The off-fleet authority witnesses take their executor as a supplied value

[briansrls]

Fixes the srv1-only floor failure: local-repo wet lane: 2 refusal(s) on fabric_capacity_standing_wet_witness and spark_pair_serving_apply_wet_witness.

Cause. Both wet witnesses read the runner's own hostname and asserted the refusal that a host with no dashboard instance produces. dashboard_instance_for_host declares instances for srv1, srv2 and macbook. The CI runners include srv1, so there the lookup resolved and the claims failed; on srv3/srv4 they passed. Over the last 60 witness runs, every srv1 floor that reached the wet step failed these two, and srv3/srv4 never did. The job cgroup showed no OOM and zero memory pressure, so this was not memory. The verdict depended on which runner picked up the job, not on the change.

Change. Both claims now take the executor as a supplied value (off-fleet.invalid: the RFC 2606 .invalid TLD guarantees no declared instance answers for it), plus a supplied instant. They move into their existing hermetic sibling files. They still execute the real read route: current_pair_serving_authorities, the store refusal, and the verdict or plan fold over it. That route has no host effect, which is the dissolution the exclusion row itself named ("driven hermetically with a fixed executor … re-enrolls as an ordinary hermetic discovery row, drops off local_repo_wet_schedule, and this row deletes"). Deleted:

• the two _wet_witness_test.dag files;
• their two local_repo_wet_schedule rows;
• their two WitnessExclusionRows, and the excl_local_repo_wet_executor_identity_{reason,dissolve} data only they used.

What is no longer executed by any witness: the live entry's own hostname/clock read (observe_executor_reach). That read is host state by nature, and it is the part that made the verdict host-dependent.

Evidence (claim_batch --hermetic, current main):

• fabric_capacity_standing_witness: 17/17 pass; spark_pair_serving_apply_witness: 5/5 pass.
• Discriminating red: planting a resting-row fallback on the HostStoreRefused arm of current_pair_serving_authorities turns exactly the two new claims red (16/17, 4/5, exit 1). Every other claim stays green.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T05:05:37.383080Z	41d6831	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[briansrls]

Superseded by #12478 (landed first with the supplied off-fleet premise). A follow-up trims its live-read claims per operator direction: wet witnesses stay hermetic.