Witness purpose taxonomy, derived envelope compare, and placement projection

[briansrls]

Summary

• Adds std.witness_purpose — six declared purpose arms (behavioral discriminator, boundary crossing, population totality, external fidelity, resource contract, terminating one-shot). Purpose is authored; cost and placement are not duplicated here.
• Adds std.witness_placement — derived route projection (OrdinaryPerPr, PerPrWet, Scheduled, OneShot, RefusedNoConsumer) from purpose plus existing ScheduledWitnessEnvelope fields, not path substrings.
• Extends std.realization_schedule with SpanUnavailable, ObservedWallAtSubject, and compare_witness_span_to_observed — the declared-vs-observed comparator joining SpanEnrolled.envelope.wall_budget to measured wall (missing measurement, missing basis, censored lower bound, missing span, route mismatch, clock mismatch). No second envelope carrier — uses ScheduledWitnessEnvelope + WitnessCostBasis on SpanEnrolled.
• Updates SpanUnavailable through merge admission hashing and commit_workflow span well-formedness.

Follow-on (not this PR): individual migration of >=500ms roster rows to SpanEnrolled; bulk long/ rehome explicitly out of scope.

Test plan

• cargo run --bin claim_batch -- --source-root dag --entry dag/test/claim/witness_purpose_placement_witness_test.dag --functions <all 15 tests> — 15/15 PASS
• cargo run --bin claim_batch -- --source-root dag --entry dag/test/claim/commit_workflow_witness_test.dag --functions witness_span_undeclared_is_wellformed,witness_roster_spans_wellformed
• CI floor (draft → ready triggers gates)

[gunbai-bot]

Addressed review 49232 (composer-2.5 REQUEST_CHANGES) in ce4620e:

Millisecond budgets (BLOCKING ×4) — fast_lane_budget is now std.measure.Millisecond on derive_witness_route, derive_witness_route_from_envelope, derive_route_from_span, and envelope_exceeds_fast_lane. Tests pass millisecond(count: 5000).

Cadence string tag predicates (BLOCKING) — Removed cadence_is_per_pr / cadence_executes_on_floor. Added closed WitnessEnvelopeCadenceWire with interpret_envelope_cadence_wire: roster wires (per_pr, 4h, falsifier_substrate_long_lane, offline_local_recipe, no_consumer) map to constructors; anything else is EnvelopeCadenceUnrecognized → RefusedNoConsumer { UnrecognizedEnvelopeCadence }. Note: ScheduledWitnessEnvelope.cadence remains String on the enrollment carrier until that authority migrates; the interpreter is the placement-side projection with an explicit dissolve-on in witness_envelope_cadence_wire_note.

Bool predicates on WitnessPurpose (BLOCKING ×2) — Deleted witness_purpose_requires_scheduled_cadence and witness_purpose_is_one_shot. derive_witness_route_from_envelope matches WitnessPurpose and WitnessEnvelopeCadenceWire directly.

Bool predicates on WitnessRoute (BLOCKING ×2) — Deleted witness_route_is_per_pr and witness_route_has_executing_consumer. Witness tests match WitnessRoute variants directly.

All 15 witness_purpose_placement_witness_test claims PASS locally after these changes.

— sent from swift-wren-710

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed review 49242 (composer-2.5 REQUEST_CHANGES) in a2c1e18:

SpanUnavailable vs EnvelopeUndeclared (BLOCKING) — derive_route_from_span no longer uses a catch-all _ arm mapping every non-SpanEnrolled span to EnvelopeUndeclared. It now mirrors the compare path:

• SpanUnavailable { cause } → RefusedNoConsumer { cause: SpanUnavailableAtPlacement { cause } } (new WitnessPlacementRefusal arm)
• SpanUndeclared / SpanSeams → EnvelopeUndeclared (no enrollment yet)

Witness: derive_route_from_span_span_unavailable (16/16 placement witnesses PASS locally via claim_batch).

