test(capability_broker): Phase B — full-ladder evidence green, parity instrument, connection_pool flag fix

Ladder results (evidence under verification/, Read-back per the
file-based evidence protocol; summary in cb-summary.md): battery 11/0;
freeze --verify 33 cases byte-identical (fixture-pinned standalone
re-verify + self-verifying regen); live parity 468/468 (frozen=33
fuzz=421 live=14) — LIVE PARITY 100% on the gap fns; clippy -D warnings
clean; adjacent Python 107/107 in BOTH pins (delegation live and
RUNE_CAPABILITY_BROKER_CORE=python); full suite both pins: failure set
ZERO-delta vs the master baseline (118 pre-existing).

Phase B language advantages proven by the battery-after-landing:
trait CbIo IO injection (deterministic mtime pins in-test), Result
error paths, exhaustive handle_hook match, zero-copy static tables,
in-process Rust-to-Rust cs kernel delegation in _py_score_card.

Fix-first with proof: test_connection_pool's evict-oldest flag read
raw temp-dir paths so any 'a' in the random tempdir name flipped it
(~17% isolated flake, sole live full-suite delta on first run);
normalized to basenames like the status comparison — 15/15 green
after, both full-suite deltas zero. 1e4598aa instrument class.

tests/test_connection_pool.py

@@ -26,8 +26,12 @@ def _scenario(core_pin: str) -> list[dict]:
         p.get_connection(b)
         snapshots.append(("create-b", p.get_status(), None))
         p.get_connection(c)
-        snapshots.append(("evict-oldest", p.get_status(),
-                          "a" not in " ".join(p.get_status()["databases"]).lower()))
+        st_evict = p.get_status()
+        # flag must read basenames like the norm pass below — the raw-path
+        # substring form flaked on any 'a' in the random temp-dir name
+        snapshots.append(("evict-oldest", st_evict,
+                          "a.db" not in [os.path.basename(d).lower()
+                                         for d in st_evict["databases"]]))
         p.connections[b].close()  # force stale
         p.get_connection(b)
         snapshots.append(("stale-b", p.get_status(), None))

verification/cb-battery.exit

@@ -0,0 +1 @@
+0

verification/cb-battery.log

@@ -0,0 +1,24 @@
+    Finished `release` profile [optimized] target(s) in 0.01s
+     Running unittests src/lib.rs (target/release/deps/capability_broker-32625e21545245f2)
+
+running 11 tests
+test gap_battery::cards_are_stale_branch_law ... ok
+test gap_battery::cs_core_probe_and_py_score_card_contract ... ok
+test gap_battery::failio_seam_declared ... ok
+test gap_battery::handle_hook_error_and_boundary_arms ... ok
+test gap_battery::native_tool_schemas_law ... ok
+test gap_battery::py_repr_law ... ok
+test gap_battery::load_registry_missing_and_value_law ... ok
+test gap_battery::load_cards_corrupt_and_non_list_arms ... ok
+test gap_battery::load_cards_rebuild_and_degrade_arms ... ok
+test branch_battery::select_matches_frozen_oracle ... ok
+test gap_battery::gap_replays_frozen_truth_verbatim ... ok
+
+test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+
+   Doc-tests capability_broker
+
+running 0 tests
+
+test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
+

verification/cb-build.exit

@@ -0,0 +1 @@
+0

verification/cb-build.log

@@ -0,0 +1 @@
+    Finished `release` profile [optimized] target(s) in 0.10s

verification/cb-clippy.exit

@@ -0,0 +1 @@
+0

verification/cb-clippy.log

@@ -0,0 +1,2 @@
+    Checking capability_broker v0.1.0 (/mnt/workdrive/rune-wave-cd/src/rust/capability_broker)
+    Finished `release` profile [optimized] target(s) in 0.83s

verification/cb-fixture-setup.log

@@ -0,0 +1 @@
+canonical seed fixture rebuilt at /tmp/rune_cb_truth_home

verification/cb-freeze-verify.exit

@@ -0,0 +1 @@
+0

verification/cb-freeze-verify.log

@@ -0,0 +1 @@
+OK: 33 cases byte-identical against live oracle rune.capability_broker

