Repair readiness output writes and witness-state validation

.github/workflows/register-execution-readiness.yml

@@ -32,6 +32,8 @@ jobs:
           PYTHONDONTWRITEBYTECODE: '1'
         run: |
           set -euo pipefail
+          python -B -S -m unittest discover -s reviews/register_execution_readiness_20260930 -p 'test_*.py' -v
+          python -B -O -S -m unittest discover -s reviews/register_execution_readiness_20260930 -p 'test_*.py' -v
           python -B -S reviews/register_execution_readiness_20260930/execution_dryrun.py --mutants
           python -B -S reviews/register_execution_readiness_20260930/execution_dryrun.py --skip-old-node-move
           python -B -S reviews/register_execution_readiness_20260930/execution_dryrun.py --selector-node-only

reviews/c6_witness_collision_reconciliation_20260929/RECONCILIATION.md

@@ -31,6 +31,16 @@ with `RESULTS.json` in the baseline state and with `RESULTS_INSTALLED.json` in t
 installed selector table is accepted only when the graph carries the proposal, and the open witness node may carry none
 of its proposed edges (mutants `selector-ahead`, `witness-edges-partial`; four added in all). Nothing in §§1–7 changes. The §1a register-equivalent alternative (no separate
 residual node) is not an accepted installed state, since Math-#173 presupposes the separate node.
+v1.9 (C110 engineering successor, 3 October 2026; OpenAI/Codex delegated executor
+`/root/c99_custody_audit`, author of this repair after its original-head review): the old witness must remain
+literally `controlling: false`; proposed Boolean fields cannot be satisfied by integers; and an edge on a proposed
+endpoint pair must carry an exact proposed relation/Boolean-required tuple. The historical required edge from the
+witness to `math.d5-component.offpin-second-moment-review` remains allowed alongside the separately proposed
+supporting edge to that same target. This prevents malformed edges from being mistaken for absent proposal edges.
+The bounded state and full-checker regressions live outside this sealed packet at
+`reviews/register_execution_readiness_20260930/test_witness_states.py`. Accepted baseline and installed outputs
+remain unchanged. This repair does not expand the checker to a universal graph validator, change any mathematical
+proposal or execute the register; successor acceptance requires separate review. Independence count: 0; human review: NONE.
 **Effect:** register reconciliation, **declarative only**. This record introduces **no new mathematical claim**. It binds
 the merged C6 chain to exact bytes, quotes the open obligation as the register recorded it, states which reviewed
 theorem discharges that obligation and at what scope, states precisely what is *not* discharged, and proposes the

reviews/c6_witness_collision_reconciliation_20260929/SOURCE_FILES.json

@@ -16,9 +16,9 @@
     },
     {
       "path": "RECONCILIATION.md",
-      "bytes": 44686,
-      "sha256": "81db346cb7594d8b284b548d1de052bac31041034d30f739fa87bb51d3225851",
-      "git_blob": "63599b6258045793979986e5c89e466b9fc4e5e5"
+      "bytes": 45762,
+      "sha256": "ce5ab424c3c7289c1548221956055f0d8f4404ec60a5de5d1293135745df2fde",
+      "git_blob": "efd6aa656f1877aca66ff2969214228cf66c3fbf"
     },
     {
       "path": "RESULTS.json",
@@ -28,9 +28,9 @@
     },
     {
       "path": "reconciliation_check.py",
-      "bytes": 35466,
-      "sha256": "9560763b3c8499f77b033ca9b77d24f1a5374e1283b0ce2e385b17eafb372860",
-      "git_blob": "6e8a0f6e663ebdbd8052dc5d435927234776046a"
+      "bytes": 36795,
+      "sha256": "ec5c919812e2765892df0e5a3eb512c696427483cabd2960feb8a9da72d03f9b",
+      "git_blob": "94058a013fde66f3413df8a46e8d5d86632e33f7"
     },
     {
       "path": "RESULTS_INSTALLED.json",

