Retire path location as sufficient admission for new witnesses; freeze and count the legacy path-only debt

[briansrls]

Scope, stated at what it achieves: retire path location as sufficient admission for a NEW witness, and freeze and count the legacy path-only debt. long/ remains an organizational home until that population reaches zero.

The defect

A directory was deciding an admission question, and the answer was always yes.

A witness leaves per-PR discovery for one of two reasons: an exact admission naming the cadence that executes it, or a broad path policy row. The admission side was already correct — explicit_witness_admission_cadence_executes refuses OfflineLocalRecipe on an admission row precisely so an admission cannot satisfy the has-a-consumer wall while executing nowhere. The path side had no such wall: witness_admission_refusal_for_row refused only NoConsumer, so a row an offline directory claimed was admitted unconditionally.

The live transformation that permitted:

a required per-PR witness goes over the 5s fast-lane budget → its file is moved under test/claim/long/ → it leaves per-PR discovery → no cadence row is added → nothing executes it → and admission holds.

Green CI, zero executed coverage, source file left behind. That is not deferral; it is deletion of the evidence with the file retained.

Specimen, verified by execution

gunbc#7762 commit 0cfd199f8 — "Move frontier probe closure matrix to long lane to fix CI fast-lane budget failures" — renamed src/v2/test/claim/workflow/frontier_probe_closure_matrix_test.dag to src/v2/test/claim/long/frontier_probe_closure_matrix_test.dag. Thirteen test fns crossed in that rename. What the commit added beside them was a data row holding a claim_batch command line — prose naming a recipe, not a consumer that runs — and the file appeared in no cadence roster. A later commit on the same branch split eight of the thirteen back onto the per-PR path, which is the right repair and also the proof that nothing mechanical forced it: the split happened because a reviewer looked, and the admission wall said yes either way.

The backstop that was not one

long_lane_exclusion_note and the Form-C blessing in roster_registry both justified the long/ home on the ground that the 5s eval deadline makes an over-budget fast-lane witness unwritable-in-place. That is false and both are retracted here. The deadline is evaluated only while a witness runs, and relocation is exactly the act that stops it running — the backstop is disarmed by the move it was supposed to govern. BudgetExceeded stays what it is: an interruption plus a measured lower bound on cost, never a semantic verdict, and never discharged by causing a relocation.

Scope: the hole is the fallback, not the directory

The brief named long/; the measurement says the defect is the OfflineLocalRecipe path-policy fallback wherever it applies. test/claim/execution/ and test/manual/ carry the identical arm.

population	identities	entries
admitted by path policy alone, no executing consumer	701	152
…of which under test/claim/long/	279	63
…other offline paths (execution/, manual/, enforcement/, file-grain rows)	422	89

(The first measurement was 732/155. It came down when the third consumer source below was honored — 31 of those identities already run.)

Freezing only long/ would have relocated the hatch rather than closed it — 60% of the population is outside it.

Two axes, because tolerated is not covered

The first shape of this wall returned one success arm for both — the same arm a real cadence returns — for a frozen legacy row, and then read the green live gate as evidence that every current row is admitted. A frozen row has no executing consumer; that is the entire content of its debt. Freezing establishes that the unexecuted hole existed at the cut and cannot grow. It does not establish coverage. Returning success made the same fact answer differently depending on which door it entered: exact function-grain admission correctly refuses OfflineLocalRecipe because a local recipe is not an executing cadence, while path policy was returning success for exactly that. (Operator ruling, blocking.)

WitnessExecutionStanding = WitnessHasExecutingConsumer{cadence}   -- covered
                         | LegacyFrozenPathDeferral               -- tolerated, NOT covered
                         | UnclassifiedPathDeferral               -- refused (the forward hole)
                         | UnexecutedDeferredWitness              -- refused (nothing claims it)

FrozenBaselineStanding   = Allowed | Shrank | Grew | Stale        -- a property of the ROSTER

The coverage gate admits only the first arm, so the dark population never reads as covered and anything downstream asking is this behavior exercised receives no. The floor gate additionally tolerates LegacyFrozenPathDeferral while the baseline axis holds — so the tree stays green through the migration without anything claiming those rows execute. The deferred-discovery receipt now prints the frozen population explicitly as unexecuted debt.

The seed realization is accounted for

505 production lines and 364 test lines entered cli_run.rs (against 30 removed; the first pair authored here, 487/371, was measured before the handbacks were amended in and is corrected in the carrier with its drift recorded rather than overwritten), the largest hand-maintained Rust wall in the program, already growing against its own hollowing plan. A modeled policy does not exempt its realization. gunbc.cli_run_witness_deferral_freeze_scaffold carries the typed Scaffold disposition, the measured landing delta, and an ordered dissolution: seed scan → emitted/native projection (the parse helpers go) → the classification path (the rest goes); or the frozen population reaching zero, which deletes all of it with the freeze itself.

