§10 exec-contract Slice 1: SyscallAbi paradigm + real Linux x86-64 syscall surface

[briansrls]

First increment of the ctrl §10 execution-contract substrate layer (consume-don't-fork; ctrl-driven, lands in gunbc, per zesty-swift's approval). Structure + discipline per ctrl PR #1603 (endorsed for dep-graph coherence).

What

• dsl/std/os/invocation.dag — SyscallEntry + SyscallAbi, the first invocation paradigm of the omni surface model (any cited syscall table is data, not a model edit). SyscallAbi is a record; the StableInvocationSurface coproduct is born multi-variant in Slice 2 when LibraryApiBoundary (Windows/macOS) lands — facts-first arms. Uses only Int/NonEmptyStr/List/records — no distribution-enum imports, so v2-green standalone. (Slice-2 coproduct plan, v2-resolver notes, and the omni-invariant rationale live in docs(r3): split row-85 Gap 5 after bounded adapter landing #1603 §0/§3, not in the file — Practice 9 in-file form.)
• dsl/extdeps/runtime/syscalls/linux.dag — real x86-64 subset read=0, write=1, mmap=9, execve=59, exit=60, cited to arch/x86/entry/syscalls/syscall_64.tbl, with green-by-execution witnesses on each number.

The convention 🟡 — Practice-4 dissolution content (relocated from the file per Practice 9)

The in-file mark is the one-line tag // 🟡 feature:sysv-amd64-abi-module on the authority carrier (SyscallAbi.convention: NonEmptyStr in invocation.dag, where the stringly deferral originates) and on its linux.dag inhabitant. The bound dissolution detail:

• GATE KIND: feature — the typed CallingConvention substrate does not exist yet.
• MISSING PRIMITIVE: a CallingConvention type in extdeps/runtime/abi/sysv_amd64.dag (System V AMD64: integer-arg register order rdi/rsi/rdx/r10/r8/r9; syscall nr + return in rax; r10 not rcx — SYSCALL clobbers rcx/r11 — modeled as identity, not text).
• BOUND TASK: work-item node://adhoc-51cfc897-db0 (= docs(r3): split row-85 Gap 5 after bounded adapter landing #1603 §6 Slice 1), in flight under worker warm-ibex-822, which lands sysv_amd64.dag.
• DISSOLUTION 🟡→🟢: when that module lands, convention changes from NonEmptyStr to a typed CallingConvention reference, deleting the raw-string identity duplication.

Green-by-execution receipt (E-10 Q2/Q3)

The five witnesses assert each real syscall NR (witness_read_number_is_0 … witness_exit_number_is_60). Run via a dsl-rooted claim-run (these modules live in the dsl/ tree, so --source-root dsl, not src/v4):

<gunbc-bin> run --source-root dsl \
  --entry dsl/extdeps/runtime/syscalls/linux.dag \
  --function witness_read_number_is_0 --claim-run    # -> true
# … witness_write_number_is_1 / _mmap_number_is_9 / _execve_number_is_59 / _exit_number_is_60 -> true

Receipt — run by snappy-stag-903 on the governed gunbc v2 runner (isolated worktree under ctrl-build), head-pinned to 8d0a63f:

----- witness_read_number_is_0 -----
resolved 5 sources
true
----- witness_write_number_is_1 -----
resolved 5 sources
true
----- witness_mmap_number_is_9 -----
resolved 5 sources
true
----- witness_execve_number_is_59 -----
resolved 5 sources
true
----- witness_exit_number_is_60 -----
resolved 5 sources
true

Five true, zero diagnostics — x86-64 sysv-amd64 numbers confirmed by execution (read=0, write=1, mmap=9, execve=59, exit=60).

Standing CI gate (honest status): these witnesses have no executing standing gate yet — the v4 claim-witness corpus is src/v4-rooted and cannot load dsl/ imports. Their standing home is #4874's parametric dsl-rooted corpus gate (derive_source_root, swift-stag/stern-bear); enrollment of these 5 is the named fast-follow (authored by me) once both #4874 and #4870 land. So: green-by-execution is shown above (receipt pending); standing execution is consumer-gated on #4874.

Modeling rationale (relocated from the files per Practice 9 strict-allowlist form)

The files carry only path + terse Scope + Anchor URL + one-line tags; the rationale lives here:

• The numbers are the real x86-64 syscall NRs from syscall_64.tbl (kernel 6.8) — read=0, write=1, mmap=9, execve=59, exit=60; arg_count follows the man(2) prototype. An invented number would break the native=real-modeled-contract thesis (operator hard-requirement).
• The register-convention facts (args rdi/rsi/rdx/r10/r8/r9; nr+return in rax; r10 not rcx since SYSCALL clobbers rcx/r11) are deliberately NOT narrated in linux.dag — that would be a second authority for what the convention 🟡 defers to. Their single home is the ABI module (extdeps/runtime/abi/sysv_amd64.dag, the stacked dissolution PR exec-contract ABI: dissolve convention 🟡 (mechanism b, standalone -> main) #4877).

Anchoring

All five syscall numbers verified against syscall_64.tbl by zesty-swift + two review bots; the operator's anchor-to-real-specs hard requirement is met (no invented values).

Out of scope (staged for the verified v2 flip-SHA)

The satisfies-reuse (shared compute_fabric kernel, possibly lifting a generic Eligibility<Witness,Reason>) and the OS-catalog attach — both inherit the catalog's v2 gate (Option-repoint + single-variant-enum + G3, per snappy-stag). gunbc merge queue is frozen — no merge urgency.