docs(cascade): promote Pure Bootstrap to Zero — PROPOSAL → LIVE (atomic across 5 authority docs)

ROADMAP.md

@@ -34,7 +34,7 @@ T-TestGen is therefore the gate-enabling lane on two axes: it extends the predic
 3. **Multi-target emission.** Rust production-grade; Python/Go demonstrably working. Lane T-Emit.
 4. **Impossible-bugs demo suite.** Enumerated bug classes with compile-time proofs (see THESIS `Enumerable impossible-bug classes`). Lane T-Demo.
 5. **Arbitrary lens composition.** User-authored lenses. Lane T-LensAPI.
-6. **Self-hosting (Pure Bootstrap).** Hand-authored compiler files at the irreducible-shim floor (≤5 per `docs/design-pure-bootstrap.md`); generated escape hatch acceptable for additional files. Lanes T-PB-A + T-PB-B.
+6. **Self-hosting (Pure Bootstrap).** Hand-authored compiler files at the **0-floor target per `docs/design-pure-bootstrap-zero.md`** (LIVE 2026-04-25; supersedes the prior ≤5-floor framing in `docs/design-pure-bootstrap.md`); generated escape hatch acceptable for additional files. Lanes T-PB-A + T-PB-B.
 
 Enablers (prerequisites for the goals): T-P0 (bug sweep), T-Sub (surface syntax completion).
 
@@ -50,8 +50,8 @@ Each lane owns one concrete `.dag` gate. Lane owners do the comprehensive decomp
 | T-LaneE | XL | Complexity lens v2 parity via substrate-carrier-port | Existing Lane E-T/C/I/P/M program |
 | T-TestGen | L | Testgen runner, service simulation, first-class TestClaim | DB-15 follow-up |
 | T-LensAPI | M-L | User-authored lenses + composition | Lens capability honesty pass |
-| T-PB-A | XL | Compiler self-emits (fixed-point); **non-test** hand-Rust surface reaches the ≤5 irreducible-shim floor (per `docs/design-pure-bootstrap.md`; generated escape hatch OK). Live baseline is the non-test subset of the SG-0 census (`EXPECTED_HAND_AUTHORED_NON_TEST` file-level + `EXPECTED_HAND_AUTHORED_FRAGMENTS` crate-root scaffolds) in `src/v3/compiler/tests/integration/sg0_census_test.rs` — this doc does not freeze the count. **Lens-producer files are the priority slice within this census** (concrete examples: `per_call_descent_evidence` at `src/v3/compiler/src/dag.rs`; the cost / complexity / descent-evidence producer family around the E-family port). Retiring a lens-producer `.rs` dissolves "lens purity by reviewer-convention" into "lens purity by construction" via the closed-world `.dag` kernel — the bounded kernel admits no hidden computation in a lens body, so `.dag`-authored lens producers are pure-total-projections by construction rather than by audit. That purity is what makes lens sustainability structural rather than carried by reviewer memory. Tracked as the `lens_producer_files_remaining` gate below. The **test subset** (`EXPECTED_HAND_AUTHORED_TEST`) of the same census is T-PB-B's responsibility, not T-PB-A's. | Compiler–std consolidation program, SG-0 census |
-| T-PB-B | M | Tests-as-data — pipeline/contract tests port to `.dag`. The two `TESTING.md §Post-R2 shape` residual categories (compiler-internal unit tests for Rust-only helpers; external-toolchain boundary tests invoking rustc/go/python) remain Rust-authored. | DB-15 + T-TestGen |
+| T-PB-A | XL | Compiler self-emits (fixed-point); **non-test** hand-Rust surface reaches **0** (per `docs/design-pure-bootstrap-zero.md` LIVE 2026-04-25; supersedes the prior ≤5-floor + 2-3-principled-floor framings in `docs/design-pure-bootstrap.md` + PR #756, both retracted in the cascade promotion PR). Generated escape hatch OK. Live baseline is the non-test subset of the SG-0 census (`EXPECTED_HAND_AUTHORED_NON_TEST` file-level + `EXPECTED_HAND_AUTHORED_FRAGMENTS` crate-root scaffolds) in `src/v3/compiler/tests/integration/sg0_census_test.rs` — this doc does not freeze the count. **Lens-producer files are the priority slice within this census** (concrete examples: `per_call_descent_evidence` at `src/v3/compiler/src/dag.rs`; the cost / complexity / descent-evidence producer family around the E-family port). Retiring a lens-producer `.rs` dissolves "lens purity by reviewer-convention" into "lens purity by construction" via the closed-world `.dag` kernel — the bounded kernel admits no hidden computation in a lens body, so `.dag`-authored lens producers are pure-total-projections by construction rather than by audit. That purity is what makes lens sustainability structural rather than carried by reviewer memory. Tracked as the `lens_producer_files_remaining` gate below. The **test subset** (`EXPECTED_HAND_AUTHORED_TEST`) of the same census is T-PB-B's responsibility, not T-PB-A's. | Compiler–std consolidation program, SG-0 census |
+| T-PB-B | M | Tests-as-data — pipeline/contract tests port to `.dag`. ~~The two `TESTING.md §Post-R2 shape` residual categories (compiler-internal unit tests for Rust-only helpers; external-toolchain boundary tests invoking rustc/go/python) remain Rust-authored.~~ **Retracted via cascade promotion 2026-04-25**: the residual carve-out dissolves under the 0-floor framing — Rust-only-helper unit tests vanish naturally (no Rust-only helpers under 0-floor); external-toolchain boundary tests migrate to `ExecuteCommand`-based `.dag` `TestClaim` declarations (predicate **schema** landed PR #678; runner foundation in #688/#741 with `true`-no-args allowlist only — **full arbitrary-command runner support deferred to PB-Runtime lane**, blocking the actual boundary-test migration). See `TESTING.md` for live capability state. | DB-15 + T-TestGen + PB-Runtime |
 | T-Demo | M | Two canonical fixtures + impossible-bugs suite + narrative | — (new) |
 