reviews/c6_witness_collision_reconciliation_20260929/reconciliation_check.py

@@ -190,7 +190,7 @@ def check_verdicts(root):
 def check_obligation(root):
     graph = json.loads((root / GRAPH).read_text(encoding="utf-8"))
     node = graph["nodes"].get(WITNESS)
-    if not node or node.get("kind") != "region":
+    if not isinstance(node, dict) or node.get("kind") != "region" or node.get("controlling") is not False:
         return False
     if node.get("classification") == "OPEN_ACTIVE":
         ok = node.get("fingerprint") == "eta->0 mutual witness separation"
@@ -246,7 +246,9 @@ def check_negatives(src):
 
 
 def matches(live, fields):
-    return isinstance(live, dict) and all(live.get(k) == v for k, v in fields.items())
+    return isinstance(live, dict) and all(live.get(k) == v and
+                                         (type(v) is not bool or type(live.get(k)) is bool)
+                                         for k, v in fields.items())
 
 
 def installed_state(graph, proposed_nodes, proposed_edges):
@@ -257,7 +259,8 @@ def installed_state(graph, proposed_nodes, proposed_edges):
     node on a proposed source. 'installed': every node present, every edge not leaving the witness node live, and the
     witness node OPEN_ACTIVE with none of its proposed edges live (step 4 pending) or PROVED_REVIEWED with all of them
     live and their required targets PROVED_REVIEWED (Codex 4143661519). 'baseline': nothing of the proposal live.
-    Anything else is 'partial' and rejected."""
+    The old witness must remain literally noncontrolling. Edges on a proposed endpoint pair must match a proposed
+    tuple with a Boolean required flag, or the one preserved historical offpin edge. Anything else is 'partial'."""
     nodes = graph["nodes"]
     proposed = {n["id"]: n for n in proposed_nodes}
     present, mismatched = set(), set()
@@ -279,19 +282,30 @@ def installed_state(graph, proposed_nodes, proposed_edges):
             mismatched.add(nid)
     live_edges = {(e["from"], e["to"], e["required"], e["relation"]) for e in graph["edges"]}
     wanted = {(e["from"], e["to"], e["required"], e["relation"]) for e in proposed_edges}
+    # Count exact proposed edges only after rejecting malformed edges on their endpoint pairs. Otherwise, e.g.
+    # required=False in place of True vanishes from the intersection and masquerades as an untouched open witness.
+    # The baseline already carries this required offpin edge; section 7 separately proposes a supporting edge to
+    # the same target. Preserve both distinct relation slots rather than rejecting the historical tuple.
+    historical = (WITNESS, "math.d5-component.offpin-second-moment-review", True, "requires_evidence")
+    pairs = {(e[0], e[1]) for e in wanted}
+    allowed = wanted | {historical}
+    edges_ok = all(type(e["required"]) is bool and
+                   (e["from"], e["to"], e["required"], e["relation"]) in allowed
+                   for e in graph["edges"] if (e["from"], e["to"]) in pairs)
     wit_edges = {e for e in wanted if e[0] == WITNESS}
     other = wanted - wit_edges
     n_other, n_wit = len(other & live_edges), len(wit_edges & live_edges)
     wit = nodes.get(WITNESS) if isinstance(nodes.get(WITNESS), dict) else {}
     cls = wit.get("classification")
+    noncontrolling = wit.get("controlling") is False
     targets_ok = all(nodes.get(e[1], {}).get("classification") == "PROVED_REVIEWED" for e in wit_edges if e[2] is True)
     if MUT == "witness-edges-partial":
         wit_ok = cls == "OPEN_ACTIVE" or (cls == "PROVED_REVIEWED" and targets_ok)
     else:
         wit_ok = (cls == "OPEN_ACTIVE" and n_wit == 0) or (cls == "PROVED_REVIEWED" and n_wit == len(wit_edges) and targets_ok)
-    if not mismatched and set(present) == set(proposed) and n_other == len(other) and wit_ok:
+    if edges_ok and noncontrolling and not mismatched and set(present) == set(proposed) and n_other == len(other) and wit_ok:
         state = "installed"
-    elif not mismatched and not present and n_other == 0 and n_wit == 0:
+    elif edges_ok and noncontrolling and not mismatched and not present and n_other == 0 and n_wit == 0:
         state = "baseline"
     else:
         state = "partial"

reviews/register_execution_readiness_20260930/README.md

@@ -1,5 +1,12 @@
 # Register execution readiness — Math-#167, #160 and #173 against their own checkers after execution
 
