Wire CliWireResponse into gunbc run: SCM log/status reach an operator

[gunbai-bot]

The SCM answer reaches an operator

gunbc.scm.render has produced CliWireResponse since it was written, and outside its witness
test nothing consumed it. A function returning one hit classify_exit's NotProcessExit arm
and the run refused with "wrap the result in ExitSuccess / ExitFailure", so every SCM read
answer was computed and discarded — the unwired-renderer state gunbc.cli_dispatch_surface
already records.

run_verb now tries cli_wire_outcome first and falls through to classify_exit unchanged for
every other value. Binding it in the outcome seam rather than under a new scm subcommand
keeps dispatch peripheral (§3): one binding serves every wire-returning entry instead of the host
growing an arm per verb.

The slice is exactly that: CliWireResponse is bound once in the gunbc run outcome seam,
making SCM log and status observable. init is not in this PR — see below.

Proven by execution

$ gunbc run --entry dag/gunbc/scm/cli.dag --function scm_log --arg path=<fixture>
no commits yet                                         rc=0

$ ... --function scm_status --arg path=<fixture>
nothing checked out
0 commits
  nothing staged

$ ... --function scm_log --arg path=/tmp/no-such-repo
cannot read repository at /tmp/no-such-repo
  No such file or directory (os error 2)
repository unavailable                                 rc=1

The last one is load-bearing: bytes printed and a nonzero exit — the case an absorbing
implementation turns into either silence or a spurious 0.

init is cut from this PR, and that is a deferral rather than a fix

An earlier revision of this branch shipped scm_init. Review 5085479276 found a destructive
TOCTOU in it: initialize_repository established an absence from a directory listing and then
called save_repository, which writes unconditionally, so an actor creating the file in between
made init truncate exactly the bytes it advertises that it refuses to touch. The decision was
honest; the write was simply not conditioned on it.

That is not repairable by observing more carefully — check-then-write is two acts with a gap, and
the existence test and the creation have to be one act. The fix needs a new file-transport verb
in src/v1/05_emit.dag, a load-bearing pipeline stage, which a review finding about a CLI verb is
not authority to extend. It therefore lands in #10026 with the primitive, where the emit-stage
change is judged on its own merits.

Removed with it, because they had no other consumer: the FilesystemEntryName admission carrier,
the init decision witnesses, and the save-rendering helpers that only scm_init_cli_response
reached. gunbc.cli_dispatch_surface and the seed-growth receipt were corrected to stop asserting
init is reachable — that row had previously been wrong in the other direction, still claiming
scm was unreachable after the host had been wired.

Also dissolves a fork this PR would otherwise have created

main.rs's exit_status_for carried its own copy of the verdict map; once the wire path needed
the same decision, that copy was two places free to drift. The body moved to
cli_run::exit_status_for_class, where an executing test can reach it — rust-unit-tests runs
cargo test -p v1-compiler --lib, and main.rs is a bin whose tests clippy compiles and
nobody runs.

A malformed wire response is not "some other type"

classify_cli_wire first returned NotCliWire for two materially different situations: a value of
another type, and a value that names CliWireResponse without inhabiting it. The second fell
through to classify_exit and was reported as "not a ProcessExit" — true, useless, and about a
type the value never claimed. MalformedCliWire is its own arm and refuses with nothing on
stdout, exit 2; NotCliWire keeps its fall-through so every pre-existing entry point is
untouched.

Review 58518 then found the remaining hole: a present but invalid exit was accepted, so the
host printed bytes before returning the shape error. Only a real exit keeps a response printable.

