[EHotwagner]

Refs #1026 (does not close it). Repairs a latent source gap in the dormant forward Execution pair route from #1044/#1045, which blocks the parent's "hosted receiver run" prerequisite.

Problem

The forward route reused the fixed original four-receiver table (PAIR_RECEIVERS). Its two S1 receivers pin the pair at exactly [0.3.0], and their locks resolve 0.3.0:

• FS.GG.SDD@d0bb4059: Directory.Packages.local.props
• FsQuint@708587f2: FsQuint.Tooling.fsproj and the locks

The receiver jobs restore in --locked-mode against a feed that holds only the candidate packages. The join (pair_consumers) requires every lock entry to be resolved == version. So no forward version (e.g. 0.3.1) could pass a real hosted receiver run or the publisher-side receiver join. The forward controls passed only because the synthetic fixture writes locks at the candidate version.

Change

• selection.receiverSources is a new required, closed key of a forward selection:

  {"sdd-s1": {"commit": "<40 hex>"},
   "fsquint-s1": {"commit": "<40 hex>", "coreLocks": {"<the seven pinned FsQuint lock paths>": "<sha256>"}}}

  • Neither commit may be the original receiver commit or all zeros.
  • coreLocks must cover exactly the seven PAIR_SDK_SOURCE_LOCKS paths.
  • Repositories, fixture populations (71/124 and the TRX counts) and both rollback receivers stay fixed.
• eng/write-callable-cli-release-readback.py:
  • New pair_receiver_table(sources). None returns the unchanged original table.
  • pair_consumers(admission, root, receiver_sources=None) and pair_sdk_bundled_input(..., source_locks=None) take the effective table.
  • The original pair path is unchanged; the legacy suite reports identical case counts.
• eng/execution_pair_forward.py:
  • validate_selection validates the sources through the maintained table.
  • acquire_receivers passes them to the join.
  • content_id binds them.
• Tests:
  • 13 new selection refusals (including null override and any fixed receiver commit).
  • Content-identity sensitivity.
  • Acquisition controls: original-version receiver evidence is refused under a forward selection, with a causal control that drops the override and is then accepted. Evidence for another selected S1 commit or lock digest is refused. Forward evidence is refused by the original table.
• Docs: a "Forward receivers" section with the operational order. Packed bytes embed RepositoryCommit = A, so the receiver lock hashes exist only after A is fixed, and main must stay at A from candidate preparation through the receiver run.
• Atlas: coordination/execution-pair-forward-receivers.

Validation (local, Python 3.14)

• test_execution_pair_forward.py: passes. Refusals go 202 → 221 and the new acquisition-forward-receivers control is counted. real-candidate=1 (a real forward 0.3.1 candidate was prepared and reproduced on the clean tree), against shared helper 641072f5.
• test_execution_pair_release.py: passes with case counts identical to main.
• Atlas archive validates (61 records; baseline preserved).

Not done / unchanged

• The route stays disabled (enabled:false, selection:null). The admission file and workflows are unchanged.
• No dispatch, receiver branch, publication or credential effect.
• Original 0.3.0 admission, publisher, ordinals 1–4 and Unknowns are untouched.

🤖 Generated with Claude Code