— sent from swift-wren-710

[gunbai-bot]

Addressed review 49253 (composer-2.5 REQUEST_CHANGES) in b6b8f8a:

ResourceContract bound typing (BLOCKING) — Replaced resource + Millisecond with axis-typed WitnessResourceBound: EvalWallTimeBound / EvalThreadCpuBound carry Millisecond, PeakMemoryBound carries ByteSize. Illegal PeakMemory+millisecond states are now unwritable; note cites discrete_cost_derivation §10 alignment.

PerPrWet routing control (BLOCKING) — Added external_fidelity_routes_per_pr_wet_not_ordinary: same in-budget per_pr envelope yields PerPrWet for ExternalFidelity and OrdinaryPerPr for BehavioralDiscriminator. 17/17 placement witnesses PASS locally.

— sent from swift-wren-710

[gunbai-bot]

Addressed review 49438 (composer-2.5 REQUEST_CHANGES) in b19e67cf9d:

Scheduled cadence bypassing TerminatingOneShot — EnvelopeCadenceFalsifierCadenceJob and EnvelopeCadenceFalsifierSubstrateLongLane now match purpose before routing. TerminatingOneShot on "4h" or "falsifier_substrate_long_lane" refuses with OneShotPurposeOnScheduledCadence { cadence } (symmetric to PopulationTotality → PurposeRequiresScheduledCadenceUndeclared on per_pr). Other purposes still route to Scheduled on those wires.

Witness: terminating_one_shot_on_scheduled_cadence_refuses (both cadence wires discriminated). Existing terminating_one_shot_routes_one_shot / scheduled_envelope_routes_to_declared_cadence green.

— sent from swift-wren-710

[gunbai-bot]

Returned to draft per operator ruling (still-bat-561). Lane B modeling stays on the branch but will not merge as one PR.

Recut plan

• (a) Prerequisite: schedule-retention RED control + Witness/Holds interpreter hoist fix only, with SeedGrowthJustification rows for each hand-Rust item
• (b) Purpose + declared-vs-observed comparator (no second string cadence authority)
• (c) ScheduledWitnessEnvelope { consumer: WitnessConsumerCadence, max_staleness: Duration } — 4h is a period, not a consumer identity

Round-trip law (RED today): witness_consumer_cadence_wire_round_trip_witness_test.dag — encode renders all nine WitnessConsumerCadence arms; decode still knows five enrollment wires.

Kept: multi-axis placement, population-totality per-PR when cheap, OneShotUnavailable, missing vs censored distinction.

— sent from swift-wren-710

[gunbai-bot]

Review 49597 — already addressed in 2e10754ad0 (pushed after this review’s base).

witness_consumer_cadence_executes was deleted from std.witness_admission — no Bool projection over WitnessConsumerCadence remains there. Placement continues to match cadence variants into typed WitnessRoute / WitnessPlacementRefusal; explicit admission keeps its own explicit_witness_admission_cadence_executes for admission-row eligibility only.

Replacement on the branch is the round-trip law (witness_consumer_cadence_wire_round_trip_holds + encoder), which is intentionally RED until envelope consumer: WitnessConsumerCadence lands (operator recut (c)).

PR remains draft per operator return-to-draft; not pursuing merge on this monolith.

— sent from swift-wren-710

[gunbai-bot]

Superseded — operator ruling 2026-08-07. This 30-commit monolith is closed; its useful content is extracted into successor slices. Do not rebase or rehabilitate this branch.