Evidence, and its boundary

• cli_wire_outcome_tests (5, executing in CI): bytes with the response's own exit, a rendered
  answer that still fails, a renderer refusal not reading as empty success, the non-wire
  fall-through, and the inherited ExitFailure { code: 0 } refusal.
• cli_wire_classify_tests (9, executing in CI): the classifier boundary, which previously had
  zero coverage — every earlier test started from an already-classified CliWireClass. A
  positive control, the non-wire fall-through control, the malformed shapes, and the assertion that
  a refusal reaches the host with stdout: None.
• test.claim.scm.scm_cli_witness (floor-executed): pins the plain-terminal bytes and the
  capability row. scm_log_response is split from scm_log precisely so these are authorable —
  the verbs read a file and this witness family is SubstrateInputsOnly.
• Not enrolled: the end-to-end runs above are a manual receipt. An integration test would live
  in src/v1/tests/, which clippy compiles and no CI step runs. So the e2e path is
  mitigatable, and its next-rung trigger is a CI step that runs an integration target.

Mutation receipts

claim	mutant	fixed
a_malformed_wire_response_refuses_rather_than_falling_through	FAIL	PASS
a_printable_response_whose_exit_is_not_a_process_exit_is_malformed_and_prints_nothing	FAIL	PASS

Each mutation restores the exact prior behaviour rather than an invented one, and takes only its
own claim red.

Named, not hidden

• add/commit are not here. They need one modeled ScmWriteOutcome (each composes two outcome
  types), and add has no staging authority to persist to. Both are written up in
  docs/plans/scm-demo-cli-rebuild.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQ4iThiZ1B9LPB9ePr8qa9

[gunbai-bot]

All three findings from review 58060 are addressed in 0259205.

dag/gunbc/scm/init.dag — every non-absent observation now refuses. You were right that
proceeding on RepositoryFileUnreadable is fail-open: it is a guess about the host's permission
model, and a file can be unreadable and perfectly truncatable. The fix is not a better read — it is a
different observation. initialize_repository now takes a directory and a name (presence is a
fact about a listing, so its subject has to be an argument, not something recovered by splitting a
string) and routes through extdeps.filesystem.filesystem_io filesystem_file_observation. Absence
is established from a listing that succeeded and did not name the entry; only that arm reaches
save_repository. A new ScmInitRefusedPathUnobserved { path, cause } carries the indeterminate and
disagree arms.

Executed, one per arm:

fresh directory       [file] write /tmp/scminit/fresh/repo.json (166 bytes)
                      initialized repository at /tmp/scminit/fresh/repo.json
repository present    refusing to initialize … a repository is already there
foreign file present  refusing to initialize … and the file reads back byte-intact afterwards
directory mode 000    refusing to initialize … the path could not be observed, so nothing about
                      it is established -- the directory /tmp/scminit/nodir could not be listed,
                      so the absence of repo.json is not established -- Permission denied (os error 13)

Three hermetic claims are enrolled beside them in test.claim.scm.scm_cli_witness: no init refusal
renders as a success exit, the three refusals render differently, and the unobserved arm names what
could not be observed. All three evaluate true.

The hand-Rust receipt. dag/gunbc/cli_wire_host_admission.dag enumerates all 11 declarations at
identity grain (5 production, 6 test), reproducible from the merge base rather than the moving tip.
It states why the boundary is real — the host process's stdout/exit and the interpreter's Value
representation both lack a .dag denotation, so the fold between them cannot be written in the
substrate it is bridging into — records that exit_status_for_class is a relocation of
main.rs's exit_status_for body rather than new behaviour, and names two capability-grain
triggers. It does not admit the growth: the disposition is Terminal and fails closed without an
operator ruling. Wired into gunbc.seed_growth_admission.

The dispatch-surface fork. Correct and now closed at both ends: cli_dispatch_surface.dag names
the real route and says what changed, and the stage0 mirror is regenerated from the emitter rather
than hand-edited. claim_executor --required-regen produced a candidate tree whose
gunbc_cli_dispatch_surface.rs differed from the committed mirror by exactly this one string, which
is the evidence that taking it is a regeneration and not a patch.

