Lane 2 witness fan-out: field_access + complement family suites (emit-on-demand kernel extension)

dag/gunbc/ci_layer_roots.dag

@@ -144,14 +144,24 @@ data known_red_probe_entries: List<ScheduleWitnessEntry> = [
   probe_red(entry: "src/v2/test/claim/self_host/compiler_closure_emit_from_ingest_test.dag", f: "compiler_closure_scoped_ingest_module_count_ok_holds"),
   probe_red(entry: "src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag", f: "emit_host_fold_closure_equals_eval_holds"),
   probe_red(entry: "src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag", f: "emit_host_fold_closure_wrong_fixture_refuses_holds"),
-  probe_red(entry: "src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag", f: "emit_host_fold_closure_equals_eval_all_holds")
+  probe_red(entry: "src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag", f: "emit_host_fold_closure_equals_eval_all_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_field_access_family_witness_test.dag", f: "emit_on_demand_field_access_agreement_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_field_access_family_witness_test.dag", f: "emit_on_demand_field_access_native_cold_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_field_access_family_witness_test.dag", f: "emit_on_demand_field_access_native_warm_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_field_access_family_witness_test.dag", f: "emit_on_demand_field_access_native_cold_then_warm_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_field_access_family_witness_test.dag", f: "emit_on_demand_field_access_native_content_change_cold_rebuild_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_complement_family_witness_test.dag", f: "emit_on_demand_complement_agreement_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_complement_family_witness_test.dag", f: "emit_on_demand_complement_native_cold_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_complement_family_witness_test.dag", f: "emit_on_demand_complement_native_warm_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_complement_family_witness_test.dag", f: "emit_on_demand_complement_native_cold_then_warm_holds"),
+  probe_red(entry: "src/v2/test/claim/execution/emit_on_demand_complement_family_witness_test.dag", f: "emit_on_demand_complement_native_content_change_cold_rebuild_holds")
 ]
 
 data long_lane_exclusion_note: String = "test/claim/long/ is the LONG-test home (operator 5-second rule, 2026-07-12; authority + enforcement: gunbc_ci_fast_lane_rule_note / gunbc_ci_fast_lane_witness_eval_budget in v2.workflow.ci_floor_plan): a witness whose own eval reaches 5s does not run in per-PR discovery — the executor's cooperative eval deadline REDs it by name (EvalBudgetExceeded), and the fix is moving its file here (dag/test/claim/long/, src/v2/test/claim/long/), where discovery excludes it at dir grain and it runs via the local recipe (claim_batch --source-root dag --source-root src/v2 --entry <file> --functions <csv>) or the scheduled lane's future enrollment. First residents (receipted): s1_closure_receipt_test (whole-closure re-parse through the interpreted v2 frontend, 90+min eval, the run-29183446733 wedge class) and self_host_module_emit_derisk_test (~31s/witness). Unlike the roster exclusions above, membership here is a HOME, not a per-file ruling: the 5s deadline makes an over-budget fast-lane witness unwritable-in-place, so the roster cannot silently grow stale (§5 construction over validation). Dissolve-on: per-witness declared cost envelopes (witness-cost-locality admission law) subsume the dir grain."
 
 data wet_integration_offline_note: String = "Four wet-integration entries above (host_effect_apply, deploy_access_privilege, ci_deploy_observed_wet, random_bytes_csprng) are OFFLINE per the hermetic-floor posture (operator 2026-07-11: integration-style witnesses must not run regularly; CI runs hermetic/mocked behavior checks). Each performs genuinely live host effects the hermetic envelope refuses by construction: host_effect_apply drives real LocalShell/SSH host effects (the 133s row atop the slow-witness census), deploy_access_privilege applies privileged shell mutations through fixture actors, ci_deploy_observed_wet shells whoami + sudo -n, random_bytes_csprng reads host entropy. Hermetic duals stay discovered where they exist (the ci_deploy split keeps the pure half; deploy_access_check(access, actor) is the mock-shaped dual). Local recipe: claim_batch --wet --source-root dag --source-root src/v2 --entry <entry> per file. Dissolve-on: the scheduled (nightly) lane un-darkens and admits wet integration rows under its own budget — then these four enroll there as declared execution rows and the exclusion rows delete."
 
