Add the PLAN-123 citation-trust foundation: fail-closed evidence contract, six first-wave packets, and resolved-configuration bindings - #3445

Address two independent review passes on d0cb640:

- Close the bypass where a manifest lane could satisfy the evidence check
  with a file the packet checks never reached: every lane-referenced path is
  now validated wherever it sits, and prose, non-JSON files, paths outside
  evidence/, negative controls, and duplicate packet owners are rejected.
- Make "unsupported is never silently zero" an enforced rule rather than a
  promise: every exact zero inside a measured metric group must be typed
  {status: unsupported, reason} or declared in measured_zero_fields, and
  spelled placeholders, nulls, NaNs, dangling raw_paths, empty measurement
  windows, and empty-container metrics now fail.
- Fix the packets that violated it. StepMetrics.last_step_residual is
  structurally zero on the rigid contact path (recordSolverDiagnostics takes
  residual = 0.0 and no rigid call site passes one) and the boxed-LCP branch
  records no iteration count at all, so both are now typed unsupported with
  their source citations in scripts/citation_packet_utils.py instead of being
  published as measurements.
- Distinguish mechanism from deviation in CT-001: record which isotropy
  criterion fired, test the antisymmetric friction-pyramid signature, and
  gate the disposition on physical validity so a degenerate run cannot
  strengthen a "reproduced" verdict.
- Add CT-002 dense inelastic contact (reproduced: sequential impulse at
  dt=4 ms is still moving at the 2 s horizon) and CT-003 dense elastic
  contact (unresolved: no energy injection and no solver failure, recorded as
  an honest negative result rather than a refutation of the original report).

Tests grow to 68 cases covering the bypass and each new rule.

Round-2 verification found the first dense-contact packets still overclaimed:

- CT-002's verdict rested on one cell crossing a hardcoded settle-speed
  threshold, but that speed is bit-exactly linear in dt (speed/dt identical
  to 17 digits across timesteps), which is converging integrator residual
  rather than instability. The packet now computes the dt-linearity and
  refuses to count a dt-linear excess as instability.
- In its place CT-002 gains a real oracle: total mechanical energy must not
  rise once the pile has settled. Sequential impulse gains 1.0e-3 J (2 ms)
  and 1.3e-3 J (4 ms) per step against a 1.8e-4 J tolerance while boxed LCP
  stays at or near zero, so the reproduced signal is now specific, small,
  non-divergent, and attributed to a solver rather than to a threshold.
- configuration.resolved_provenance claimed per-cell assertion of four fields
  while only the contact solver was checked, and the recorded timestep was
  the first cell's for every cell. Resolved identity is now keyed per cell
  with contact solver, timestep, and gravity each asserted, in all three
  packets and on release-6.20.
- solver_iterations_by_method() keyed "unsupported" off the method name, so
  a genuinely recorded count would have been laundered as unsupported; it now
  keys off the observed value.
- CT-002 cited an energy-monotonicity oracle it did not have, and CT-003's
  envelope maximum was its own seed. Both are now transparent.

Passive 4-link pendulum chain with no contact and no control, released from
rest and swept over four timesteps for both multibody integration families.
A passive chain conserves total mechanical energy exactly, so the oracle is
solver-neutral: relative energy drift versus timestep, summarized by the
least-squares log-log slope.

Measured: SEMI_IMPLICIT drift falls 5.68e-1 -> 6.47e-2 and VARIATIONAL
8.70e-2 -> 1.05e-2 as dt goes 4 ms -> 0.5 ms, observed slopes 1.04 and 1.02.
Both families stay finite and converge, so the convergence half of the row is
reproduced.

The packet explicitly does not cover the row's 'at matched cost' half: no
timing methodology was applied, performance is typed unsupported, and no
ranking between the families is claimed. Angular momentum is reported as an
observed envelope, not a conservation oracle, because gravity exerts a torque
about the world origin.