— sent from deep-carp-676

[briansrls]

Exact-head review — 0230151dc4821b8c9ddb9c05a4dfb5c1a3af15ba

REQUEST_CHANGES

I reviewed the current tree, the host binding, the init model, the evidence, and the cli_run.rs merge resolution.

The cli_run.rs conflict resolution is accepted

The merge commit has the authored branch as its first parent and exact current main@c26de912077a702bd7d3a12c2da9fcc4fe21b8ca as its second. Relative to that current main, cli_run.rs is exactly the intended +255/-0 wire block. The block closes completely before main's ambiguity-ban declarations begin; I found no brace rotation, lost shared tail, duplicated declaration, or interleaving of the two changes. rust-unit-tests also completed green on the exact head. Do not redo this resolution.

Four substantive blockers remain.

1. init observes absence and then performs an unconditional write

initialize_repository performs List and Read, derives FilesystemFileAbsent, and only then calls save_repository. save_repository uses ordinary Filesystem.Write, which this code explicitly describes as unconditional.

That closes the fail-open cases during the observation, but not the interval after it. Another actor can create or replace the target between the observation and the write; the ordinary write can then truncate bytes that init claims it refuses to replace. The preflight is useful for the repository-vs-foreign diagnostic, but it cannot authorize a destructive actuation.

The final actuation must be atomic create-if-absent: O_CREAT|O_EXCL / create_new(true) or a modeled equivalent. Do not reuse WriteOwnerOnly merely because its current realization happens to carry create_new; owner-only mode and create-only existence policy are separate facts. Add a distinct filesystem operation/outcome, preserve an already-existing file byte-for-byte, and return a named occupied/moved-at-actuation refusal rather than generic unwritable.

Required evidence:

• absent target → one new repository document;
• existing target → exact original bytes remain and the create-only cause is returned;
• the observation-to-actuation moved case cannot reach ScmInitialized.

2. name: String does not identify one entry of directory

The listing asks whether it contains the supplied name, while the read/write subject is constructed independently as directory + "/" + name. A value such as ../victim, subdir/repo.json, the empty string, or a string containing a newline is not one directory entry. It can escape the listed directory or corrupt the line-delimited membership predicate, so the observation and actuation no longer necessarily concern one subject.

Admit an entry-name carrier before either operation: nonempty; not . or ..; no path separator; no NUL; and no newline while Filesystem.List uses newline-delimited names. Construct both the listing query and the final path from that admitted component. Add the rejecting cases above and an ordinary repo.json control.

3. A malformed nominal CliWireResponse falls through as “not ProcessExit”

classify_cli_wire correctly recognizes the nominal CliWireResponse type first. But a missing/wrong bytes, missing exit, empty/absent cause, or unknown wire variant is returned as CliWireClass::NotCliWire. cli_wire_outcome(NotCliWire) returns None, and run_verb then falls through to classify_exit.

So a value that is nominally a CliWireResponse and is malformed as one is reported as merely not being ProcessExit. The owner and remedy are lost. NotCliWire must be reserved for a genuinely different return type. Add a MalformedCliWire { cause }/equivalent arm that produces a nonzero wire-boundary refusal and never reaches the ProcessExit classifier.

The present five tests start after classification by constructing CliWireClass directly, so they cannot detect this. Execute the classifier for the malformed field/variant cases and retain the genuine non-wire fall-through control.

4. The init safety decision is not independently executed, and the authority text contradicts the live interface

test.claim.scm.scm_cli_witness renders preconstructed ScmInitOutcome values. It does not execute the mapping from FilesystemFileObservation to write/refusal. Consequently, mutating either FilesystemFileIndeterminate or FilesystemFileObservationsDisagree to the save arm leaves the enrolled init claims green. The manual receipt does not include the disagreement case.

Factor the observation-to-decision step into a pure function/carrier, execute all four observation arms one fact apart, and let only an established-absence decision reach the atomic create-only actuation from item 1.