+**C110 engineering successor (3 October 2026).** OpenAI/Codex found further
+maintenance-output and witness-state defects at PR183 head `0efd00e`. The original
+six review repairs remain distinct from these new findings. The successor adds
+executable regression controls in this directory; they run in both Python modes
+before the three existing composition checks. No mathematical proposal, live
+register, selector table or scientific status is executed by these repairs.
+
 **Object:** REGISTER-EXECUTION-READINESS-20260930-v1.
 **Author:** Anthropic Claude, Claude Code session `session_017Mi3hxjaxV45x6zo6o1ee3` — the same session that authored the
 three records (author-side; exposure stated in §5). **Read at:** Math- `main` `dda8991` (30 September 2026; Math-#177 merged).
@@ -88,6 +95,16 @@ repository, neither inside it nor one of its parents, that does not exist or is
 deletes anything). `--write-installed-results` (maintenance of this packet) writes the pinned installed outputs only
 after every checker, both interpreter modes and, if requested, every mutant have passed.
 
+Maintenance also rejects symlinks in destination paths and nonregular existing
+outputs, prepares all new outputs and recovery copies before replacing any pin,
+and restores prior bytes on recoverable replacement failure. It preserves file
+permissions and does not write through a hardlink to another name. If restoration
+itself fails, the command fails explicitly and retains the named recovery copy.
+Use an exclusively owned checkout: this is not crash-atomic across three files
+and does not provide exclusion against a concurrent writer. A write error gives
+`repository_written: null` (inspect the error/recovery report); a successful write
+gives `true`, and an ordinary dry run gives `false`.
+
 ```
 python -B -S reviews/register_execution_readiness_20260930/execution_dryrun.py --mutants
 python -B -S reviews/register_execution_readiness_20260930/execution_dryrun.py --skip-old-node-move

reviews/register_execution_readiness_20260930/execution_dryrun.py

@@ -32,9 +32,11 @@
 import hashlib
 import importlib.util
 import json
+import os
 import pathlib
 import re
 import shutil
+import stat
 import subprocess
 import sys
 import tempfile
@@ -164,6 +166,85 @@ def compose(out, skip_old_node_move, selector_node_only):
     return report
 
 
+def write_installed_outputs(root, outputs):
+    """Prepare all pins before replacing any; roll back recoverable install failures.
+
+    This maintenance operation requires an exclusively owned checkout. It is not
+    a cross-file atomic transaction against process termination or another writer.
+    Symlink paths are rejected; replacing a regular hardlinked pin preserves its
+    other names. A failed rollback retains its backup and reports its location.
+    """
+    root = root.resolve()
+    originals, modes = {}, {}
+    for name, (folder, _) in PACKETS.items():
+        target = root / folder / "RESULTS_INSTALLED.json"
+        relative = target.relative_to(root)
+        for i in range(1, len(relative.parts) + 1):
+            part = root.joinpath(*relative.parts[:i])
+            if part.is_symlink():
+                raise ValueError("symlink output path rejected: " + str(part))
+        if not target.parent.is_dir():
+            raise ValueError("output parent directory missing: " + str(target.parent))
+        if target.exists() and not stat.S_ISREG(target.stat().st_mode):
+            raise ValueError("regular output file required: " + str(target))
+        originals[target] = target.read_bytes() if target.exists() else None
+        modes[target] = stat.S_IMODE(target.stat().st_mode) if target.exists() else 0o644
+
+    temporary, retained, staged, backups, installed = [], set(), {}, {}, []
+
+    def stage(target, data):
+        fd, name = tempfile.mkstemp(prefix=".installed-result-", dir=target.parent)
+        path = pathlib.Path(name)
+        temporary.append(path)
+        with os.fdopen(fd, "wb") as stream:
+            stream.write(data)
+        path.chmod(modes[target])
+        return path
+
+    primary_error = None
+    try:
+        for name, (folder, _) in PACKETS.items():
