CI two-tier placement + progress-observation lane, and the two defects debugging it surfaced (supersedes #7162)

DESIGN.md

@@ -116,4 +116,4 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/`
 
 - `cargo test --workspace` · `cargo clippy --all-targets -- -D warnings` · `cargo fmt --all --check`
 - one-time: `git config core.hooksPath .githooks` (pre-push runs `cargo fmt`)
-- CI (`gunbc ci` generates `.github/workflows/ci.yml`; all `v1-compiler` seed bins, no shell gate): **one** composed floor pass — `claim_executor --source-root src/v2 --source-root dag --plan-entry src/v2/workflow/ci_floor_plan.dag --plan-function gunbc_ci_floor_batches`. The v2 scheduler decides the batches from the single-authority spec (`gunbc.ci_spec`); the only structural fact the plan adds is *compile-clean gates the rest* (batch-1 `dag_compile_clean_gate` → batch-2 everything else, a dependency edge). Witness enrollment: **discovery shrunk by the affected set** (operator acceptance 2026-07-09, firing the 2026-07-04 opt-in inversion's dissolve-on — see `gunbc.ci_spec` `ci_spec_discovery_flip_note`): the corpus batch scans `CiSpec.discovery_scan_dirs` (plus the source-root `*_test.dag` walk) with `SelectionApplied`, so a PR runs the tree-wide witness corpus (~1,721 rows at flip time) shrunk to the diff's affected set; selection is fail-closed (a provenance gap refuses, never widens; host-scaffold/live-tree rows never predict-skip) and the scheduled `affected-set-falsifier` (every 4 hours) runs the corpus cold with predictions recorded, so a missing selection edge surfaces as a counted divergence within one cadence window. `CiSpec.witness_entries` (`CommitWitnessClaim` rows on the `GithubActionsCiJob` surface, projected by `project_ci_floor_witness_entries`) remains the explicit-entry roster — execution-kind rows with their own resource profile, and any row that must run as declared. Empty entries AND empty discovery dirs = zero witness-corpus nodes (the regen spec's shape). Naming hygiene stays fail-closed (a `test fn` outside `*_test.dag` is still a violation — the executor runs the zero-enrollment naming walk when no discovery batch is scheduled), and tree-wide unselected discovery remains the **local** path (`claim_batch --roster-from-discovery --source-root dag --source-root src/v2 --scan-dir dag/test/claim --scan-dir src/v2/test/claim/manual`). Batch-2 also carries the effectful gates: the rust fmt gate (when a `.rs` changes; nextest was removed from CI 2026-07-11 — operator ruling recorded in `gunbc.commit_workflow` `rust_tests_removed_disposition`, the suite runs locally only; clippy removed from CI 2026-07-08 — crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44m/run, still available as a local dev check), emit-host MVP smokes, source-root-ingest, and the `ci.yml` drift+parse gate (ci.yml == `gunbc ci` output). The compile-clean gate is `--target dag`, and its per-PR scope is the same import-closure authority (2026-07-16, channel 2 of the 2026-07-10 grain fork): an all-`.dag`/docs diff compiles only the affected shard-entry closures (`tools.dag_compile_clean_scope`, host fast path `entry_file_touched_via_import_closure`); any non-selectable touched path (`.rs`, workflow yml, manifests), any non-docs departed path, or any selection refusal keeps the whole-tree baseline, loudly; the falsifier cadence carries the deterministic whole-tree cold control (`GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL=1`, widen-only). The regen step (self-host fixed-point) is scoped the same way at its own closure (#6732 + this change's departed-path guard): `regen_floor_skip_witness` skips the pull_request step only when a non-empty merge-base diff is provably disjoint from the regen input set (`cli_run::regen_input_sources` — the SAME closure authority `regen_stage0` compiles — plus the src/v1/** prefix and Cargo/toolchain config); empty diffs, departed non-docs paths, and every failure arm run regen, and the skip is shell-gated to pull_request events so main pushes stay the unconditional cold control. Parse is grammar-owned: `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell/host parser.