Final independent review found two majors:

- A genuine gate bypass: a non-string entry in a lane's evidence list was
  silently dropped, so evidence: [{"path": ...}] on a closed lane validated
  with zero errors, skipping the missing-packet, not-JSON, outside-evidence,
  negative-control, and two-review checks. This is the same shape as the
  subdirectory bypass an earlier round fixed. Non-string entries now fail.
- CT-004's disposition was reproduced on an oracle unrelated to the cited
  claim. The corpus defines reproduced as "the claimed behavior is observed";
  CT-004's claim is a methodological prescription about comparison at matched
  cost, and this packet measures no cost, so none of its content was observed.
  The row is now unresolved, following CT-003, and the convergence result it
  did establish is published as a finding that explicitly does not promote it.

Also from that review: raw_paths accepted a directory, negative controls in a
subdirectory were enumerated by neither loop, and scene.digest was
format-checked but never recomputed from the parameters the packet publishes
(a hand-edited scene used to pass). CT-004's relative drift is disclosed as
gauge-dependent, CT-001's claim boundary now leads with its observed outcome,
CT-002 publishes the basis of its energy tolerance, and writers carry forward
recorded review passes instead of erasing them on every regeneration.

Tests grow to 72 cases.

A 4-link chain hanging under gravity tracks a sinusoidal joint reference,
swept over four timesteps for both multibody integration families.

The fixture needed four iterations, and the reason is worth recording: a
fixed-gain diagonal PD saturated its torque limit in every cell and diverged
at the coarser timesteps, so it measured the controller rather than the
integrator. A direct probe showed why -- the root joint of a serial chain
sees a far smaller articulated inertia than the composite rigid-body inertia
used to size its gains, so gains stiff enough for the root were unstable
while the tip tracked fine. Replaced with a computed-torque controller built
on Multibody.compute_inverse_dynamics, which gives every configuration the
same closed-loop bandwidth: no saturation, max torque 143.7 Nm, RMS error
about 1% of the reference amplitude.

The result is substantive. Refining the timestep eightfold does NOT reduce
tracking error (2.14e-3 rad at 4 ms versus 2.41e-3 rad at 0.5 ms) while
control work rises monotonically, so the error is controller-limited rather
than integration-limited and the row's premise -- a whole-step speed/accuracy
tradeoff -- is not the simple 'smaller timestep is more accurate' shape.

Disposition is unresolved: the cited claim is about a speed/accuracy
tradeoff and this packet measures no step cost. constraint_error is typed
unsupported because the scene has no constraints to violate.

The docs-policy gate caught the dashboard entry growing to 17 lines against
its own 15-line Next step budget, which is exactly the drift that budget
exists to prevent: each landed packet had been appended to the operating view
instead of to a history owner.

Per the dashboard's own rule, the accumulated WS0/WS1/WS2 narrative and the
review record now live in a Progress log section of the owner plan, and the
dashboard keeps the current action plus a History pointer.

Every packet had been recording resolved solver identity by reading back the
option it had just set, which cannot distinguish a method that ran from one
the World silently substituted. Three review rounds named this as the gap
behind the typed-unsupported markers.

World::getResolvedConfiguration() already existed in C++ but was unreachable
from Python. This binds ResolvedConfigurationNote and
ResolvedSolverConfiguration, adds the World.resolved_configuration property,
and threads it through every packet: each run now records, per domain, what
was requested, what actually resolved, why, and whether it was a
substitution. Verified on a live World -- empty before bake, four domains
after, and the recorded rigid-contact resolution follows the requested
contact solver.

Stub scope: pixi run generate-stubs rewrote 1990 lines across eight files
because the committed stubs were already stale relative to the build. That
churn is reverted and only the 37 lines this change needs were added by
hand; the pre-existing drift is left for its owner rather than swept in.

The remaining WS4 gap is a comparable per-solve residual, which still does
not exist and stays typed unsupported in every packet.

…lure

Establishes the baseline arm the WS5 exact-cone GO/NO-GO needs: a two-box
stack at rest, upper mass swept over four decades, both contact solvers, two
deterministic repeats per cell.

