Interlock: native-route required-lane milestone; namespace cutover and grammar retirement run on the native floor

[briansrls]

Interlock carrier edit under two rulings from fierce-lark-661 (2026-09-12). Scope: dag/gunbc plus one witness file.

1. New milestone SelfHostNativeRouteRequiredLane: the native route as a required lane.

• The lane is promoted through the C6 discriminating matrix, which retires gunbc.rung_drop v2_native_route_off_the_merge_path.
• gunbc.compiler_frontend_program_status native_route_required_lane_outstanding derives its standing from that drop row. A standing drop reads outstanding at the drop's identity; a retired drop reads clear. The standing is never authored.
• SelfHostRatchetGateEnrolled is deliberately left unchanged. It is the compile-phase regression gate against the persisted frontier (gunbc.self_host_compile_phase_live_gate, merged in Gate the LIVE tree with the compile-phase frontier ratchet, and declare why the measurement is not yet enrolled #9857, enrolment parked by the operator). Native admission answers a different question, so re-pointing it would be a §3 meaning fork.

2. Cycle removed.

• SelfHostSeedRetirement used to require NamespaceGrammarRetired.
• The adopted order, grammar last (2026-08-25) and v1 deleted on the native floor first (2026-09-12), runs XL-6/XL-7 after v1 deletion. Combined with that edge, this is a cycle.
• Seed retirement now requires the native-route milestone instead. NamespaceFixForwardComplete requires SelfHostSeedRetirement, and NamespaceGrammarRetired requires the cutover. That encodes the adopted order (native floor, then v1 deleted, then cutover, then grammar last) as direct edges, per review 64743.

Evidence (test.claim.compiler_frontend_program_status_witness):

• the_native_route_milestone_is_wired_to_its_drop_row: a relation over the live drop row.
• the_native_route_fold_answers_both_ways: both drop standings authored as fixtures.
• the_namespace_cutover_runs_on_the_native_floor_after_the_seed: pins those four edges. It is red on main's edges. It is not a general cycle detector: before this change, no carrier encoded the "grammar after v1 deletion" order.
• Execution status: NOT YET EXECUTED. Three BuildBuddy attempts built claim_batch, but every one refused before evaluating any test. The runner exposes no readable host memory bound (HostBudgetUnreadable). A requested bind exceeded its 7.6 GB, and its cgroup2 tree is not writable. The changed witness file is therefore left to this PR's required floor, which plans a touched witness. The two mutant REDs (the fold arm emptied; main's seed-retirement edge restored) will be run on a machine with a writable memory bound and posted here before any landing ask.

Receipt-neutral: no src/v1 and no closure-manifest members.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AGawTbuANGBSUghDFv4hjW

[gunbai-bot]

Both findings in review 64743 are addressed.

1. .xl_run.sh was a scratch driver committed by accident. It is removed in f2803b8.
2. Accepted. The native-floor edge made the cutover a sibling of seed retirement, which the adopted order does not allow. In 90dab70, NamespaceFixForwardComplete requires SelfHostSeedRetirement, and NamespaceGrammarRetired requires the cutover. The native floor now reaches the cutover through seed retirement, so it is not restated as a direct edge. the_namespace_cutover_runs_on_the_native_floor_after_the_seed checks all four edges. Seed retirement's closure has no namespace milestone, so this adds no cycle.
   Witness execution plus the two mutant REDs are still to be posted before any landing ask.

[gunbai-bot]

Execution evidence at head 90dab70. Run locally with claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/compiler_frontend_program_status_witness_test.dag --functions <every test fn>:

• GREEN: 37 PASS, 0 FAIL (the whole witness file, one resolve).
• RED 1, fold mutant (native_route_required_lane_outstanding Standing arm returns []): the_native_route_fold_answers_both_ways FAILS. The other two new tests pass. That is correct: the wiring test is a relation, and both of its sides move together.
• RED 2, main's edges restored (seed retirement requires NamespaceGrammarRetired; the cutover without seed retirement): the_namespace_cutover_runs_on_the_native_floor_after_the_seed FAILS. The other two pass.
  Both mutants were restored from backups afterwards.
  — sent from swift-bat-902

[gunbai-bot]

Review 64771 is right, and the defect is fixed in 2ade182. Once the cutover required it, SelfHostSeedRetirement's DerivableOnlyViaPrerequisites would have held the cutover's startability NotDerivable forever. Seed deletion is observable from the tree, so the milestone now awaits a new MissingInstrument SeedDeletionObservation (NotBuilt). The authored seed rosters are explicitly not that instrument, because an emptied roster is not an absent seed. Authorization still stays with the prerequisites. New test: seed_retirement_awaits_an_instrument_rather_than_only_its_prerequisites.
Executed locally at 2ade182: 38 PASS / 0 FAIL over the whole witness file. MUTANT: the cause restored to DerivableOnlyViaPrerequisites. Result: the new test FAILS, and every_declared_instrument_is_distinct_and_awaited FAILS too, because the instrument becomes unawaited. The file was restored afterwards.
— sent from swift-bat-902