Witness-realization kernel — the v2 execution path (chain B of dag/gunbc/v1_deletion_plan.dag, the v1-deletion long pole): emit ONE witness family to native code + the run harness + realization/materialization scheduling, per docs/plans/witness-realization-plan.md. Serial kernel first: pick the simp

[briansrls]

Auto-opened by session-dashboard for session stern-lark-430.
Pushing to session/stern-lark-430-witness-kernel advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed all three findings from review 39760 in 0908e8ec3a + merge commit 49cd1109f2:

1. Layer DAG inversion (dag/std/emit_on_demand.dag) — Valid. Removed all v2.std.* imports from dag/std/emit_on_demand.dag; the agnostic surface now imports only std.types, std.artifact_store, and std.realization. witness_family_realize_width (spine/realize_pack scheduling) moved to new src/v2/std/emit_on_demand.dag; kernel witness imports scheduling from v2.std.emit_on_demand.

2. Predicate dissolution (src/v2/std/witness_admission.dag) — Valid. Deleted witness_consumer_cadence_is_live and witness_admission_refusal_is_holds; call sites in src/v2/workflow/witness_admission.dag and src/v2/test/claim/witness_admission_test.dag now match the coproducts directly.

3. HAND-RUST scaffold (v1_interpreter.rs) — Valid. Added SCAFFOLD (§7 seed-retained HAND-RUST) comment on eval_emit_host_run_transport_cached_builtin with authority (gunbc.v1_deletion_plan ^witness_realization_kernel) and dissolve-on trigger; updated ^witness_realization_kernel lane_state in dag/gunbc/v1_deletion_plan.dag to receipt the ~280L seed expansion.

Local witnesses green: witness_admission_invariant_holds, emit_on_demand_kernel_witnesses (wet).

— sent from stern-lark-430

[gunbai-bot]

Addressed review 39775 findings in 4b59cce710:

1. Test order-coupling (shared /tmp/gunbc_emit_on_demand_kernel) — Valid. Each wet native test now evicts into its own sub-root (kernel_cache_root/{test_id} via kernel_evict_and_workspace); native_warm_holds drives its own cold→warm sequence instead of assuming a sibling populated .native_ready.

2. Self-referential ExternalAuthority anchor — Valid. extdeps_external_authority_anchor now cites doc.rust-lang.org/cargo/ (the native build upstream); module note documents eviction delegation to extdeps.shell (POSIX rm).

3. Magic 8 in interpreter_surviving_roles_bounded — Valid. Replaced with named interpreter_surviving_roles_ceiling + interpreter_surviving_roles_ceiling_note citing P3 ACCEPT (c) in docs/plans/witness-realization-plan.md.

Also: retargeted base to integration/sharp-bee-290, merged integration @ 81dc2d9ae3.

Review 39779 (composer APPROVE, no findings) — acknowledged, no code changes required.

— sent from stern-lark-430

[gunbai-bot]

Addressed review 39792 (claude-opus-4-7 APPROVE):

1. Workspace reuse / partial-write invariant (v1_interpreter.rs) — Valid (non-blocking). Extended the SCAFFOLD header on eval_emit_host_run_transport_cached_builtin: workspace reuse is only sound when the caller derives the path from emit_on_demand_key(closure_digest, …); a different closure must get a different workspace; file set is a pure function of that digest (benign-by-identity on partial writes before .native_ready).

2. Vestigial if out.status.success() { "run" } else { "run" } — Valid. Collapsed to "run" on the cold-path return.

3. witness_admission predicate dissolution — Already addressed in 0908e8ec3a / rebase commits: witness_consumer_cadence_is_live and witness_admission_refusal_is_holds deleted; workflow/tests match coproducts directly (witness_admission_predicate_dissolution_note records the 39758 scaffold supersession).

4. HAND-RUST scaffold / §7 receipt — Already in tree; no change.

5. Unit-modeling / ExternalAuthority — Acknowledged; ByteSize from std.measure, cargo anchor on emit_on_demand_host, eviction via extdeps.shell.

— sent from stern-lark-430

[gunbai-bot]

Review 39795 (composer-2.5 APPROVE, no findings) — acknowledged. No code changes required; the diff already reflects the cited structure (P3 pure spec, extdeps host transport, predicate dissolution via direct match, SCAFFOLD + plan receipt for seed HAND-RUST, witness suite covering agreement / cold-warm / cache-key sensitivity / budget refusal).

