feat(bridge): #259 cp5 — the full Finding, the refusal text and the rendered surfaces, proven

[PhysShell]

Что и зачем

Checkpoint 4 left three members of ownir.Finding carried by the Layer 3 goldens but not compared — message, related, flow — one normalization on every refusal, and the rendered surfaces with no golden at all. This PR closes all of it across checkpoints 5.0–5.4: the inventory, the message matrix and evidence slices, the refusal text, a new byte-exact fixture family for BR-V9, and the status surfaces brought level with what the tree proves. No existing golden was regenerated or edited.

Тип изменения

• feat — новая возможность
• fix — исправление бага
• docs — документация
• refactor / chore / test / ci — без изменения поведения

Как проверено

• python tests/run_tests.py
• ruff check . и mypy
• cd rust && cargo fmt --check, cargo clippy --workspace --all-targets (zero warnings), cargo test --workspace --no-fail-fast
• every mutation campaign this branch touches, re-run on a clean tree at its head (cp5.1, cp5.2, cp5.3, plus cp4 and shadow-cp2, both re-anchored where cp5 moved the code they mutate)

Связанные issue

Refs #259 (checkpoints 5.0–5.4). Refs #250. Does not close #259: row 4b (the obligation-protocol analysis) and the coordinate-domain decision are both outstanding.

Чеклист

• изменение покрыто тестом/селфтестом (или объяснено, почему нет)
• README/docs обновлены при необходимости
• коммиты в conventional-commit стиле

---

Checkpoint report

Every count in this report lives in a generated fragment and is linked, never typed — the one exception being the differential counters the checkpoint report itself requires.

Scope

	what landed
5.0	tests/verdict_surface_inventory.py — a completeness ledger: every BR-V4 wording branch with who owns the string, every BR-V5 evidence family and degradation rule, every BR-V9 rule, each matched against the committed goldens so the coverage column is computed from the tree. Self-policing: a finding matching zero or two branches, or a slice matching zero or two families, fails the gate.
5.1	own_bridge::Finding grows message, related, flow; the BR-V4 matrix and BR-V5 slice builders are ported; the replay compares every member.
5.2	own_cfg::Diag carries the reference's message for the resolver text BR-V3's map-or-raise line interpolates; the message= cut is removed and refusals compare in full.
5.3	ownlang/renders.py + tests/fixtures/verdict_renders/ + its harness + a Rust replay comparing the bytes — the surface that had no golden of any kind.
5.4	The census, the campaigns, spec/Bridge.md §6, spec/BridgeBehaviorMatrix.md, the P-022 row and the proposals index.

Explicit non-goals

• The obligation-protocol family (OBL001–005) — P-022 step 6b: implement Rust own-bridge with layered OwnIR parity #259 row 4b. The bridge still refuses a protocol-bearing document; the reference documents stay in rust_replay_excluded.
• The u32 coordinate domain — its boundary controls stay excluded; the contract decision is still owed, and the stated direction is a Python-first tightening.
• OD-1 door controls — measured, unchanged.
• own-shadow is not extended to Layer 3. The reducer still refuses the verdict layer and records the refusal in every reduction. One thing there did change and is explained below: the engine's declaration of what it puts in the envelope, which had become false.
• The ledger rust_replay_excluded neither grew nor shrank.

Python source of truth

ownlang/ownir.py::check_facts (the BR-V4 matrix, BR-V5 slice construction, _di_findings, _effect_findings, _unresolved_findings, the OWN051 mint), ownlang/di.py, ownlang/effects.py, ownlang/evidence.py::di_path_steps, and ownir.render_finding / ownir.build_sarif for BR-V9. ownlang/cfg.py::lookup for the one core message the refusal text quotes.

Frozen fixtures and their regeneration commands

• tests/fixtures/verdicts/*.verdicts.json — python tests/test_verdict_fixtures.py --write
• tests/fixtures/verdict_renders/*.renders.json — python tests/test_verdict_render_fixtures.py --write (new family)
• tests/fixtures/unreachable_branches.json — python tests/test_unreachable_branch_probe.py --write (the oracle probe, below)

No pre-existing golden was regenerated or edited, verified against the branch base: the only pre-existing file touched under the four frozen corpora is manifest.json, and its diff is additions only — zero deleted lines. Cases were added to both families, and the shadow slice's digest ledger gained one record per added document with existing-record churn measured at zero: P-022 discipline rule 4, on both of its lines.

