Split floor progress from terminal receipt (falsifier PR C)

[gunbai-bot]

Summary

• Subject 1 — progress vs terminal judgement: Unreached batches on checkpoint writes use outcome=pending (ComponentNotConcluded) instead of fabricated skipped verdicts. A new run_terminal envelope (disposition=incomplete, cause, concluded/pending indices) separates mid-run progress from concluded runs.
• Subject 2 — exact active workset: Witness admission/completion is tracked in a process-wide registry, journaled to GUNBC_FLOOR_PHASE_JOURNAL, and serialized into active_workset on incomplete receipts (attempt id, entry, function).
• Subject 3 — typed witness diagnostics: Adds witness_verdict_diagnostic companion naming (parallel to failure receipts), lands CargoInvocationOutcome from PR A: model Cargo execution placement; make the roster-bijection outcome typed #8231, and projects cargo_outcome_diagnostic for interpreter_dispatch_bijection_real_roster_red_holds into component failure detail without runtime-error smuggling.

Also includes population-budget watchdog terminal receipt write (progress announced but no terminal receipt on kill).

Test plan

• cargo test --bin claim_executor tests::checkpoint_tail_is_run_incomplete_and_final_tail_is_not_reached
• cargo check --bin claim_executor
• CI floor witnesses (floor_component_receipt_witness_test, cargo_execution_placement_witness_test)
• Falsifier run — expect legible incomplete receipt (pending tail + active workset), not green

Made with Cursor

[gunbai-bot]

Addressing review 51784 (REQUEST_CHANGES):

Encoder dual representation — floor_component_receipt_document_json now emits run_terminal and active_workset alongside the other required members, matching what floor_component_receipt_decode_with requires. Without this, decode→floor_component_receipt_document_text→decode would refuse its own output.

Incomplete envelope round trip — Added two executing witnesses on the checkpoint path this PR exists to fix:

• fcr_incomplete_checkpoint_receipt_decodes_through_the_strict_reader — floor_component_receipt_document_incomplete → strict decoder (pending tail + run_terminal.disposition=incomplete + active_workset)
• fcr_incomplete_checkpoint_receipt_reencodes_through_document_encoder — decode → floor_component_receipt_document_text → decode again

PR A duplicate files (silent-bee-502) — Dropped cargo_execution_placement.dag, its witness, and the transport rewrite from this branch; restored interpreter_dispatch_bijection_real_roster_transport.dag to main. Will rebase on main once #8231 lands and re-apply only the Subject 3 delta if still needed.

Active workset kill path — Added executed controls (not construction-only): registry retains admitted identity without complete; phase journal records admitted without completed; incomplete receipt write snapshots the in-flight entry (incomplete_receipt_active_workset_survives_without_completion in claim_executor + active_workset_kill_path_controls in cli_run).

Non-blocking notes from review 51778: Mutex race on concurrent same (entry,function) is noted — sequential floor today; cargo placement honesty belongs in #8231 after rebase.

— sent from witty-gull-388

[gunbai-bot]

Addressing review 51818 (REQUEST_CHANGES):

Updated concluded-path JSON fixtures in falsifier_alert_migration_witness_test.dag (receipt_json, receipt_with, and the numeric-workflow_name negative control) and falsifier_alert_decision_witness_test.dag (receipt_text_with) to include \"run_terminal\":null,\"active_workset\":[] per the strict decoder contract.

Left intentionally absent-member fixtures unchanged (e.g. a_required_auxiliary_member_absent_refuses_rather_than_becoming_null still omits affected_set_cold_control only).

Executed: receipt_document_decodes_its_subject, an_agreeing_component_count_decodes, a_decoded_malformed_marker_refuses_instead_of_starting_a_new_incident — all green.

— sent from witty-gull-388

[gunbai-bot]

Response to review 51856 (REQUEST_CHANGES)

Finding 1 — required run_terminal / active_workset without schema bump

active_workset: Fixed on 20457c52e (operator ruling #8239 → #8163). The member is removed from the schema, not required-empty. Subject identity is a temporary GUNBC_FLOOR_PHASE_JOURNAL projection with dissolve-on into #8163's RecordedObservation ledger — see floor_component_resource_checkpoint_note / floor_component_phase_journal_scaffold_note. No second workset authority on the receipt.

run_terminal: Valid compat concern for retention receipts that predate this PR. Fixed on 7694c1e14: receipt_run_terminal_at maps absent member → json_null() (concluded / no incomplete envelope), symmetric with the legacy not_concluded pending-tag arm. Writer still always emits the member on new receipts; only the reader carries the transitional default. Witness: fcr_legacy_receipt_without_run_terminal_member_decodes. Schema id stays floor-component-receipt/v1 intentionally — absent→null preserves decode of artifacts already under retention.

Finding 2 — active_workset: [] by construction / no executing consumer

Superseded by the removal above. The prior design conceded empty-by-construction while naming the field "live working set"; that parallel-authority shape is gone. What remains on this PR:

• Receipt: batch/component checkpoint + run_terminal.incomplete + pending tail (outcome=pending, not fabricated skipped) — the falsifier PR C fix for run 31685755058.
• Journal: admit/completed rows (temporary scaffold, not a second durable receipt family).
• Executing consumers: incomplete checkpoint round-trip witnesses, claim_executor checkpoint write on RunIncomplete, falsifier alert decode path.

Happy to re-review at 7694c1e14.

— sent from witty-gull-388

[gunbai-bot]

Response to review 51876 (REQUEST_CHANGES)

Finding — silent GUNBC_FLOOR_PHASE_JOURNAL I/O in append_active_workset_phase_journal: Fixed on 5b1193fe4. When the env is set, create_dir_all, open, and write_all/flush/sync_data failures now emit located stderr (cli_run: create|open|persist floor phase journal …) matching claim_executor::append_floor_phase_journal — no bare let _ = … / silent return. The in-memory registry still updates on admit/complete (same as before); the fix is that a configured journal path can no longer fail without a visible deficit.

Executed locally: active_workset_kill_path_controls (3 tests, including phase_journal_records_admit_without_completed_on_kill_path).

— sent from witty-gull-388