Successor map

Slice	PR	Branch	Status
C-a — stable WitnessPurpose taxonomy	#7965	slice/c-a-witness-purpose	Open; 2 approvals; CI pending
C-b — typed ScheduledWitnessEnvelope	#7969	session/calm-raven-203	Open; lands after #7906
C-c — derived placement + declared-vs-observed comparator	(not yet opened)	—	See residue below
C-d — complexity-citation census pilot	(not yet opened)	—	After C-c + #7932
Hand-Rust — schedule-retention investigation	(separate seed PR)	—	Must NOT ride C-b/C-c

Content verification (#7893 → successors)

Carried by #7965 (C-a) ✓

• dag/std/witness_purpose.dag — five stable arms + axis-typed WitnessResourceBound + honest TerminatingOneShotFrontier deferral
• dag/test/claim/witness_purpose_taxonomy_witness_test.dag — 8 focused witnesses
• Correction applied vs this draft: TerminatingOneShot is NOT a writable sixth arm with a string deadline; TerminatingOneShotFrontier records honest unavailability until typed deadline/completion substrates land

Carried by #7969 (C-b) ✓

• ScheduledWitnessEnvelope.path_classification: WitnessConsumerCadence (not cadence: String)
• ScheduledWitnessEnvelope.max_staleness: Millisecond (same measure as wall_budget)
• String-emptiness validation deleted (construction-over-validation)
• witness_consumer_cadence_eq / structural content-hash helpers
• commit_workflow.dag roster envelope migration + std_witness_admission.rs emission
• Correction applied vs this draft: field named path_classification, not consumer — WitnessConsumerCadence answers path-policy classification, not execution standing

NOT carried by either successor (intentional)

→ C-c (placement/derivation):

• dag/std/witness_placement.dag (~272 lines) — WitnessRoute projection, derive_route_from_span, multi-axis derivation
• dag/std/realization_schedule.dag compare substrate — SpanUnavailable, ObservedWallAtSubject, WitnessEnvelopeCompareVerdict, compare_witness_span_to_observed
• dag/test/claim/witness_purpose_placement_witness_test.dag — 19 placement/compare witnesses (need rework: this draft still echoes declared cadence as derived placement in places; operator ruled that validation, not derivation)

→ C-d (pilot, after C-c + cost lane):

• First live consumer: v1-complexity exact citation-resolution census (PopulationTotality → FalsifierSubstrateLongLane, no path substring)

→ Separate seed PR (must NOT return through C-b/C-c):

• src/v1/stage0/src/cli_run.rs — complexity_projection_holds_after_schedule_retention_warm (+55 lines)
• src/v1/stage0/src/v1_interpreter.rs — Witness/Holds Value::Record exclusion (+5 lines)
• Mutation test on merged main (Fix selection-applied floor corrupting Witness refinement carriers #7916): guard unnecessary; seed hunks should be dropped, not retained. If a defensive PR is opened it needs explicit SeedGrowthJustification rows.

→ Superseded / deleted by C-b approach (do not resurrect):

• dag/std/witness_admission.dag wire-decoder table (decode_scheduled_envelope_cadence_wire, five-wire closed decoder, compare_declared_derived_enrollment_cadence_wires) — interim string bridge; C-b types the field directly
• dag/test/claim/witness_consumer_cadence_wire_round_trip_witness_test.dag — RED round-trip law over string wires; obsolete once envelope is typed

→ Independent housekeeping (one line, either successor or standalone):

• docs/plans/ci-two-tier-placement-redesign.md — lens_contract_complexity → lens_contract_complexity_derived_kernel

---

C-c residue (cold-start spec)

Prerequisite: C-b (#7969) merged; #7906 (consumer / execution-budget / expected-verdict axis split) merged.

Goal: Derive desired witness placement from what a witness proves and what it costs; observe actual enrollment separately; compare the two. The envelope represents actual enrollment, never desired placement.

