Production-path stage executor fixture (#7499 blocker 3)

[briansrls]

Summary

Production-path stage-executor fixture for #7499 run_stage — four discriminating controls driven through real WalkPlan recipes in src/v2/test/fixture/walk_plan_stage/plan.dag (overlap+barrier, failure, panic, receipt-write refusal). Fixtures use typed Wet service ops only; discovery excludes test/fixture/walk_plan_stage/ at dir grain (mirrors floor_skip). Integration harness in walk_plan_stage_fixture.rs is #[ignore] by default (~7m cold walks each).

Fixture-only delta on current main (after merged #7518, #7505). No executor/substrate edits — §7 run_stage deferral stays on main via #7518.

Merge order (operator sequence)

1. Close the four review blockers on the merged run_stage extraction #7518 — merged: receipt identity + walk_plan_note repair + §7 deferral
2. On-success materialization receipt (#7499 blocker 6) #7505 (B) — merged: v2 schedule lens
3. Production-path stage executor fixture (#7499 blocker 3) #7503 (A, this PR) — ready for operator merge after CI floor green
4. Admission occupants / Run merge admission as ordered CI success stages #7522

A proves the seed executor realizes stage boundaries; B's v2 schedule lens proves authored plan structure — complementary, not substitutable.

Fixture contract

• GUNBC_WALK_ATTEMPT_ID=walk-plan-stage-fixture (required for staged walks; executor refuses unidentified walks)
• Receipt path authority in common.dag: target/floor-attempt-walk-plan-stage-fixture/on-success-stage-N-receipt.tsv
• Barrier witness reads attempt-scoped stage-1 receipt; TSV rows assert claim\t{entry}\t{function}\t{outcome}\t{wall_ms} plus plan_site header (Close the four review blockers on the merged run_stage extraction #7518 shape)
• Poison claim: Mkdir.Parents on the stage-1 receipt path (directory blocks write)
• PASS/FAIL claim lines on stdout; stage progress on stderr
• Stage-1 overlap peers record independent markers (no wall-time concurrency oracle — aligned to walk_plan_note; spawn/join latch is stage_members_actually_overlap)

Test plan

• cargo test -p v1-compiler --bin claim_executor stage_members_actually_overlap join_waits_for_every_member_before_returning join_reports_a_panicking_member_without_losing_the_others
• cargo build -p v1-compiler --release --bin claim_executor --bin claim_batch && cargo test -p v1-compiler --test walk_plan_stage_fixture --release -- --ignored --test-threads=1
• CI floor green on final head (ed63b287d)

Execution receipts

Head: ed63b287d7fe71a7f923c919caba16edc1e709e9 · remote ctrl-build runner · 2026-08-01

Unit latch controls (claim_executor spawn/join primitives)

$ cargo test -p v1-compiler --bin claim_executor stage_members_actually_overlap -- --nocapture
test tests::stage_members_actually_overlap ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 48 filtered out; finished in 0.00s

$ cargo test -p v1-compiler --bin claim_executor join_waits_for_every_member_before_returning -- --nocapture
test tests::join_waits_for_every_member_before_returning ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 48 filtered out; finished in 0.08s

$ cargo test -p v1-compiler --bin claim_executor join_reports_a_panicking_member_without_losing_the_others -- --nocapture
test tests::join_reports_a_panicking_member_without_losing_the_others ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 48 filtered out; finished in 0.00s

Production-path controls (#[ignore] integration harness → real claim_executor / claim_batch)

$ cargo build -p v1-compiler --release --bin claim_executor --bin claim_batch
$ cargo test -p v1-compiler --test walk_plan_stage_fixture --release -- --ignored --test-threads=1 --nocapture

test walk_plan_stage_failure_blocks_stage2 ... ok
test walk_plan_stage_overlap_barrier_production_path ... ok
test walk_plan_stage_panic_blocks_stage2 ... ok
test walk_plan_stage_receipt_refusal_blocks_stage2 ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1035.23s

Per-test assertions (all green on this head):

Control	Plan function	Key oracle
overlap+barrier	walk_plan_stage_overlap_barrier_plan	both stage-1 peers PASS; stage-1 receipt exists; stage-2 barrier witness PASS; exit 0
failure blocks stage 2	walk_plan_stage_failure_barrier_plan	stderr remaining stage(s) NOT run; stage-2 marker absent; exit ≠ 0
panic blocks stage 2	walk_plan_stage_panic_barrier_plan	stdout call depth exceeded / unbounded recursion; stderr remaining stage(s) NOT run; stage-2 marker absent; exit ≠ 0
receipt-write refusal	walk_plan_stage_receipt_refusal_barrier_plan	poison claim PASS; stderr receipt write failed + remaining stage(s) NOT run; stage-2 marker absent; exit ≠ 0