Steady-state test commands without Python

Run from rust/: cargo test -p own-bridge --test verdicts and cargo test -p own-bridge --test renders.

Production dependency changes

own-bridge gains serde as a normal dependency (it was a dev-dependency): the BR-V9 SARIF log is typed structs whose field order is the surface, so the shape is checked at compile time rather than assembled as a free-form value. No change to the crate DAG; own-diagnostics/tests/dag.rs still asserts no core crate depends on the bridge.

Behavior changes

In Python: none. The only file added under ownlang/ is renders.py, an observer in the same shape as verdicts.py and lowered.py — it calls the production renderers and records what they returned, and nothing in the production path imports it. No existing ownlang/ module was touched. The OwnIR schema is unchanged.

On the Rust side, additive core data where the reference keeps it (BR-B1 — the analysis owns its verdict, message included):

• own_analysis::di::Service regains the ctor metadata P-022 step 4: port own-analysis (worklist solver + ownership/lifetime/effect/DI) with layered diagnostic parity #214 dropped as "presentation-only"; DiFinding carries its message, the registration (file, line) its DI004/DI005 related needs beside the call/store-site primary, and the raw site_line that says whether the primary came from a site at all — which line alone cannot, once the fallback has been applied;
• own_analysis::effect::EffectStorm carries its message, origin_kind, decl_line and reference chain;
• own_cfg::Diag gains message: Option<String> and own-analysis reads it. The Option is the design: an unported message renders as the code's title, and because refusals now compare byte-exact, the first golden that refuses on such a code goes red demanding the message rather than agreeing with a title — a tripwire, not a blind spot.

check_di, effect_diagnostics and own-diagnostics are untouched, so no existing core surface changed shape.

Counters over the measured set

	count
Python-only	0
Rust-only	0
Changed	0
Ordering-only	0
Unexplained	0

Asserted, not tallied: each replay collects every divergence without fail-fast and fails if one exists, so a green run is 0/0/0/0/0 by construction. That the comparisons bite was checked rather than inferred — breaking a single wording turns a large block of verdict cases red, and breaking a single escaping rule turns a render case red.

The measured set, and what it is not — generated, never typed: p022-cp4-census.md (the Layer 3 census, both families, describing the cp5 surface) and p022-cp5-inventory.md (which BR-V4 wording, BR-V5 slice family and BR-V9 rule the corpus reaches, and the recorded disposition of every one it does not). Unmeasured, named: protocol documents (row 4b), coordinate-domain controls (decision owed), OD-1 door controls.

The oracle probe: where the unreachable branches' expected text comes from

Some BR-V4 wordings are unreachable end to end — the routing table never mints a handle that would take them, or the analysis never reports a verdict that would select them. Their controls have to get their expected text from somewhere, and "the reference's own output" is only worth saying if someone else can re-run it.

tests/test_unreachable_branch_probe.py runs check_facts with its lowering and core substituted, which is the only way to ask the oracle about a state its own inputs cannot construct, and records what it answered into tests/fixtures/unreachable_branches.json. The Rust controls (own-bridge's verdict::tests, own-analysis's effect::tests) include_str! that record and read the wording out of it rather than carrying their own copy — one source of truth, and the two sides cannot drift into agreeing with each other instead of with Python.

What the probe does not prove is stated beside it: the substitution removes reachability, ordering and the pipeline around the branch, so it can never stand in for a golden anywhere a golden is possible. It is used only where one is not.

Two mutations in the cp5.1 campaign attack the wiring rather than the port: corrupt a recorded wording, and the corresponding control must fail. A control that survives a drifting oracle record is carrying a literal and only appears to read the reference.

Mutation campaigns

All re-run on a clean tree at this branch's head, rendered into p022-cp5-mutations.md and p022-cp4-mutations.md by the one interpreter every campaign in the tree shares. Counts live only there; the suite gate fails while any is stale, was taken on a dirty tree, missed a required catcher, or names a commit this tree does not descend from.

