CI-0: replace interpreter fallback with authoritative v2-emitted witness execution

.github/workflows/ci.yml

@@ -186,6 +186,14 @@ jobs:
           components: rustfmt
           cache: false
           rustflags: ''
+      - name: Derive native-cache root (rustc-version segment; after setup-rust-toolchain)
+        run: |
+          # 🟡 dissolve-on: ci_native_cache_root_script — orch-emitted foreign-executor prelude step deriving GUNBC_NATIVE_CACHE_ROOT from rustc -V after setup-rust-toolchain; leaf rustc/tr/mkdir/echo strings remain until typed toolchain probe lands on host_effect_apply (#5828 / shell→intent Phase 2)
+          if ! GUNBC_TOOLCHAIN_SEG_RAW=$(rustc -V 2>/dev/null); then echo "::error::rustc -V failed after setup-rust-toolchain: cannot derive native-cache toolchain segment"; exit 1; fi
+          GUNBC_TOOLCHAIN_SEG=$(echo "$GUNBC_TOOLCHAIN_SEG_RAW" | tr ' ' '-')
+          if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then echo "::error::rustc -V produced an empty native-cache toolchain segment after setup-rust-toolchain"; exit 1; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
       - name: Download release-bins artifact
         uses: actions/download-artifact@v4
         with:
@@ -276,6 +284,14 @@ jobs:
           components: rustfmt
           cache: false
           rustflags: ''
+      - name: Derive native-cache root (rustc-version segment; after setup-rust-toolchain)
+        run: |
+          # 🟡 dissolve-on: ci_native_cache_root_script — orch-emitted foreign-executor prelude step deriving GUNBC_NATIVE_CACHE_ROOT from rustc -V after setup-rust-toolchain; leaf rustc/tr/mkdir/echo strings remain until typed toolchain probe lands on host_effect_apply (#5828 / shell→intent Phase 2)
+          if ! GUNBC_TOOLCHAIN_SEG_RAW=$(rustc -V 2>/dev/null); then echo "::error::rustc -V failed after setup-rust-toolchain: cannot derive native-cache toolchain segment"; exit 1; fi
+          GUNBC_TOOLCHAIN_SEG=$(echo "$GUNBC_TOOLCHAIN_SEG_RAW" | tr ' ' '-')
+          if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then echo "::error::rustc -V produced an empty native-cache toolchain segment after setup-rust-toolchain"; exit 1; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
       - name: Download release-bins artifact
         uses: actions/download-artifact@v4
         with:

.github/workflows/falsifier.yml

@@ -133,6 +133,14 @@ jobs:
           components: rustfmt
           cache: false
           rustflags: ''
+      - name: Derive native-cache root (rustc-version segment; after setup-rust-toolchain)
+        run: |
+          # 🟡 dissolve-on: ci_native_cache_root_script — orch-emitted foreign-executor prelude step deriving GUNBC_NATIVE_CACHE_ROOT from rustc -V after setup-rust-toolchain; leaf rustc/tr/mkdir/echo strings remain until typed toolchain probe lands on host_effect_apply (#5828 / shell→intent Phase 2)
+          if ! GUNBC_TOOLCHAIN_SEG_RAW=$(rustc -V 2>/dev/null); then echo "::error::rustc -V failed after setup-rust-toolchain: cannot derive native-cache toolchain segment"; exit 1; fi
+          GUNBC_TOOLCHAIN_SEG=$(echo "$GUNBC_TOOLCHAIN_SEG_RAW" | tr ' ' '-')
+          if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then echo "::error::rustc -V produced an empty native-cache toolchain segment after setup-rust-toolchain"; exit 1; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
       - name: Download release-bins artifact
         uses: actions/download-artifact@v4
         with:
@@ -193,6 +201,14 @@ jobs:
           components: rustfmt
           cache: false
           rustflags: ''
+      - name: Derive native-cache root (rustc-version segment; after setup-rust-toolchain)
+        run: |
+          # 🟡 dissolve-on: ci_native_cache_root_script — orch-emitted foreign-executor prelude step deriving GUNBC_NATIVE_CACHE_ROOT from rustc -V after setup-rust-toolchain; leaf rustc/tr/mkdir/echo strings remain until typed toolchain probe lands on host_effect_apply (#5828 / shell→intent Phase 2)
+          if ! GUNBC_TOOLCHAIN_SEG_RAW=$(rustc -V 2>/dev/null); then echo "::error::rustc -V failed after setup-rust-toolchain: cannot derive native-cache toolchain segment"; exit 1; fi
+          GUNBC_TOOLCHAIN_SEG=$(echo "$GUNBC_TOOLCHAIN_SEG_RAW" | tr ' ' '-')
+          if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then echo "::error::rustc -V produced an empty native-cache toolchain segment after setup-rust-toolchain"; exit 1; fi
+          mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG"
+          echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV"
       - name: Download release-bins artifact
         uses: actions/download-artifact@v4
         with:

