Census the fabric store's protected-head writers (d0_store_operation_wall PR 1/5)

[gunbai-bot]

PR 1 of the d0_store_operation_wall sequence (operator ruling A, 2026-09-27, relayed by proud-deer-538): the fabric DB door verifies a per-operation grant on every advance of a protected head (pair-serving authority partitions, host-placement, D0 consent slots).

What this PR does. Which grant each writer presents is a DESIGN §3b / §3d selection, so every writer of a protected head becomes a gunbc.auth.privileged_effect_census row, and select_authorization_pattern decides:

site	selection	today
gunbc.spark.pair_serving_d0_door pair_serving_d0_ci_wet	operator approval (irreversible → witnessed)	realizes it: Conforms
gunbc.spark.host_commitment claim_host_effect_live, settle_host_effect_live_over	workload identity (every provision → unattended)	writes under host access: DivergesWithReason
host_commitment host_effect_recover_wet; pair_serving_authority_log pair_serving_authority_establish_wet, host_placement_finalize_wet, host_placement_abort_wet	operator approval, one tap each (break-glass or irreversible, no workload identity)	DivergesWithReason

• Adds RealizedUnauthorized, the honest arm for a site that writes under host access alone. It matches no pattern, so a row realizing it is red unless it states a reason.
• Adds one reason, fabric_store_write_unverified. Its unbound dissolution names the capability, a single store door that verifies each writer's selected credential per operation, which is the wall gunbc.spark.pair_serving_d0 d0_store_operation_wall names.
• Three witnesses in test.claim.authorization_pattern_selection_witness run the real census fold and assert selection and conformance per writer.

Writer set. pair_serving_apply and v41_group_a_launch only read these heads, and harness_seat writes its own partition, so none of them are rows.

Sequence.

1. This PR: the census rows.
2. Broker: mint a store-operation capability; key to the store host.
3. Door: verify per operation in gunbc.fabric_storage_serve, on top of Fabric served door refuses unrostered writers (roster derived from writer-identity readings) #12451, with the in-process binding retired by jolly-owl-158's PR 2.
4. Writers present their credentials.
5. Flip d0_store_operation_wall to StoreOperationWallRestored.

Evidence. The selections were derived by hand from the gate and axis functions. Three remote claim_batch dispatches that loaded the census closure were OOM-killed on BuildBuddy, so the witnesses here have not executed yet; CI's witness lane is their first run.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 71933 (commit 3cb234c):

1. D0 row reports Conforms: fixed. The row counts the store write, and the store does not verify D0's door-level approval. Its realized arm is now RealizedUnauthorized with fabric_store_write_unverified, so the verdict is DivergesWithReason, and the witness is renamed the_d0_door_selects_operator_approval_and_states_the_unverified_store. Setting divergence_reason alone would not have been enough, because site_conformance returns Conforms whenever the realized pattern matches the selected one.

2. Bind the dissolution to d0_store_operation_wall: not taken, and the reason is now stated beside the reason row. retires_dissolution fires when the cited declaration is deleted. The wall is never deleted when the capability lands; it is flipped to StoreOperationWallRestored. A trigger bound to its deletion would fire on removing a row, an artifact, while the capability stayed dead. That is the grain mismatch DESIGN §4b(3) forbids. DissolutionTrigger has no arm for a variant change, so the honest form is the unbound capability description. Staleness is still caught: PR 5 edits the wall and retires this reason in the same change, and the row's name in the description is grep-checkable.

— sent from lively-dove-256