verification/cb-full-live.exit

@@ -0,0 +1 @@
+1

verification/cb-full-pinned.exit

@@ -0,0 +1 @@
+1

verification/cb-parity.exit

@@ -0,0 +1 @@
+0

verification/cb-parity.log

@@ -0,0 +1,2 @@
+parity: 468/468 checks OK (frozen=33 fuzz=421 live=14)
+LIVE PARITY 100% on the gap-closing functions

verification/cb-py-live.exit

@@ -0,0 +1 @@
+0

verification/cb-py-live.log

@@ -0,0 +1,11 @@
+........................................................................ [ 67%]
+...................................                                      [100%]
+=============================== warnings summary ===============================
+tests/test_p1_01_capability_authority.py::test_operator_trace_record_carries_capability_fields
+tests/test_p1_01_capability_authority.py::test_operator_trace_record_carries_selected_tools
+tests/test_p1_01_capability_authority.py::test_operator_run_selects_capabilities_once
+  /mnt/workdrive/rune-wave-cd/src/rune/rune_operator.py:952: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    "observed_at": __import__("datetime").datetime.utcnow()
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+107 passed, 3 warnings in 1.29s

verification/cb-py-pinned.exit

@@ -0,0 +1 @@
+0

verification/cb-py-pinned.log

@@ -0,0 +1,11 @@
+........................................................................ [ 67%]
+...................................                                      [100%]
+=============================== warnings summary ===============================
+tests/test_p1_01_capability_authority.py::test_operator_trace_record_carries_capability_fields
+tests/test_p1_01_capability_authority.py::test_operator_trace_record_carries_selected_tools
+tests/test_p1_01_capability_authority.py::test_operator_run_selects_capabilities_once
+  /mnt/workdrive/rune-wave-cd/src/rune/rune_operator.py:952: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    "observed_at": __import__("datetime").datetime.utcnow()
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+107 passed, 3 warnings in 0.90s