Reconcile the live narrative at the same time:

• there is no gunbc scm subcommand; gunbc.cli_dispatch_surface still marks it AbsentFromEmitMainRs and names gunbc run --entry ... as the reachable route;
• the PR's init receipt passes --arg path=..., but scm_init now requires directory and name;
• the PR body says init does not refuse an existing repository, the opposite of the current module;
• the body says the SCM witness has six tests; it has eight;
• cli_wire_host_admission likewise says gunbc scm log/status/init reach the operator rather than accurately naming the gunbc run host seam.

The architecture choice to bind CliWireResponse once in run_verb is accepted. The current title and prose must describe that real interface rather than the future subcommand.

Exact-head CI

Workflow 33586792719 is terminal red on this exact head: required-witnesses-build failed, while the floor, Rust unit, and fabric jobs succeeded. Fresh terminal exact-head green is required after the repairs.

Re-review bar

1. Atomic create-only init actuation with preserved-existing-byte evidence.
2. An admitted one-entry filename carrier joining observation and actuation.
3. A distinct malformed-wire classification, executed before the outcome map.
4. Executed observation-to-init-decision coverage for absent, present, indeterminate, and disagreement.
5. Truthful PR/source/plan narrative for the actual gunbc run interface and current signatures/counts.
6. Terminal exact-head CI.

The merge-conflict resolution itself is approved; no blocker asks you to redo it.

[briansrls]

Exact-head re-review — 82f8312ea22a9c9b5a5a051ce17c953fa8601f56

REQUEST_CHANGES

The operator's deferral is acceptable. Do not restore scm.init to this PR. Removing an unsafe claimed capability is a valid way to close this slice; the atomic create-only file-transport primitive remains a hard predecessor of the later init PR, not a blocker to a wire-binding PR that contains no init route.

The malformed-wire repair is also accepted. A nominal CliWireResponse whose exit field is present but classifies as NotProcessExit now becomes MalformedCliWire; the outcome refuses with status 2 and stdout: None. The new test asserts the load-bearing consequence—untrusted bytes are not emitted—and the reported mutant distinguishes exactly that case. The earlier cli_run.rs conflict resolution remains accepted.

Four bounded blockers remain.

1. The init subtraction is incomplete

dag/gunbc/scm/init.dag and the init decision machinery are gone from this PR, which is correct. But branch-only artifacts that existed solely for init remain:

• gunbc.scm.render: repository_save_lines, scm_save_exit, scm_save_document, and scm_save_cli_response, plus their RepositorySave imports and write-verb commentary. No remaining log/status entry consumes them.
• test.claim.scm.scm_cli_witness: wire_refuses and wire_bytes remain beneath the stale heading “SHARED BY THE INIT CLAIMS BELOW”, but there are no init claims below; the file ends after those helpers.

Move those artifacts with init or delete them here. Cutting the consumer while leaving its private projection and test helpers is not a complete scope subtraction.

2. The hand-Rust receipt no longer matches the implementation

cli_wire_host_seed_growth_justification omits the newly added test

a_printable_response_whose_exit_is_not_a_process_exit_is_malformed_and_prints_nothing.

The exact implementation population is therefore 26 declarations, not 25:

• 5 production declarations;
• cli_wire_outcome_tests: 1 module + 5 test functions = 6;
• cli_wire_classify_tests: 1 module + 5 helpers + 9 test functions = 15.

The receipt currently says the classifier module has seven test functions, while its roster actually lists eight and the implementation now has nine. It also assigns every helper/test child the parent path v1_compiler.cli_run; those children belong under v1_compiler.cli_run.cli_wire_classify_tests, just as the older outcome-test children use v1_compiler.cli_run.cli_wire_outcome_tests. Correct the identities, total, and the stale “three declarations below” wording.

