feat(05_eval): exact-arity gates — fail closed on excess signature/body/actual arity + comprep_eval_by_execution discriminating reds

[briansrls]

Summary

Adds exact-arity fail-closed gates to the wave-1 add callee in 05_eval.dag so that oversized inputs (extra signature facts, extra body operands, or extra call actuals) are refused rather than silently dropped via prefix-match. Extends the comprep_eval_by_execution keystone witness in the manual claim file with three discriminating red tests, one per gate.

Why now: The COMPREP wave-1 eval-by-execution keystone (#4624) proved that add executes through real callee dispatch. This PR closes the remaining gap where a callee with four Int params, a body with four operands, or a call with three actuals would previously have been admitted as the canonical Int,Int->Int add shape — silently discarding the extra fact — violating Facts Flow Forward (INVARIANTS P3/P5).

Changes:

• src/v4/compiler/05_eval.dag

  • New eval_rejected_argument_arity_excess diagnostic symbol for excess-actual rejection.
  • New eval_actual_present helper: probes list_nth and returns a Bool (true = index exists).
  • eval_bind_wave1_arguments: before binding [0],[1], checks that index 2 is absent; rejects with eval_rejected_argument_arity_excess if present.
  • New eval_child_absent helper: returns true iff a Node has no child at the given index.
  • eval_wave1_add_signature: extended with && eval_child_absent(node: arrow, wanted: 4) — the Arrow is [Int, Int, Int, body]; index 4 must not exist.
  • eval_wave1_add_body: extended with && eval_child_absent(node: body, wanted: 3) — the body is [+, x, y]; index 3 must not exist.

• src/v4/test/claim/manual/comprep_eval_by_execution.dag

  • Three malformed input constructors: comprep_excess_signature_arrow, comprep_excess_body_arrow, comprep_excess_actual_call.
  • Three red-holds predicates (comprep_excess_signature_red_holds, comprep_excess_body_red_holds, comprep_excess_actual_red_holds) each asserting the run returns non-passing.
  • comprep_eval_by_execution_keystone_holds extended with all three conjuncts.

Test plan

# Local claim-run witness (the keystone Bool witness executed by v4_lens_ci / glob discovery):
cargo build --release -p v2-compiler
target/release/gunbc run \
  --source-root src/v4 \
  --entry src/v4/test/claim/manual/comprep_eval_by_execution.dag \
  --function comprep_eval_by_execution_keystone_holds \
  --claim-run

CI (v4_lens_gate, v4_lens_ci, ci_floor*) runs the glob-discovered claim corpus including this witness on every push.

The three new *_red_holds conjuncts in the keystone witness are the discriminating signal: before this PR, the gates were absent and each oversized input would have produced a passing run result (silently discarded the extra fact). With the gates in place, every malformed input now causes the run to be rejected, and the == false assertions hold.

Checklist

• Title describes the change (not the session id or branch).
• PR body summarises what and why (above).
• Tests run: claim-run witness above; CI green on HEAD.
• No commits on this branch are surprises.
• No secrets / credentials / large binaries staged.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: a3b9dd81 · Trigger: schedule
• Thinking: 332s wall

---

✅ The exact-arity gates and red claims are scoped to the existing COMPREP wave-1 scaffold, fail closed on oversized signature/body/actual inputs, and I found no blocking concerns.

[briansrls]

Inherited review triage (bright-pike-355)

Verified all four inherited dashboard/api-review artifacts against current HEAD (11ee690):

Review	Provider	Verdict	Actionable findings
#4465635824	codex (GitHub)	✅ no blocking concerns	none
dashboard-28132	cursor	APPROVE	none
dashboard-28133	codex	APPROVE	none
dashboard-28184	claude	APPROVE	none

No code changes required — the exact-arity gates (eval_child_absent, eval_actual_present, eval_rejected_argument_arity_excess) and the three comprep_excess_*_red_holds conjuncts match the approved design. Updated the PR test plan to cite the correct gunbc run --claim-run witness command (not a v3-compiler Rust test).

Awaiting CI on the merge-from-main commit; reviews on prior SHA a3b9dd remain valid (diff unchanged: 2 files, +186/−15).

— sent from bright-pike-355

[briansrls]

Review triage — dashboard artifacts #28250 (claude) and #28252 (cursor)

Verified both APPROVE artifacts against current HEAD 11ee690 (unchanged diff: 2 files, +186/−15):

• #28250 (claude/claude-opus-4-7): Confirmed the three exact-arity gates are present — eval_wave1_add_signature index-4 absence (eval_child_absent at wanted 4), eval_wave1_add_body index-3 absence, and eval_bind_wave1_arguments excess-actual refusal via eval_rejected_argument_arity_excess. Helpers eval_actual_present / eval_child_absent wrap list_nth / eval_nth_child at Bool call boundaries. Matching reds wired into comprep_eval_by_execution_keystone_holds. No code changes required.

• #28252 (cursor/composer-2.5): Confirmed narrowly scoped .dag-only diff within the 🟡 COMPREP-WAVE1-EVAL interim lane; three discriminating reds (comprep_excess_signature_red_holds, comprep_excess_body_red_holds, comprep_excess_actual_red_holds) satisfy E-10 red-when-wrong. No code changes required.

Merge readiness: ≥2 distinct approvals on HEAD (claude + cursor), no REQUEST_CHANGES, mergeable=CLEAN, CI green (11/11). Ready for operator merge.

— sent from bright-pike-355