R3 Verification Mgr — lane through R3 close

[briansrls]

Auto-opened by session-dashboard for session neat-raven-162.
Pushing to session/neat-raven-162 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: f014ae98 · Trigger: manual
• Comparison: main @ 7efdd2ba ... session/neat-raven-162 @ f014ae98
• Conversation: View conversation

---

1. Story of the diff

This PR tightens the GeneratedFromDag test-runner predicate so ResolvedFact is no longer treated like PendingFact plus ignored payload. The runner still consumes the shared output_path, but now, when the manifest arm is ResolvedFact, it requires dag_source to be a declaration reference and source_hash to be a non-empty string before downstream byte-regeneration checks can trust the arm as shape-materialized (src/v3/compiler/src/test_runner.rs:5042-5047, src/v3/compiler/src/test_runner.rs:5101-5141). The added regression test constructs a tiny .dag suite with a ResolvedFact whose source_hash is empty and verifies the predicate fails closed at the runner boundary (src/v3/compiler/tests/integration/test_runner_test.rs:669-706).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — this is implementation-only runner logic plus a Rust regression test; it does not add or alter a Dag substrate type, dag.rs shape, cross-pass stored fact, or new substrate variant.

1. INVARIANTS.md + modeling-discipline.md.

Compliant — fail-closed / facts-flow-forward: ResolvedFact now rejects missing or malformed dag_source via ClaimResult::Fail (src/v3/compiler/src/test_runner.rs:5109-5121) and rejects missing, non-string, or empty source_hash (src/v3/compiler/src/test_runner.rs:5122-5140) instead of allowing downstream consumers to infer whether resolution data was real.

1. CODING.md.

Compliant — the change stays within the existing data-and-pattern-match style: it decomposes variant_payload locally (src/v3/compiler/src/test_runner.rs:5102-5108) and returns explicit ClaimResult::Fail values for each invalid boundary shape (src/v3/compiler/src/test_runner.rs:5111-5119, src/v3/compiler/src/test_runner.rs:5124-5138), with no new hidden state, object hierarchy, or mutable builder surface.

1. TESTING.md.

Compliant — the added test is behavior-driven and focused on one contract: an empty ResolvedFact.source_hash fails closed (src/v3/compiler/tests/integration/test_runner_test.rs:669-706). The fixture is small, and the assertion targets the runner result rather than incidental manifest internals.

1. LOCKED DESIGN DECISIONS.

N/A — the diff does not modify a locked design document or introduce a semantic divergence from the Pure Bootstrap / verification direction. It narrows an existing runner acceptance path by making ResolvedFact carry real resolution shape before the later byte-regeneration layer consumes it (src/v3/compiler/src/test_runner.rs:5044-5047).

1. TRACKED vs UNTRACKED DEBT.

Compliant — no new scaffold, TODO, temporary file, or extra authority is introduced. The only forward reference is to the later byte-regeneration check, and this PR reduces the interim gap by ensuring ResolvedFact is no longer accepted with inert dag_source / source_hash payload (src/v3/compiler/src/test_runner.rs:5044-5047, src/v3/compiler/src/test_runner.rs:5101-5141).

2.5. Top-down PM intent review

Compliant — the change preserves the high-level verification intent: a generated-from-DAG manifest entry marked ResolvedFact must now provide structural evidence that it is resolved, rather than relying on a label while ignoring the payload (src/v3/compiler/src/test_runner.rs:5101-5141). I do not see a PM-level dilution where a must-have verification target is postponed, converted into permanent scaffolding, or redirected into a parallel hand-maintained authority; the Rust test is a focused regression for the existing runner surface, not a new verification architecture (src/v3/compiler/tests/integration/test_runner_test.rs:669-706).

3. Verdict

APPROVE. The PR is a narrow fail-closed tightening of an existing verification predicate, with an appropriate regression test and no substrate, locked-design, or debt-tracking issues visible in the diff.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: f014ae98 · Trigger: schedule
• Thinking: 237s wall

---

BLOCKING (1)

Root Cause

• src/v3/compiler/tests/integration/test_runner_test.rs The new ResolvedFact negative test reused the older non-generated-path fixture shape → switch the fixture to a generated manifest path so source_hash validation is the first failing obligation.

⚠️ One test fixture masks the behavior this PR is trying to verify.

[briansrls]

BLOCKING: This fixture uses a path already outside the generated-file authority, so the runner fails on path membership before reaching the new empty-source_hash diagnostic; use a known GENERATED_FILES path to make the P3 fail-closed check actually exercise the added branch.