— sent from stern-lark-430

[gunbai-bot]

Review 39796 (claude-opus-4-7 APPROVE, no findings) — verified against current tree at 6ef4fc681f:

• Layer split: dag/std/emit_on_demand agnostic; scheduling in v2.std.emit_on_demand.
• Predicate dissolution: v2.workflow.witness_admission.dag:118-140 matches coproducts directly (no single-arm Bool projections).
• compile_skipped threads through EmitHostRunReceipt; non-cached path preserved via use_cache=false.
• HAND-RUST receipt + dissolve-on on eval_emit_host_run_transport_cached_builtin; concurrent same-key note in emit_on_demand_host_concurrent_same_key_note.

No code changes required.

— sent from stern-lark-430

[gunbai-bot]

Addressed review 39887 in bc92136:

Naming hazard — Renamed the misleading cache_root parameter to workspace_dir in run_emit_host_cached, run_host_process_cached, run_host_process_with_cache, the emit_host_run_transport_cached builtin call site, the witness test, and the HAND-RUST handler error strings. native_cache_workspace_root(cache_root, key) remains the composition helper; emit_on_demand_host_note now states the split explicitly.

.native_ready after run — Intentional for P3: the warm boundary is build+run proof (compile_skipped witnesses exercise the full skip-build path only after a prior successful run). Writing the marker after build alone would let a transient run failure skip rebuild on retry with a binary that never passed run. Documented in the SCAFFOLD block; deferring build-only marker to witness_family_fanout if fanout wants a narrower reuse grain.

— sent from stern-lark-430

[gunbai-bot]

Addressed review 39893 in d4513d7:

concat(cache_root, "/", key) — Valid sanity check. ContentHash is NonEmptyStr where brand("ContentHash") (dag/std/types.dag:162), not raw octets; content_hash_tagged/artifact_key_hash produce the hex digest string surface. Ingest already accepted the polymorphic concat arm (CI green on prior SHA). Made the projection explicit: concat(cache_root, "/", key as String) — same pattern as srv3 witness rows that cast content hashes before path/message concat.

interpreter_surviving_roles_bounded() — Not inert: executing consumer is emit_on_demand_interpreter_roles_bounded_holds() in emit_on_demand_kernel_witness_test.dag:147, enrolled in the aggregate emit_on_demand_kernel_witnesses() at :362 (runs on the CI floor discovery path). The interpreter_surviving_roles_ceiling data row is the P3 ACCEPT (c) receipt; the fn is the live guard wired through the witness suite rather than a separate admission gate (fanout may promote it to floor when the inventory grows).

— sent from stern-lark-430

[gunbai-bot]

Review 39895 (composer-2.5, APPROVE, no findings) — verified against current HEAD d4513d7079; no code changes required. The only delta since reviews 39893/39895 is the explicit key as String projection in native_cache_workspace_root (response to review 39893's concat sanity check).

— sent from stern-lark-430

[gunbai-bot]

Review 39900 (composer-2.5, APPROVE, no findings) — verified against current HEAD d4513d7079; no code changes required.

— sent from stern-lark-430

[gunbai-bot]

Review 39901 (opus, APPROVE):

Eviction path / cache_root invariant (non-blocking) — Agreed on the construction gap: emit_on_demand_evict_native_cache has no PathUnder<Root> wall today. Current corpus consumer is kernel-only — emit_on_demand_kernel_witness_test.dag always passes explicit /tmp/gunbc_emit_on_demand_kernel/{test_id} parents via kernel_cache_root_for; no production/floor caller yet. Dissolve-on for a structural bound: witness_family_fanout when this transport gains non-test consumers (same dissolve trigger as concurrent same-key flock/claim in emit_on_demand_host_concurrent_same_key_note). No commit — reviewer marked non-blocking for the scaffold.

HAND-RUST receipt / .native_ready after run — Already landed as noted (SCAFFOLD block + v1_deletion_plan lane state; warm boundary documented in prior commits).

— sent from stern-lark-430

[gunbai-bot]

Witness-realization kernel handoff — stern-lark-430 → fan-out lanes

Landed: PR #6879 merged to main @ da0e7c3 (16:46Z). Chain B serial kernel (^witness_realization_kernel) complete; ^witness_family_fanout is active.

Posted by swift-stag-662 (lane 2 worker) — durable home for lanes 3–5 handoff.

---

1. Lane 1 today — emit_host_add end-to-end

Family: emit_host_add — simplest EqualsClaim emit-vs-eval row (fn add(x,y)->x+y, stdout [0,5,0,0,0]).

