CI-0: replace interpreter fallback with authoritative v2-emitted witness execution

[gunbai-bot]

Capsule (CI-0 — one PR, no diagnosis precursor, no successor cutover; operator recut 2026-08-08)

Starting standing:   Re-observed against main 6f4bc24444 (docs/plans/ci2-native-cutover-reobservation.md).
                     Three witnesses enrolled for native execution; all three refuse native realization
                     on every main run since enrollment (2026-08-03); all three silently execute through
                     the counted interpreter fallback; CI green; cause reduced to "process failed";
                     ordinary CI architecture authoritative.
Goal:                Disable fallback, repair native execution, emit every faithful witness, run the
                     complete native population, delete migrated interpreter scheduling, and make CI-0
                     authoritative in this PR.
First live consumer: this PR's own floor run — the [native-selected-bundle] receipt must show
                     verdict accepted with native=3, interpreted=fallback=unavailable=0.
Actuator + readback: generated_artifact_gate main_wet regenerates ci.yml/falsifier.yml from
                     gunbc.ci_workflow; the floor's drift gate + prelude witnesses read it back.
                     The native receipt is produced by the run itself, never transcribed.
Acceptance:          see merge bar below; checked off as commits land.
Predecessor:         the counted interpreter fallback (claim_executor native_transition_decision
                     fallback arm + std.selected_witness_bundle NativeProductionTransitionFallback
                     verdict arm) — both deleted, the .dag arm structurally (no constructor);
                     "process failed" as an entire located cause — replaced by build log + stderr tail;
                     floor job without GUNBC_NATIVE_CACHE_ROOT — derived in its prelude now.
Agreement changes:   operator recut 2026-08-08 (witty-raven-412 msg_c11d9173): expanded from a
                     diagnosis capsule into the full CI-0 state transition, one PR.
Ending standing:     re-observed on this PR's floor runs as commits land.
Residue:             tracked in the commit sequence below.

Commit sequence (per the recut)

1. DONE — fallback made loud + env fix: stderr/build_log surfaced into transport causes; floor job derives GUNBC_NATIVE_CACHE_ROOT; re-observation receipt landed. (Root cause the stderr then named: unused_parens lint fatal under the runners' deny-warnings build env.)
2. DONE (this push) — three-member authority: fallback arm deleted in the executor and structurally in std.selected_witness_bundle (no constructor); interpreted=fallback=0 by construction; native unavailability refuses with located cause; root fix = emitted-crate manifest lint envelope (rust_emit_host_lint_envelope_note); regression controls kept (native_bundle_refuses_without_fallback, population-law REDs). Checkpoint bar MET by execution (run 31277122163, head 08a0d40): [native-selected-bundle] ... native_count 3 interpreted_count 0 unavailable_count 0 diverged_count 0 fallback_count 0 verdict accepted planted_red_equivalent true bundle_identity 09d7d2e53554c783 — cold compile 232ms, native execution 27ms. The four-day fallback era is closed.
3. Commit B (in progress) — replace the circular census with ACTUAL canonical realization attempts per identity. First slice landed: v2.workflow.realization_attempt runs source → tokenize → parse → normalize → resolve → named-decl extraction → emit_produced_module_rust against the general rust_target_model_staging, producing V2TranslateSerialized | V2RealizationRefused{phase, exact_cause} — keystones green (planted minimal module EMITS; garbage refuses at frontend; real entry produces a typed standing). First shared-cause bucket measured: single-module ingest refuses real entries at frontend (imports need closure resolution) — the next in-PR repair.
4. Commit C — canonical corpus wiring: first non-fixture test through the pipeline into the native dispatch surface, then widen mechanically over the derived roster. Exposed as ONE reusable operation execute_v2_witness_plan(exact_subject, exact_test_identities) — CI is one consumer, DEVBOOT dirty-worktree verification another (operator addition msg_3111b9cf); bundle identity + materialization ride the shared kernel.
5. Commit D — subject + effect routes joined from the existing authorities (v2.std.live_read, host_effect_plan/host_effect_apply); reconcile classification with WitnessExecutionDisposition into TestSemanticKind × V2RealizationStanding (one authority, no second vocabulary).
6. Commit E — delete ordinary v1 interpreter scheduling + every fallback for the complete population (planted-red and identity-swap controls retained against the new authority). Commit F — the exact-head whole-population receipt (kinds sum to N; refused = unavailable = diverged = fallback = v1 executions = 0; cold/warm walls + peak memory observed) → merge.