+- CI (`gunbc ci` generates `.github/workflows/ci.yml`; all `v1-compiler` seed bins, no shell gate): **one** composed floor pass — `claim_executor --source-root src/v2 --source-root dag --plan-entry src/v2/workflow/ci_floor_plan.dag --plan-function gunbc_ci_floor_batches`. The v2 scheduler decides the batches from the single-authority spec (`gunbc.ci_spec`); the only structural fact the plan adds is *compile-clean gates the rest* (batch-1 `dag_compile_clean_gate` → batch-2 everything else, a dependency edge). Witness enrollment: **discovery shrunk by the affected set** (operator acceptance 2026-07-09, firing the 2026-07-04 opt-in inversion's dissolve-on — see `gunbc.ci_spec` `ci_spec_discovery_flip_note`): the corpus batch scans `CiSpec.discovery_scan_dirs` (plus the source-root `*_test.dag` walk) with `SelectionApplied`, so a PR runs the tree-wide witness corpus (~1,721 rows at flip time) shrunk to the diff's affected set; selection is fail-closed (a provenance gap refuses, never widens; host-scaffold/live-tree rows never predict-skip) and the scheduled `affected-set-falsifier` (every 4 hours) runs the corpus cold with predictions recorded, so a missing selection edge surfaces as a counted divergence within one cadence window. `CiSpec.witness_entries` (`CommitWitnessClaim` rows on the `GithubActionsCiJob` surface, projected by `project_ci_floor_witness_entries`) remains the explicit-entry roster — execution-kind rows with their own resource profile, and any row that must run as declared. Empty entries AND empty discovery dirs = zero witness-corpus nodes (the regen spec's shape). Naming hygiene stays fail-closed (a `test fn` outside `*_test.dag` is still a violation — the executor runs the zero-enrollment naming walk when no discovery batch is scheduled), and tree-wide unselected discovery remains the **local** path (`claim_batch --roster-from-discovery --source-root dag --source-root src/v2 --scan-dir dag/test/claim --scan-dir src/v2/test/claim/manual`). Batch-2 also carries the effectful gates: the rust fmt gate (when a `.rs` changes; nextest was removed from CI 2026-07-11 — operator ruling recorded in `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`, the suite runs locally only; clippy removed from CI 2026-07-08 — crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44m/run, still available as a local dev check), emit-host MVP smokes, source-root-ingest, and the `ci.yml` drift+parse gate (ci.yml == `gunbc ci` output). The compile-clean gate is `--target dag`, and its per-PR scope is the same import-closure authority (2026-07-16, channel 2 of the 2026-07-10 grain fork): an all-`.dag`/docs diff compiles only the affected shard-entry closures (`tools.dag_compile_clean_scope`, host fast path `entry_file_touched_via_import_closure`); any non-selectable touched path (`.rs`, workflow yml, manifests), any non-docs departed path, or any selection refusal keeps the whole-tree baseline, loudly; the falsifier cadence carries the deterministic whole-tree cold control (`GUNBC_CI_COMPILE_CLEAN_COLD_CONTROL=1`, widen-only). The regen step (self-host fixed-point) is scoped the same way at its own closure (#6732 + this change's departed-path guard): `regen_floor_skip_witness` skips the pull_request step only when a non-empty merge-base diff is provably disjoint from the regen input set (`cli_run::regen_input_sources` — the SAME closure authority `regen_stage0` compiles — plus the src/v1/** prefix and Cargo/toolchain config); empty diffs, departed non-docs paths, and every failure arm run regen, and the skip is shell-gated to pull_request events so main pushes stay the unconditional cold control. Parse is grammar-owned: `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell/host parser.

