Remove the 25 roster rows that now pass, and fix the Optional patterns I over-qualified

[gunbai-bot]

Two findings from the first complete run of the new witness floor (main 611fd027708, run 32076934126) — the run that never happened before the cut merged, because the branch run was cancelled by the merge itself.

The run reported, and every join held

planned=9366  executed=9366  terminal=9366
passed=8523   known_red_held=795   failed=48

8523 + 795 + 48 = 9366 exactly. The decline partition came out 1088 = 309 long-home-declined + 779 live-tree-declined (68 in both, attributed once). The roster's own partition held at 820 = 795 held + 25 now-passing. Nothing landed in the declined-by-neither arm, which is the one that would have meant a silent narrowing.

Memory also answered for the first time: [floor-heap-trim] 46 trim(s) returned 5.08GB total, 2.08GB worst single trim. Most of the fold's diffuse growth was allocator retention rather than live data. (A small reclaim would not have proved the converse — fragmentation and arena boundaries produce the same reading — but 5 GB back is positive evidence.)

1. Twenty-five enrolled rows now pass

They red the build and named themselves for removal, which is the roster's self-emptying arm doing its job rather than a roster edit. Six merges landed under a roster measured on 380c242c79a; these are the rows those merges fixed. Removed at exact identity grain. The roster is now 795.

2. Eleven failures are mine, and they are the mirror of the bug they were fixing

My earlier qualification commit (fda9ca03c55) rewrote bare Absent to std.upsert_decision.Absent across eight modules, to break a real collision with ConvergeVerdict. But Absent is also the absent arm of Optional, and in a match over SwapStats? that arm belongs to Optional, not to ObservationVerdict. So twelve patterns were qualified to the wrong authority, turning exhaustive matches into non-exhaustive ones:

errored: non-exhaustive pattern match on: null

where null is the Optional's own runtime absence.

Worth naming precisely, because of what it says about the fix strategy: the original defect was a bare name binding to the wrong declaration by insertion order; this was a qualified name binding to the wrong declaration because the scrutinee's type was never checked. Both mis-bind — only one of them looks careful. Site-level qualification is exactly as capable of naming the wrong authority as bare lookup is, which is an argument for the construction wall (the #8282 lane) rather than for more hand-qualification.

Reverted at the twelve sites whose match carries a Present { sibling arm — those scrutinees are Optional. Sites that genuinely match ObservationVerdict keep their qualification; readback_independence's two arms were checked individually and are correct as-is.

Not in this PR

The other twelve failures are pre-existing and unrelated: nine witnesses failing on host tool unresolved: "cargo" (runner environment), two Bool(false) rows in runner_slot_provision, and one witness at 569ms against a 500ms whole-receipt ceiling.

Verification

The roster was evaluated through required_floor's own closure — the exact frame the floor reads it in, which is the reachability defect that broke the previous run.