dag/gunbc/ci_layer_roots.dag

@@ -1255,6 +1255,60 @@ type SubstrateLongLaneRow {
 data falsifier_substrate_long_lane_note: String = "Nightly falsifier batch 6 (test-decomposition Class C, 2026-07-25): the declared Hermetic lane for SubstrateInputsOnly ingest/parse pipeline witnesses whose own eval exceeds the per-PR 5s fast-lane budget (gunbc_ci_fast_lane_rule_note) but are not wet integration — the live-grain half of the provenance-producer Class C split (fixture fail-closed walls stay per-PR via hand-built rows in affected_set_provenance_producer_test.dag and sg_claims_test.dag selectivity receipts). Runs SelectionApplied after the rehomed-bin-wet batch; claim_executor halts this batch if an earlier one fails (fail-closed). Local recipe until enrolled: claim_batch --source-root dag --source-root src/v2 --entry <file> --functions <csv>."
 
 data falsifier_substrate_long_lane_rows: List<SubstrateLongLaneRow> = [
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_attempt_keystone_test.dag",
+    function: "witness_planted_minimal_module_emits",
+    reason: "5015ms deadline kill measured on CI run 31290921315 (2026-08-09): every keystone witness runs the real interpreted v2 pipeline (tokenize->parse->normalize->resolve->emit or assemble->join->infer->translate) at least once — the mechanism IS the modeled boundary crossing and its interpreted cost exceeds the 5s fast lane on CI hardware",
+    dissolve_on: "witness realization lands the pipeline natively or eval drops under gunbc_ci_fast_lane_witness_eval_budget on a measured CI run — then re-enroll per-PR discovery and delete the five keystone rows"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_attempt_keystone_test.dag",
+    function: "witness_planted_garbage_refuses_frontend_RED",
+    reason: "same keystone deadline class as witness_planted_minimal_module_emits (CI run 31290921315)",
+    dissolve_on: "same as witness_planted_minimal_module_emits row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_attempt_keystone_test.dag",
+    function: "witness_real_corpus_entry_produces_typed_standing",
+    reason: "same keystone deadline class as witness_planted_minimal_module_emits (CI run 31290921315)",
+    dissolve_on: "same as witness_planted_minimal_module_emits row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_attempt_keystone_test.dag",
+    function: "witness_assembled_cross_module_subject_reaches_typed_standing",
+    reason: "same keystone deadline class as witness_planted_minimal_module_emits (CI run 31290921315)",
+    dissolve_on: "same as witness_planted_minimal_module_emits row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_attempt_keystone_test.dag",
+    function: "witness_assembled_identity_absent_refuses_RED",
+    reason: "same keystone deadline class as witness_planted_minimal_module_emits (CI run 31290921315)",
+    dissolve_on: "same as witness_planted_minimal_module_emits row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_sweep_test.dag",
+    function: "witness_canonical_identities_join_own_enrolled_roster",
+    reason: "~150s-class dir walk (floor_discovery_producer over dag/test/claim, the census-walk cost class): the canonical-roster derivation witnessed against this file's own enrolled roster — fixture-controlled identity join, corpus-breadth walk",
+    dissolve_on: "witness realization lands the walk natively or eval drops under gunbc_ci_fast_lane_witness_eval_budget on a measured run — then re-enroll per-PR discovery and delete this row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_sweep_test.dag",
+    function: "witness_sweep_rows_join_planted_roster_exactly_once",
+    reason: "~16s measured eval (valiant-boar-65, 2026-08-09): one real canonical two-module closure assembly (tokenize->parse->normalize->resolve) through attempt_closure_rows — the CI2-0 sweep mechanism keystone; the cheap identity-scan and witness-absent RED siblings stay per-PR",
+    dissolve_on: "witness realization lands the assembly natively or eval drops under gunbc_ci_fast_lane_witness_eval_budget on a measured run — then re-enroll per-PR discovery and delete this row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/realization_sweep_test.dag",
+    function: "witness_sweep_receipt_and_histogram_render_every_row",
+    reason: "same Class C assembly wall as sibling witness_sweep_rows_join_planted_roster_exactly_once (~17.5s measured)",
+    dissolve_on: "same as sibling row"
+  },
+  SubstrateLongLaneRow {
+    entry: "dag/test/claim/witness_execution_class_live_census_test.dag",
+    function: "witness_live_roster_census_holds",
+    reason: "~150s measured single-walk eval (valiant-boar-65, 2026-08-08): the CI-0 live-roster classification census — a full floor_discovery_producer walk over witness_discovery_scan_dirs (~1k file reads through the interpreted producer) joined against the enrolled bundle plan. Corpus-breadth census, not a fixture-shaped defect (DESIGN witness-cost ruling: the census is irreducible, the mechanism never is); the mechanism fixtures stay per-PR in witness_execution_class_test",
+    dissolve_on: "witness realization lands the census natively or the interpreted walk drops under gunbc_ci_fast_lane_witness_eval_budget on a measured run — then re-enroll per-PR discovery and delete this row"
+  },
   SubstrateLongLaneRow {
     entry: "src/v2/test/claim/long/wave1_gate1_d_mvp_subsumption_witness_test.dag",
     function: "wave1_gate1_d_census_subsumption_witness_holds",

