Restore identity-grain witness cost disclosure on the required floor: mint one occurrence, fold everything from it

[gunbai-bot]

R of the R/X pair (operator ruling, 2026-08-22). Draft on purpose — see What is not here.

What was lost, and what "restore" means

run_required_floor already measures every claim: run_claim_measured returns a PerformanceReceipt carrying wall and CPU nanoseconds, and the loop binds it. It was consumed to increment one integer, then dropped at end of iteration. The floor measured 10,457 claims, kept over_cost_line_diagnostic, and discarded every identity behind it.

That is why the number could move 67 → 77 → 73 with nobody able to say which witnesses entered or left. Nothing new is measured here; what was already in hand stops being thrown away.

One occurrence, minted immediately; everything is a fold over it

WitnessExecutionOccurrence is pushed the instant run_claim_measured returns — before expected-red holding, route-gap classification, or summary accounting can diverge from it. over_cost_line_diagnostic is now over_cost_members.len(), and the independent += 1 is deleted. The summary cannot disagree with its own members, and there is no separate tally to drift.

The re-derivation is exact, not approximate

This is the only reason folding is safe. exceeds_completed_cost_line judges VerdictReached claims and compares observed_*_ms, which claim_terminality computes as nanos / 1_000_000. The row retains exact nanos, verdict_reached, and the cost_line_ms it was judged against; the fold re-applies that same arithmetic. If the two could ever disagree, the fold would be a second account of the population — the defect this change exists to remove.

What the row deliberately does not carry

No over_cost flag, no count. Membership is the policy predicate applied to the measurement, not a stored property — a stored flag is a second representation of a comparison the policy already owns. Milliseconds are a rendering choice; flooring at mint would destroy the sub-millisecond-vs-unmeasured distinction at the one place it still exists.

Every executed claim gets a row, not only the over-cost ones. Emitting only positives loses which identities entered or left, the near-threshold population, the ability to reclassify after a policy-line change, and the proof that every executed identity was measured at all.

witness_execution_outcome_label is exhaustive with no _ arm: a new ClaimOutcome variant must fail to compile rather than be absorbed into a plausible existing label.

What is not here — and why this is a draft

• No gate. Artifact presence changes no verdict; no witness pass/fail depends on elapsed time. The disclosure wall is a separate change, after a real run proves this producer.
• No .dag-side ObservationEvent projection. The agreed end state builds events and renders in .dag from a minimal carrier. That carrier and its transport are unbuilt. This is the seam most worth arguing about before it goes live — a Rust-side cost projection is the shape Retire the batch-fed witness-cost materialization at the root: three writers and two census rows #8923 just deleted, and "we will move it to .dag next" is the deferred-refactor tell §6 names. I would rather that be reviewed than assumed.
• No test. A producer with no discriminating red is written, not done (§5).

Operational note

Touches src/v1/stage0/src/cli_run.rs, which a peer session is holding for ~a day while absorbing 28 conflicted files. Draft status keeps it out of their integration path.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PgpEN2jnUGsLhM5vRKH6fD