fix(semantics): verify bounded production evidence and input domains

[songoow]

Refs #4447. Continues the semantic-vocabulary RFC; supersedes the initial implementation proposed in #4461. Review-contract reference: #4459.

Problem and behavior

The initial producer guard could prove liveness from an enum definition alone, associate a writer with an unrelated function in the same module, and miss scalar return values. This change separates owner membership from production evidence, attributes known outputs to exact sites, and reports unresolved paths explicitly.

Scope

• Python AST production observations cover field writes, declared returns, imported enum members, bounded variable resolution and result positions. Keys, conditions, comparisons, shadowed imports and assignments after a return do not establish liveness.
• TypeScript object/assignment/return observations use the repository's locked parser. Syntax failures identify a safe file/line without echoing source text.
• Six kernel entries have explicit evidence lanes: four source-producer models; executable witnesses at the real Turn result decoder; and a legacy lease input vocabulary retained with compatibility reasons and an M4 retirement condition. A new lease producer invalidates the compatibility-only declaration.
• Five existing quota return values are registered. Python callers reuse the quota owner while preserving wire strings. There is no field-shape or runtime permission change.
• Known production and return coverage is anchored; scope declarations preserve raw counts, and retirement counts use standalone tokens.
• A real executor/journal/resume regression establishes that the Turn route is persisted. The English/Chinese RFCs retain three vocabularies and require migration evidence before future renaming.

This is the bounded M0.5 repair plus owner adoption. Full M1 slot/TypeScript migration, M2 generation, baseline semantic-debt reduction and M3/M4 retirement remain separate work. Structural witnesses do not prove trace reachability or whole-program data flow; unresolved locations remain explicitly unproved.

Dependency and review scope

Based on origin/main. The prerequisites have landed: #4459 was squash-merged as f6a6d1139, and #4457 was closed as superseded because its content had already arrived through #4459 — it is a no-op against current main. This branch is therefore rebased onto main directly and no longer depends on either. The producer-specific review delta is the range from origin/main to this head.

The earlier six-file resolution is preserved on main and inherited here: #4457's domain notation, candidate labels/default and proof boundary, plus #4459's review rules and current-checkout repair commands. This PR contributes its own scope declarations, executable decoder witnesses, exact producer/return evidence, retirement counts and negative tests. Inventory is regenerated from the combined tree. No entire registry side was selected and no budget was raised.

CI and repair

No new PR-required check name is added. The guard remains on the existing pytest/premerge path. Full Public Smokes gains npm ci --ignore-scripts for the locked TypeScript parser; Python test shards already install these dependencies.

After editing producers, update the actual owning function or its exact registry site, regenerate the inventory, and rerun the semantic tests. Do not use owner membership, unrelated registry entries, renaming, a raised budget or a narrowed scan root to clear a failure.

Validation

Tested revision: bf74194a2876188a5035c68a49ddaf57c5e9a439

• 193 combined semantic inventory/production/drift, PR-review/configuration and Turn-lane fence tests passed with Node 22.
• Ruff, kernel mypy (22 source files), docs governance and explicit combined-contract consistency checks passed.
• Exact five-PR candidate d8c8988b35a40d7f9784462967d3b14391d6ce75 passed 467 Python tests plus 187 plugin tests; plugin typechecking/build and lifecycle/docs smokes also passed. The Python set includes real executor/journal, controller/quota, Goal collection/Markdown, interpreter discovery and the previously failing chat/change-window regressions.

The combined result is local validation evidence, not an independent approval or a main merge. #4461 is closed as the superseded initial proposal. No frontend/settings companion is needed for the producer owner adoption: existing wire values and payload shapes remain unchanged. New-head CI/review remains required.

[songoow]

Maintenance update at 0ee28317af347c3daeb503a43ab0662d059a37ac.

Merged main edcddc7aa and regenerated the inventory; all 72 semantic inventory/production/drift tests passed with Node 22. The only conflict with main was the generated inventory. The newer main 1d8a72522 also composes without conflict. Budgets and producer evidence rules are unchanged.

#4461 is now closed as the superseded initial proposal, matching this PR's stated replacement scope; its branch/discussion are preserved.