dag/gunbc/ci_materialization.dag

@@ -140,9 +140,12 @@ data ci_cost_floor_exempt_step_names_note: String = "Cost-floor roster BY STEP N
 data ci_cost_floor_exempt_step_names: List<String> = [
   "Isolate toolchain dirs",
   "Pin rustup default (isolated RUSTUP_HOME has no default toolchain)",
-  "Unpack + verify release bins (claim_executor --verify-build-artifacts; fail-closed)"
+  "Unpack + verify release bins (claim_executor --verify-build-artifacts; fail-closed)",
+  "Derive native-cache root (rustc-version segment; after setup-rust-toolchain)"
 ]
 
+data ci_native_cache_root_exempt_note: String = "Fourth exempt entry (CI2-0 capsule 1, 2026-08-08): the GUNBC_NATIVE_CACHE_ROOT derivation now runs in build, regen, AND ci — GITHUB_ENV is job-scoped, so each job that spawns native emit-host transports must derive its own root, and the three sites' LCA is the workflow isolation boundary. The script is one rustc -V plus a mkdir and a GITHUB_ENV append — a sub-second environment write whose store-tier discharge would cost more than the recompute it saves, the exact class the first two roster entries name. Dissolve-on: the same typed-toolchain-probe trigger the step's own 🟡 marker carries (#5828 / shell→intent Phase 2)."
+
 data ci_sccache_provider_note: String = "C0 (operator ruling, 2026-07-09): this provider row is DERIVED from the cited catalog, never hand-typed. extdeps.cache.sccache owns what sccache IS (NativeInternal content hashing over RustcInvocation+ToolchainSpec, PerHostFilesystem locality, and a cited retention: a finite on-disk ceiling with least-recently-used replacement); this module owns only the ROLE: scope (whole tree, covers every LCA including the fleet frame - why the release build is already cross-run warm while the floor is not) and coverage (the release build script). WHAT THIS ROW USED TO REST ON, and no longer does (2026-08-06): the sentence here read Lru => SpacePacked, sound to drop, costs one recompile - an inference from a replacement ORDER to a space GUARANTEE, which the old fused eviction axis made silently for every Lru row. A least-recently-used order says which entry goes first when the store is full; it does not establish that the store is ever full rather than growing without limit. The boundedness now comes from the fact that actually carries it: sccache v0.15.0 Configuration.md documents SCCACHE_CACHE_SIZE as the maximum size of the local on-disk cache (default 10G), pinned at the modeled binary version rather than main, so the row projects through CapacityBounded with LeastRecentlyUsed replacement. The effective ceiling stays LimitUnobserved because a runner may override it and none was read. A catalog correction still flows into this gate with zero edits here, but eligibility is now ASKED rather than minted by the projection, and a row that stopped establishing a ceiling would refuse here, counted, never a silent shrink of the provider list."
 