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed both findings from review 45598 on 78822c7668:

1. Hand-Rust / scaffold gate (claim_executor.rs) — Fixed. Added walk_plan_run_stage_claim_executor_seed_deferral in dag/std/realization_schedule.dag and the matching SCAFFOLD (§7 seed-retained HAND-RUST) marker on run_stage. The Rust here is the #7499 run_stage extraction (merged into this branch): it consolidates the duplicated inline on-success-stage runner into one path shared with ordinary batches. The deferral names the census shrink, what stays in .dag, and the witness-realization dissolution trigger. In-process latch tests remain seed-side discriminating witnesses, not parallel ledger rows.

2. Medium-as-string shell programs (fixture claims) — Fixed. All five cited files now use typed service operations only:

• cleanup_test.dag → shell.Remove.RecursiveForce
• overlap_peer_{a,b}_test.dag → shared overlap_coordination.dag (shell.Mkdir, Filesystem.Write, shell.Test.IsFile, sleep.Delay.Seconds)
• stage2_marker_test.dag → Filesystem.Write
• receipt_refusal_poison_test.dag → shell.Mkdir + shell.Remove

Verified locally on this commit: walk_plan_stage_failure_barrier_plan and walk_plan_stage_receipt_refusal_barrier_plan both drive the new typed claims through the production claim_executor path (failure RED + receipt-write refusal fail-closed as expected).

Merge order: This branch contains the #7499 merge (678f620ad3); #7499 should land first or this PR subsumes it — the fixture is the blocker-3 consumer of run_stage.

— sent from silent-tern-582

[gunbai-bot]

Addressed review 45620 on 0c1a3f2b9f:

Finding 1 (walk_plan_note overstates admission) — Fixed. Lines 210/214 were stale after the review 2026-07-31 correction already landed in validate_on_success_stage_admissibility (claim_executor.rs:3729). walk_plan_note now states: spawned units share governor admission; memo/discovery lanes remain unadmitted; heavy-whole-tree-resolve still refuses at arm-time (dissolve-on resident lease, not lane partition).

Finding 2 (deferral lacks concrete receipt) — Fixed. walk_plan_run_stage_claim_executor_seed_deferral now carries: (a) checkable census via git show f0569d77a9 (~197-line duplicate inline stage loop deleted), (b) enrolled executing controls (cargo test -p v1-compiler --bin claim_executor stage_members + walk_plan_stage_fixture.rs), (c) concrete ROADMAP row v1-ci-floor-cutover / cli_run_hollowing_plan §2.10 (same dissolution family as gunbc_ci_floor_batch_stop_policy_claim_executor_seed_note).

— sent from silent-tern-582

[gunbai-bot]

Addressed review 45688 on f8ea78b85e:

Finding 1 (missing GUNBC_WALK_ATTEMPT_ID) — Fixed. walk_plan_stage_fixture.rs sets GUNBC_WALK_ATTEMPT_ID=walk-plan-stage-fixture (matches walk_plan_stage_attempt_id in common.dag). Recipes in plan.dag document the same env prefix.

Finding 2 (obsolete receipt paths) — Fixed. Single path authority in common.dag (walk_plan_stage_stage1_receipt_path / walk_plan_stage_attempt_dir); consumed by cleanup, barrier reader, poison claim (directory at attempt-scoped stage-1 path), and the Rust harness. Barrier witness also checks attempt_id=walk-plan-stage-fixture in the receipt payload.

Also per operator third-pass: removed the copied run_stage §7 deferral row + SCAFFOLD marker from this branch (owned by #7518). Harness now captures stdout/stderr separately; tightened panic/receipt-refusal oracles.

— sent from silent-tern-582

[gunbai-bot]

Addressed review 45755 on b2816e5051:

Finding 1 (hand-Rust scaffold gate) — Fixed. Added dag/gunbc/walk_plan_stage_fixture_scaffold.dag (§7 Scaffold disposition, dissolve trigger, plan/roadmap anchors, path census) and executing witness dag/test/claim/walk_plan_stage_fixture_hand_rust_witness_test.dag. walk_plan_stage_fixture.rs carries the matching SCAFFOLD (§7 seed-retained HAND-RUST) marker citing both authorities.

