[Phase 16] S8 — Run-scoped effective state and provenance #894

Roadmap · Phase 16, step S8 · size XL · 4 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:518-551

Summary

Artifact producers and estimators re-interpret the original config instead of consuming this run's observed effective state, and the provenance that does exist is bound to a module singleton instead of the run. The model card misses DoRA, PiSSA and rsLoRA in all three of its surfaces, and the manifest's training_parameters.dora is False for method: dora, contradicting the same manifest's adapter_method — an internally inconsistent compliance artefact.

Units

Decisions this step executes

• C-6 — keep model_lineage.quantization meaning "requested" and add quantization_effective beside it.
• C-7 — effective fields when no training run occurred: a "not_observed" sentinel.
• C-9 — training.gradient_checkpointing does not become a real field; delete fit-check's invalid recommendation.

Plan

• Record the run's effective state in ForgeTrainer and pass it to the card and manifest producers as a parameter — do not add CARD→MODEL or COMPLIANCE→MODEL import edges (architecture.md has none).
• forgelm --compliance-export without a training run writes the "not_observed" sentinel.
• No fixture mass-regeneration: each regenerated golden fixture needs a named reason.

Exit criteria

• A 4×2 matrix (lora.method × CUDA available/absent, load_in_4bit) proves the card and the manifest name the method and quantization actually applied, with the requested value kept in its own field.
• Runs A→B and B→A in one process produce manifests with no cross-contamination.
• A failed merge_and_unload() is visible identically in the audit log, the card and the manifest.
• Every YAML snippet fit-check emits validates against ForgeConfig.
• A directory fingerprint changes on content change and not on traversal order.
• A test enumerates all loader surfaces, so a new one cannot be added silently.

How to deliver

• One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
• A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
• Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
• A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
• Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}