 ### Lane acceptance — `.dag` gates
@@ -64,8 +64,8 @@ This section lists gate names + schema-compilability tags; full `TestClaim` decl
 - **T-LaneE.** `complexity_merge_sort_is_nlogn` [ext: `LensOutputEquals`] · `complexity_merge_sort_v3_matches_v2_oracle` [ext: `DifferentialEquals`] · `lane_e_bundled_witness_host_emit_parity` [ext: `DifferentialEquals`]
 - **T-TestGen.** `testgen_structural_coverage` [ext] · `testgen_mock_backed_integration_safe` [ext: `MockBackedInvariant` — runner `NotYetImplemented` until `TestClaim.requires` carries at least one `ResourceReference`; M1(2.8) fixture list bodies) · `testgen_manual_claim_is_first_class` [ext] — T-TestGen also owns scoping the predicate shape for `[ext]` gates that other lanes consume; currently includes `lens_producer_files_remaining` for T-PB-A (enumeration declared in `sg0_census_test.rs` at scoping time).
 - **T-LensAPI.** `user_authored_lens_compiles` [Day 1] · `lens_composition_associative` [ext: `AlgebraicLaw`] · `lens_output_is_queryable_data` [ext]
-- **T-PB-A.** `pb_hand_rust_at_shim_floor` [ext] · `lens_producer_files_remaining` [ext — priority slice of the non-test census: hand-Rust files implementing lens producers, drops as each migrates to `.dag`; enumeration declared in `sg0_census_test.rs` when T-TestGen scopes the predicate] · `pb_self_compile_fixed_point` [ext] · `pb_compiler_std_ratchet_zero` [ext] — live baselines read from authorities; not frozen in this doc. Hand-Rust (**non-test subset**): SG-0 census (file-level + fragments ratchet) minus the test subset owned by T-PB-B → ≤5 irreducible-shim per `docs/design-pure-bootstrap.md`. Consolidation ratchet: compiler-local types not in positive-def set → 0.
-- **T-PB-B.** `pb_test_file_generated_from_dag` [ext] · `pb_rust_tests_outside_residual_zero` [ext] — the first gates the pipeline-equivalent suite; the second gates the outcome: zero Rust-authored tests exist outside the `TESTING.md §"Post-R2 shape"` residual (compiler-internal unit tests + external-toolchain boundary tests). Single-file generation is insufficient proof of the lane's end-state.
+- **T-PB-A.** `pb_hand_rust_at_shim_floor` [ext] · `lens_producer_files_remaining` [ext — priority slice of the non-test census: hand-Rust files implementing lens producers, drops as each migrates to `.dag`; enumeration declared in `sg0_census_test.rs` when T-TestGen scopes the predicate] · `pb_self_compile_fixed_point` [ext] · `pb_compiler_std_ratchet_zero` [ext] — live baselines read from authorities; not frozen in this doc. Hand-Rust (**non-test subset**): SG-0 census (file-level + fragments ratchet) minus the test subset owned by T-PB-B → **0** per `docs/design-pure-bootstrap-zero.md` (LIVE 2026-04-25 per cascade promotion; supersedes the prior ≤5-floor framing). Consolidation ratchet: compiler-local types not in positive-def set → 0.
+- **T-PB-B.** `pb_test_file_generated_from_dag` [ext] · `pb_rust_tests_outside_residual_zero` [ext] — the first gates the pipeline-equivalent suite; the second gates the outcome: zero Rust-authored tests exist (post cascade promotion 2026-04-25, the `TESTING.md §"Post-R2 shape"` residual carve-out is **retracted**; both prior categories — compiler-internal unit tests + external-toolchain boundary tests — dissolve under 0-floor: helper unit tests vanish naturally, boundary tests migrate to `ExecuteCommand`-based `.dag` `TestClaim` declarations per the cascade promotion PR's TESTING.md rewrite). Single-file generation is insufficient proof of the lane's end-state.
 - **T-Demo.**
   - `fixture_compiler_nerd_canonical` [Day 1 (Compiles) / ext (lens-output demos)] — demonstrates: complexity, ownership, parallelism
   - `fixture_integration_canonical` [Day 1 (Compiles) / ext (lens-output demos)] — demonstrates: effects, idempotency, testgen
@@ -137,7 +137,7 @@ Read bottom-up. Arrows point producer → consumer.
 