Finding 2 (forked attempt/receipt identity) — Fixed. common.dag remains the single literal authority (walk_plan_stage_attempt_id, receipt paths, walk_plan_stage_plan_entry, stage-2 marker). New walk_plan_stage_materialize_harness_authority_holds writes target/walk_plan_stage_harness_authority.txt; the Rust harness reads that file via claim_batch --wet before each walk — no hard-coded ATTEMPT_ID / receipt path constants. Witness walk_plan_stage_fixture_recipes_carry_common_attempt_id pins recipes to the same data rows.

— sent from silent-tern-582

[gunbai-bot]

Addressed review 45760 on current head:

Finding 1 (pre-cleanup before authority materialized) — Fixed. stage2_marker_path / stage1_receipt_path now route through ensure_harness_authority(root), which runs walk_plan_stage_materialize_harness_authority_holds on first access. Isolated cargo test … walk_plan_stage_overlap_barrier_production_path -- --ignored --test-threads=1 can pre-clean without panicking.

Finding 2 (forked harness authority path literal) — Fixed. Removed the hard-coded target/walk_plan_stage_harness_authority.txt read. common.dag now emits harness_authority_path= in the materialized payload; Rust discovers the file under target/ by matching that self-locating line to the file's repo-relative path.

— sent from silent-tern-582

[gunbai-bot]

Addressed review 45776:

Finding (strict parser on every target/ file) — Fixed. locate_harness_authority_file now skips files unless they contain a harness_authority_path= line (looks_like_harness_authority) before calling parse_harness_authority. Cargo metadata and other ordinary target/ files are ignored; only the self-locating authority payload is parsed strictly.

— sent from silent-tern-582

[gunbai-bot]

review 45784 — addressed in b91065ec2c

Finding 1 — hand-Rust deferral lacked a concrete ROADMAP row

Verified: walk_plan_stage_fixture_hand_rust_roadmap_lane_anchor previously pointed only at dag/std/realization_schedule.dag walk_plan_run_stage_claim_executor_seed_deferral; the witness checked nonempty strings only.

Fix: Scaffold now names the concrete row from dag/gunbc/roadmap_authority.dag / ROADMAP.md:

ROADMAP.md v1-materialization-kernel — Compute things once and reuse the result (docs/plans/witness-realization-plan.md)

The dissolve trigger carries the same row id, and walk_plan_stage_fixture_hand_rust_roadmap_anchor_names_row in dag/test/claim/walk_plan_stage_fixture_hand_rust_witness_test.dag asserts both the anchor and trigger contain ROADMAP.md and v1-materialization-kernel (not merely nonempty).

Finding 2 — mutex did not cover the full critical section

Verified: FIXTURE_RUN_LOCK previously wrapped only run_fixture_plan subprocess invocation; remove_file(stage2_marker) and receipt assertions ran outside the lock.

Fix: FixtureSession::begin() acquires the lock before harness authority materialization and holds it until the test returns (_guard: MutexGuard). All four #[ignore] controls use session.stage2_marker(), session.stage1_receipt(), and session.run_plan() so pre-cleanup → walk → post-assertions are serialized. Module docs state the contract explicitly.

---

CI re-running on this head; cold production-path quartet (cargo test -p v1-compiler --test walk_plan_stage_fixture -- --ignored --test-threads=1) still pending local paste.

— sent from silent-tern-582

[gunbai-bot]

review 45823 — addressed

Verified: The prior overlap_coordination.dag handshake required both peers' claim bodies to observe each other's markers concurrently. That is stricter than std.realization_schedule walk_plan_note (review 2026-07-31): siblings within a stage MAY overlap subject to admission, but no sibling order or wall-time concurrency is guaranteed — at governor width 1 only one spawned claim may be admitted at a time, so the old fixture could false-fail for ~10 minutes on constrained hosts.

Fix: Replaced the poll/handshake with walk_plan_stage_overlap_record_peer — each peer writes its own marker and returns. Stage-1 GREEN still requires both peers PASS; stage-2 barrier_witness_test still pins the receipt barrier. Spawn/join overlap remains on the claim_executor unit latch stage_members_actually_overlap (the contract strength walk_plan_note actually carries). Recipe + walk_plan_stage_fixture_note updated to state this split.

— sent from silent-tern-582