PR A: one release-profile v1-compiler build per CI build job (align features, gate after release)

.github/workflows/ci.yml

@@ -98,22 +98,17 @@ jobs:
       - name: cargo fmt --all --check (fast gate; fails in seconds, before the release build)
         run: "\"$CARGO_BIN\" fmt --all --check"
         timeout-minutes: 5
-      - name: cargo check -p v1-compiler-tests --tests (compile gate; no test execution)
-        run: |
-          # 🟡 dissolve-on: ci_v1_compiler_tests_compile_gate_script — foreign-executor (GitHub Actions run:) shell transport for extdeps.cargo_build cargo.Build.Check(extra_args: ci_v1_compiler_tests_compile_gate_extra_args); DISSOLVES WHEN bash-emit (#5828 / ROADMAP 6-shell-slice0 / shell→intent Phase 2) binds the build-job step to orchestration emit over the typed cargo operation — the same de-fork ci_fmt_gate_line and ci_release_build_script await
-          "$CARGO_BIN" 'check' '-p' 'v1-compiler-tests' '--tests'
-        timeout-minutes: 15
       - name: Build release bins (claim_executor + gunbc)
         id: release_build
         run: |
           # 🟡 dissolve-on: ci_release_build_script — concat-built foreign-executor (GitHub Actions run:) release-build runner (ROOT stamp + verify-artifacts + sccache stats wrapping the orch-emitted EAGAIN retry core); membership of --bin / verify paths is derived from gunbc.ci_release_bins, but the runner transport itself remains hand-shell; DISSOLVES WHEN bash-emit (#5828 / ROADMAP 6-shell-slice0 / shell→intent Phase 2) realizes the release-build runner through orchestration emit or typed host_effect_apply without a medium-as-string concat scaffold
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
           set -o pipefail
           BUILD_LOG=$(mktemp)
-          if ! ("$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey) 2>&1 | tee "$BUILD_LOG"; then
+          if ! ("$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter,interp_test_witness,test_hooks --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey) 2>&1 | tee "$BUILD_LOG"; then
             if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache: encountered fatal error|(exit status: 254)|sccache: error: failed to execute compile' "$BUILD_LOG"; then
               echo "::warning::cargo/sccache EAGAIN under fleet pressure; cold retry CARGO_BUILD_JOBS=1 (keep sccache)"
-              CARGO_BUILD_JOBS=1 "$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey
+              CARGO_BUILD_JOBS=1 "$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter,interp_test_witness,test_hooks --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey
             else
               exit 1
             fi
@@ -122,6 +117,13 @@ jobs:
           "$ROOT/target/release/claim_executor" --verify-build-artifacts "$ROOT/target/release/claim_executor" "$ROOT/target/release/gunbc" "$ROOT/target/release/regen_floor_skip_witness" "$ROOT/target/release/floor_skip_discovery_witness" "$ROOT/target/release/selection_control_skip_witness" "$ROOT/target/release/discover_source_root_ingest" "$ROOT/target/release/claim_batch" "$ROOT/target/release/regen_stage0" "$ROOT/target/release/interp_recorded_fixture_witness" "$ROOT/target/release/v1_src_dag_parse" "$ROOT/target/release/auth_declared_but_unwired_witness" "$ROOT/target/release/bootstrap_witness" "$ROOT/target/release/dag_collect_fingerprint_witness" "$ROOT/target/release/diagnostics_witness" "$ROOT/target/release/effects_rest_transport_witness" "$ROOT/target/release/infer_semantics_witness" "$ROOT/target/release/parse_witness" "$ROOT/target/release/resolution_divergence_census" "$ROOT/target/release/cssl_assemble" "$ROOT/target/release/frontier_probe_survey"
           sccache --show-stats 2>/dev/null || true
         timeout-minutes: 45
+      - name: cargo test -p v1-compiler-tests --release --no-run (compile-contract gate; reuses release v1-compiler)
+        run: |
+          set -e
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          # 🟡 dissolve-on: ci_v1_compiler_tests_compile_gate_script — foreign-executor (GitHub Actions run:) shell transport for extdeps.cargo_build cargo.Build.Test(extra_args: ci_v1_compiler_tests_compile_gate_extra_args); DISSOLVES WHEN bash-emit (#5828 / ROADMAP 6-shell-slice0 / shell→intent Phase 2) binds the build-job step to orchestration emit over the typed cargo operation — the same de-fork ci_fmt_gate_line and ci_release_build_script await
+          "$CARGO_BIN" 'test' '-p' 'v1-compiler-tests' '--release' '--no-run'
+        timeout-minutes: 15
       - name: Pack release bins for cross-job handoff (tar keeps exec bits)
         run: |
           # 🟡 dissolve-on: ci_release_bins_pack_script — concat-built foreign-executor (GitHub Actions run:) release-bins tar pack runner; membership of archived bin names is derived from gunbc.ci_release_bins, but the pack transport itself remains hand-shell; DISSOLVES WHEN bash-emit (#5828 / ROADMAP 6-shell-slice0 / shell→intent Phase 2) realizes the pack runner through orchestration emit or typed host_effect_apply without a medium-as-string concat scaffold

