PR-time detectors: CommitWitnessClaim roster-resolvability check + always-on non-fold-residue receipt, with RED controls

[gunbai-bot]

Auto-opened by session-dashboard for session lively-ant-806.
Pushing to session/lively-ant-806 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Review 41573 — addressed in f8d39c5

Valid finding. 2d1fd0f regressed commit_witness_claim_pair_resolvable: it called commit_witness_claim_pair_resolvability_with_index with 4 args after the roster-cache refactor added the required entry_cache parameter (E0061).

Fix: pass a local entry_cache in commit_witness_claim_pair_resolvable, and keep the roster scan optimization (one build_multi_entry_index + per-entry resolve cache in commit_witness_claim_roster_defects).

— sent from lively-ant-806

[gunbai-bot]

Review 41577 — verified, no further code changes

Confirmed against f8d39c5:

• Roster scan projects via ci_floor_commit_witness_claim_schedule → project_ci_floor_witness_entries; schedule projection failure surfaces as schedule_projection_failed (counted refusal, not silent pass).
• Per-row defects emit COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL with entry/function/cause.
• NFR witness entry is stamped ReadsLiveTree (not SubstrateInputsOnly).
• RED controls: synthetic stale roster pair (commit_witness_claim_roster_red_control_holds), synthetic unrostered + wildcard residue fixtures.

Prior review 41573 (E0061) addressed in the same commit series (f8d39c5 passes entry_cache).

— sent from lively-ant-806

[gunbai-bot]

Review 41579 — verified, no further code changes

Confirmed against f8d39c5:

• Both detectors enrolled with ReadsLiveTree, named dissolution triggers (module-identity Phase-0 admission invariant), and RED controls for stale roster + synthetic unrostered/wildcard residue.
• Refusal arms are detect-only/count: COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL per bad row; schedule projection failure → schedule_projection_failed (no widen).
• Builtin precedence in eval_call (eval_builtin at v1_interpreter.rs:3108 before lookup_fn at :3112) is correct for host builtins.

One nuance on the recursion incident (#7060-class fix): the 2629ff0 failure was user-fn name shadowing (imported workflow commit_witness_claim_roster_holds vs same-named test fn), not a builtin collision — builtins would have won. Current witness calls commit_witness_claim_roster_live_unresolvable_count() (host builtin) directly, which is unambiguous either way.

— sent from lively-ant-806

[gunbai-bot]

Review 41591 — verified, no further code changes

Confirmed against current head (5b2efb9):

• Two PR-time detectors (roster resolvability + always-on nfr receipt) with green + RED controls, commit_gate_roster enrollment, and named dissolution triggers (discovery-derived admission invariant).
• Refusal shape matches §5: typed/located/counted (COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL), never widen.
• Witness entry stamped ReadsLiveTree (nfr receipt cannot be predict-skipped).

On the test fn foo() { foo() } / builtin-precedence note: current roster witness does not use that shape — test fn commit_witness_claim_roster_holds delegates to witness_commit_witness_claim_roster_live_holds, which calls host builtin commit_witness_claim_roster_live_unresolvable_count(). Builtin precedence (eval_builtin before lookup_fn, v1_interpreter.rs:3108) is correct for host builtins; the earlier recursion was imported user-fn name shadowing, already removed.

— sent from lively-ant-806

[gunbai-bot]

Review 41592 — verified, no further code changes

Confirmed against 5b2efb9 (no findings):

• commit_gate_roster enrolls both witnesses (commit_witness_claim_roster_witness_test.dag, non_fold_residue_test.dag) on GithubActionsCiJob.
• non_fold_residue_test.dag stamped ReadsLiveTree; RED controls cover synthetic stale roster pair + wildcard/synthetic unrostered fixtures.
• Host-fed cli_run.rs roster scan: typed/located COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL, schedule projection failure → counted refusal; dissolve-on triggers on .dag carriers.
• No fail-open arms or parallel-authority forks in the changed lines.

— sent from lively-ant-806

[gunbai-bot]

Review 41604 — verified, no further code changes

Confirmed against 008d8000:

• Fast/long split documented at dag/test/claim/long/commit_witness_claim_roster_witness_test.dag:12 with named dissolve-on (falsifier enrollment); per-PR fast lane retains synthetic stale-pair RED only.
• Enrolled path: ReadsLiveTree nfr receipt + roster RED control + typed COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL via ci_floor_commit_witness_claim_schedule authority.

On the non-blocking surface-area notes: non_fold_residue_total_fold_green_fixture_holds / non_fold_residue_roster_red_fixture_holds remain registered host fixtures (available to claim_batch / long-lane recipes) but were intentionally trimmed from commit_gate_roster when enrollment narrowed to receipt + two discriminating REDs per the operator brief. Rust commit_witness_claim_roster_holds() is the host helper behind the workflow/long .dag surface (commit_witness_claim_roster_unresolvable_count path), not a parallel enrollment — agree it is not a DESIGN violation in the enrolled path.

— sent from lively-ant-806

[gunbai-bot]

Review 41605 — addressed in 685f930

Both notes were valid hygiene, not blocking:

1. Builtin name collision (non_fold_residue_test.dag:14-19): added witness_* wrappers so enrolled test fn bodies delegate to distinctly named helpers before calling host builtins — same layering pattern as the roster witness after the 2629ff0 shadowing incident.

2. Dropped census tests: documented in non_fold_residue_always_on_note — non_fold_residue_coproduct_universe_is_nonempty and non_fold_residue_discovery_roots_follow_layer_authority were intentionally removed from commit_gate_roster enrollment when scope narrowed to always-on receipt + two discriminating RED controls per the operator brief (class 4).

— sent from lively-ant-806

[gunbai-bot]

Review 41607 — verified, no further code changes

Confirmed against 685f930 (no findings):

• Roster resolvability via ci_floor_commit_witness_claim_schedule → host builtins with typed COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL diagnostics.
• Fast-lane synthetic RED + long-lane full receipt split per 5s-rule precedent (008d8000).
• non_fold_residue_test.dag stamped ReadsLiveTree with witness_* wrappers (685f930) for RED controls.
• Dissolution triggers on-carrier in new .dag modules; detection-only, never widen.

— sent from lively-ant-806

[gunbai-bot]

Review 41608 — verified, no further code changes

Confirmed against 685f930 (APPROVE, no blocking findings):

• Roster detector: typed/located/counted COMMIT_WITNESS_CLAIM_ROSTER_REFUSAL; schedule projection failure → synthetic defect row (never silent widen).
• NFR receipt re-stamped ReadsLiveTree with explicit lying-SubstrateInputsOnly cite; dissolution triggers on-carrier.
• Long-lane roster receipt documented non-enrolled with falsifier dissolve-on.

On the eprintln! nit (cli_run.rs:21696-21699): agree cosmetic — each refusal line repeats total defects.len() for counted observability in CI logs; not changing in this PR.

— sent from lively-ant-806