Accepting wildcards cut 1: name the verdict classifier and the two route gates

[gunbai-bot]

Accepting wildcards, cut 1: the verdict classifier and the two route gates

Three closed-coproduct matches whose wildcard arm returned the ACCEPTING answer, so an unhandled or future constructor silently inherited acceptance. Each is repaired by naming every arm; no fallback is swapped for another. Three non_fold_residue rows deleted by hand with this receipt.

1. dag/gunbc/fleet/fleet_revision_acceptance.dag::merge_group_run_carries_verdict

• Bad state: match c { Cancelled => false, Skipped => false, _ => true } over WorkflowRunConclusion (8 constructors) — every conclusion the arm did not name was treated as carrying a verdict.
• Path that permitted it: a floor run concluded Neutral (the workflow did not apply to the revision) was counted as a verdict, landed in others, and (a) refused an all-neutral floor as RequiredCiMergeGroupRunsNotSuccess — "the floor ran and did not succeed", a different refusal demanding a different operator action — or (b) blocked admission of a floor where another run succeeded, reading not applicable as contradicting verdict.
• Owning invariant: a run carries a verdict exactly when GitHub states a terminal outcome for it (Success, Failure, TimedOut, ActionRequired, StartupFailure); Neutral, Cancelled and Skipped report that no verdict was rendered (DESIGN 5: the failure arm must refuse, never widen).
• Repair at the owner: the classifier names all eight conclusions; the admission flow consumes it unchanged. A conclusion added to WorkflowRunConclusion later cannot inherit verdict-carrying — the match refuses to compile without an arm (NonExhaustiveMatch).
• Executed discriminator (red before, green after), both run on the remote runner (BuildBuddy, cold build, gunbc run --claim-run, cgroup-bound 24 GiB):
  • a_floor_of_neutral_runs_refuses_as_unconcluded_not_not_success: FAIL before (refused ...NotSuccess), PASS after (refuses RequiredCiMergeGroupRunUnconcluded, run_ids == [11]).
  • a_neutral_run_beside_a_success_admits: FAIL before (neutral beside a success blocked the entry), PASS after.
  • Every other claim in fleet_desired_merge_queue_admission_witness_test.dag (26) and fleet_revision_acceptance_witness_test.dag (9) PASSES before and after; merge_group_runs_with_no_verdict_refuse_as_unconcluded is unaffected.
• Census row deleted: dag/gunbc/fleet/fleet_revision_acceptance.dag::merge_group_run_carries_verdict.

merge_group_run_succeeded (_ => false) is left as is: a narrow "is exactly Success, else false" accessor whose false is right for every other constructor — out of scope per the brief, its census row stays.

2. dag/gunbc/runner/runner_throughput_qualification_route.dag::route_bmc_writes_are_gated

• Bad state: the gate audit matched StageEffect with BmcWrite { .. } => <gate check>, _ => true — any effect that is not exactly BmcWrite trivially complied.
• Path that permitted it: a write-shaped effect added to StageEffect later (the coproduct is the audit's own vocabulary: BmcWrite, GitHubControlPlaneWrite, ObservationOnly) would have inherited "not a BMC write" and skipped the approval-gate audit by declaration identity — the route qualified without anyone deciding what the new effect means for the gate.
• Owning invariant: EVERY BMC WRITE IS UNDER THE APPROVAL GATE, by declaration identity; the audit is the owner of that reading, and stage_is_effectful/stage_egress already spell all three effects by name.
• Repair at the owner: ObservationOnly => true and GitHubControlPlaneWrite { authority: _ } => true are named — both true today, but now true by arm, not by fallback; a fresh effect demands an arm at this gate.
• Executed discriminator: behavior is unchanged for every existing constructor (the 29-claim runner witness file PASSES identically before and after). Totality executed by removing the ObservationOnly arm: the module load refuses with the compiler's non-exhaustiveness diagnostic naming this match — the same refusal a fresh constructor produces (output in the run log; the diagnostic is CompilerDiagnostic::NonExhaustiveMatch, rendered "(non-exhaustive)").
• Census row deleted: dag/gunbc/runner/runner_throughput_qualification_route.dag::route_bmc_writes_are_gated.

