test(formal): give feature witness histories their raw ITF states and gate the corpus at load

[lan17]

Stacked on #176, which removed the triple parse from the effects witness gate. The feature profiles had the same shape: test/formal-features.test.ts parsed every history at import for its replay, checkWitnesses(name, paths) re-read and re-parsed each file in loadCorpus, and the ten classifiers keyed on explicit inputs (runtimeWitnesses, recoveryShadowWitnesses, the five public-prefix families, recoveryReadWitnesses, runtimeBoundaryWitnesses and publicPrefixWitnesses itself) read every file a third time through readTrace and re-decoded private state through privateStates. On the generated corpus the policy, layers and shadow gates each took 2.5 to 3.5 s inside vitest locally, all of it re-reading.

Histories

formal/replay/witnesses/trace.mjs replaces privateStates with witnessStates(raw, context), which returns the raw ITF states of a history together with the private predictions decoded from them once. loadCorpus spreads that beside the parsed steps, so a feature history is { path, steps, states, predictions }: states are the raw ITF states for every profile that has classifiers keyed on explicit inputs, as #176 already made them for effects, and predictions are what the five corpus classifiers that read decoded private state (policy, recovery, independent, layers, shadow) now destructure; layers.mjs already called them predictions. Every path-taking classifier takes histories instead of paths and evaluateCorpus hands the corpus to all of them; runtimeBoundaryTraceWitnesses takes a { states } history rather than a raw ITF document. The smoke-fixture skips (states[0]?.s?.sources / phase === undefined) and every credit, checkpoint and recorder call are unchanged. checkWitnesses(profile, paths, registry) is unchanged for formal/witnesses.mjs and every port that runs the CLI.

The eight classifier unit tests and the provenance test hand histories to the classifiers directly and no longer write temp files. Type declarations gained RawHistory and PrivateHistory in trace.d.mts, and loadCorpus is typed per profile ("effects", "local-clock", any other name a feature profile).

The gate runs at load

test/formal-features.test.ts loads each profile's histories once with loadCorpus(name, paths), runs checkCorpus over that corpus at load, and keeps only { path, steps } for the replays plus the gate's missing list. The first version of this change kept the full histories at module level for the whole file; the review pass measured that at about 2.16 GB of live heap for the twelve profiles against about 216 MB on main, because every it closure pinned the raw ITF states, and showed the file dying at import under a 2 GB V8 heap where main survives. With the projection the file passes under NODE_OPTIONS=--max-old-space-size=2048 (peak RSS 1.64 GB, 4837 tests). test/formal-effects.test.ts gets the same shape. Since the gate it bodies now assert a precomputed list, the 30 s timeouts #172 added to them are gone; the evaluator's cost sits in module import, which has no per-test timeout.

Measurements

Evaluator cost in isolation on the generated corpus, locally: checkWitnesses(paths) on the #176 tree against checkCorpus(loadCorpus(paths)) now, where the second column excludes the load that the test module shares with its replays.

profile	histories	checkWitnesses(paths) before	checkCorpus(corpus) after
policy	541	2269 ms	41 ms
layers	527	3080 ms	70 ms
shadow	1031	2618 ms	204 ms
independent	519	1423 ms	40 ms
recovery	542	1039 ms	48 ms
shadow-layers	278	994 ms	36 ms
recovery-read	282	734 ms	75 ms
source-budgets	263	661 ms	27 ms
scope	266	615 ms	24 ms
runtime-boundaries	281	537 ms	22 ms
admission	134	295 ms	11 ms
local-failure	132	123 ms	9 ms

Labels, per-label provenance and history sequences from the two paths are identical for every profile. The three-file gate run (test/formal-effects.test.ts test/formal-local-clock.test.ts test/formal-features.test.ts against the full corpus) went from 32.6 s to 24.1 s, with peak RSS 2.29 GB.

Verification

The three-file gate run against the full generated corpus: 5534 tests passed, also under the 2 GB heap cap for the features file. The witness evaluator unit tests and the whole unit suite pass (3099 tests). make audit passes; no formal/*.md prose changed, so the ledgers are untouched.

node formal/witnesses.mjs evaluate --profile all: all 14 evidence files are identical to the pre-#176 snapshot except the inputs[].sha256 entries for the edited files under formal/replay/witnesses/, which change by design whenever a replay source changes. witness-report.json is byte-identical. Go's TestGeneratedWitnessEvidence and TestWitnessEvidenceBindsSharedReplaySources pass against the regenerated evidence.

Review

An adversarial review pass (three lenses, two skeptics per finding) confirmed two items, both applied: the module-level retention described above, and a historyParser comment that claimed every history keeps raw states when local-clock histories do not. Two style claims (the predictions: states destructuring alias in three classifiers, and the repeated one-line history literal in the unit tests) were refuted as pre-existing or not defects.

🤖 Generated with Claude Code