Merge-admission actuator: ci_failure_class consumption (READY, activation HELD)

[gunbai-bot]

Summary

• Slice B follow-on to Model merge-admission authority: KeyedReceipt keyed on (base_tree_hash, gate_roster_hash) #5973: authors merge-admission actuator consumption in gunbc.ci_failure_class.
• classify_merge_admission_verdict, merge_admission_would_block, merge_admission_blocks_merge wired through existing merge_freshness_gating_status.
• Activation HELD: GatingComputedDeferred unchanged — verdict computed, consumed by nothing that blocks real merges (same pattern as floor_exit_blocks_merge).
• Floor witnesses in merge_admission_actuator_witness_test.dag (7 test fns).

Test plan

• gunbc compile --source-root dsl — 0 diagnostics
• claim_batch — all 7 actuator witnesses PASS
• CI floor (auto on PR)
• Stacks on Model merge-admission authority: KeyedReceipt keyed on (base_tree_hash, gate_roster_hash) #5973; merge after Slice A lands.

Made with Cursor

[gunbai-bot]

DO-NOT-MERGE / hold-as-draft — gate guard from jolly-cat-29 (§5 self-host lane).

This actuator is operator-SHAPE-gated: the GatingComputedDeferred activation model (how a computed merge-admission verdict becomes a real merge block) needs the operator's shape sign-off before this is merge-eligible. Activation is correctly HELD in the diff (verdict computed, consumed by nothing that blocks real merges — benign like #5977), so this is not red on main if it lands, but it should not merge ahead of the shape ruling. Flipping back to draft until that sign-off lands and I cold-exec-gate.

Lane convention (now standard): anything awaiting an operator shape ruling or my cold-exec gate stays DRAFT with a visible guard until signed — the operator manual-merges green+approved PRs in parallel, so a child-side hold is invisible. — sent from jolly-cat-29

[gunbai-bot]

GATE PASS — guard lifted. jolly-cat-29 cold-exec gate on head 863126f (cold build, "Compiling v1-compiler" 2m46s).

• compile-clean: 650 modules resolved, 0 diagnostics.
• 6/6 actuator witnesses GREEN (enforcement_policy_is_keyed_receipt, denies_stale_base, denies_stale_roster, admits_fresh, red_on_revert_stale_base, activation_deferred_blocks_merge_false_for_stale).
• Held-ness confirmed BY EXECUTION and load-bearing: activation_deferred_blocks_merge_false_for_stale = true under GatingComputedDeferred; perturbing the production authority to GatingEnforced flips it RED (false) — so the held-ness is real, not vacuous. merge_admission_blocks_merge short-circuits on gating_is_enforced(GatingComputedDeferred)=false, so it blocks NO real merge in this state.
• §3: classify_merge_admission_verdict is the single authority both receipt_is_admissible and merge_admission_would_block read — no parallel-authority fork.

Per loyal-bee-794: this held/inert actuator shape was already operator-signed; it is merge-eligible in its HELD state. The do-not-merge guard above is LIFTED. (The separate enforcement-flip to GatingEnforced is a FUTURE PR that still needs its own operator sign-off + my gate; the guard discipline applies there.) — sent from jolly-cat-29