 **Two distinct baselines inside T-PB-A.** Both read from live authorities — this doc does not freeze counts.
 
-- **Hand-Rust census (T-PB-A owns the non-test subset):** SG-0 census — `EXPECTED_HAND_AUTHORED_NON_TEST` + `EXPECTED_HAND_AUTHORED_FRAGMENTS` for the T-PB-A subset, and `EXPECTED_HAND_AUTHORED_TEST` for the T-PB-B subset — in `src/v3/compiler/tests/integration/sg0_census_test.rs`. T-PB-A's gate scopes to the **non-test entries** → ≤5 irreducible-shim (per `docs/design-pure-bootstrap.md`). The **test entries** of the same census are T-PB-B's gate: zero Rust-authored tests **outside the TESTING.md §"Post-R2 shape" residual** (compiler-internal unit tests + external-toolchain boundary tests, which stay Rust-authored permanently per TESTING.md as single authority). The census floor is therefore `(≤5 irreducible-shim per design doc) + (TESTING.md residual)`, not the shim floor alone; neither lane dissolves the TESTING.md residual, and each lane is a scoped half of the census, not blocked on the other for work.
+- **Hand-Rust census (T-PB-A owns the non-test subset):** SG-0 census — `EXPECTED_HAND_AUTHORED_NON_TEST` + `EXPECTED_HAND_AUTHORED_FRAGMENTS` for the T-PB-A subset, and `EXPECTED_HAND_AUTHORED_TEST` for the T-PB-B subset — in `src/v3/compiler/tests/integration/sg0_census_test.rs`. T-PB-A's gate scopes to the **non-test entries** → **0** per `docs/design-pure-bootstrap-zero.md` (LIVE 2026-04-25; supersedes the prior ≤5-floor framing in `docs/design-pure-bootstrap.md`). The **test entries** of the same census are T-PB-B's gate: zero Rust-authored tests (post cascade promotion 2026-04-25, the TESTING.md "Post-R2 shape" residual carve-out is **retracted** — both prior categories dissolve under 0-floor: helper unit tests vanish naturally, boundary tests migrate to `ExecuteCommand`-based `.dag` `TestClaim` declarations). The census floor under 0-floor is `0 hand-Rust + 0 TESTING residual`; both lanes dissolve their respective subsets toward 0.
 - **Compiler–std consolidation ratchet:** compiler-local `type` declarations not in the positive-def set and not exempted → 0 (see ROADMAP §"Compiler–`std/` consolidation program"). What's allowed to exist as a compiler-local type name.
 
 Both land inside T-PB-A because dissolving the compiler-local surface forces both gates down together, but the acceptance claims (`pb_hand_rust_at_shim_floor`, `pb_compiler_std_ratchet_zero`) are independent gates tracked against independent authorities.

TESTING.md

@@ -187,26 +187,22 @@ predicate structurally.
 
