{397.2} Harness shape — the rebased nightly lane

{397.2} The rebased lane’s harness shape

Status: RATIFIED — {397.3} owner board, S513 (walk-trigger model ruled W2; board preserved at reports/s513-id397-lane-target-board.html). Specifies staging cadence, walk trigger model, and census comparability. Executed by the S2-execute mint. Companion: TRIAGE.md §5 new mints (NM-1..8) and §8 rulings record.

§1 Staging cadence — the run skeleton

Per nightly run, in order (deltas from today marked Δ):

1. Δ Pre-run sweep (D1, id-396/TECH.md:100-111): delete fixture-prefixed rows (VERIFY-* + declared per-test dest prefixes); CASCADE takes derived rows. Asserted, not just performed (NM-6): the sweep step fails the run if its scope guard would touch a non-fixture row. Showcase/platform data never sweep-eligible.
2. Baseline staging: verify_driver --fixtures templates over the manifest’s staging_mode: verify-driver set — unchanged mechanism (id-62 Inv-7..12).
3. Δ Lineage staging (NM-1/NM-2): the ingest-once and keep-and-watch proof fixtures staged with class-tagged dest prefixes; their assertions run at fixed points (§3).
4. Per-test staging: stageFixture with declared dest prefixes (staging_mode: per-test), byte-faithful, distinct-bytes by default; same-bytes only for the hash-identity population (id-396/TECH.md:76-86).
5. Vitest assertion pass (sequential), then teardown. dropFixture stays as hygiene (demoted, TRIAGE §3.8).

§2 Walk trigger model — the OQ-397-3 fork

Today: one initial /walk + a 10 s background pump re-POSTing for the whole Vitest run (cocoindex-nightly.yml:709-729) — uncontracted, and the direct mechanism behind the op_id moving-target failures (TRIAGE §4: #3, #13, #15, #18).

Option	Shape	Solves	Costs
W1 — pump + quiescence gate	Keep the pump; add a test-visible “walk N complete, no newer started” primitive	(b) races, partially	Pump keeps re-stamping under fork Option B — quiescence windows shrink toward zero as corpus grows; gate is fighting the pump it depends on
W2 — explicit awaited walks (RATIFIED)	Delete the pump. stageFixture (and the driver) gain stage → request /walk → await completion; the awaited walk is the test’s attribution anchor	(b) fully; (a) attribution (the test knows which walk absorbed its fixture); (d) bounded by sweep + small corpus	More walk invocations per run; under fork Option B each walk is O(corpus) — acceptable at ≤ ~40 mock-tier files, and fork Option A makes later walks memo-cheap; diverges from production’s live-watch shape (mitigation below)
W3 — live-mode watch	update_blocking(live=True) matching production __main__.py	Shape parity with production	No completion signal at all — every op_id/run assertion needs the very quiescence primitive W1 lacks; flow-scope op_id unchanged; worst of both for a verification lane

RULED: W2 ({397.3} board). The lane’s job is proving corpus→rows semantics (D4 lane boundary), not the watch mechanism; production’s live-watch arming stays covered by id-62 Inv-16 (activation observability) plus one workflow smoke assertion that live=True arming occurs on container start. NM-4 then contracts the trigger model as invariants: no background re-walk during the assertion pass; every walk is requested, awaited, and attributable.

§3 Run-observation primitives (NM-5)

Minted alongside W2, replacing today’s uncontracted reads:

• awaitWalk(handle) — resolves when the requested walk’s pipeline_runs row reaches terminal status AND no newer walk is in flight; returns {op_id, status, stage_counts}. The only sanctioned way a test learns an op_id.
• Status-filtered run reads — readStageCount et al. take an explicit {op_id, status: 'succeeded'|'failed'}; the status-blind .maybeSingle() shape is retired (fixes TRIAGE #3/#18 class permanently).
• Run-selection idiom for accumulating history (id-53 Inv-13, C-54 rider): assertions bind to the awaitWalk-returned op_id, never “latest row”.

§4 Census comparability across runs

• Fixture population = the manifest. The sweep guarantees a known start population; the census reads the same manifest the guard enforces (id-396/TECH.md:45-47, 112-113).
• Per-run census read gate (NM-8): zero UniqueViolations in the sidecar log; same-bytes population green at the write path; staged-fixture row counts match the manifest (id-396/TECH.md:171-173).
• Census entry shape (id-128 journal discipline): run id, repo SHA, llm_tier, manifest hash, F/P/S counts, per-class deltas vs previous — deltas are signal only when tier AND manifest hash match the comparand.
• Telemetry accumulates by design (pipeline_runs history; comparability requires history) — no telemetry sweep, ever.
• Wiring-census coupling: any change to what the lane stages ships with a census-impact note (the lane is the live-population producer for the drop standard, census-protocol.md:127-129).

§5 Tier model

• Scheduled run stays mock. The entity-identity cluster (TRIAGE §3.4) carries an explicit quarantine marker at mock — skipped with a named reason string the census counts separately (not silently green, not honestly-red noise) — pending OQ-397-2.
• Real-tier (openrouter/anthropic) dispatch proves the quarantined cluster on demand; cadence is an owner call (cost). id-395/D2 (tier joins the pair-resolver cache key) is the prerequisite for mock-vs-real replay hygiene.

§6 Sequencing into S2-execute

1. D-397-A ruled Option C (TRIAGE §3.1): W2 attributes against the restored S265 op_id semantic; the S2-execute mint carries BOTH the context-passed-op_id engine fix (op_id via ContextKey, detect_change=False, removed from memoised kwargs) AND the Inv-9 curation-pinning mechanism.
2. S2-execute implements: the §3.1 engine fix → sweep step → W2 helpers + NM-5 primitives → pump deletion → dead-test fixes (#2, #10, #15; OQ-397-4) → [SV] substrate-verify checklist from TRIAGE §3.5 while porting each assertion → NM-1/2/3 new tests → NM-8 gate → VQ-1 embed-seam measurement.
3. First post-rebase nightly = the class-2 clean test (TRIAGE §6) and the new census baseline; S8 (e2e retire-and-replace) proceeds independently per D4.