The row stays unresolved -- the cited claim is comparative and no exact-cone
arm exists on this branch -- but the baseline is not a null result.
SEQUENTIAL_IMPULSE, the World's default contact solver, holds the stack at
mass ratios 1 and 10 (relative closure 1.4e-4 and 1.0e-3) and fails
completely at 100 and 1000: the heavy box descends 0.20002 m, exactly one box
height, while the light box beneath it moves by microns, and the pair comes
to rest fully interpenetrated at near-zero velocity. BOXED_LCP holds the same
stack across all four decades (3.3e-5 to 3.0e-4). Both outcomes are
bit-identical across repeats, and the scene starts with exactly zero overlap,
so the closure is produced by the solve.

This is consistent with iterative Gauss-Seidel contact under a fixed
iteration budget, which is what makes it credible rather than a fixture
artifact, but the packet does not claim the mechanism: confirming it needs
the per-solve residual WS4 has not exposed. It needs a maintainer decision on
the default path and is the strongest WS5 GO input so far.

The gate rejected an untyped null for the 'no failure onset' case on the
first attempt; that is now a typed unsupported marker.

Working copy of the GitHub issue for the sequential-impulse high-mass-ratio
failure, with a standalone repro script (verified against the current build:
the heavy box descends to full interpenetration in about one second at
ratio 100 while boxed LCP holds the gap at 1e-5 m) and the sweep table from
the CT-007 packet. Posting needs maintainer approval; the draft lives in the
dev-task folder until that decision is made.

…s covered

The RobotDART row's restore-equivalence half, measured with a seven-arm
protocol over a contact-rich five-sphere pile, both contact solvers, every
continuation hashed bit-exactly over the full state vector, and the whole
protocol repeated twice and required identical.

Finding: World.state_vector restore is not a function of the restored state
once the world has contact history. In-place restores diverge from the
original continuation at the FIRST post-restore step and depend on how much
history preceded the restore -- two restores of the same snapshot differ
from each other. Meanwhile fresh-world restores of the same vector are
bit-exact and repeatable, identical histories agree, pre-contact history is
harmless, and the ballistic control is exact. Everything is deterministic
given full history: this is hidden result-affecting contact state surviving
the restore, not nondeterminism. Deactivation was ruled out by probing
(nothing asleep; disabling it changes nothing), and update_kinematics()
changes nothing. Both solvers are affected identically, pointing at shared
contact-pipeline state.

This is the design doc's 'reset semantics must explicitly choose whether
solver/contact history is preserved' requirement observed unmet, the
concrete motivation for WS3 contact ordering/identity, and the second
maintainer-decision finding of the campaign (issue draft included alongside
the CT-007 one).

Disposition stays unresolved: the corpus row is a requirements claim, and
reset cost, allocation, and concurrency are typed unsupported. The gate
rejected first_divergent_step: 0 until it was declared a measured zero --
which it genuinely is.

…t-foundation

…design

The WS3 mechanism hunt closed in three probes. At the identical restored
state only local_point_a differs between in-place and fresh worlds, and the
in-place value is a body-frame anchor of a rotated sphere.
World::getStateVector() stores position and linear velocity only per rigid
body (the header documents the dense order as 'dynamic rigid-body
translations', built for the differentiable path), and the decisive probe
shows it directly: 30 entries for the five-sphere scene, and after restoring
the same vector the in-place sphere keeps a rolled orientation and ~7 rad/s
spin while the fresh sphere sits at identity with zero spin.

So the CT-011 divergence is a partial restore by design, not hidden contact
state: orientation and angular velocity are never captured, and friction
couples the retained rotational state into the continuation. Contact history
mattered only because contact is what makes spheres spin. The packet,
manifest, verification log, and the posted issue #3443 (body updated with
approval, as part of the approved posting workflow) now state the identified
mechanism; the earlier contact-pipeline hypothesis is recorded as ruled out
rather than silently replaced.

The first contact solve is now inside the gate; every cell still
passes physical validity and the disposition is unchanged
(reproduced).