Repair three main-floor regressions, and isolate the partition-closure cost defect

ROADMAP.md

@@ -37,8 +37,8 @@ The graph has sixteen lanes: SCM compatibility · namespace · P-derive · obser
         - [ ] **Decide what matters before paying to prepare everything** — Which computations a change affects is decided from source and module facts, ahead of broad roster, index, grouping and closure preparation. Only the views that decision actually needs are then prepared. Why: Selection is already sharp about meaning and blunt about cost: it can correctly conclude that most of the corpus is irrelevant, but only after the corpus has been discovered, named, rostered and indexed. The saving it reports is real while the work it claims to have avoided has largely already been done. [authority](docs/plans/ci-selection-vs-scheduling.md)
           - [ ] **Start running as soon as the first thing is ready** — Preparation stops being a barrier standing in front of execution. A module's facts becoming ready makes an entry view ready, which makes a witness ready, which runs — while everything else is still being prepared. Why: Several hundred seconds are currently spent preparing every selected entry before the first one executes. That is a barrier, not work that had to finish first. [authority](docs/plans/floor-prep-tax-program.md) — requires all: ci-selection-before-preparation, ci-scoped-worker-shared-substrate
 - [ ] **Write the closing check for: Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — One executable check states when this is done, transcribed from the node's own bar: A member reported as a frontend GAP whose refusal is actually normalize's own retention contradicting itself refuses the classification — the two populations are separated by reading the rejection reason as a containment read, never by the first reason rendered, because rejected_with_pending prepends accepted-carrier diagnostics to a later rejection and the FIRST reason is systematically wrong. A cohort claimed as reaching Accepted whose closure contains no Accepted member refuses. A repair asserted separable from a description, without a cherry-pick onto main executed green, refuses. Why: Turns a prose bar into a runnable verdict, so the node it gates can be dispatched and its completion checked rather than judged. [authority](docs/plans/five-minute-ci-gate-design.md)
-  - [ ] **Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — STOPPED AND RE-CUT (operator ruling 2026-08-10, superseding the 2026-08-08 one-PR mandate this row used to carry). #8043/#8080 attempted the complete cutover in one PR and is closed as quarry; the row survives because the CAPABILITY is real and the SCOPE was wrong. Root, in the operator's words: v2 native execution entails a real self-host frontier and must be named as such — not carried as a CI-performance step. The frontier is measured, not estimated: of 11 rejecting members in one real 15-file std closure, 5 are normalize CONTRACT VIOLATIONS (it retains wrapper declarations under its declared lowered | wrapper-retained{cause} 'corpus stays green' frontier, then its own module-grain well_formed gate rejects the tree those retentions live in), 2 are the graft dissolution guard working correctly, 3 are genuine frontend gaps (dag/std/types at LEX; src/v2/std/node and dag/std/content_hash at PARSE, the where-refinement form), and 1 went uncaptured. A broken contract is a bounded repair with a known intended behaviour; a missing capability is a program — so the 5 and the 3 are different work and do not schedule together. Why: The stopped lane still paid for itself twice. It produced two merged frontend repairs (#8114: arrow-lambda grammar admission, and the graft dissolution guard — main accepted hollow-shell modules until it landed, proven by reverting only namespace_graft.dag and watching both RED witnesses fail), and it produced the frontier table that replaces an eleven-item guess with a three-item program. What it disproved is equally load-bearing: this row no longer parents five-minute-ci-gate, because witness EVALUATION is 97s of a 3,290s floor — an infinitely fast evaluator leaves 97 percent of the floor standing, so native execution was never the CI-cost lever and CI cost must not wait on a self-host frontier. [authority](docs/plans/five-minute-ci-gate-design.md)
-    - [ ] **V2-LENS-0: every registered v2 lens executes over one exact corpus subject through the CI2 route** — BLOCKED, AND THE BLOCK IS HONEST (2026-08-10): the former trigger — CI2-0 terminal acceptance — is unreachable, because that lane is stopped and its one-PR shape retired. This row keeps its dependency on the native row deliberately rather than being re-anchored around it: its own handback demands ZERO v1 lens-body executions, which is native execution by definition, so relaxing the trigger would only move the frontier into the handback. Its residue lives in #8077, an ownerless draft whose concurrency portion already merged separately as #8112; the genuine remainder is the six-module lens suite. The underlying concern is DESIGN section 6's, and it does not expire with the lane: an executable hygiene check must keep every lens either wired or deleted, because an inert lens is coverage by illusion. Roster derived from the existing v2 lens registry — no second hand-maintained suite list; every registry identity appears exactly once in the plan; every applicable lens body executes through the v2/CI2 route with ordinary v1 interpreter lens executions zero. Each lens returns a reading or a typed located refusal — Unavailable retains its exact trigger and counts as executed, never as accepted capability. One exact whole-corpus fact pack per process; a repeated query constructs nothing. Why: Registry completeness proves metadata coherence, not execution: many LensContract rows carry NoConsumerWitness, and an inert lens is coverage by illusion. Binary acquisition, not lens logic, was the recurring execution failure; #8054 proved a whole-corpus query executes and its expense is corpus-fact construction, not lens evaluation. [authority](docs/plans/five-minute-ci-gate-design.md)
+  - [ ] **Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — STOPPED AND RE-CUT (operator ruling 2026-08-10). #8043/#8080 attempted the complete cutover in one PR and is closed as quarry; the CAPABILITY is real, the SCOPE was wrong. Root: v2 native execution entails a real self-host frontier and must be named as such, not carried as a CI-performance step. The frontier is measured: of 11 rejecting members in one real 15-file std closure, 5 are normalize CONTRACT VIOLATIONS, 2 the graft guard working correctly, 3 genuine frontend gaps, 1 uncaptured. A broken contract is a bounded repair; a missing capability is a program, so they do not schedule together. Why: The stopped lane still paid for itself twice. It produced two merged frontend repairs (#8114: arrow-lambda grammar admission, and the graft dissolution guard — main accepted hollow-shell modules until it landed, proven by reverting only namespace_graft.dag and watching both RED witnesses fail), and it produced the frontier table that replaces an eleven-item guess with a three-item program. What it disproved is equally load-bearing: this row no longer parents five-minute-ci-gate, because witness EVALUATION is 97s of a 3,290s floor — an infinitely fast evaluator leaves 97 percent of the floor standing, so native execution was never the CI-cost lever and CI cost must not wait on a self-host frontier. [authority](docs/plans/five-minute-ci-gate-design.md)
+    - [ ] **V2-LENS-0: every registered v2 lens executes over one exact corpus subject through the CI2 route** — BLOCKED, AND THE BLOCK IS HONEST (2026-08-10): the former trigger, CI2-0 terminal acceptance, is unreachable because that lane is stopped. This row keeps its dependency on the native row deliberately: its handback demands ZERO v1 lens-body executions, which is native execution by definition, so relaxing the trigger would only move the frontier into the handback. The concern is DESIGN section 6's and does not expire with the lane: an inert lens is coverage by illusion. Roster derived from the existing v2 lens registry; each lens returns a reading or a typed located refusal. Why: Registry completeness proves metadata coherence, not execution: many LensContract rows carry NoConsumerWitness, and an inert lens is coverage by illusion. Binary acquisition, not lens logic, was the recurring execution failure; #8054 proved a whole-corpus query executes and its expense is corpus-fact construction, not lens evaluation. [authority](docs/plans/five-minute-ci-gate-design.md)
 - [ ] **Write the closing check for: Stop re-walking the string to read one character** — One executable check states when this is done, transcribed from the node's own bar: Identical output over the corpus is the equivalence half and is satisfied by changing nothing, so it does not stand alone: a long literal mixing non-ASCII text with escapes must separate the two implementations by cost, and a deliberately wrong escape decode must change the output. Why: Turns a prose bar into a runnable verdict, so the node it gates can be dispatched and its completion checked rather than judged. [authority](docs/plans/inner-cost-lanes-scoping.md)
   - [ ] **Stop re-walking the string to read one character** — One function in the tokenizer still reads a string by counting from the start each time, while the rest of its file was already moved onto a pre-decoded form. Move it too, and collect its result into one buffer instead of a list of one-character pieces. Why: For text that is entirely plain ASCII this costs one allocation per character. For text containing any non-ASCII character at all, reading position N costs N steps and asking how long the string is re-counts the whole thing, on every pass — so the work grows with the square of the literal's length, and a single accented character anywhere flips the whole literal onto that path. [authority](docs/plans/inner-cost-lanes-scoping.md)
 - [ ] **Write the closing check for: One way to ask for work to be done, with the subject pinned exactly** — One executable check states when this is done, transcribed from the node's own bar: A request whose subject is a moving reference refuses. A provider that cannot serve the requested class of operation refuses before running rather than quietly answering a smaller question. The five endings stay five — a machine that killed the work cannot render as the work having failed. Why: Turns a prose bar into a runnable verdict, so the node it gates can be dispatched and its completion checked rather than judged. [authority](docs/plans/execution-spine-design.md)