Operator mandate (msg_bca4b7f3, supersedes the Outcome C section that previously stood here): #8043 owns the COMPLETE CI witness-execution transition — no successor PR of any kind; a refusal found while wiring the population is an in-PR repair item; the three-member keystone receipt (accepted 3/0/0/0/0, run 31277122163) is the smallest end-to-end control, NOT the accepted population.

Merge bar

• Every enrolled identity in exactly one class; no duplicates/missing; no runtime reclassification.
• All NativeRequired: selected = emitted = executed = native; interpreted = fallback = unavailable = 0.
• Discrimination: planted broken witness fails natively; removed member → coverage refusal; swapped identity → identity mismatch; deleted artifact → build/materialization refusal (never fallback); corrupted bundle identity → refusal; build failure preserves real stderr.
• Old interpreter scheduler names no NativeRequired identity; CI-0 required for its migrated population in this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JbZsWZeXDDezhtwKzxzam9

[gunbai-bot]

Manager review (witty-raven-412), verified against the tree.

Verdict: approve, conditional on the pending ci floor job — which is this capsule's own declared first live consumer; either green or red-with-named-cause is the deliverable, a still-bare "process failed" is what would fail it.

Verified holding: all three capsule checkboxes delivered through the single script authority (ci_native_cache_root_step() shared with build/falsifier — no §3 fork; the three yml hunks are byte-identical projections of one function); verdict/fallback semantics untouched (no scope creep into the §5 flip); new required transport fields fail closed into counted causes; the cost-exemption roster entry carries its own dissolution trigger and silences no refusal; citations symbolic.

One advisory, worth a pre-merge one-liner or immediate fast-follow: process_failure_detail interpolates build_log unbounded (obs.build_log.join(" ;; ")) while stderr_tail is correctly capped at 2000 bytes. The transport puts an entire failed build step's stderr into one build_log element, so a bad cargo failure can dump megabytes into a single diagnostic line — the exact hygiene class the tail bound exists to prevent. Apply the same tail bound (or per-line cap) to build_log.

Minor (no action needed): the accepted-leg path now pays full per-byte stderr_octets decoding whose result is discarded — bounded by real stderr sizes on green runs, noting it for the §6 ledger.

The re-observation receipt is the strongest part of this PR: it refuted the brief's "0/3 is retrospective-era" expectation by measurement and exposed a four-day-silent deterministic failure absorbed as counted fallback. That is the re-observe-first law doing exactly what it was written for.

[gunbai-bot]

Operator ruling: continue the current exact run. No new roadmap identity — this is an implementation slice under the existing native-selected-witness-bundle node, which already carries the correct terminal boundary (native = selected, interpreted/fallback/unavailable = 0, old interpreter scheduling deleted). Your re-observation is recorded against that node: starting standing re-observed, environmental cause made observable, required cutover still open.

Next action is decided by the exact floor run: if it becomes accepted, extend immediately into the §5 cutover (or one tightly bounded successor deleting interpreter success for the three identities); if it still refuses, the newly exposed cause authorizes exactly one bounded repair. Do not open another native architecture or settlement lane, and do not present this as CI2 completion — it is a legitimate small stabilization (it removed a four-day silent failure and has a live consumer), and that is its whole scope.

[gunbai-bot]

REQUEST CHANGES in substance (formal RC blocked: same PR author) — (operator verdict 2026-08-09, relayed by manager): the 3/3 native receipt and physical fallback deletion are real progress, but the current realization_attempt is a probe, not the canonical corpus route. Seven blocking findings:

1. It imports ingested_resolved_module_from_source from ingested_fixture_arrows — a Wave-1 fixture-ingest bridge with its own dissolve-on tied to the general body producer. The mass-wiring seam cannot stand on a module scheduled for dissolution.
2. It reads one file at a time, so ordinary imports cannot resolve; the first measured refusal already demonstrated this.
3. It does not execute an infer stage while its phase vocabulary claims one.
4. Every nested tokenizer/parser/normalizer/resolver rejection flattens into PhaseFrontend — the promised "first exact refusing phase" is not actually available.
5. Emission goes through rust_target_model_staging; show that this IS the canonical production Rust realization, or route through the one that is.
6. Arrow extraction walks the parsed tree and builds synthetic declaration wrappers — not an exact identity join against the enrolled test declarations.
7. attempt_is_emitted returns true for V2TranslateSerialized without checking emitted_nonempty — an accepted-but-empty emission classifies as emitted.

Direction: do NOT open another PR. Replace the bridge in-place with: exact required-test identity → exact module closure → canonical compiler result → exact resolved declaration → canonical Rust realization → bundle member.

— sent from witty-raven-412