3. The public narrative still claims the cut capability

The dispatch-surface authority and generated projection now correctly say only log/status are reachable through gunbc run, and that init is deferred pending atomic create-only write. The PR metadata and plan do not agree:

• the title still says gunbc scm log/status/init reach an operator;
• the PR body still contains the scm_init execution receipt, says init proves host write, says init overwrites existing repositories, and reports the old witness count;
• docs/plans/scm-demo-cli-rebuild.md still labels init as landed, carries its execution/witness receipts, and derives later conclusions from that run;
• gunbc.scm.cli still describes “every gunbc scm answer” although this PR lands no gunbc scm subcommand—the real interface is the gunbc run --entry ... outcome seam.

Rewrite these as the log/status-only wire-binding slice. Historical init work may be named as deferred and preserved on its branch, but it may not remain presented as landed behavior.

4. Current-main composition and exact-head CI are not green

Current main is ecda0710810f6fca89b39a3fc808f42d8a9717fe. This head still has merge base c26de912077a702bd7d3a12c2da9fcc4fe21b8ca; it is behind current main, whose intervening work overlaps src/v1/stage0/src/cli_run.rs and the generated source-type-binding projection. Merge current main, preserve the accepted wire block, regenerate declared projections from the composed authority, and obtain fresh exact-head CI.

Workflow 33603696869 is already red at this head: required-witnesses-build succeeded, but rust-unit-tests failed. The remaining jobs cannot turn that run green.

Re-review bar

1. Complete the init subtraction by removing/moving the unconsumed write-render and witness helpers.
2. Correct the seed-growth roster to the exact 26-declaration population and nested module identities.
3. Reconcile the title, PR body, plan, and source wording to log/status through gunbc run; init is deferred, not landed.
4. Compose current main, regenerate, and obtain terminal exact-head green CI.

The deferral itself is approved. No finding asks you to put init back into #9864.

[briansrls]

Exact-head re-review — 01ebacbf3b1741433ff05f874e2ba8c6b4b8f957

REQUEST_CHANGES

The named 594d6db repairs are substantially correct:

• the init-only render and witness residue is gone;
• the unused empty_repository import is gone while empty_proposal remains correctly consumed;
• the seed-growth roster now derives and enumerates the exact 26 declarations, with correct nested module identities;
• the five-production-declaration / three-route-function / two-carrier split is truthful;
• the title and gunbc.scm.cli now name the real gunbc run seam;
• the deferred-init section now explicitly denies that its receipts or claims are evidence for this PR.

The projection-drift hypothesis is also closed by falsification. The main-wide red was not an SCM defect. Main commit 2f6f7aa0950df8edd7897902f1b7a51eb1630e26 / #10025 independently confirms the actual contract: an unmodeled shell output key produces a typed, located emit refusal and no emitted file. The old test required src/probe.rs to exist and thereby asserted the fail-open shape it existed to forbid. Do not repair or waive that test inside #9864; compose the main-owned correction.

Three bounded blockers remain.

1. The PR body still names a nonexistent command and retains an init-only bullet

The opening paragraph still says:

so every `gunbc scm` answer was computed and discarded

There is no gunbc scm subcommand. Use the same truthful wording now present in source—every SCM read answer—or name the gunbc run entry route directly.

The final “Named, not hidden” section still says:

The write renderer does not decompose RepositoryEncodeRefusal's arms

This PR contains no write renderer after the init subtraction. Move that fact with #10026/future write work or remove it here.

2. The plan still mixes baseline, landed, and future states without marking the transitions

docs/plans/scm-demo-cli-rebuild.md opens with:

It is a plan, not a receipt: nothing here claims to be built.

but later contains ## LANDED plus execution receipts. Make the document's mixed role truthful—for example, a plan and historical ledger whose explicitly marked landed sections carry receipts.

It also still states in the present tense that scm_log_cli_response and scm_status_cli_response have NO consumer, although this branch adds gunbc.scm.cli as that consumer. Mark that section as the baseline gap before this change and use past tense.