What landed

1. std.witness_admission gains UnclassifiedPathDeferral — a refusal arm, sibling to UnexecutedDeferredWitness. They stay separate because the remedies differ: one matches no policy at all, the other was claimed by a directory. One arm would have hidden 732 identities behind a nearly-empty class.
2. gunbc.witness_deferral_freeze — the frozen legacy population at (entry, function) grain. Enumerated, never a predicate: a new file under long/ does not join it and refuses on its first PR.
3. Forward join — an offline-classified witness outside the freeze and outside gunbc.explicit_witness_admission refuses.
4. Backward join — a frozen row naming a witness the tree no longer carries (file gone, decl gone, or path no longer offline-classified) refuses as StaleFrozenPathDeferral, so a row cannot outlive its witness and be inherited by the next name.
5. Third consumer source honored — commit_gate_roster's CommitWitnessClaim rows project into explicit entries, and explicit rows merge after discovery with no exclusion filter, so an enrolled witness under an offline path executes even though the path excludes it. The first revision of this wall read only two authorities and would have refused 31 identities that already run — fail-closed, and still a wrong answer. Only surfaces that execute admit (GitPrePushHook has been fmt-only since 2026-07-25). Found by a manager's correction to a prediction in this body, not by a test.
6. Monotonicity gate — the roster may only shrink: gaining identities against the diff baseline refuses (FrozenPathDeferralGrew). Without this the ratchet is diligence, not construction — an author could append a row in the same PR that adds the witness. An unresolvable baseline refuses rather than passing unchecked; the single non-refusing arm is the roster being absent at base, which is this change and is unreachable once the roster is on main.

test/claim/long/ still organizes the files. It no longer answers the admission question.

A frozen row asserts membership, not a verdict

It carries no cause, purpose, cost or consumer — deliberately, because none exists. At least three dispositions live in the frozen population and they owe different things: a permanent regression witness owes a scheduled consumer (an offline recipe establishes that this head was tested once, never that a later regression will be observed); a terminating one-shot survey owes no cadence at all — it has no later, and demanding one would enroll a job whose whole purpose is to be deleted; a witness with no discriminating red owes deletion rather than either. The mechanism cannot yet tell them apart, so it labels none of them, and the live terminating specimen already in the roster is named in the carrier. Typing that arm is stricter than typing a cadence, not looser: a one-shot owes a pinned subject, a mechanically checkable dissolution and a deadline after which an undissolved one-shot refuses — without the deadline every permanent witness simply claims to be a one-shot.

Green by execution

17 .dag witnesses, fixture-shaped and cheap — mechanism on fixtures, per the decomposition rule this PR's own wall enforces (a census may be irreducible; a mechanism never is). Every positive claim holds the row, the pattern and the exclusion verdict fixed and moves only freeze membership — the fact the wall added:

PASS witness_deferral_freeze_unfrozen_offline_row_refuses
PASS witness_deferral_freeze_frozen_row_is_not_covered
PASS witness_deferral_freeze_frozen_row_is_tolerated_by_the_floor
PASS witness_deferral_freeze_grown_baseline_withdraws_the_toleration
PASS witness_deferral_freeze_empty_roster_refuses_the_same_row
PASS witness_deferral_freeze_fixture_path_is_unaffected
PASS witness_deferral_freeze_unclaimed_path_stays_unexecuted_deferred
PASS witness_deferral_freeze_included_row_is_never_refused
PASS witness_deferral_freeze_join_is_by_identity_not_by_entry
PASS witness_deferral_freeze_live_rows_join_the_discovered_population
PASS witness_deferral_freeze_departed_row_fails_the_join
PASS witness_deferral_freeze_empty_function_list_is_malformed
PASS witness_deferral_freeze_live_roster_is_well_formed
PASS witness_deferral_freeze_commit_roster_enrollment_admits
PASS witness_deferral_freeze_commit_roster_row_is_not_frozen
PASS witness_deferral_freeze_rust_realization_is_declared_scaffold
PASS witness_deferral_freeze_rust_realization_names_a_dissolution

9 Rust controls, including appending_a_row_to_the_live_roster_source_refuses — the discriminating case over the real roster, not a hand-made pair.

Live gates, against the real tree: witness_admission_deferred_rows_refuse_none_and_frozen_debt_is_counted_uncovered — deliberately not named "every deferred row has a consumer", which is what the first version asserted and was false; what holds is that no row refuses and the tolerated population is counted as uncovered and frozen_path_deferral_roster_carries_no_stale_rows (every frozen identity still exists and is still offline-classified).

Executed refusal receipt — one freeze row planted in the working tree, live git baseline gate run:

thread 'frozen_roster_monotonicity_reads_a_real_baseline' panicked:
the roster cannot have grown against itself:
["src/v2/test/claim/long/relocated_matrix_test.dag::relocated_matrix_holds"]

Row reverted; gate green again.

Adjacent suites unaffected: witness_admission_test 15/15, exact_witness_admission_witness_test 9/9, witness_exclusion_reconciliation_test 8/8, roster_registry_test 5/5, generated_artifact_drift_test 7/7.

What this does NOT claim

• Modified-in-place is not covered. Identity grain refuses a new function under an offline path; it cannot see a frozen function whose body grew a corpus scan, because the identity did not change. Next trigger: the cost half — a per-witness declared cost envelope the measured eval is checked against. A per-file content pin was rejected as a stand-in: a hash an author must hand-bump on every unrelated touch is a change detector, and change detectors train the blind bump.
• No purpose taxonomy yet. A frozen row records identity only. That these 732 identities were admitted with no declared purpose, cost or consumer is the debt — the taxonomy is the next slice.
• frozen_path_deferral_identity_count is a receipt, never an oracle. The roster was authored from the current tree, so a count equality would compare a measurement to a copy of itself and go green on any pair of compensating edits. Completeness here is the identity join, in both directions. The in-carrier note says so, load-bearing.
• One adjacent case named, not closed: a falsifier_self_host_wet row reaches WitnessAdmissionHolds through the explicit arm while its cadence is inactive. Same shape one layer in, but it is a counted roster with a named owner and a dated trigger rather than a directory admitting silently.

Dissolution

The freeze reaching empty deletes the path-policy pass-through arm, the test/claim/long/ dir row and this roster together — at which point OfflineLocalRecipe stops being an admission answer at all.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.