Consolidate roadmap projections over explicit acceptance history

[gunbai-bot]

Live roadmap consumers and continuity fixtures now use one pure roadmap_authority_projection(history) chain. The explicit input is the existing RoadmapAcceptanceEventHistoryLoad, carrying parsed events or the original typed load refusal. Acquisition stays at callers.

Rebased onto main after #11310 landed. That correction replaced the old accepted-ID projection with a joint accepted/withheld frontier. This consolidation follows the new authority: frontier_sets_projection(history) retains its supersession join, replay validation, and live-receipt join; withheld_node_ids_projection(history) and the authority projection consume that same result. The text-keyed projection implementations and live-only frontier/withheld wrappers are dissolved, and all live and fixture callers are updated. The receipt-to-ID helper remains as the single fold used by the new frontier authority.

The malformed-history control requires a refusal, rather than accepting an empty successful document. The revocation carrier, withheld frontier behavior, and refusal distinctions added by #11310 are preserved. This PR changes no floor sharing, enrollment, preparation mechanism, or thresholds, and makes no performance claim. Those belong to PR two; #10994 follows the chain.

Preparation boundary finding (verbatim):

Source confirms the test-only parallel family. The requested preparation-level carried history crosses an unresolved floor boundary: v2.workflow.floor_pure_producer_share says "a WARM row is nullary and preparation-forceable" and "a CLAIM-FORCED row has claim-shaped arguments, so its fills happen inside the fold on first touch"; cli_run.required_floor_runner::install_pure_producer_share realizes exactly that via warm_cross_claim_pure_producer in a Hermetic frame. I have not found a prepared effect-input binding that can carry the loaded history into existing nullary claim entrypoints. Consolidating the roadmap functions with an explicit history argument is straightforward but does not alone carry acquisition at the cross-claim LCA.

This is where PR two starts; its preparation-input mechanism belongs to the existing materialization / carried-value authority.

Validation on rebased head 4a0a1c56722: git diff --check and pre-push cargo fmt --all --check pass. Source comparison verifies that the frontier-validation body from main is retained verbatim apart from indentation, and that the authority/withheld projection bodies differ only in explicit history routing. CI must validate execution on this new head; prior approvals and passing checks are historical evidence, not results for this revision.

Why this PR exposed #11310: base run 34774085639 at 72cd7840544 recorded test.claim.roadmap_authority.witness_acceptance_receipts_are_valid_and_unique as declined_outside_gate_closure, not_executed in its required-floor-disposition artifact. Our changed call site caused it to execute in run 34777425381, where it returned Bool(false). Source inspection found an existing live receipt for the superseded entry-graph-union-construction node; #11310 supplied the separately owned correction and is now included through main. The Boolean failure did not identify the first failing branch: the witness discards load-refusal detail and short-circuits its conjuncts. That diagnostic limitation is kept distinct from the source-proven inconsistency.

Earlier validation: build and regeneration passed on the pre-rebase heads. Scoped BuildBuddy attempts built successfully but produced no witness verdict: one lacked an enforceable memory bound, one refused an 8 GiB request above executor capacity, and a 6 GiB-bound attempt was killed during preparation. Those attempts are not passing test evidence.

[gunbai-bot]

PARKED under the operator wind-down (bright-eagle-728, 2026-09-14). The blocker is #11404, not this PR.

Why. The four live-roadmap identities EXECUTE AND BLOCK IN THE MERGE GROUP while every PR-level run declines them. #11303's merge-group run 34882892311 came back FloorRefused with four BLOCKING rows (339076 / 247475 / 472575 / 401454 against a 72,300 new-witness budget); #11255's run 34883083851 failed with the identical four before passing at a different base that did not compose #11303. So a green PR-level check never predicted what the merge group does, and any PR whose composed group changes the roadmap closure pays that cost.

#11404 declares the bounded §4b(3) drop that clears it. It is parked on review 66408's second finding: the exemption is realized only in the seed runner while v2.workflow.required_floor claim_safety_outcome still states the unconditional wall, which is a model-realization fork. Fixing that means an exemption arm in required_floor.dag, a load-bearing file, and that is not a wind-down change.

Pickup: land #11404 first, then merge main here and re-run. Do not optimize these witnesses to get under budget — that was refused twice as coupling a cost-shape change to unrelated work, and the measured evidence is that indexing buys ~6-7% against a 4-6x gap.

— sent from bright-boar-435

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T23:49:32.057807Z	4a0a1c5	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.