Finally, the numbered host-shape section still presents Commands::Scm plus scm_verb as the required host binding. This PR chose and implemented the generic run_verb outcome seam instead. Mark the direct subcommand as the original/future ergonomic shape, not as an unfinished requirement for the binding this PR claims landed.

The deferred init subsection itself is accepted, including its explicit statement that the init claims are absent here and travel with scm-init-create-only.

3. Current-main composition and terminal CI

Current main is 583ffd661c0037c0f3a10a8410d4cbeb5b4c5c07. This head's merge base is still 7f71ee34094d9879ea06a69d25ac9f6186c3acb5; it is six main commits behind. Those six include #10025, the exact main-owned correction for the inherited unit-test red.

Merge current main (or a newer tip), regenerate every declared projection from the composed authority, and obtain terminal exact-head CI. The pending workflow on 01ebacb is tied to the obsolete base and cannot be the qualifying receipt even if its required aggregate reports green.

Exact remaining bar

1. Correct the two residual PR-body statements.
2. Mark the plan's baseline, landed, and future sections truthfully.
3. Compose current main including #10025, regenerate, and obtain terminal exact-head green CI.

No source-code, carrier, witness, or mutation redesign is requested. No approval carries on 01ebacb.

[briansrls]

Exact-head native ruling — f2ff7ae344fe814399b152c2dadcbc6f6488e90d

REQUEST_CHANGES

The implementation bar remains closed: the generic gunbc run CliWireResponse binding, malformed nominal-wire classification, no-output refusal for an invalid exit, five-plus-twenty-one seed declaration census, init subtraction, and the #10025 main-owned shell-refusal correction are accepted. The first floor attempt's single BUDGET-REFUSED row is not a semantic failure: it produced zero failed verdicts and one undecided result after exceeding the row's 500 ms CPU ceiling. One failed-job rerun is the correct response; do not patch SCM semantics or the witness to make that event disappear.

Three bounded blockers remain.

1. One PR-body statement still belongs to the removed init/write slice

The final “Named, not hidden” section still says the write renderer does not decompose RepositoryEncodeRefusal arms. This PR contains no write renderer after init moved to #10026. Remove that bullet or move it to the write/init PR.

2. The plan still states mutually incompatible time slices

docs/plans/scm-demo-cli-rebuild.md opens by saying it is only a plan and that nothing claims to be built, then contains a LANDED section with execution receipts. Describe it as a plan and historical ledger, or otherwise scope that opening claim.

The same document still states in present tense that scm_log_cli_response and scm_status_cli_response have no consumer, although this branch adds gunbc.scm.cli; mark that as the baseline gap before this change. It also still presents Commands::Scm plus scm_verb as the required host binding, although this PR deliberately chose the generic run_verb outcome seam. Mark the direct subcommand as a future ergonomic surface rather than unfinished work required for the binding landed here.

The deferred-init subsection itself is accepted.

3. Recompose current main and obtain a terminal exact-head receipt

This head composed main@583ffd661c0037c0f3a10a8410d4cbeb5b4c5c07. Current main is now 1ad016a2174c9c6fdb30def5ee03b6441c15c395. Compose the current tip, regenerate every declared projection from the composed authority, and obtain terminal exact-head green CI. The rerun on f2ff7ae may classify the one budget interruption, but it cannot qualify a head that no longer contains current main.

No source-code, carrier, witness, mutation, or init redesign is requested. No approval carries on f2ff7ae.

[briansrls]

Exact-head re-review — 91550f772c734a631741b4ad9c851140dfb13deb

REQUEST_CHANGES

The four bounded items from native review 5089156132 are discharged.

• The removed write-renderer bullet is gone.
• docs/plans/scm-demo-cli-rebuild.md now truthfully separates its baseline plan from its landed ledger.
• The old no-consumer statement is scoped to the baseline this change closes.
• Commands::Scm / scm_verb is correctly marked as a future ergonomic surface rather than unfinished work required by this PR.
• The current body and source name the real gunbc run outcome seam.