-data known_red_frontier_note: String = "Two entries above (logic_ground_truth_test, english_emit_add_test) are the KNOWN-RED FRONTIER: witnesses red on main for feature gaps owned by named lanes, exposed per-PR only when a whole-corpus-affecting diff (like the 2026-07-12 interpreter change) selects the entire tree. They are RED CONTROLS for their lanes, not broken tests — deleting them would discard the discriminating input; leaving them discovered reds every wide PR on debts those PRs did not create. So they sit here as declared, countable rows (the typed self-host-frontier pattern applied to witnesses), each with its diagnosis and dissolve-on. logic_ground_truth_test (4 witnesses): the v1 resolver does not bind imported bare variant constructors in EXPRESSION position (import v2.std.logic { True } then gt_complement(a: True) -> undefined variable: True; patterns-via-scrutinee work) — the namespace-only-resolution lane's containment SymbolIndex covers exactly this class; dissolve-on: that lane lands imported-variant value bindings, these four run green, the entry deletes. english_emit_add_test (1 witness): the english-language emit-ingest round trip returns false undiagnosed (S2 emit family); dissolve-on: the S2 behavioral-closure lane greens it locally, the entry deletes. Local recipe per file: claim_batch --source-root dag --source-root src/v2 --entry <file> --functions <csv>. compiler_closure_emit_from_ingest_test (1 witness, compiler_closure_scoped_ingest_module_count_ok_holds, admitted 2026-07-19): it asserts COMPLETE ingest coverage for the src/v2/compiler/00_compile.dag closure. That closure is 91 source reads and the manifest emitter inlines the full Lossless text of every row, so it exceeds MANIFEST_INLINE_LIST_MAX (64) and the emitted carrier is legitimately Empty. The witness was GREEN until 2026-07-19 only because the receipt fabricated its own numbers — produced_row_count was emitted as read_count and coverage_complete was hardcoded true, so it asserted complete coverage over an empty carrier and could never go red. Making the receipt honest (the elision is now the typed, counted SourceRootManifestElided { read_count, cap }) turned a fabricated green into a true red. It is admitted here rather than deleted because it is the discriminating input for the carrier deficit: when the carrier can hold 91 rows, this witness greens by itself and that greening is the un-quarantine event. Its gate did not go vacuous — compiler_closure_ingest_receipt_describes_carrier_holds replaced it as the live claim (the receipt must describe the carrier that landed, falsifiable at any corpus size). Owner: wise-bee-768 / the module-identity storage-binding lane. Dissolve-on: manifest rows carry a source ref plus content hash instead of inlined text, the parse oracle reads through the ref with hash verification, the cap stops binding, this witness greens and the row deletes. emit_host_fold_closure_equals_eval_test (3 witnesses, admitted 2026-07-19, owner: jolly-dove-581 / witness-realization lane 3): run_test_claim_emit_vs_eval over fold_fixture_param_call_body fails because eval_type_node_atom cannot evaluate closure Arrow arguments at transform position 3 — xs/z literals admit after pick_lit repair but the closure child still routes to binding lookup (BuildFailed), so equals_eval is not interpreted==native agreement. Native cached-path witnesses (emit_on_demand_fold_closure_native_cached_octets_holds) carry fold P3 coverage until eval gains structural closure-arg support or fold-body eval. Dissolve-on: emit_host_fold_closure_equals_eval_holds greens wet with the real fold body subgraph (no empty Value stub); un-quarantine deletes the three probe rows. Local recipe: claim_batch --wet --source-root src/v2 --source-root dag --entry src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag --function <name>.
+data known_red_frontier_note: String = "Two entries above (logic_ground_truth_test, english_emit_add_test) are the KNOWN-RED FRONTIER: witnesses red on main for feature gaps owned by named lanes, exposed per-PR only when a whole-corpus-affecting diff (like the 2026-07-12 interpreter change) selects the entire tree. They are RED CONTROLS for their lanes, not broken tests — deleting them would discard the discriminating input; leaving them discovered reds every wide PR on debts those PRs did not create. So they sit here as declared, countable rows (the typed self-host-frontier pattern applied to witnesses), each with its diagnosis and dissolve-on. logic_ground_truth_test (4 witnesses): the v1 resolver does not bind imported bare variant constructors in EXPRESSION position (import v2.std.logic { True } then gt_complement(a: True) -> undefined variable: True; patterns-via-scrutinee work) — the namespace-only-resolution lane's containment SymbolIndex covers exactly this class; dissolve-on: that lane lands imported-variant value bindings, these four run green, the entry deletes. english_emit_add_test (1 witness): the english-language emit-ingest round trip returns false undiagnosed (S2 emit family); dissolve-on: the S2 behavioral-closure lane greens it locally, the entry deletes. Local recipe per file: claim_batch --source-root dag --source-root src/v2 --entry <file> --functions <csv>. compiler_closure_emit_from_ingest_test (1 witness, compiler_closure_scoped_ingest_module_count_ok_holds, admitted 2026-07-19): it asserts COMPLETE ingest coverage for the src/v2/compiler/00_compile.dag closure. That closure is 91 source reads and the manifest emitter inlines the full Lossless text of every row, so it exceeds MANIFEST_INLINE_LIST_MAX (64) and the emitted carrier is legitimately Empty. The witness was GREEN until 2026-07-19 only because the receipt fabricated its own numbers — produced_row_count was emitted as read_count and coverage_complete was hardcoded true, so it asserted complete coverage over an empty carrier and could never go red. Making the receipt honest (the elision is now the typed, counted SourceRootManifestElided { read_count, cap }) turned a fabricated green into a true red. It is admitted here rather than deleted because it is the discriminating input for the carrier deficit: when the carrier can hold 91 rows, this witness greens by itself and that greening is the un-quarantine event. Its gate did not go vacuous — compiler_closure_ingest_receipt_describes_carrier_holds replaced it as the live claim (the receipt must describe the carrier that landed, falsifiable at any corpus size). Owner: wise-bee-768 / the module-identity storage-binding lane. Dissolve-on: manifest rows carry a source ref plus content hash instead of inlined text, the parse oracle reads through the ref with hash verification, the cap stops binding, this witness greens and the row deletes. emit_host_fold_closure_equals_eval_test (3 witnesses, admitted 2026-07-19, owner: jolly-dove-581 / witness-realization lane 3): run_test_claim_emit_vs_eval over fold_fixture_param_call_body fails because eval_type_node_atom cannot evaluate closure Arrow arguments at transform position 3 — xs/z literals admit after pick_lit repair but the closure child still routes to binding lookup (BuildFailed), so equals_eval is not interpreted==native agreement. Native cached-path witnesses (emit_on_demand_fold_closure_native_cached_octets_holds) carry fold P3 coverage until eval gains structural closure-arg support or fold-body eval. Dissolve-on: emit_host_fold_closure_equals_eval_holds greens wet with the real fold body subgraph (no empty Value stub); un-quarantine deletes the three probe rows. Local recipe: claim_batch --wet --source-root src/v2 --source-root dag --entry src/v2/test/claim/execution/emit_host_fold_closure_equals_eval_test.dag --function <name>. emit_on_demand_field_access_family_witness_test + emit_on_demand_complement_family_witness_test (10 wet witnesses total, admitted 2026-07-19, swift-stag-662 lane 2): wet emit-vs-eval P3 ACCEPT subtests (agreement, native cold/warm/cold-then-warm, content-change cold rebuild) red on main because emit_host_field_access and emit_host_complement fail the base equals_eval claims pre-transport — same pre-red class as lane 3 match/fold_closure; coordinate with jolly-dove-581 if root cause is one shared transport defect. Owner: swift-stag-662 (lane 2 scaffold + transport fix). Dissolve-on: emit_host_field_access_equals_eval_all_holds and emit_host_complement_equals_eval_all_holds green on main, these ten probe rows delete and the wet subtests graduate to falsifier_self_host_wet or per-PR discovery per the emit-on-demand cutover lane. Local recipe: claim_batch --wet --source-root dag --source-root src/v2 --entry <file> --functions <csv>. Pure subtests in the same files stay OfflineLocalRecipe via test/claim/execution/ exclusion.
 