3. dag/gunbc/runner/runner_throughput_qualification_route.dag::route_dispatch_selector_names_the_attempt

• Bad state: DispatchFloorToSlot { .. } => <selector check>, _ => true over QualificationStage (5 constructors).
• Path that permitted it: a stage constructor added later inherited the vacuous "names the attempt" pass without the route deciding whether a dispatch-shaped stage must name the attempt.
• Owning invariant: the selector-names-the-attempt requirement is a property of dispatch stages; the other four stage kinds say so explicitly rather than by default (the house rule of dag/gunbc/product/compute_board/composition.dag: _ on a closed coproduct means a variant added later contributes silently).
• Repair at the owner: all four non-dispatch stages named => true.
• Executed discriminator: 29-claim runner witness file PASSES identically before and after; totality executed by removing the CollectInstruments arm — the load refuses non-exhaustive, naming this match.
• Census row deleted: dag/gunbc/runner/runner_throughput_qualification_route.dag::route_dispatch_selector_names_the_attempt.

Census

Three rows deleted from dag/gunbc/non_fold_residue.dag by hand (the detector's doctrine: never auto-delete; greening a site deletes its row with the receipt on the PR). Roster goes 907 → 904. The remaining rows are the wider roster — out of scope for this cut.

Benign wildcards passed over (one line each)

• cohort_observation.dag::instants_comparable — "is exactly Incomparable, else comparable": the true answer is right for every other constructor of the closed comparison result; not a policy site.
• emit_copy_qualification_transport.dag filter, mtcollins1_boot_run.dag::observer_ok (Optional Present/none), bmc_model.dag::bmc_sol_drop_fired (is-exactly shape) — instruments/measurement or is-exactly accessors, not policy/decision sites.

[briansrls]

Approved at 5d25b04.

The verdict repair is semantically discriminating, not only exhaustive: all eight WorkflowRunConclusion arms and all six WorkflowRunStatus arms are named. Neutral no longer enters the verdict population, so an all-neutral floor reaches RequiredCiMergeGroupRunUnconcluded and a neutral run cannot contradict an independently successful run; Failure, TimedOut, ActionRequired and StartupFailure remain verdict-bearing non-successes. The two new controls exercise both changed downstream outcomes.

The route edits preserve current behavior while closing the accepting fallback: StageEffect is covered 3/3 and QualificationStage 5/5, with every constructor named exactly once and no invented fields. A future constructor now requires an explicit policy decision instead of inheriting true.

The non_fold_residue delta is exact: the only three deleted rows are the three totalled sites; merge_group_run_succeeded and the other benign/is-exactly wildcards remain rostered or untouched as described. The PR changes only the two production modules, the two semantic witnesses, and the three-row roster deletion. All four exact-head jobs are green and GitHub reports the PR mergeable. No blockers.

[gunbai-bot]

The red floor at 93dfc07 isn't from this diff. It's the runner pool's missing browser-toolchain premise (RunnerBrowserToolchainReadyForJobUser): all four floor runners tested (srv1-03, srv1-08, srv3-03, srv4-09) refuse the browser/spark wet claims this PR's changed-witness closure selects, with WetTerminalHostPremiseUnmet, and origin/main reproduces the same refusals in a full floor run. No content change can fix it; it needs a host action on the floor runners. The PR stays approved and unqueued until that lands. — sent from lively-ram-153

[gunbai-bot]

Closed without folding in the v1 closeout bankruptcy (#13641). Accepting-wildcards cut 1 is blocked only on the retiring floor's browser-toolchain premise; the surviving native job doesn't require it. Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604