 fn ci_sccache_eligibility() -> CatalogProviderEligibility {

dag/gunbc/ci_workflow.dag

@@ -278,8 +278,10 @@ fn ci_floor_upstream_red_refusal_step() -> Step {
   }
 }
 
+data ci_floor_native_cache_root_note: String = "The floor job runs the NativeBundle unit (gunbc_pr_native_batch), so it needs the same GUNBC_NATIVE_CACHE_ROOT prelude the build and falsifier jobs already carry: GITHUB_ENV is job-scoped, so the build job's derivation never reaches the floor, and the bundle workspace silently fell back to the shared /tmp scratch prefix instead of the toolchain-segmented durable root (CI2-0 re-observation 2026-08-08: every main floor run since enrollment cold-failed there and was absorbed by the counted interpreter fallback). Deriving the root after setup-rust-toolchain is the same ordering contract the other two jobs witness."
+
 fn ci_floor_job_prelude_steps() -> List<Step> {
-  [ci_heal_revalidation_checkout_step(), ci_heal_revalidation_preflight_step(), ci_floor_gate_toolchain_step()]
+  [ci_heal_revalidation_checkout_step(), ci_heal_revalidation_preflight_step(), ci_floor_gate_toolchain_step(), ci_native_cache_root_step()]
 }
 
 fn ci_floor_spec_from_roster() -> CiSpec {

dag/gunbc/doc_graph_roots.dag

@@ -108,6 +108,34 @@ fn hand_authored_doc_path(b: HandAuthoredDocBind) -> String {
 }
 
 data hand_authored_doc_binds: List<HandAuthoredDocBind> = [
+  HandAuthoredDocBind {
+    home: PlanDoc,
+    slug: "ci0-witness-execution-census",
+    primary_work: DeclarationRef { module_path: "gunbc.witness_execution_class", decl_name: "witness_execution_class_note", field: WholeDeclaration },
+    additional_works: [
+      DeclarationRef { module_path: "gunbc.witness_execution_class", decl_name: "native_blocked_cause_note", field: WholeDeclaration },
+    ],
+    dissolution: HasTrigger { text: "the general witness→TargetModel producer lands (body-lowering keystone) and the enrolled-roster census is re-derived from executed emission attempts rather than the fixture-bound dispatch surface; the census numbers are superseded by that re-derivation and this receipt deletes with the NativeBlocked{GeneralWitnessTargetModelUnavailable} population it counts." },
+  },
+  HandAuthoredDocBind {
+    home: PlanDoc,
+    slug: "ci2-native-cutover-reobservation",
+    primary_work: DeclarationRef { module_path: "gunbc.ci_workflow", decl_name: "ci_floor_native_cache_root_note", field: WholeDeclaration },
+    additional_works: [
+      DeclarationRef { module_path: "gunbc.ci_materialization", decl_name: "ci_native_cache_root_exempt_note", field: WholeDeclaration },
+      DeclarationRef { module_path: "gunbc.native_witness_transition_receipt", decl_name: "native_at_small_scale_transition_receipt", field: WholeDeclaration },
+    ],
+    dissolution: HasTrigger { text: "the CI2 correctness flip lands — the native-selected population is native-required with the counted interpreter fallback deleted — and a main floor run's [native-selected-bundle] receipt shows verdict accepted with fallback = interpreted = unavailable = 0. The measured-standing content is superseded at that point by the run receipts and the transition-receipt authority; this doc records the pre-flip standing and its two located defects, and deletes with the fallback machinery it diagnosed." },
+  },
+  HandAuthoredDocBind {
+    home: PlanDoc,
+    slug: "witness-bridge-reobservation",
+    primary_work: DeclarationRef { module_path: "v2.compiler.body_producer_forward", decl_name: "body_producer_forward_note", field: WholeDeclaration },
+    additional_works: [
+      DeclarationRef { module_path: "v2.compiler.body_lowering_fold", decl_name: "body_lowering_fold_note", field: WholeDeclaration },
+    ],
+    dissolution: HasTrigger { text: "the first witness-bridge stage lands (lowered body -> derived TargetModel -> bundle member -> native execution with planted-red control) and the bridge carrier's own notes record the standing this receipt captured; then this doc folds into the bridge design/receipt and deletes." },
+  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "review-surface-subject-map",