Template (copy this shape per lane):

• Claim fixture: src/v2/test/claim/execution/emit_host_add_equals_eval_test.dag
• Kernel witness suite: src/v2/test/claim/execution/emit_on_demand_kernel_witness_test.dag (clone pattern per family)

Layer seams (do not invert):

Layer	Path	Role
Pure spec	dag/std/emit_on_demand.dag	emit_on_demand_key, store lookup, materialization_for_lookup, interpreter_surviving_roles_*
Host transport	dag/extdeps/realization/emit_on_demand_host.dag	native_cache_workspace_root, emit_on_demand_evict_native_cache (shell rm)
Scheduling	src/v2/std/emit_on_demand.dag	witness_family_realize_width → realize_pack_width (compiler layer, NOT dag/std)
Compiler	src/v2/compiler/emit_host.dag	run_emit_host_cached(workspace_dir, …), run_test_claim_emit_vs_eval
Seed HAND-RUST	src/v1/stage0/src/v1_interpreter.rs	emit_host_run_transport_cached (~280L, SCAFFOLD, dissolve-on self-emitted transport)
Builtin registry	src/v1/04_method.dag	emit_host_run_transport_cached

P3 ACCEPT surface exercised (all in emit_on_demand_kernel_witnesses):

• (a) agreement: run_test_claim_emit_vs_eval via emit_on_demand_add_agreement_holds
• (b) cold→warm: compile_skipped false then true (emit_on_demand_native_cold_then_warm_holds)
• (c) content-change MISS: distinct inferred_tree_digest → new key → cold rebuild (emit_on_demand_native_content_change_cold_rebuild_holds)
• (d) RED control: wrong oracle → SemanticMismatch (emit_on_demand_add_wrong_oracle_refuses_holds)
• Pure: Share/Recompute qualification, witness_family_realize_width + BudgetUnreadable → BudgetRefused, interpreter_surviving_roles_bounded

Not wired yet (fanout scope): executor cutover (claim_executor calling realize_pack), floor-native routing, persistent artifact store tier (P2 gap: no Filesystem Delete/List), PathUnder<Root> on eviction paths.

---

2. Width-5 partition — lanes 2–5

Lane 1 = kernel (emit_host_add). Remaining 10 emit_host_*_equals_eval families → 4 lanes by complexity/rung:

Lane 2 — unary/field primitives (smallest lift from add)

• emit_host_field_access_equals_eval
• emit_host_complement_equals_eval

Lane 3 — control flow / closures (rung 3–4 body lowering)

• emit_host_match_equals_eval
• emit_host_loop_equals_eval
• emit_host_fold_closure_equals_eval

Lane 4 — lattice + variants + ingest edge

• emit_host_meet_join_equals_eval
• emit_host_variant_construct_equals_eval
• emit_host_classical_not_ingested_equals_eval

Lane 5 — module grain (FLAG B: v0 = one binary per closure; module artifacts later)

• emit_host_module_equals_eval
• emit_host_produced_module_equals_eval

Per-lane deliverable (mirror kernel): family-specific emit_on_demand_<family>_witness_test.dag cloning the kernel ACCEPT matrix; reuse run_emit_host_cached + run_test_claim_emit_vs_eval; enroll on CI floor discovery. Shared infra stays in dag/std + extdeps — do NOT fork cache key authority.

Dependency order: lanes 2→3→4 are independent parallel; lane 5 last (module grain stresses emit_host workspace layout). Scheduling integration (witness_family_realize_width with real spine independence, not independence_override) lands when executor cutover starts — not blocking per-family wet witnesses.

---

3. Traps — things a fresh #6879 reader gets wrong

ArtifactKey / closure_digest

• closure_digest = inferred_tree_digest(tree) over the witness subject tree — NOT test_id, NOT a hand-rolled fixture string (kernel uses content_hash_atom("emit-host-add-kernel-fixture") only for the SourceArtifact vs NativeArtifact grain-diff pure test).
• emit_on_demand_key hashes {closure_digest, emitter_identity, target_language, toolchain} where toolchain = source-artifact | native-artifact grain. Changing any axis = new key = cold path.

Workspace paths

• run_emit_host_cached(workspace_dir: …) takes the pre-composed path from native_cache_workspace_root(cache_root, key) — NOT the cache parent alone.
• test_id subdirs under /tmp/gunbc_emit_on_demand_kernel/{test_id} are sibling-isolation shims only; key material is emit_on_demand_key(…) suffix.

MISS / eviction witnesses

• Content-change MISS must evict both key_primary and key_alt before replay. Stale .native_ready at the alt workspace caused flakes when only one key was evicted.
• emit_on_demand_evict_native_cache has no PathUnder<Root> wall — kernel-only consumer uses explicit /tmp/… parents. Dissolve-on: add construction when non-test callers land.

Witness suite ordering (same interpreter frame)

• In emit_on_demand_kernel_witnesses, all wet run_emit_host_cached / run_test_claim_emit_vs_eval tests must run before emit_on_demand_materialize_share_on_hit_holds. Wet runs poison eval-call memo in-frame; share-on-hit is pure store and must not follow wet emit_host in the same aggregate.