+            target = root / folder / "RESULTS_INSTALLED.json"
+            staged[target] = stage(target, outputs[name])
+            backups[target] = stage(target, originals[target]) if originals[target] is not None else None
+        try:
+            for target, replacement in staged.items():
+                os.replace(replacement, target)
+                installed.append(target)
+        except BaseException as error:
+            failures = []
+            for target in reversed(installed):
+                try:
+                    if backups[target] is None:
+                        target.unlink()
+                    else:
+                        os.replace(backups[target], target)
+                except OSError as rollback_error:
+                    if backups[target] is not None:
+                        retained.add(backups[target])
+                    failures.append(str(target) + ": " + str(rollback_error)
+                                    + "; backup=" + str(backups[target]))
+            if failures:
+                raise RuntimeError("output rollback incomplete: " + "; ".join(failures)) from error
+            raise
+    except BaseException as error:
+        primary_error = error
+        raise
+    finally:
+        cleanup_errors = []
+        for path in temporary:
+            if path not in retained:
+                try:
+                    path.unlink(missing_ok=True)
+                except OSError as error:
+                    cleanup_errors.append(str(path) + ": " + str(error))
+        if cleanup_errors:
+            prior = (str(primary_error) if primary_error is not None
+                     else "output installation completed")
+            raise RuntimeError(prior + "; temporary cleanup incomplete: "
+                               + "; ".join(cleanup_errors)) from primary_error
+
+
 def run_checkers(root, out, mutants, write_installed):
     """Run every checker (both interpreter modes, and every mutant if asked) on the executed copy; then, only if all of
     that passed, write the pinned installed outputs if asked; then compare with the pinned files."""
@@ -197,12 +278,18 @@ def run_checkers(root, out, mutants, write_installed):
             valid &= not not_rejected and len(rejected) == len(names)
         results[name] = entry
         outputs[name] = outs[("-B", "-S")]
+    if write_installed and valid:
+        try:
+            write_installed_outputs(root, outputs)
+        except (OSError, ValueError, RuntimeError) as error:
+            for entry in results.values():
+                entry.update(written=None, write_error=str(error), matches_RESULTS_INSTALLED=None)
+            return False, results
     ok = valid
     for name, (pdir, script) in PACKETS.items():
         entry = results[name]
         pinned = root / pdir / "RESULTS_INSTALLED.json"
         if write_installed and valid:                       # never on a failed run (Codex 4143661525)
-            pinned.write_bytes(outputs[name])
             entry["written"] = str(pinned.relative_to(root))
         elif write_installed:
             entry["written"] = None
@@ -260,7 +347,9 @@ def main():
             shutil.rmtree(tmp, ignore_errors=True)
     payload = {"object": "REGISTER-EXECUTION-DRYRUN-20260930-v1", "scenario": scenario, "composition": report,
                "checkers": checkers, "mutants_run": args.mutants, "passed": bool(composed and ok),
-               "scientific_effect": "NONE", "repository_written": bool(args.write_installed_results),
+               "scientific_effect": "NONE", "repository_write_requested": bool(args.write_installed_results),
+               "repository_written": (None if any("write_error" in entry for entry in checkers.values())
+                                      else any(entry.get("written") for entry in checkers.values())),
                "meaning": "composition of three declarative proposals on a scratch copy; validation by the hard gate; the "
                           "records' own checkers in their installed state; not an execution, not acceptance"}
     print(json.dumps(payload, indent=2, sort_keys=True))