 This roster must not grow silently: a new known-red admission requires the same per-file diagnosis + owner + dissolve-on in this note, and an entry whose witness runs green locally is stale and deletes."
 

dag/std/emit_on_demand.dag

@@ -7,7 +7,7 @@ import std.artifact_store {
 }
 import std.realization { Materialization, Share, Recompute }
 
-data emit_on_demand_module_note: String = "Witness-realization kernel (plan P3): the pure-spec authority for emit-on-demand native execution — closure ContentHash -> artifact store lookup -> cold (emit+build+run+put) | warm (run-only, compile skipped). Composes P2 std.artifact_store (ContentKeyed, eviction counted) and std.realization (Share on store hit). Source grain (toolchain: source-artifact) is the emit cache; native grain (toolchain: native-artifact) is the zero-compile warm path. The interpreter's surviving roles are named here with dissolution triggers (P3 ACCEPT (c)). Host transport: extdeps.realization.emit_on_demand_host; spine/realize_pack scheduling: v2.std.emit_on_demand. First witness family: emit_host_add (the simplest EqualsClaim emit-vs-eval row)."
+data emit_on_demand_module_note: String = "Witness-realization kernel (plan P3): the pure-spec authority for emit-on-demand native execution — closure ContentHash -> artifact store lookup -> cold (emit+build+run+put) | warm (run-only, compile skipped). Composes P2 std.artifact_store (ContentKeyed, eviction counted) and std.realization (Share on store hit). Source grain (toolchain: source-artifact) is the emit cache; native grain (toolchain: native-artifact) is the zero-compile warm path. The interpreter's surviving roles are named here with dissolution triggers (P3 ACCEPT (c)). Host transport: extdeps.realization.emit_on_demand_host; spine/realize_pack scheduling: v2.std.emit_on_demand. Serial kernel family: emit_host_add (#6879). Fan-out lane 2 (swift-stag-662): emit_host_field_access + emit_host_complement. Width-5 partition ratified on #6879 comment."
 
 data emit_on_demand_cache_key_authority_note: String = "Cache key purity (§5 cache-impurity): emit_on_demand_key hashes ArtifactKey { closure_digest, emitter_identity, target_language, toolchain } — closure_digest is the content hash of declared inputs (inferred_tree_digest over the witness root + evaluated facts; emitted source + build inputs derive from that tree). Witness test_id subdirectories under /tmp are isolation-only shims; they are NOT key material. A changed subject changes closure_digest -> new key -> new workspace path -> cold rebuild (witness: emit_on_demand_native_content_change_cold_rebuild_holds)."