Make the v2 frontend census typed and exactly reconciled

ROADMAP.md

@@ -37,7 +37,7 @@ The graph has sixteen lanes: SCM compatibility · namespace · P-derive · obser
         - [ ] **Decide what matters before paying to prepare everything** — Which computations a change affects is decided from source and module facts, ahead of broad roster, index, grouping and closure preparation. Only the views that decision actually needs are then prepared. Why: Selection is already sharp about meaning and blunt about cost: it can correctly conclude that most of the corpus is irrelevant, but only after the corpus has been discovered, named, rostered and indexed. The saving it reports is real while the work it claims to have avoided has largely already been done. [authority](docs/plans/ci-selection-vs-scheduling.md)
           - [ ] **Start running as soon as the first thing is ready** — Preparation stops being a barrier standing in front of execution. A module's facts becoming ready makes an entry view ready, which makes a witness ready, which runs — while everything else is still being prepared. Why: Several hundred seconds are currently spent preparing every selected entry before the first one executes. That is a barrier, not work that had to finish first. [authority](docs/plans/floor-prep-tax-program.md) — requires all: ci-selection-before-preparation, ci-scoped-worker-shared-substrate
 - [ ] **Write the closing check for: Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — One executable check states when this is done, transcribed from the node's own bar: A member reported as a frontend GAP whose refusal is actually normalize's own retention contradicting itself refuses the classification — the two populations are separated by reading the rejection reason as a containment read, never by the first reason rendered, because rejected_with_pending prepends accepted-carrier diagnostics to a later rejection and the FIRST reason is systematically wrong. A cohort claimed as reaching Accepted whose closure contains no Accepted member refuses. A repair asserted separable from a description, without a cherry-pick onto main executed green, refuses. Why: Turns a prose bar into a runnable verdict, so the node it gates can be dispatched and its completion checked rather than judged. [authority](docs/plans/five-minute-ci-gate-design.md)
-  - [ ] **Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — STOPPED AND RE-CUT (operator ruling 2026-08-10, superseding the 2026-08-08 one-PR mandate this row carried). #8043/#8080 attempted the complete cutover in one PR and is closed as quarry; the row survives because the CAPABILITY is real and the SCOPE was wrong. Root, in the operator's words: v2 native execution entails a real self-host frontier and must be named as such, not carried as a CI-performance step. The measured frontier — which of one std closure's rejecting members are bounded contract repairs and which are genuine frontend gaps, and why those do not schedule together — is gunbc.roadmap_authority native_selected_witness_bundle_frontier_note. Why: The stopped lane still paid for itself twice. It produced two merged frontend repairs (#8114: arrow-lambda grammar admission, and the graft dissolution guard — main accepted hollow-shell modules until it landed, proven by reverting only namespace_graft.dag and watching both RED witnesses fail), and it produced the frontier table that replaces an eleven-item guess with a three-item program. What it disproved is equally load-bearing: this row no longer parents five-minute-ci-gate, because witness EVALUATION is 97s of a 3,290s floor — an infinitely fast evaluator leaves 97 percent of the floor standing, so native execution was never the CI-cost lever and CI cost must not wait on a self-host frontier. [authority](docs/plans/five-minute-ci-gate-design.md)
+  - [ ] **Name the v2 self-host frontier that native witness execution actually requires, and close it stage by stage** — STOPPED AND RE-CUT (operator ruling 2026-08-10, superseding the 2026-08-08 one-PR mandate this row carried). #8043/#8080 attempted the complete cutover in one PR and is closed as quarry; the row survives because the CAPABILITY is real and the SCOPE was wrong. Root, in the operator's words: v2 native execution entails a real self-host frontier and must be named as such, not carried as a CI-performance step. The frontier is gunbc.roadmap_authority native_selected_witness_bundle_frontier_note (historical) and native_selected_witness_bundle_exact_head_recut_note (current). Why: The stopped lane still paid for itself twice. It produced two merged frontend repairs (#8114: arrow-lambda grammar admission, and the graft dissolution guard — main accepted hollow-shell modules until it landed, proven by reverting only namespace_graft.dag and watching both RED witnesses fail), and it produced the frontier table that replaced an eleven-item guess with a three-item program — a table since superseded by the 2026-08-11 exact-head re-observation, under which the split is four normalize members and two independent lex walls, not five and three. What it disproved is equally load-bearing: this row no longer parents five-minute-ci-gate, because witness EVALUATION is 97s of a 3,290s floor — an infinitely fast evaluator leaves 97 percent of the floor standing, so native execution was never the CI-cost lever and CI cost must not wait on a self-host frontier. [authority](docs/plans/five-minute-ci-gate-design.md)
     - [ ] **V2-LENS-0: every registered v2 lens executes over one exact corpus subject through the CI2 route** — BLOCKED, AND THE BLOCK IS HONEST (2026-08-10): the former trigger, CI2-0 terminal acceptance, is unreachable because that lane is stopped and its one-PR shape retired. This row keeps its dependency on the native row deliberately rather than being re-anchored around it: its own handback demands ZERO v1 lens-body executions, which is native execution by definition, so relaxing the trigger would only move the frontier into the handback. The underlying concern is DESIGN section 6's and does not expire with the lane: an inert lens is coverage by illusion. Residue, roster derivation and the per-lens execution contract are gunbc.roadmap_authority v2_lens_suite_execution_block_note. Why: Registry completeness proves metadata coherence, not execution: many LensContract rows carry NoConsumerWitness, and an inert lens is coverage by illusion. Binary acquisition, not lens logic, was the recurring execution failure; #8054 proved a whole-corpus query executes and its expense is corpus-fact construction, not lens evaluation. [authority](docs/plans/five-minute-ci-gate-design.md)
 - [ ] **Write the closing check for: Stop re-walking the string to read one character** — One executable check states when this is done, transcribed from the node's own bar: Identical output over the corpus is the equivalence half and is satisfied by changing nothing, so it does not stand alone: a long literal mixing non-ASCII text with escapes must separate the two implementations by cost, and a deliberately wrong escape decode must change the output. Why: Turns a prose bar into a runnable verdict, so the node it gates can be dispatched and its completion checked rather than judged. [authority](docs/plans/inner-cost-lanes-scoping.md)
   - [ ] **Stop re-walking the string to read one character** — One function in the tokenizer still reads a string by counting from the start each time, while the rest of its file was already moved onto a pre-decoded form. Move it too, and collect its result into one buffer instead of a list of one-character pieces. Why: For text that is entirely plain ASCII this costs one allocation per character. For text containing any non-ASCII character at all, reading position N costs N steps and asking how long the string is re-counts the whole thing, on every pass — so the work grows with the square of the literal's length, and a single accented character anywhere flips the whole literal onto that path. [authority](docs/plans/inner-cost-lanes-scoping.md)