Cross-PR coordination: a local integration preview combining #4360, #4457, #4459 and this PR encounters semantic conflicts in the bilingual RFC, drift smoke, inventory, vocabulary registry and drift tests. Suggested sequence is #4457 / #4459 before the producer layer, with exact-head reconciliation after each landing; #4360 is independently ready for review. This records a composition hold, not a claim that the combined candidate passed. Current individual-head CI/review remains authoritative; no PR was merged.

[songoow]

Coordinated semantic chain and combined validation

The previously reported six-file composition hold is resolved. The source branches now encode the dependency chain #4457 → #4459 → #4480 instead of leaving overlapping semantic edits for the eventual merger. #4360 and #4482 remain independent sources in the combined validation candidate.

PR	Exact included head	Coordination role
#4360	d70419e42583c3ac287e4ce690638f27cbfe0aff	Goal lifecycle readout
#4457	d12be19c5666c7cd3ed61fc57571dc93eeee3d3b	Proof-domain/candidate-label foundation
#4459	f1c3a83a046763eee5f0548dc1699f5ad94744a4	Includes #4457; review evidence and repair guidance
#4480	bf74194a2876188a5035c68a49ddaf57c5e9a439	Includes #4459/#4457; bounded producer implementation
#4482	db58562bf8db078504006f02af6f8a10f3863849	Python runtime/developer entrypoints; author head preserved

Base: main 675a9e50b43295c8dd97fe9e09a1fd23b744c578. Local combined candidate: d8c8988b35a40d7f9784462967d3b14391d6ce75.

The merge resolution retains the corrected proof domains and advisory candidate metadata, the current-checkout uv run repair instructions, and the producer scope/decoder/return checks and their negative tests. The generated inventory is recomputed for the combined tree. No semantic budget or scan scope was relaxed.

Validation on the combined candidate:

• 467 Python tests passed, including semantic/review contracts, lifecycle collection and Markdown, executor/journal, controller/quota, Python discovery, and chat/change-window regression paths.
• 187 DSH plugin tests passed, including real admission/closeout integration.
• Plugin TypeScript checks, packaged host/client build and client artifact smoke passed.
• CI-scoped Ruff, kernel mypy (22 source files), docs governance and lifecycle smoke passed.
• Integration-branch readback is in_sync, sync_required=false; the supplied candidate contains the exact base and all five source heads.

CI follow-up: reused #4482’s four-line unbound-channel fixture correction in #4360 and the semantic prerequisite chain. The shadow-CLI crash-gap case passed on an isolated rerun and the full shadow-CLI module passes in the combined candidate; no unproven root-cause claim is made for the old CI failure.

The PR descriptions now name prerequisites and review-specific comparison ranges. Land the semantic chain in the stated order, with the normal exact-head CI/review gates. Source pushes were fast-forward updates; no force push, protection bypass or merge to main was performed. #4461 remains superseded by #4480.

中文：六处组合冲突已实际解决；三条语义 PR 已建立依赖提交关系。整组候选通过 654 项测试及类型/构建检查，集成状态回读为 in_sync。这份证据对应表中准确提交；新提交的远端 CI 和独立评审仍需正常完成。

[songoow]

Closing as superseded by #4494 / 关闭：已被 #4494 取代

English: #4494 (merged as 75fcd5556, same area — separating owner membership from production evidence) landed a strictly more complete version of this slice. Evidence at upstream/main@4aaad69bd:

File	This branch	main	Branch-only
tests/architecture/test_semantic_python_production.py	17 cases	35 cases	0
tests/architecture/test_semantic_production.py	13 cases	20 cases	0
tests/architecture/test_semantic_vocabulary_drift.py	11 cases	17 cases	0

comm -23 over each file's test names returns empty, and loopx/semantics/production.py / python_production.py carry no branch-only function. Merging produces 12 add/add conflicts whose main side is the superset in every case. Superseded work: production.py +124 branch vs +219 main, python_production.py +246 vs +436.

中文: #4494（已合并为 75fcd5556，同一领域——分离 owner 归属与生产证据）落地了本切片的严格超集。在 upstream/main@4aaad69bd 上验证：三个测试文件的用例名做 comm -23 全部为空，生产模块也没有分支独有函数；合并产生的 12 处 add/add 冲突中 main 侧每处都是超集。本 PR 的独立增量已归零。

The M1 evidence obligations this PR addressed are recorded as satisfied on main by #4494; remaining M1 work (B1 scope, B2 producer pilot) is tracked in #4447.