dag/gunbc/doc_graph_roots.dag

@@ -402,6 +402,24 @@ data hand_authored_doc_binds: List<HandAuthoredDocBind> = [
     ],
     dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the work this document plans lands and its subject gate_runnable_profile describes shipped behavior rather than a planned change; the row deletes with the document. Registered at subject grain: the systems bound here are the ones whose movement would make this document's purpose false, not every system its prose mentions.") },
   },
+  HandAuthoredDocBind {
+    home: PlanDoc,
+    slug: "v2-frontend-std-ingestion-frontier",
+    primary_work: DeclarationRef { module_path: "v2.compiler.normalize", decl_name: "normalize", field: WholeDeclaration },
+    additional_works: [
+
+    ],
+    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the frontier this receipt measures is closed and the rows describe shipped ingestion rather than a measured gap; the row deletes with the document. Bound to normalize at subject grain because that is the terminal stage of the measured chain and where the majority of the rejections it records land — the tokenize and parse gaps it also names are reached through the same run. Registered when the document was found unreachable from every doc-graph root: it landed in gunbc#8114 without a binding, and the only prose naming it does so inside a code span rather than a markdown link, so no doc reaches it either.") },
+  },
+  HandAuthoredDocBind {
+    home: PlanDoc,
+    slug: "four-lane-closeout-and-root",
+    primary_work: DeclarationRef { module_path: "gunbc.roadmap_authority", decl_name: "five_minute_ci_gate_program_note", field: WholeDeclaration },
+    additional_works: [
+
+    ],
+    dissolution: PlanRetiresWhen { condition: unbound_dissolution(description: "the four closed lanes' measurements are carried by the systems they measured rather than by this closeout note, and the note deletes with the last of them. Bound to the five-minute-CI-gate program boundary at subject grain because that is the row this document's central measurement bears on: witness evaluation was 97s of a 3,290s floor, so native execution is not the CI-cost lever. Registered when the document was found unreachable from every doc-graph root, having landed in gunbc#8116 without a binding.") },
+  },
   HandAuthoredDocBind {
     home: PlanDoc,
     slug: "for-sugar-over-fold",