recurring_failure_mode: runner-identity-derived off-fleet premise in wet witnesses (repaired by #12478)

dag/gunbc/recurring_failure_mode/wet_witness_premise_read_from_the_runner_it_happens_to_land_on.dag

@@ -0,0 +1,24 @@
+module gunbc.recurring_failure_mode.wet_witness_premise_read_from_the_runner_it_happens_to_land_on
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, decl_ref }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data wet_witness_premise_read_from_the_runner_it_happens_to_land_on: RecurringFailureMode = RecurringFailureMode {
+  identity: "wet_witness_premise_read_from_the_runner_it_happens_to_land_on" as NonEmptyStr,
+
+  receipts: [
+    "**a wet witness's premise read from the runner it happens to land on** (a required-floor claim is ABOUT a host of one kind -- here, an executor with no event log placement -- but observes the executing runner's identity instead of supplying the subject, so its expected verdict is true only on the runners that happen to be of that kind; on any other runner it is red with no change to the code).",
+
+    "SPECIMEN (2026-09-27, #12425 and other unrelated PRs). test.claim.spark.fabric_capacity_standing_wet_witness and test.claim.spark.spark_pair_serving_apply_wet_witness observed the runner's hostname and asserted every group's authority read refused 'off fleet'. The floor job passed on srv3/srv4 runners and failed (expected passed, observed failed) on srv1 runners: gunbc.roadmap_dashboard_instance declares a dashboard instance for srv1, so gunbc.fabric_event_log_host event_log_store_for_host RESOLVES there and the premise is false. Not a regression in the read and not flake: the verdict was a function of runner assignment.",
+
+    "WHY IT IS A CLASS: a CI runner pool is not a neutral environment -- runners are fleet hosts, and which one a job lands on is scheduling, not an input the claim declares. The tell is a wet claim whose expectation names a property of the host ('off fleet', 'no dashboard', 'no GPU') while its subject is taken from observe_executor_reach or another observation of the executing machine. DESIGN §3: the subject belongs at the interface as a supplied value.",
+
+    "REPAIR (gunbc#12478, landed; this row was filed by gunbc#12461, whose parallel repair was superseded by it): the off-fleet premise is a SUPPLIED value at the entry's seam, gunbc.instruments.fabric_capacity_standing fabric_capacity_standing_for, and at spark_pair_apply_plans, with a host that declares no dashboard instance and a fixed instant. The store resolution and the per-group refusal naming the read still run for real on every runner. The claim on the RUNNER'S OWN host is kept, but its expectation no longer names a host property: the_live_entry_judges_exactly_what_the_runners_log_read_returned and the_apply_seam_refuses_exactly_what_the_runners_log_read_could_not_answer assert that the verdict is an identity join over whatever the runner's log read returned, so they hold on srv1 and srv3/srv4 alike. They stay on the local-repo wet lane (v2.workflow.local_repo_wet_terminal) and are enrolled as route gaps in v2.workflow.floor_route_gap for their hostname read. RUNG found at 1 (the harm occurred: unrelated PRs and the merge queue blocked). NOW 2 for these claims. CEILING 2: whether a wet claim's expectation depends on a host fact is not yet a modeled fact of the wet roster. NEXT TRIGGER, capability not artifact: the wet lane schedule records, per scheduled claim, which host facts its verdict depends on, and refuses a claim whose expectation depends on a host fact the runner pool does not hold uniformly.",
+  ],
+
+  evidence: [
+    decl_ref(module_path: "gunbc.instruments.fabric_capacity_standing", decl_name: "fabric_capacity_standing_for"),
+    decl_ref(module_path: "gunbc.fabric_event_log_host", decl_name: "event_log_store_for_host"),
+  ],
+}