The implementation bar remains accepted: the one generic CliWireResponse binding, malformed nominal-wire refusal before ProcessExit, no stdout for a malformed exit, the exact 26-declaration seed census, init subtraction, and the main-owned #10025 correction.

The earlier floor event is also closed as classified. One row produced no verdict after the 500 ms CPU ceiling, with failed=0; the single rerun returned green. That is a transient threshold crossing at the available evidence, not an SCM semantic regression. Do not patch or repeatedly rerun around it.

Two blockers remain on this exact head.

1. The checked-in add/commit plan now contradicts the object model that this head composed

The Next increment section still labels the following as “settled by execution”:

• source content enters through store_node(store, n: Node);
• a source file is represented by a synthetic semantic Node;
• commit can recover the staged identity by rebuilding that node;
• immediate content-addressed storage with no staging authority is the honest add model.

That is the pre-#9891 model. This head contains merged #9891, under which authored bytes enter through the authored-source object arm, and the accepted remaining Finding 6 is that add/commit need a CorpusManifestObject joining path, semantic root, and authored-source identity, plus a staging authority. The same document's final section already names CorpusManifestObject, so it presently publishes both designs at once.

Do not design Finding 6 inside this CLI-binding PR. Remove the obsolete recipe, or mark it explicitly as superseded historical reasoning and state the actual block: CorpusManifestObject plus staging authority must be designed before production add/commit. The phrase “settled by execution” cannot remain over a route the composed object model has invalidated.

2. Current-main composition and terminal exact-head CI

This head's second parent is main@a0f03e41c992c9c1f4d404bda099804494b2629b. Current main is now 533264517ca822002519b96cc670c7832dcbc87f. Compose the current tip or a later one, regenerate every declared projection from the composed authority, establish the required fixed point, and obtain terminal exact-head green CI. The workflow on 91550f7 is still nonterminal and cannot authorize landing in any event.

Exact remaining bar

1. Make the plan carry one truthful post-#9891 add/commit model boundary.
2. Compose current main, regenerate to fixed point, and obtain terminal exact-head green CI.

No source-code, carrier, classifier, witness, mutation, or init redesign is requested. No approval carries on 91550f7.

[briansrls]

Exact-head composition ruling — 91550f772c734a631741b4ad9c851140dfb13deb

REQUEST_CHANGES

The two content/text blockers from review 5089156132 are closed.

• The PR body no longer attributes a RepositoryEncodeRefusal-arm defect to a write renderer that left with init.
• docs/plans/scm-demo-cli-rebuild.md now tells the truth about its two time slices: plan/baseline above LANDED, historical receipt below it; the no-consumer statement is explicitly the baseline gap this PR closes; and Commands::Scm/scm_verb is correctly a future ergonomic surface rather than a prerequisite for the generic run_verb binding.

No source-code, carrier, witness, mutation, init, or narrative redesign remains.

Binding ruling on the moving-main question

The literal rule I previously stated — “compose the current tip and then obtain terminal CI while it is still the current tip” — is not an honest gate on a main branch advancing faster than the run. It does not converge. I withdraw that literal formulation.

The binding rule is a pinned green composition plus an explicit forward-delta admission:

1. Exact head H composes a named main checkpoint B, regenerates every declared projection from that composed authority, reaches a fixed point, and obtains terminal exact-head CI.
2. At merge authorization, observe main at T and adjudicate the entire forward delta B..T.
3. If that delta is disjoint from the PR's authored authority, generated-output dependency closure, and the compiler/witness/CI machinery that qualified the PR, the green receipt remains valid. Authorization is bound to (H, T). If main moves again, adjudicate only T..T'; do not restart CI merely because time passed.
4. If the delta overlaps any of those populations, or its effect is unclassified, compose it, regenerate, and obtain a new exact-head receipt. If overlapping changes keep arriving, wait for a quiet admission window or use a merge queue/frozen merge slot; do not burn runs chasing every unrelated tip.

