts_refused, standings: standings,
-        launch: launch,
-      )
-    AcceptedRoadmapNodeIdsProjected { ids: accepted_ids } =>
-      daily_workspace_view_of_for_accepted(
-        doc: doc,
-        merged: merged,
-        accepted_ids: accepted_ids,
-        attempts: attempts,
-        attempts_refused: attempts_refused, standings: standings,
-        launch: launch,
-      )
-  }
-}
-
 fn roadmap_daily_workspace_page_impl_for_accepted(
   doc: RoadmapDocument,
   merged: List<Int>,
@@ -1190,34 +1153,6 @@ fn roadmap_fleet_page() -> Fragment {
   }
 }
 
-fn roadmap_daily_workspace_page_impl(doc: RoadmapDocument, merged: List<Int>, main_prefix: List<Fragment>, attempts: List<WorkflowAttemptProgress>, attempts_refused: String?,
-  standings: RoadmapStandings, launch: LaunchHostStanding) -> Fragment {
-  match accepted_roadmap_node_ids_projection() {
-    AcceptedRoadmapNodeIdsProjectionRefused { detail: _ } =>
-      roadmap_daily_workspace_page_impl_for_accepted(
-        doc: doc,
-        merged: merged,
-        accepted_ids: [],
-        main_prefix: main_prefix,
-        attempts: attempts,
-        attempts_refused: attempts_refused,
-        standings: standings,
-        launch: launch,
-      )
-    AcceptedRoadmapNodeIdsProjected { ids: accepted_ids } =>
-      roadmap_daily_workspace_page_impl_for_accepted(
-        doc: doc,
-        merged: merged,
-        accepted_ids: accepted_ids,
-        main_prefix: main_prefix,
-        attempts: attempts,
-        attempts_refused: attempts_refused,
-        standings: standings,
-        launch: launch,
-      )
-  }
-}
-
 fn roadmap_page_impl(doc: RoadmapDocument, merged: List<Int>, main_prefix: List<Fragment>, launch: LaunchHostStanding) -> Fragment {
   let ctx = page_launch_context(doc: doc, merged: merged, launch: launch)
   let lead = map(doc.lead_lanes, s => section_markup(s: s, merged: merged, launch: ctx))
@@ -1294,10 +1229,6 @@ fn roadmap_page_for_authority() -> Fragment {
   roadmap_page_for_projection(proj: roadmap_authority_projection())
 }
 
-fn roadmap_page_for_authority_launch(launch: LaunchHostStanding) -> Fragment {
-  roadmap_page_for_projection_launch(proj: roadmap_authority_projection(), launch: launch)
-}
-
 fn roadmap_page_for_projection(proj: RoadmapAuthorityProjection) -> Fragment {
   roadmap_page_for_projection_launch(proj: proj, launch: launch_host_unobserved_static_render())
 }
@@ -1327,26 +1258,30 @@ fn roadmap_page_for_projection_launch(proj: RoadmapAuthorityProjection, launch:
   }
 }
 
+// THE ACCEPTED SET IS SUPPLIED HERE TOO, AND THAT IS WHY THE LEAK HAS NO CONSTRUCTOR LEFT.
+//
+// These two entries used to reach roadmap_daily_workspace_page_impl, which read
+// accepted_roadmap_node_ids_projection() itself. That fold was also the refusal arm of
+// roadmap_daily_workspace_page_for_projection_observed, so a caller-supplied plan that failed to
+// project rendered beside the PUBLIC accepted set (review 63317). Routing that one arm to the
+// _for_accepted form closed the route, but left the ambient-reading fold standing -- and a probe
+// cannot guard it: under the hermetic witness route the carrier read REFUSES and yields the same
+// empty set, so the defect is invisible to any witness that could be enrolled (measured: the
+// leak restored in an isolated worktree, the probe still PASSED). DESIGN 4b says a check whose RED
+// is not authorable is not a weak wall but a decoration, and 5 says prefer construction over
+// validation. So the fold is deleted rather than watched: nothing below the parameterized route
+// can name the public accepted set any more, and these two get the empty one, which is what their
+// own "the event carrier is not consulted" already claimed and did not deliver.
+
 fn roadmap_daily_workspace_page(doc: RoadmapDocument, merged: List<Int>) -> Fragment {
-  roadmap_daily_workspace_page_impl(doc: doc, merged: merged, main_prefix: [], attempts: [], attempts_refused: none, standings: StandingsUnobserved { reason: "static render: the event carrier is not consulted" }, launch: launch_host_unobserved_static_render())
+  roadmap_daily_workspace_page_impl_for_accepted(doc: doc, merged: merged, accepted_ids: [], main_prefix: [], attempts: [], attempts_refused: none, standings: StandingsUnobserved { reason: "static render: the event carrier is not consulted" }, launch: launch_host_unobserved_static_render())
 }
 
 fn roadmap_daily_workspace_page_launch(doc: RoadmapDocument, merged: List<Int>, launch: LaunchHostStanding) -> Fragment {
-  roadmap_daily_workspace_page_impl(doc: doc, merged: merged, main_prefix: [], attempts: [], attempts_refused: none, standings: StandingsUnobserved { reason: "static render: the event carrier is not consulted" }, launch: launch)
-}
-
-// The served daily workspace consumes the OBSERVED attempt evidence at render (the serve handler decomposes the belt observation and passes progress rows or the located refusal), so the active band and every server-rendered activity region are real facts, not placeholders — the same decided views the /workflow.json wire carries, giving the client poll an identical starting DOM (the parity obligation's server half). The zero-argument form stays pure (empty attempts, nominal observation) for witnesses that assert composition without observation.
-fn roadmap_daily_workspace_page_for_authority_observed(attempts: List<WorkflowAttemptProgress>, attempts_refused: String?,
-  standings: RoadmapStandings, launch: LaunchHostStanding) -> Fragment {
-  roadmap_daily_workspace_page_for_projection_observed(
-    proj: roadmap_authority_projection(),
-    attempts: attempts,
-    attempts_refused: attempts_refused,
-        standings: standings,
-    launch: launch,
-  )
+  roadmap_daily_workspace_page_impl_for_accepted(doc: doc, merged: merged, accepted_ids: [], main_prefix: [], attempts: [], attempts_refused: none, standings: StandingsUnobserved { reason: "static render: the event carrier is not consulted" }, launch: launch)
 }
 
+// The served daily workspace consumes the OBSERVED attempt evidence at render (the tick decomposes the belt observation and passes progress rows or the located refusal), so the active band and every server-rendered activity region are real facts, not placeholders — the same decided views the /workflow.json wire carries, giving the client poll an identical starting DOM (the parity obligation's server half). The plan is a parameter because the caller that renders it is the caller that chose it.
 fn roadmap_daily_workspace_page_for_projection_observed(
   proj: RoadmapAuthorityProjection,
   attempts: List<WorkflowAttemptProgress>,
@@ -1356,9 +1291,10 @@ fn roadmap_daily_workspace_page_for_projection_observed(
 ) -> Fragment {
   match proj {
     RoadmapAuthorityProjectionRefused { detail: detail } =>
-      roadmap_daily_workspace_page_impl(
+      roadmap_daily_workspace_page_impl_for_accepted(
         doc: RoadmapDocument { preamble: [], lead_lanes: [], sections: [] },
         merged: [],
+        accepted_ids: [],
         main_prefix: [
           dashboard_instance_banner(),
           roadmap_authority_refusal_markup(detail: detail),