.github/workflows/falsifier.yml

@@ -74,10 +74,10 @@ jobs:
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
           set -o pipefail
           BUILD_LOG=$(mktemp)
-          if ! ("$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey) 2>&1 | tee "$BUILD_LOG"; then
+          if ! ("$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter,interp_test_witness,test_hooks --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey) 2>&1 | tee "$BUILD_LOG"; then
             if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache: encountered fatal error|(exit status: 254)|sccache: error: failed to execute compile' "$BUILD_LOG"; then
               echo "::warning::cargo/sccache EAGAIN under fleet pressure; cold retry CARGO_BUILD_JOBS=1 (keep sccache)"
-              CARGO_BUILD_JOBS=1 "$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey
+              CARGO_BUILD_JOBS=1 "$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter,interp_test_witness,test_hooks --bin claim_executor --bin gunbc --bin regen_floor_skip_witness --bin floor_skip_discovery_witness --bin selection_control_skip_witness --bin discover_source_root_ingest --bin claim_batch --bin regen_stage0 --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin resolution_divergence_census --bin cssl_assemble --bin frontier_probe_survey
             else
               exit 1
             fi

dag/gunbc/ci_spec.dag

@@ -50,6 +50,9 @@ import gunbc.merge_admission_produce {
 import v2.workflow.ci_regen_rustfmt_path_emit {
   ci_regen_ensure_rustfmt_path_script,
 }
+import v2.workflow.ci_v1_compiler_tests_compile_gate_emit {
+  ci_v1_compiler_tests_compile_gate_script,
+}
 import v2.workflow.ci_heal_skew_guard_emit {
   ci_heal_binary_source_skew_guard_script,
 }
@@ -227,7 +230,7 @@ data gunbc_ci_compile_clean_clamp_note: String = "COMPILE-CLEAN LEG CLAMP (prelu
 
 data gunbc_ci_compile_clean_clamp: RunnableBatchClamp = RunnableBatchClamp { overhead: second(count: 60), per_unit: millisecond(count: 320) }
 
-data ci_release_features: String = "text_lookup_work_counter"
+data ci_release_features: String = "text_lookup_work_counter,interp_test_witness,test_hooks"
 
 fn ci_release_build_line() -> String {
   concat(
@@ -249,7 +252,7 @@ fn ci_fmt_gate_line() -> String {
   "\"$CARGO_BIN\" fmt --all --check"
 }
 