Therefore dashboard ready=true is necessary but not sufficient until the dashboard carries this forward-composition standing. A selection over the criteria it currently models cannot define the full admission population. Native APPROVE likewise will not be used as a content-only signal going forward; content-only acceptance will be a comment, and APPROVE will mean the exact head is merge-admissible under this rule.

Application to 91550f7

This forward delta is not disjoint.

91550f7 composes main@a0f03e41c992c9c1f4d404bda099804494b2629b. Main has since taken #10033 (f6d872e09b252e13c1a8c3e4100792712b7a3a5f), which changes the same hand-authored host seam, src/v1/stage0/src/cli_run.rs, and installs a crate-wide reachability gate whose subject includes declarations and tests this PR adds to that file. Exact-head CI on 91550f7 cannot have executed that newly landed gate over the combined tree. A clean textual merge would not prove the semantic join.

Let the present run reach its terminal verdict; it remains useful exact-head evidence and makes any later composition failure attributable. Then compose a checkpoint containing #10033 (normally the observed main tip), regenerate all declared projections, and run exact-head CI once. After that run, later main movement is handled by the bounded forward-delta rule above, not by automatic recomposition.

The earlier 500 ms BUDGET-REFUSED attempt is closed as non-semantic by the successful floor on this head. The only remaining hold is composed-tree qualification.

[briansrls]

Post-merge exact-tree ruling

I re-anchored the final PR head and the actual squash result rather than treating the dashboard tally as the ruling.

Accepted

Exact PR head af506ef2d264ec995e32292f0710712d7baa4fdc completed workflow 33640744335 green across required-witnesses-build, required-witnesses-floor, rust-unit-tests, fabric-evidence, and the aggregate witnesses job. The generic gunbc run CliWireResponse binding, malformed nominal-wire refusal, no-output invalid-exit behavior, exact seed census, and main composition are accepted.

The actual squash result is 5a91f3183e50a959c0f26264a9265391fab0c76e. Its push workflow 33651809509 also completed green across every required lane, including Rust unit tests and fabric evidence. The combined landed implementation is therefore qualified ex post; no rollback or code repair is requested for the wire binding.

The merge-time gate was nevertheless not satisfied

af506ef composed main@de531c35496f2cdd3a223a1d5c5f048f782a3226. The squash landed on parent 4e6a597de07450f3dbde2096e78b09e1fadf7bbd. That eight-commit forward delta was not disjoint: it changed src/v1/stage0/src/cli_run.rs, .github/workflows/witnesses.yml, the witness-floor authority, seed-growth admission, compiler tests, and generated compiler projections. Under the pinned-green-composition-plus-forward-delta rule, that overlap required composed-tree qualification before merge. GitHub CLEAN and dashboard ready=true did not supply it.

The successful push run closes the resulting uncertainty after the fact; it does not turn the pre-merge decision into an admitted one.

One authority-text correction remains on main

docs/plans/scm-demo-cli-rebuild.md still labels the pre-#9891 add/commit recipe “settled by execution” and says authored content enters through store_node, a file is rebuilt as a synthetic semantic node, mint_repository_commit takes ObjectId and checks store_contains, and immediate object-store insertion is the honest substitute for staging. The current object model instead has an authored-source object arm; mint_repository_commit takes SemanticNodeTarget; and the accepted production boundary is CorpusManifestObject plus staging authority before add/commit.

This is a text-only correction on main: mark that recipe as superseded historical reasoning and state the current model block. It is not a request to redesign or revert #9864.

Process ruling

Dashboard ready=true remains necessary but insufficient until it includes forward-composition standing. Native APPROVE will mean merge-admissible, not content-approved with a hidden composition hold. Because this PR was already merged before this re-review completed, I am leaving the historical CHANGES_REQUESTED review intact and recording the retrospective acceptance and residual here rather than manufacturing a late pre-merge approval.