 At that point the hermetic principle still holds — each
 `TestClaim` declaration is its own unit, the runtime just
-shares the compile work when sources match. Rust integration
-tests collapse to two residual categories:
+shares the compile work when sources match.
 
-- **Compiler-internal unit tests** inside `src/v3/compiler/src/`
-  (`#[cfg(test)] mod tests`) for Rust-only helpers
-- **Boundary tests** that must invoke external processes
-  (rustc, go, python)
-
-Everything else ports to `.dag`.
+> **🔄 RETRACTED 2026-04-25 (cascade promotion of `docs/design-pure-bootstrap-zero.md`).** The previous "two residual categories" framing (compiler-internal unit tests + external-toolchain boundary tests stay Rust-authored permanently) is **retracted under the 0-floor target**. Both categories dissolve:
+>
+> - **Rust-only-helper unit tests vanish naturally** — under 0-floor (per `docs/design-pure-bootstrap-zero.md` LIVE), there are no Rust-only helpers in v3's source tree; everything generates from `.dag`. Unit tests for non-existent helpers don't need to exist.
+> - **External-toolchain boundary tests migrate to `ExecuteCommand`-based `.dag` `TestClaim` declarations** as the cascade-named successor pattern. **Capability state today (2026-04-25):** the `ExecuteCommand` predicate is declared in `src/v3/std/verification.dag:115-119` (PR #678 landed the schema). Runner support is **foundation-only**: the M1.5 testgen harness at `src/v3/compiler/tests/integration/m1_5_testgen_test.rs:292-294` accepts only the tautological allowlist shape (`command == "true" && args.is_empty() && expect_exit == 0`) and panics fail-closed (`m1_5_testgen_test.rs:394-398`) on any other shape ("ExecuteCommand shell shape is not supported here (runner-owned — do not treat as ordinary false)"). The Rust `TestRunner` at `src/v3/compiler/src/test_runner.rs:352-382` returns `ClaimResult::NotYetImplemented(...)` for `ExecuteCommand` (no match arm). **Full runner support — arbitrary `command` + `args` (e.g., `rustc`, `python`, `go`) with exit-code capture — is deferred to the PB-Runtime lane** (Zero-Floor program). A `TestClaim` like *"emit Rust, invoke rustc on output, check exit code"* is structurally expressible as data today; **executing it is blocked** until PB-Runtime lands the runner extension.
+>
+> **0-residual is the target.** Until v3's source tree reaches 0 hand-authored files AND the PB-Runtime runner extension lands, write tests in whichever shape (Rust integration test OR `.dag` `TestClaim` evaluable by the current restricted runner) is cleanest for the work being done. On cascade-promoted PB-Runtime lane execution, residual Rust tests migrate per the `ExecuteCommand` pattern. See `docs/design-pure-bootstrap-zero.md` §"PB-Runtime" for the migration scope and runner-extension dependency.
 
 Until DB-15 R2's runtime lands, write Rust integration tests
 that match the guidelines above so the eventual port is a
 rewrite of shape, not of intent.
 
-**Post-R2 shape:** once DB-15 R2 ships, most of this document
-collapses into "see `dsl/std/verification.dag` for the test
-surface." The Rust-side residual is: compiler-internal unit
-tests (`#[cfg(test)] mod tests`) inside `src/v3/compiler/src/`,
-and boundary tests that invoke external toolchains. Everything
-else ports to `.dag`.
+~~**Post-R2 shape:** once DB-15 R2 ships, most of this document collapses into "see `dsl/std/verification.dag` for the test surface." The Rust-side residual is: compiler-internal unit tests (`#[cfg(test)] mod tests`) inside `src/v3/compiler/src/`, and boundary tests that invoke external toolchains. Everything else ports to `.dag`.~~
+
+**0-floor shape (post cascade promotion 2026-04-25):** once DB-15 R2 ships AND the Zero-Floor program reaches 0 hand-authored files (per `docs/design-pure-bootstrap-zero.md` LIVE) AND the PB-Runtime lane lands the `ExecuteCommand` runner extension (arbitrary `command` + `args` with exit-code capture — see capability-state note above), this document collapses into "see `dsl/std/verification.dag` for the test surface." There is **no Rust-side residual**: compiler-internal unit tests don't exist (no Rust-only helpers); external-toolchain tests use `ExecuteCommand`-based `.dag` `TestClaim` declarations evaluated by the extended runner. Everything is `.dag`.
 
 ## Anti-patterns