-data ci_v1_compiler_tests_compile_gate_note: String = "cargo check -p v1-compiler-tests --tests, RE-ENROLLED 2026-07-31 (operator ruling, PR #7490 repair): the nextest RUN half of commit_gate_rust_suite_removed_disposition stays retired (~37 GiB, seed-runtime red), but #7490's typecheck_module signature migration updated stage0 call sites and left four direct integration-test callers stale on main — compile breakage invisible to DagCompileCleanGate (dag-only) and the release build (v1-compiler stage0 only; v1-compiler-tests is a separate workspace crate). This is the fmt-amendment pattern applied to the missing COMPILE half: compile-only, no test execution, ~41s measured cold on the repair host — not RustMonolithGate re-enrollment. Placement: build job immediately after fmt, before the ~33min release build. Operation shape and shell scaffold: v2.workflow.ci_v1_compiler_tests_compile_gate_emit (extdeps.cargo_build cargo.Build.Check)."
+data ci_v1_compiler_tests_compile_gate_note: String = "cargo test -p v1-compiler-tests --release --no-run (compile-contract gate; no test execution), RE-ORDERED 2026-08-05 (operator ruling, PR A / fierce-heron-177): runs AFTER the release build so the gate reuses the release-profile v1-compiler artifact instead of forcing a second dev-profile compile. ci_release_features carries text_lookup_work_counter,interp_test_witness,test_hooks so release bins and the test crate share ONE release-profile v1-compiler artifact (feature-set union). Per-call depth instrumentation is default-off armed (record_call_env_depth is a relaxed-load guard until a test calls arm_call_env_depth_witness_for_test). Affected-set admission (compile_contract_admission_witness + CompileContractAdmissionReceipt) was built per lane brief step 3, measured at 84-133s to skip an 18s compile (resolve_entry_graph_shared for one git diff), and REMOVED 2026-08-06 — the gate runs unconditionally on every build job. Operation shape: v2.workflow.ci_v1_compiler_tests_compile_gate_emit (extdeps.cargo_build cargo.Build.Test)."
 
 fn ci_retry_body_run(command: String) -> Run {
   Run {
@@ -436,6 +439,16 @@ fn ci_regen_floor_skip_shortcut_script() -> String {
   )
 }
 
+fn ci_v1_compiler_tests_compile_gate_run_script() -> String {
+  concat(
+    "set -e\n",
+    concat(
+      concat("ROOT=", ci_repo_root_shell(), "\n"),
+      ci_v1_compiler_tests_compile_gate_script()
+    )
+  )
+}
+
 fn gunbc_ci_regen_floor_only_script(spec: CiSpec) -> String {
   concat(
     concat(ci_regen_ensure_rustfmt_path_script(), "\n"),

dag/gunbc/ci_workflow.dag

@@ -17,6 +17,8 @@ import gunbc.ci_spec {
   gunbc_ci_workflow_wrapper_budget_minutes,
   ci_heal_author_commit_artifact_dir, ci_heal_author_commit_artifact_name,
   gunbc_ci_heal_repo_local_git_config_invoke,
+  ci_fmt_gate_line,
+  ci_v1_compiler_tests_compile_gate_run_script,
 }
 import v2.workflow.ci_heal_revalidation_preflight_emit {
   ci_heal_revalidation_preflight_script,
@@ -40,7 +42,6 @@ import v2.workflow.ci_workflow_run_emit {
   ci_selection_control_script
 }
 import v2.workflow.ci_release_build_emit { ci_release_build_script }
-import v2.workflow.ci_v1_compiler_tests_compile_gate_emit { ci_v1_compiler_tests_compile_gate_script }
 import std.disposition { Disposition, RealizationDispatch, Scaffold, SingleAuthority, Terminal }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.types { Duration }
@@ -298,9 +299,9 @@ fn ci_fmt_gate_step() -> Step {
 
 fn ci_v1_compiler_tests_compile_gate_step() -> Step {
   RunStep {
-    name: Present { value: "cargo check -p v1-compiler-tests --tests (compile gate; no test execution)" },
+    name: Present { value: "cargo test -p v1-compiler-tests --release --no-run (compile-contract gate; reuses release v1-compiler)" },
     id: none,
-    run: ci_v1_compiler_tests_compile_gate_script(),
+    run: ci_v1_compiler_tests_compile_gate_run_script(),
     shell: none,
     env: none,
     working_directory: none,
@@ -485,7 +486,7 @@ data gunbc_ci_aux_step_timeout_minutes: Int = 5
 
