Accepting wildcards refuse instead of widening: arrow-contract walls, neutral verdicts, and the wet-step exit gates (re-derives #13382, #13383, #13411)

[briansrls]

Re-derives the three accepting-wildcards cuts on current main (closed gunbc#13382, #13383, #13411, which were blocked only on the retired floor's browser-toolchain premise). Each replaces an accepting wildcard with named arms, and where the wildcard was failing open, the named arm now refuses (DESIGN §5: a failure arm must refuse, never widen).

What changes

• Vocabulary walls (cut 2), src/v2/std/arrow_contract.dag. In the three *_edge_target_reads walls, _ => true becomes Absent => true and Ambiguous => false: an ambiguous lookup (two edges sharing one contract marker) used to be granted conformance and now refuses. The three walls' rows leave non_fold_residue_frontier, since they no longer hold wildcard residue.
• Verdict classifier (cut 1), gunbc.fleet_revision_acceptance. Neutral moves from "carries a verdict" to "no verdict": a floor of only neutral runs refuses as RequiredCiMergeGroupRunUnconcluded instead of reading as "ran and did not succeed", and a neutral run beside a success admits ("not applicable" is not a competing verdict).
• Wet-step exit gates (cut 3), gunbc.managed_host_unit_hold and gunbc.pair_serving_authority_log. Which outcome maps to which step exit moves out of the wet steps into the pure, single-authority helpers probe_hold_release_step_exit and placement_cleanup_step_exit, each witnessed hermetically.
• Small consequent edits in gunbc.megarac_kvm_observer_observe and gunbc.runner_throughput_qualification_route.

Evidence

Witness files run with claim_batch --source-root dag --source-root src/v2 on srv1 against this head (ce86594, main merged in), seed built from #13597's head:

witness file	result
dag/test/claim/fleet/fleet_desired_merge_queue_admission_witness_test.dag	26/26, exit 0
dag/test/claim/host/managed_host_unit_hold_witness_test.dag	19/19, exit 0
dag/test/claim/spark/pair_serving_authority_log_witness_test.dag	39/39, exit 0
src/v2/test/claim/arrow_contract_edge_conformance_test.dag	6/6, exit 0
dag/test/claim/machine_intake/megarac_kvm_observer_observe_witness_test.dag	14/14, exit 0
dag/test/claim/fleet/fleet_revision_acceptance_witness_test.dag	9/9, exit 0

New discriminating reds: an_ambiguous_contract_edge_does_not_read_at_the_vocabulary_wall (the wall alone refuses the ambiguous cases, without the cardinality check), and the neutral-only floor and neutral-beside-success claims.

Provenance

The re-derivation was done by lane smart-dove-862, which was archived by mistake before it wrote this description; the branch was flushed as a single WIP commit, and smart-gull-336 merged main, ran the witness files above and wrote this body. Note for the fleet-desired retirement lane: fleet_desired_merge_queue_admission_witness_test.dag gains the neutral-verdict claims here; if that file is deleted with the concept, those claims move with gunbc.fleet_revision_acceptance.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T19:36:00.571854Z	90ef38c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90ef38c29f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep neutral runs in the disagreement check

When the API returns a completed Neutral floor run alongside a Success for the same revision, this arm drops the neutral run from verdicts, leaving others empty and admitting the revision. That bypasses the surrounding agreement policy that every completed verdict must be Success; it also conflicts with the repository's existing conclusion folds, which explicitly classify Neutral as non-success (dag/gunbc/merge_admission.dag:663-673 and dag/extdeps/github/checks.dag:104-114). Treat Neutral as a non-success verdict so it refuses by itself and produces RequiredCiContradictoryRuns beside a success.

Useful? React with 👍 / 👎.