Repair main (layer 3/3): realize REST input_digest as the ContentHash carrier

[gunbai-bot]

The third and final layer of #7480 fallout on main. #7656 fixed layer 1 (the rest.dag import), #7663 fixed layer 2 (the bare-string field in the witness fixture). This fixes layer 3, and with it all nine rest_exchange_replay witnesses pass again.

The defect

#7480 made ContentHash a family coproduct in .dag. v1_interpreter.rs rest_bound_invocation_value kept minting the pre-#7480 branded string:

(ctx.sym("input_digest"), Value::Str(input_digest))

So a RestBoundOperationInvocation built in .dag (a ContentHash variant) could never equal one built by the seed (a Value::Str). Fixture lookup compares those two values, so no fixture ever matched.

This is the model↔realization fork DESIGN's open threads name: a primitive modeled as a coproduct and realized as a native Value, reconciled by per-site bridges, so coverage is accidental. #7480 moved the model; this construction site was one of the bridges it did not move with it.

How it was located

Not by reading the diff — by the failure signature. Every witness requiring a fixture to MATCH failed; every witness requiring NO match passed:

requires	witness	result
match	rest_status_and_body_are_persistable	FAIL
match	rest_success_projects_rest_ok	FAIL
match	rest_operation_without_outcome_still_refuses	FAIL
match	rest_transport_failure_is_persistable	FAIL
match	rest_unreadable_body_is_not_fabricated_empty	FAIL
match ×2	rest_replay_duplicate_exact_fixture_refuses	FAIL
no match	rest_replay_missing_fixture_refuses_without_network_fallback	PASS
no match	rest_replay_sibling_operation_fixture_cannot_satisfy_subject	PASS
n/a	rest_replay_binding_does_not_escape_its_frame	PASS

That partition is the signature of an equality that is always false, not of a broken lookup — a broken lookup would have disturbed the no-match arm too. It pointed straight at the one field #7480 changed.

Receipts

Baseline. At 9abf6243e98 — the commit immediately before #7480 — all nine witnesses PASS, same binary invocation. So this is a genuine regression against something those witnesses were already pinning, not pre-existing red.

After this change, on a release build of claim_batch:

PASS rest_status_and_body_are_persistable
PASS rest_success_projects_rest_ok
PASS rest_operation_without_outcome_still_refuses
PASS rest_transport_failure_is_persistable
PASS rest_unreadable_body_is_not_fabricated_empty
PASS rest_replay_missing_fixture_refuses_without_network_fallback
PASS rest_replay_duplicate_exact_fixture_refuses
PASS rest_replay_sibling_operation_fixture_cannot_satisfy_subject
PASS rest_replay_binding_does_not_escape_its_frame

9/9 — exactly the pre-#7480 baseline, including both no-match controls still refusing. The discriminating pair is load-bearing: a fix that made everything match would have flipped sibling_operation_fixture_cannot_satisfy_subject and missing_fixture_refuses_without_network_fallback to FAIL. They hold.

What this deliberately does not do

An earlier attempt of mine routed rest_bound_invocation_eq through compare_content_hash in dag/extdeps/transports/rest.dag. It did not fix the six, and it flipped sibling_operation_fixture_cannot_satisfy_subject PASS→FAIL. I reverted it rather than leave a speculative edit in another lane's carrier — and it turns out no .dag change is needed at all: once both sides construct the same coproduct, substrate == compares them structurally. Recording it here so the next person does not re-derive the dead end.

The bridge itself is recovered from closed PR #7650, which had this exact shape right; that PR's ci failed on its wider scope, so the correct piece went down with it.

Hand-Rust disposition

~28 lines of seed Rust, carried in-diff as a doc comment on rest_structural_content_hash_value:

• Lane: v1 exit (ROADMAP §11 — zero hand-maintained Rust).
• Row: "Get hand-written Rust in this repository down to zero", authority dag/gunbc/v1_deletion_plan.dag.
• Dissolution trigger: REST service dispatch is evaluated by the emitted transport handler and this host-side RestBoundOperationInvocation construction is deleted.

No census moves: the diff adds zero tracked-Rust paths (v1_interpreter.rs is M, already tracked and already carrying its disposition), and HandAuthoredLOC is a declared-deferred axis per stage0_rust_honest_frontier_projection_note, so there is no line-grain census to shrink. The alternative was leaving .dag and the seed constructing structurally different values for the same modeled thing — a silent always-false equality, which is the §5 fail-open this closes.

🤖 Generated with Claude Code