dag/extdeps/provisioning/ubuntu_install_media_fetch.dag

@@ -5,6 +5,7 @@ import std.disposition { Disposition, Terminal }
 import std.types { NonEmptyStr, List, String, Bool, FilePath }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import gunbc.output_policy { OutcomeIsData }
 import extdeps.shell
 import extdeps.http.client
 import extdeps.tools.sha256sum { sha256sum_verify_via_shell, Sha256Matches, Sha256Mismatch, Sha256VerifyInfraFailure }
@@ -51,8 +52,10 @@ type MirrorFoldAcc = MirrorFoldAcc { terminal: InstallMediaFetchReconcileOutcome
 
 data mirror_fold_refusal_doc: String = "DESIGN §5 fix (cursor review, PR #6596): install_media_fetch_try_mirror previously returned `none` for BOTH an unreachable mirror (transport miss, keep trying) AND a Sha256Mismatch (a genuine digest failure), so a run where every mirror downloaded but none verified fell through the fold to 'all mirrors unreachable' - a state-space conflation between reachability and digest correctness. MirrorAttempt now names the three outcomes distinctly, and the fold tracks saw_mismatch so the final refusal reads 'digest verification failed' when that's what actually happened."
 
+data observe_install_media_fetch_outcome_is_data_note: String = "The presence probe is OutcomeIsData: a non-zero `test -f` here means the media is ABSENT, which is one of this fn's four declared answers (InstallMediaFetchAbsent), not a fault. The type already draws the distinction the arm formalises — InstallMediaFetchVerifyInfraFailure is the separate 'the probe itself broke' arm — so subject-state and probe-breakage were never conflated here; only the effect layer's glyph conflated them. Admissible under the §5 guard: this fn returns InstallMediaFetchObservation, a typed observation whose arms ARE the adjudication, and the exit selects among them."
+
 fn observe_install_media_fetch(path: NonEmptyStr, expected_hash: NonEmptyStr) -> InstallMediaFetchObservation {
-  let present = shell.Test.IsFile(path: path as FilePath)
+  let present = shell.Test.IsFile(path: path as FilePath, expect: OutcomeIsData)
   if present.is_file == false {
     InstallMediaFetchAbsent
   } else {

dag/extdeps/provisioning/ubuntu_seeded_install_media_remaster.dag

@@ -1,5 +1,6 @@
 module extdeps.provisioning.ubuntu_seeded_install_media_remaster
 
+import gunbc.output_policy { OutcomeIsData }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import extdeps.shell
@@ -140,8 +141,10 @@ fn observe_install_media_remaster(artifact: UbuntuSeededInstallMediaArtifactRow)
   }
 }
 
+data ensure_grub_cmdline_probe_note: String = "grep exits non-zero when the pattern is ABSENT, and absence is precisely the question this fn asks — it is the idempotence probe that decides whether to substitute or leave the file alone. Both answers are ordinary: on a fresh image the cmdline is missing and gets inserted, on a re-run it is present and nothing happens. The §5 guard holds on the belt_program_available shape: the Bool is consumed as the branch discriminator, never discarded. A grep that could not RUN is a different event and does not travel this arm."
+
 fn install_media_remaster_ensure_grub_cmdline(grub_cfg: NonEmptyStr, cmdline: NonEmptyStr) -> Bool {
-  let already_present = grep.Grep.MatchesFixedString(pattern: cmdline, path: grub_cfg).matches
+  let already_present = grep.Grep.MatchesFixedString(pattern: cmdline, path: grub_cfg, expect: OutcomeIsData).matches
   let substituted = if already_present {
     true
   } else {

dag/extdeps/render/glyphs.dag

@@ -25,7 +25,7 @@ data standard_symbols: List<SymbolEntry> = [
   { id: NodeRunning,      glyphs: glyphs_for_tiers(emoji: glyph(text: "🔄"), unicode: glyph(text: "◐"),  ascii: glyph(text: "[~]")), color: Active  },
   { id: NodeCompleted,    glyphs: glyphs_for_tiers(emoji: glyph(text: "✅"), unicode: glyph(text: "✓"),  ascii: glyph(text: "[x]")), color: Success },
   { id: NodeFailed,       glyphs: glyphs_for_tiers(emoji: glyph(text: "❌"), unicode: glyph(text: "✗"),  ascii: glyph(text: "[!]")), color: Error   },
-  { id: NodeSkipped,      glyphs: glyphs_for_tiers(emoji: glyph(text: "⏩"), unicode: glyph(text: "⊘"),  ascii: glyph(text: "[-]")), color: Dim     },
+  { id: NodeSkipped,      glyphs: glyphs_for_tiers(emoji: glyph(text: "⏭️"), unicode: glyph(text: "⊘"),  ascii: glyph(text: "[-]")), color: Dim     },
   { id: NodeIntercepted,  glyphs: glyphs_for_tiers(emoji: glyph(text: "🔍"), unicode: glyph(text: "◆"),  ascii: glyph(text: "[m]")), color: Info    },
 