 data gunbc_ci_v1_compiler_tests_compile_gate_timeout_minutes: Duration = 15
 
-data gunbc_ci_v1_compiler_tests_compile_gate_timeout_note: String = "v1-compiler-tests compile gate step budget (operator ruling 2026-08-01, PR #7533 receipt): cargo check -p v1-compiler-tests --tests exceeded the 5m aux cap on cold native-cache hosts (run 30692671758 @ 6f20329: srv1-05, step killed at 5m00s while still compiling deps; warm-cache runs complete in ~50s). Raised 10m -> 15m after run 30719671973 @ 6945446401 (srv1-01, cache hit): step killed at 10m00s while Checking v1-compiler-tests — deps consumed the full prior budget. 15m is the cold-host envelope after that receipt — not RustMonolithGate re-enrollment."
+data gunbc_ci_v1_compiler_tests_compile_gate_timeout_note: String = "v1-compiler-tests compile-contract gate step budget (operator ruling 2026-08-05, PR A / fierce-heron-177): reordered after the release build and switched to cargo test --release --no-run so v1-compiler compiles once per job. Warm runs should complete in seconds once the release artifact is warm; 15m retains the prior cold-host envelope without raising the cap."
 
 data gunbc_ci_artifact_transfer_step_timeout_minutes: Int = 10
 
@@ -671,7 +672,7 @@ fn ci_build_job() -> Job {
     id: "build",
     name: none,
     runner: gunbc_ci_selected_runner_spec(),
-    steps: concat(ci_heal_revalidation_prelude_steps(), [ci_fmt_gate_step(), ci_v1_compiler_tests_compile_gate_step(), ci_release_build_step(), ci_release_bins_pack_step(), ci_release_bins_upload_step()]),
+    steps: concat(ci_heal_revalidation_prelude_steps(), [ci_fmt_gate_step(), ci_release_build_step(), ci_v1_compiler_tests_compile_gate_step(), ci_release_bins_pack_step(), ci_release_bins_upload_step()]),
     needs: [],
     env: none,
     outputs: none,

dag/gunbc/v1_compiler_tests_typecheck_module_callers_scaffold.dag

@@ -13,7 +13,7 @@ data v1_compiler_tests_typecheck_module_callers_hand_rust_scaffold: Disposition
   }
 }
 
-data v1_compiler_tests_typecheck_module_callers_hand_rust_dissolve_trigger: String = "🟡 dissolve-on: the four src/v1/tests/src/* integration-test typecheck_module call sites wired for #7490's global_variant_base seventh argument — counted interim HAND-Rust growth, NOT a census shrink (review 45400). The checkable receipt is NOT a marker grep in the test files: cargo check -p v1-compiler-tests --tests enrolled on the build job (v2.workflow.ci_v1_compiler_tests_compile_gate_emit / dag/test/claim/ci_v1_compiler_tests_compile_gate_witness_test.dag) proves every direct caller compiles after each signature migration. DISSOLVES WHEN the v1-compiler-tests crate crosses the emitted-crate partition / v1-zero-hand-maintained-rust frontier and these seed integration tests delete with the crate — authority dag/gunbc/v1_deletion_plan.dag, ROADMAP v1-zero-hand-maintained-rust."
+data v1_compiler_tests_typecheck_module_callers_hand_rust_dissolve_trigger: String = "🟡 dissolve-on: the four src/v1/tests/src/* integration-test typecheck_module call sites wired for #7490's global_variant_base seventh argument — counted interim HAND-Rust growth, NOT a census shrink (review 45400). The checkable receipt is NOT a marker grep in the test files: cargo test -p v1-compiler-tests --release --no-run enrolled on the build job after the release build (v2.workflow.ci_v1_compiler_tests_compile_gate_emit / dag/test/claim/ci_v1_compiler_tests_compile_gate_witness_test.dag) proves every direct caller compiles after each signature migration. DISSOLVES WHEN the v1-compiler-tests crate crosses the emitted-crate partition / v1-zero-hand-maintained-rust frontier and these seed integration tests delete with the crate — authority dag/gunbc/v1_deletion_plan.dag, ROADMAP v1-zero-hand-maintained-rust."
 
 data v1_compiler_tests_typecheck_module_callers_hand_rust_loc_delta_net: Int = 4