verification/cb-summary.md

@@ -0,0 +1,72 @@
+# capability_broker gap-close verification summary
+
+Module: capability_broker (dichotomy wave, issue #2479 gap-cb tranche)
+Contract: contract:BUILDER-2026-10-13T16:01:25Z-9b9389-factory-gap-cb
+Worktree: /mnt/workdrive/rune-wave-cd (base 12662658)
+
+## Coverage
+
+- Module audit: 10/19 PARTIAL → **19/19 FULL** (`scripts/dichotomy_audit.py`
+  in-memory row: `{'module': 'capability_broker', 'lines': 865, 'fns': 19,
+  'matched': 19, 'side': 'RUST', 'status': 'FULL', 'missing': []}`)
+- Ported (name-preserving, gap.rs): _native_tool_schemas, load_registry,
+  _cards_are_stale, load_cards, generate_card, build_cards, _cs_core,
+  _py_score_card, match_capabilities, handle_hook
+- FFI: cb_* doc-envelope entries in lib.rs; ctypes bindings in
+  src/rune/broker_loader.py; facade delegation in src/rune/capability_broker.py
+  gated by RUNE_CAPABILITY_BROKER_CORE=python pin.
+
+## Stages (commands, exit codes, evidence)
+
+| Stage | Command | Exit | Evidence |
+|---|---|---|---|
+| build | `cargo build --release` (crate dir) | 0 | verification/cb-build.{log,exit} |
+| battery | `cargo test --release` (crate dir) | 0 — 11 passed / 0 failed | verification/cb-battery.{log,exit} |
+| truth byte-identity | `gen_capability_broker_gap_truth.py --setup` then fixture-pinned `freeze_truth.py --verify frozen_gap_truth.json --module rune.capability_broker` | 0 — 33 cases byte-identical | verification/cb-fixture-setup.log, verification/cb-freeze-verify.{log,exit} |
+| truth self-regen | `python3 scripts/gen_capability_broker_gap_truth.py` | 0 — rebuild→freeze→byte-compare→harness gate | verification/cb-truth-regen.{log,exit} |
+| live parity | `python3 scripts/check_capability_broker_gap_parity.py` | 0 — **468/468** (frozen=33 fuzz=421 live=14), LIVE PARITY 100% | verification/cb-parity.{log,exit} |
+| clippy | `cargo clippy --release --all-targets -- -D warnings` | 0 | verification/cb-clippy.{log,exit} |
+| python adjacent (live) | `pytest tests/test_p1_01_capability_authority.py tests/test_capability_broker_delegation.py tests/test_capability_fit.py tests/test_context_broker.py tests/test_orchestration_broker.py tests/test_orchestration_capability.py` | 0 — 107 passed | verification/cb-py-live.{log,exit} |
+| python adjacent (pinned) | same, `RUNE_CAPABILITY_BROKER_CORE=python` | 0 — 107 passed | verification/cb-py-pinned.{log,exit} |
+| full suite (live) | `pytest tests/` | 1 — 118 failed / 2516 passed; **failure set == master baseline** (zero delta) | verification/cb-full-live.{log,exit} |
+| full suite (pinned) | same, `RUNE_CAPABILITY_BROKER_CORE=python` | 1 — 118 failed / 2516 passed; **failure set == master baseline** (zero delta) | verification/cb-full-pinned.{log,exit} |
+
+Full-suite baseline: 118 failures pre-exist on gitea/master (verified by
+diffing the FAILED sets; both pins' deltas are empty). Exit 1 on the full
+suite is the pre-existing master state, not a regression.
+
+## Fixed during verification (fix-first, with proof)
+
+`tests/test_connection_pool.py::test_kernel_matches_oracle_floor` flaked
+~17% in isolation (2/12 runs) and was the sole live full-suite delta vs
+master on first run: the evict-oldest flag read RAW temp-dir paths
+(`"a" not in " ".join(databases)`), so any letter 'a' in the random
+tempdir name flipped it. The status comparison already normalized to
+basenames. Fixed the flag to basename form (same normalization); 15/15
+green after the fix, and both full-suite failure-set deltas dropped to
+zero. The port never touched connection_pool — pre-existing instrument
+bug (fd731bee false-failing-instrument class).
+
+## Phase B (ladder layer 6)
+
+Language advantages in the landed kernel (gap.rs), battery green after
+the landing: `trait CbIo` (+ `impl CbIo for StdIo`) injects filesystem
+IO so the battery pins mtimes deterministically without process seams;
+`Result<Json, String>` error paths mirror Python exception arms;
+exhaustive `match` in handle_hook branches; zero-copy `&'static` tables
+(semantic examples, RISK_MAP); `_py_score_card` delegates to the
+capability_scoring kernel IN-PROCESS (Rust→Rust, no ctypes marshaling).
+No cosmetic churn — every rewrite is observable-behavior-preserving and
+parity-pinned.
+
+## Divergences (documented, not bugs)
+
+- `_cs_core`'s Some arm (returns the cs_loader module handle, not JSON)
+  is excluded from the frozen envelope; the pinned-None arm is asserted
+  by the both-pins pytest, the kernel mirror by the battery.
+- load_cards corrupt-file / OSError arms: driven by the battery seam
+  test and the live parity dual-fixture layer instead of frozen truth.
+- `_native_tool_schemas` keeps the Python object graph in the facade by
+  identity (select_for_job rehydrates by ID); the Rust port is
+  battery- and parity-pinned for the stage-3 burn. Comment documents the
+  carve-out at src/rune/capability_broker.py.

verification/cb-truth-regen.exit

@@ -0,0 +1 @@
+0

verification/cb-truth-regen.log

@@ -0,0 +1,3 @@
+OK: 33 cases byte-identical against live oracle rune.capability_broker
+ 
+frozen 33 cases -> /mnt/workdrive/rune-wave-cd/src/rust/capability_broker/frozen_gap_truth.json (harness gate byte-identical)