   { id: EdgeIdle,         glyphs: glyphs_for_tiers(emoji: glyph(text: "┄"),   unicode: glyph(text: "┄"),   ascii: glyph(text: "-")),   color: Dim     },
@@ -56,6 +56,17 @@ data standard_symbols: List<SymbolEntry> = [
   { id: StatusWarning,    glyphs: glyphs_for_tiers(emoji: glyph(text: "⚠"), unicode: glyph(text: "⚠"),    ascii: glyph(text: "WARN")), color: Warning },
   { id: StatusInfo,       glyphs: glyphs_for_tiers(emoji: glyph(text: "💡"), unicode: glyph(text: "ℹ"),    ascii: glyph(text: "INFO")), color: Info    },
 
+  { id: StatusRefused,    glyphs: glyphs_for_tiers(emoji: glyph(text: "🚫"), unicode: glyph(text: "⛔"),  ascii: glyph(text: "REFUSED")), color: Error   },
+  { id: StatusBlocked,    glyphs: glyphs_for_tiers(emoji: glyph(text: "⏳"), unicode: glyph(text: "◷"),  ascii: glyph(text: "BLOCKED")), color: Warning },
+  { id: StatusTimedOut,   glyphs: glyphs_for_tiers(emoji: glyph(text: "⌛"), unicode: glyph(text: "⏱"),  ascii: glyph(text: "TIMEOUT")), color: Error   },
+  { id: StatusDwell,      glyphs: glyphs_for_tiers(emoji: glyph(text: "⏱"), unicode: glyph(text: "◴"),  ascii: glyph(text: "DWELL")),   color: Warning },
+  { id: StatusFinal,      glyphs: glyphs_for_tiers(emoji: glyph(text: "✦"), unicode: glyph(text: "✦"),  ascii: glyph(text: "DONE")),    color: Success },
+  { id: StatusPulse,      glyphs: glyphs_for_tiers(emoji: glyph(text: "🕐"), unicode: glyph(text: "◷"),  ascii: glyph(text: "STATUS")),  color: Dim     },
+
+  { id: ChangeAdded,      glyphs: glyphs_for_tiers(emoji: glyph(text: "+"), unicode: glyph(text: "+"),   ascii: glyph(text: "+")),       color: Success },
+  { id: ChangeModified,   glyphs: glyphs_for_tiers(emoji: glyph(text: "~"), unicode: glyph(text: "~"),   ascii: glyph(text: "~")),       color: Warning },
+  { id: ChangeRemoved,    glyphs: glyphs_for_tiers(emoji: glyph(text: "-"), unicode: glyph(text: "-"),   ascii: glyph(text: "-")),       color: Error   },
+
   { id: DataList,         glyphs: glyphs_for_tiers(emoji: glyph(text: "☰"),  unicode: glyph(text: "☰"),    ascii: glyph(text: "[L]")),  color: Default },
   { id: DataMap,          glyphs: glyphs_for_tiers(emoji: glyph(text: "⊞"),  unicode: glyph(text: "⊞"),  ascii: glyph(text: "[M]")),  color: Default },
   { id: DataSecret,       glyphs: glyphs_for_tiers(emoji: glyph(text: "🔒"),  unicode: glyph(text: "✱"),    ascii: glyph(text: "[*]")),  color: Warning },
@@ -105,3 +116,41 @@ fn symbol_color(id: SymbolId) -> SemanticColor? {
     Absent => none
   }
 }
+
+data reward_animal_note: String = "The reward animal shown on a terminal success lands as ROWS in the one glyph authority, never as a hardcoded function in a renderer — the reference implementation studied for this lane keeps its emoji table mirrored by hand between Go and shell, which is the maintained dual representation we are here to not have. Selection is DETERMINISTIC: the index is derived from the run's own identity, so replaying a captured run reproduces its animal exactly and the event stream stays replayable by construction. A random draw would make the stream unreplayable and would be a non-determinism root of precisely the kind the determinism gate walls."
+
+data reward_animals: List<TierGlyphs> = [
+  glyphs_for_tiers(emoji: glyph(text: "🦦"), unicode: glyph(text: "✦"), ascii: glyph(text: "otter")),
+  glyphs_for_tiers(emoji: glyph(text: "🦊"), unicode: glyph(text: "✦"), ascii: glyph(text: "fox")),
+  glyphs_for_tiers(emoji: glyph(text: "🦉"), unicode: glyph(text: "✦"), ascii: glyph(text: "owl")),
+  glyphs_for_tiers(emoji: glyph(text: "🐢"), unicode: glyph(text: "✦"), ascii: glyph(text: "turtle")),
+  glyphs_for_tiers(emoji: glyph(text: "🦫"), unicode: glyph(text: "✦"), ascii: glyph(text: "beaver")),
+  glyphs_for_tiers(emoji: glyph(text: "🐋"), unicode: glyph(text: "✦"), ascii: glyph(text: "whale"))
+]
+
+type RewardPick {
+  idx: Int
+  found: TierGlyphs?
+}
+
+fn reward_animal_at(index: Int, tier: Tier) -> String? {
+  let n = count(reward_animals)
+  if n == 0 {
+    none
+  } else {
+    let target = index % n
+    let picked = fold(reward_animals,
+      init: RewardPick { idx: 0, found: none },
+      f: (acc, g) =>
+        if acc.idx == target {
+          RewardPick { idx: acc.idx + 1, found: Present { value: g } }
+        } else {
+          RewardPick { idx: acc.idx + 1, found: acc.found }
+        }
+    )
+    match picked.found {
+      Present { value: g } => Present { value: glyph_at(glyphs: g, tier: tier) }
+      Absent => none
+    }
+  }
+}