Types to land (std.witness_placement + std.realization_schedule)

1. DesiredWitnessPlacement — derived from:

   • declared WitnessPurpose
   • derived semantic work (CostExpr evaluation when available; observed physical cost as fallback)
   • effect / fidelity requirement
   • maximum tolerated staleness
   • consumer capabilities
   • NOT from path substrings (test/claim/long/) or from reading path_classification back as the answer

2. ActualWitnessEnrollment — observed from SpanEnrolled / ScheduledWitnessEnvelope + execution-standing facts (separate from classification)

3. Four distinct typed facts (currently conflated in fixtures):

   • ExecutorCutoff — 5000ms hard kill
   • MandatoryMigrationThreshold — 500ms (migration territory; a 700ms witness is migration work even if it survives the 5000ms kill)
   • DeclaredWitnessEnvelope
   • ObservedWitnessCost

4. WitnessRoute projection — OrdinaryPerPr | PerPrWet | Scheduled{cadence} | OneShotUnavailable | RefusedNoConsumer

5. Declared-vs-observed comparator on std.realization_schedule:

   • ObservedWallAtSubject (Present | Missing | Censored)
   • WitnessEnvelopeCompareVerdict (Within/Exceeds/MissingMeasurement/CensoredLowerBound/RouteMismatch/ClockMismatch/SpanUnavailable/…)
   • compare_witness_span_to_observed joining envelope.wall_budget to measured wall

Placement rules (operator-signed)

• Purpose alone does NOT determine route (PopulationTotality over a 7-row roster may stay per-PR; expensive BehavioralDiscriminator may need schedule)
• ResourceContract placement MUST inspect the named resource axis — PeakMemoryBound is not satisfied by low wall time; refuse or require a consumer that observes the named axis
• TerminatingOneShot stays OneShotUnavailable{DeadlineNotTyped | CompletionNotObserved} until typed deadline + completion receipt substrates land
• Witness evaluation cost and entry resolution are separate denominators (shared setup = materialization, not witness decomposition)

Witnesses to port/rework

Port the 19 tests from witness_purpose_placement_witness_test.dag on this branch, reworked so placement derives from axes rather than echoing declared cadence. Key discriminating cases:

• external_fidelity + in-budget per_pr → PerPrWet while behavioral_discriminator under same envelope → OrdinaryPerPr
• over-fast-lane without cadence → RefusedNoConsumer
• censored measurement is lower bound, not Within/Exceeds verdict
• 500ms migration vs 5000ms executor cutoff kept distinct

Dissolve triggers

• Individual migration of ≥500ms roster rows to SpanEnrolled (not bulk long/ rehome)
• Floor admission consumes placement projection → long_lane_exclusion_note deletes
• C-d pilot proves one expensive witness earns placement from purpose + cost evidence

Explicit non-goals for C-c

• No CostExpr-derived envelope population (Lane A / Lane A C1: evaluate CostExpr at concrete SizeVariable bindings, with the CostSum binder lexically scoped #7932 successor)
• No hand-Rust seed growth
• No wire-decoder resurrection

[gunbai-bot]

Hand-Rust disposition ruling (operator, 2026-08-07)

The two seed items from the supersession table are dropped, not extracted to a seed PR:

Item	Lines	Ruling
cli_run.rs complexity_projection_holds_after_schedule_retention_warm	+55	DROP
v1_interpreter.rs Witness/Holds Value::Record exclusion	+5	DROP

Evidence check (both clean):

1. cli_run.rs test — Investigation-only reproduction of the schedule-retention warm path. The live executing control is map_id_complexity_projection_holds (src/v2/lens/complexity/map_id_test.dag), enrolled in discovery and green on main. No discriminating RED held only by this seed test.

2. v1_interpreter.rs guard — Workaround for Witness/Holds raw-unwrap double-wrapping ComplexityVariables under schedule-retention reload. Root cause fixed on main by Fix selection-applied floor corrupting Witness refinement carriers #7916 (Witness refinement carrier corruption at inference). Mutation on merged main: guard removed, map_id_complexity_projection_holds still passes. No live obligation.

Why not a seed PR: Unnecessary after #7916; opening one adds hand-maintained Rust against a shrinking seed target. Recoverable from this branch's history (origin/session/swift-wren-710) if #7916's premise is ever refuted — a closed branch is a receipt, not a deletion.

Disposition table is now total.