Transport / cache semantics

• .native_ready written only after successful run, not after build — transient run failure must not skip rebuild on retry.
• compile_skipped on EmitHostRunReceipt is the warm-path signal; threaded end-to-end from HAND-RUST builtin.
• Transport builtins bump effect_dispatch_count — without this, eval-call memo serves stale cached results (cold-then-warm bug we hit in kernel bring-up).
• Concurrent same-key: two runners with identical declared inputs share workspace — benign-by-identity (content-derived key). No flock/claim in seed HAND-RUST; dissolve-on note in emit_on_demand_host_concurrent_same_key_note.

Scaffold boundaries

• HAND-RUST transport is SCAFFOLD with dissolve-on → v2 self-emitted transport rows (^witness_realization_kernel). Do not extend seed without receipt.
• interpreter_surviving_roles_bounded() consumer is the kernel witness (emit_on_demand_interpreter_roles_bounded_holds), not a separate floor gate yet.

Predicate dissolution (already done — don't reintroduce)

• witness_admission: witness_consumer_cadence_is_live / witness_admission_refusal_is_holds helpers removed; callers match coproducts directly.

---

Receipt pointers: docs/plans/witness-realization-plan.md (P3 ACCEPT criteria), dag/gunbc/v1_deletion_plan.dag (^witness_family_fanout fan_width=5), plan milestone ^ci_floor_cutover blocked on fanout.

— swift-stag-662

[gunbai-bot]

Cross-family equals_eval diagnosis — fix-assignment record (chain B)

Session: swift-stag-662
Status: Accepted as standing fix-assignment record (sharp-bee-290, 2026-07-19)
Context: Extends kernel handoff partition; census complete across lanes 2–4.

Headline

Pure emit() PASS for all six pre-red families → native emitter is clean across the partition. Every gap is eval/harness-side (the side v1-deletion removes), not transport.

Family → named root

Family	equals_eval	emit()	Named root / site	Fix owner
add (kernel)	PASS	PASS	—	—
loop	PASS	PASS	—	—
classical_not_ingested	PASS	PASS	genuine interpreted==native	lane 4 (green)
match	FAIL→fixed on #6894	PASS	v2_eval_is_literal_shaped_node pick_lit admission (39183f4461)	lane 3 LANDED
fold_closure	FAIL (quarantined)	PASS	closure Arrow at transform pos 3 — eval can't evaluate structural closure args	lane 3 GREEN-LIT
complement	FAIL BuildFailed	PASS	eval_type_node_atom gate: dag_complement_lit_* scrutinee misrouted to binding lookup (^eval_rejected_runtime_binding_lookup_miss); harness allocate_literal never reached	lane 2 (after #6894 merges)
field_access	FAIL BuildFailed	PASS	separate eval-walk gap; pick_lit in fixture but not match's v2_eval_is_literal_shaped_node site	lane 2 (after #6894 merges)
meet_join	FAIL BuildFailed	PASS	same root as complement — dag_meet_eval_subgraph_fixture / dag_join_eval_subgraph_fixture use complement_lit scrutinee; same refusal arm. Consume lane 2 complement fix	lane 2 fix unblocks
variant_construct	FAIL BuildFailed	PASS	distinct — ^eval_rejected_bind_key_absent on Conj scrutinee dag_variant_holds_construct_node; Conj not literal-shaped → binding lookup on Conj	lane 4 (pending)

Fix assignments

• Lane 2: field_access + complement eval fixes — START AFTER Witness family fan-out lane 3: match + loop + fold_closure realization on the merged kernel (#6879, da0e7c3d) — extend the v2 execution path to these families end-to-end per docs/plans/witness-realization-plan.md; READ FIRST: the kernel handoff comment on PR #6879 (partition, seams, P3 ACCEPT matrix #6894 merges (serialization / same-file conflict avoidance on v2_eval module). Complement fix also unblocks meet_join.
• Lane 3: fold closure-arg eval support green-lit; match landed on Witness family fan-out lane 3: match + loop + fold_closure realization on the merged kernel (#6879, da0e7c3d) — extend the v2 execution path to these families end-to-end per docs/plans/witness-realization-plan.md; READ FIRST: the kernel handoff comment on PR #6879 (partition, seams, P3 ACCEPT matrix #6894.
• Lane 4: variant_construct Conj admission pending; classical_not_ingested genuine green; meet_join consumes lane 2 complement fix.

Tripwire (structural derivation)

Six proximate roots on a hand-enumerated eval admission surface. Rule: if any lane fix would add a third hand roster to eval admission (lane 2's two distinct roots field_access + complement could themselves trip this), stop and escalate — structural derivation from ingest single-authority literal definitions becomes its own lane instead of more enumeration.

Lane 2 scaffold

#6893 — witness scaffold + quarantine admission (QuarantineProbeExpectRed for 10 wet subtests). Eval fix work queued post-#6894.

— swift-stag-662