dag/extdeps/tools/sha256sum.dag

@@ -4,6 +4,7 @@ import std.types { NonEmptyStr, String, Bool }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import extdeps.tools { CliTool, SourceCoreutils }
+import gunbc.output_policy { OutcomeIsData }
 import extdeps.shell
 import extdeps.filesystem.filesystem_io
 import std.roster_frontier {
@@ -65,6 +66,8 @@ data sha256_verify_native_transport_frontier_rows: List<FrontierRow> = [
   )
 ]
 
+data sha256_check_outcome_is_data_note: String = "sha256sum --check exits non-zero on DIGEST MISMATCH, which is this fn's Sha256Mismatch answer, not a fault — so the check call is OutcomeIsData. The guard holds on the same evidence as the caller: Sha256VerifyVerdict already separates the two content answers (Matches / Mismatch) from Sha256VerifyInfraFailure, the arm for the verification machinery itself breaking, so annotating the content comparison cannot silence an infra failure — that arm is reached by different conditions entirely."
+
 fn sha256sum_verify_via_shell(path: NonEmptyStr, expected_digest: NonEmptyStr) -> Sha256VerifyVerdict {
   let checksum_dir = shell.Mktemp.Dir()
   if checksum_dir.success == false {
@@ -77,7 +80,7 @@ fn sha256sum_verify_via_shell(path: NonEmptyStr, expected_digest: NonEmptyStr) -
       let cleaned = shell.Remove.RecursiveForce(path: checksum_dir.path)
       Sha256VerifyInfraFailure { reason: "checksum file write failed" as NonEmptyStr }
     } else {
-      let checked = sha256sum.Sha256.CheckFile(checksum_file: checksum_path)
+      let checked = sha256sum.Sha256.CheckFile(checksum_file: checksum_path, expect: OutcomeIsData)
       let cleaned = shell.Remove.RecursiveForce(path: checksum_dir.path)
       if checked.matches {
         Sha256Matches