Divergences found, and how each was classified

Between Python and Rust, on the verdict list: none. The first full-equality run over the cases cp4 replayed was green.

Which is exactly why the rest of the work exists — a green replay over a corpus that never reaches a branch proves nothing about it.

1. Reachable branches the inventory named → synthetic cases under the frozen ledgers: the OWN009 and pooled flow-local wordings with their slices, the DI-scoped and both inline-lambda OWN014 wordings, the injected-source lambda note, the dropped escape slice, the bare consuming-constructor tail, the one-step DI retention path, the dropped effect slice, the line-guard degradations, present-but-degenerate metadata, and the dedup pairs below.
2. Branches no facts document can reach → controls driven through map_core, in cp4's M19 shape, reading their expected text out of the recorded probe above.
3. A port bug, found by removing a comparison boundary. cp5.2 removed the message= cut and the hoist_neg_* refusals went red immediately — on py_repr. CPython's repr switches from ' to " when a string contains a single quote and no double quote, and every core message naming an identifier does; cp4's placeholder quoted unconditionally. Fixed in Rust, pinned against CPython's own repr() output across the quote switch, both escape directions, the backslash, the ASCII control range and None. This is the argument for removing a boundary instead of living with it: it was hiding a formatting defect in code that was already ported, not text that was not.
4. A regression the campaign found and a green suite would not have. Re-running cp4's campaign against the cp5.1 tree turned its BR-V7 dedup key drops <member> mutations from caught to survived. Not a weakening: putting message in the key made several of its members unobservable at the output surface — every wording that varies with event, kind or severity interpolates it. The recoverable ones are now a golden (verdict_dedup_key_members: the disposable-field wording names no handler, the flow-local wording names no component); the rest drive dedup, extracted from check_facts so the control runs the production function rather than a copy, and the cp4 definition names that control instead of the replay. Worth stating because it will recur: a comparison surface that gains a member can lose controls for the members it subsumes.
5. A false declaration in a committed artifact. own-shadow's capture declared its verdict layer a partial projection whose stated reason was that BR-V4 and the evidence slices "are checkpoint 5 and are not ported". After 5.1 that was false. The layer now emits every member and declares full; artifacts and traces were regenerated. The reducer still refuses the verdict layer — P-022 step 7a: add dual-engine shadow mode and zero-diff reproduction artifacts #260's boundary, unmoved. Promoting it opened a gap and the gap is closed rather than noted: the projection check only validated partial claims, so a full declared over a short document — the over-claim that became reachable the moment nothing was partial — was unchecked. It validates both now, and the shadow cp2 campaign's M35 was re-anchored from the lie that is no longer possible to the one that is.

Two properties of the surface, recorded rather than papered over

• The pooled "rented but never returned" sentence is emitted by two branches of the BR-V4 matrix, on the same kind, with the same empty handler. Nothing in a serialized Finding separates them, so the inventory carries them as one row and says why. A port reaching the sentence by the other branch would produce a byte-identical golden — that is what parity on this surface means.
• BR-V9 codeFlows reuses own_diagnostics::code_flow verbatim; relatedLocations deliberately does not. The core's builder drops a step whose file is empty — the "unprocessable log" invariant evidence.py names — while ownir.py's inline comprehension filters on the line alone and emits the empty uri. Python is the oracle, so the port reproduces that, and render_evidence_slices is the golden that goes red if someone simplifies the two into one. own-diagnostics behaviour on the core path is unchanged.

The checkpoint-4 subject tail, closed

cp4 established that no Rust output surface serializes a diagnostic's subject and left the re-check to cp5, once the bridge grew render and SARIF paths. Both harnesses now scan the rendered bytes for a subject key. ownir.Finding has no such member, so a bridge surface emitting one would be inventing a field.

Wording

Layer 3 parity over the measured set at the full Finding and the rendered surfaces; unmeasured set: protocol documents (4b), coordinate-domain controls (decision owed), OD-1 door controls.

Not "verdict parity complete", not "#259 complete", not "shadow mode", not "P-022 done".

CI

GitHub Actions runs on this head are linked from the checks section of this PR.

Not for merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DQ471fbXuoL2Poo4Ap3Kfb

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: a424e54b-49b4-4690-afd1-4d096091bb4a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}