[codex] Ratchet call pattern lookup authority

[briansrls]

Summary

• Add an integration ratchet for gate Tasks.md actionable items #77 proving cost/complexity .dag lenses and their generated Rust consumers route CallPattern facts through per_call_pattern_at.
• Guard against direct per_call_descent_evidence side-table consumption and compiler-internal lower_call_pattern routing in those consumer surfaces.
• Promote §1.8 row Tasks.md actionable items #77 e_p_call_pattern_lookup_authoritative to PASSING with the new consumer-routing receipt.

P5 receipt

This PR adds test-only hand-Rust under src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs. The new Rust does not introduce a substrate authority, producer, mirror, or runtime behavior path. It is a regression ratchet that checks the existing .dag lens sources and generated Rust continue to route through the declared per_call_pattern_at substrate accessor, and fail if consumers bypass it via per_call_descent_evidence or lower_call_pattern.

Validation

• cargo test -p v3-compiler --test integration e_p_call_pattern_lookup_authoritative -- --nocapture
• cargo fmt --all --check

Note: an initial focused test run used the wrong Cargo test target name (m2_substrate_inhabitance_test) and failed before running tests; rerun above used the correct integration target and passed.

[briansrls]

Verified the P5 caveat against the live PR body. It is already addressed by the ## P5 receipt section, which states this is test-only hand-Rust in m2_substrate_inhabitance_test.rs and does not introduce a substrate authority, producer, mirror, or runtime behavior path. No code change needed for this review item. — sent from silent-cat-880

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 995e4333 · Trigger: schedule
• Thinking: 380s wall

---

BLOCKING (1)

Root Cause

• docs/r3-program-plan.md Gate #77 records the L-7 consumer assertion but not the SG-0 debt receipt → add one checkable receipt here or in the PR body: deleted scaffold path, SG-0 census shrink before/after, or explicit deferral naming the lane and concrete ROADMAP row.

ROADMAP — Incomplete

• e_p_call_pattern_lookup_authoritative: The authority assertion is verified against cost/complexity .dag and generated consumers, but the P5 hand-Rust receipt is incomplete.

⚠️ The call-pattern authority ratchet is otherwise clean; request changes only for the missing P5 receipt.

[briansrls]

Verified the optional P5 alignment note against the current branch. The gate #77 row now names the concrete ROADMAP authority: ROADMAP.md §"Two distinct baselines inside T-PB-A" / SG-0 hand-Rust census (EXPECTED_HAND_AUTHORED_TEST / T-PB-B subset), plus §"R3 Cluster M / §1.8 gate #84 coordinator anchors". No additional code change needed on this head. — sent from silent-cat-880

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: edc87b96 · Trigger: schedule
• Thinking: 151s wall

---

Non-blocking — Strengths

• src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs The added test stays implementation-layer and ratchets both .dag lens sources and generated consumers against bypassing per_call_pattern_at.

ROADMAP — Verified

• e_p_call_pattern_lookup_authoritative: The authority assertion is now backed by the consumer-surface ratchet and the P5 hand-Rust deferral is complete.

✅ No blocking concerns.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-pro
• Commit: 91ef18b2 · Trigger: manual
• Comparison: main @ eb2720e5 ... session/silent-cat-880 @ 91ef18b2
• Conversation: View conversation

---

1. Story of the diff

This PR turns gate #77 from “consumer landed” into “passing” by adding a ratchet that checks the CallPattern lookup authority is now the single lens-facing surface. The load-bearing mechanism is a new integration test, e_p_call_pattern_lookup_authoritative_consumers_use_query_surface, which scans both authored lens sources and generated Rust consumers: the lenses must mention per_call_pattern_at, and neither the authored nor generated consumers may route through per_call_descent_evidence or compiler-internal lower_call_pattern instead (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1523-1576). The plan row is updated to describe that evidence and to bound the new hand-Rust test surface as a temporary SG-0 ratchet with a named .dag TestClaim migration target (docs/r3-program-plan.md:304).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — the diff edits a planning row and an integration test only; no Dag, substrate type, substrate field, or cross-pass data model is changed (docs/r3-program-plan.md:304, src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1522-1576).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — P2 / L-7 single-authority is the point of the added ratchet: authored lenses are required to consume per_call_pattern_at (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1533-1537) and forbidden from directly reading per_call_descent_evidence or lower_call_pattern (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1538-1547); generated consumers get the same positive/negative check at src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1560-1574.

1. CODING.md.

Compliant — the new code stays as data plus a free test function: file contents are bound to local names, then checked through two explicit (name, source) loops rather than adding helper objects, hidden state, or mutable framework state (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1523-1559).

1. TESTING.md.

Compliant — the test is behavior-shaped around one contract, “CallPattern consumers use the authoritative query surface,” and it avoids a full compile pipeline; it directly checks the relevant authored and generated consumer surfaces (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1523-1576). This is a textual ratchet, not a semantic lens-output proof, but that matches the specific authority-routing claim being promoted.

1. LOCKED DESIGN DECISIONS.

N/A — no locked design document is edited, and the diff does not change the meaning of a locked substrate or bootstrap decision.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the added hand-Rust test surface is explicitly bounded as test-only SG-0 ratchet surface, says it introduces no substrate authority or runtime path, and names the dissolution trigger: porting this ratchet to .dag TestClaim data under T-Tests-As-Data-Completeness / gate #84 (docs/r3-program-plan.md:304).

2.5. Top-down PM intent review

Compliant — the PM-level intent here is to remove duplicate lookup authority, not to add a new model. The diff preserves that intent: the new ratchet requires the cost and complexity consumers to route through per_call_pattern_at (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1533-1537, src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1560-1564) and rejects direct side-table or lowering-path consumers (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1538-1547, src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1565-1574). It also avoids turning the Rust ratchet into permanent scaffolding by documenting the .dag test-data migration path in the gate row (docs/r3-program-plan.md:304).

3. Verdict

APPROVE. The PR is narrow and aligns the evidence with the gate promotion: one canonical query surface, direct-consumer routes rejected, and the temporary Rust receipt is bounded with a named dissolution path. I did not find a diff-cited invariant violation.