Publish and enforce the cohort-final freeze

[pinin4fjords]

Parent: #1745

Predecessor: #1756 and its stacked draft PR, which performed the single typed materialization.

Reopened by the 2026-08-17 programme review follow-up with a corrected purpose: the original body's deletion targets were checkpoint-branch-only or nonexistent (see the close comment below), but final-freeze publication and enforcement is a valid separate behavioral boundary, and keeping it separate keeps #1756 within one working day. The stack remains unmerged until complete, so this split introduces no dual-ownership window on main.

Prototype evidence: draft PR #1743 and checkpoint 3f11f175, especially the nominal final-state checks in svg.py and the post-final compilation assertions in tests/test_corridor_cohort_integration.py.

Retrieving the prototype: git fetch origin refs/pull/1743/head:pr-1743-checkpoint, then read files with git show 3f11f1758f16341ace6b1409eff53a36a36ec715:<path>. Never check that branch out into your worktree.

Outcome

Publish cohort-final as the binding geometry and ownership freeze, prohibit all later mutation, bind plan-level compatibility completeness, and convert the checkpoint's replay expectations into final-freeze locks.

Estimate: 4-6 focused hours, hard maximum one working day. Use a fresh worktree based on the predecessor PR.

Starting reproduction

pytest -q -n 0 "tests/test_corridor_cohort_integration.py::test_post_freeze_stages_are_validation_only" --collect-only -q

Zero collected on the predecessor. #1746's test_post_cohort_final_mutation_is_rejected guards the generic trace boundary; this issue makes the freeze binding for cohort ownership specifically.

Scope

• svg.py: publish cohort-final (the COHORT_FINAL event from Trace final settlement and resolve seed-72 routing defects #1746, now cohort-backed with unchanged semantics: after it, validation only) immediately after Materialize accepted grants once through owner frames #1756's single typed materialization.
• Enforce the freeze: patched compiler, solver, convergence-settlement, ownership-discovery, and geometry materialization functions may raise after cohort-final without affecting validation; instrumentation records zero geometry, owner, clearance, compiler, or solver mutation after cohort-final.
• Owner sets and accepted grants cannot change after freeze; later stages perform no geometry translation.
• Bind plan-level compatibility completeness: the accepted plan contains only explicit dispositions; every compatibility component in it carries the typed whole-group provenance required since Join convergence variables into the one cohort problem #1752; a silent witnesses_complete fallback anywhere in the accepted plan fails.
• Convert the checkpoint's replay expectations into freeze locks: the checkpoint's test_curve_guard_observes_the_mandatory_canonical_replay and test_finalized_ledger_realizes_exact_keys_in_the_current_coordinate_frame asserted that replay compilation happened and reproduced ownership; their freeze property is re-expressed as test_post_freeze_stages_are_validation_only, and their geometric content is already carried by the opposing-bypass geometry lock from Retire the pre-request convergence settlement chain and land the four-case gate #1761, which must keep passing.

Non-goals

• No routing behavior expansion or acceptance-case repair.
• No compatibility adapter retaining old ownership beside the frozen plan.
• No new deletion sweep: the real legacy owners were deleted by the children that displaced them (Complete the member footprint lowering and patch publication slice #1750, Apply convergence grants mechanically and complete Seed 77 #1754, Retire the pre-request convergence settlement chain and land the four-case gate #1761, Persist the accepted cohort plan and make re-observation consume it #1755, Materialize accepted grants once through owner frames #1756); this issue proves the freeze, it does not hunt.

Code expected to become obsolete

None expected. If enforcement exposes a surviving mutation path, that path belongs to the child that owned its coordinate family; stop and repair there rather than deleting here.

Acceptance

• Instrumentation proves zero compiler/solver calls after cohort-final and proves all post-cohort-final stages are validation-only with zero geometry, owner, or clearance mutation.
• Owner sets and accepted grants cannot change after freeze.
• The accepted plan contains only explicit, provenance-carrying dispositions; no migrated coordinate sits under a legacy owner via compatibility.
• test_post_freeze_stages_are_validation_only passes; the opposing-bypass geometry lock and the four-case gate still pass.
• The behavior-changing stacked PR runs CI and the authoritative render diff; it remains draft and unmerged until the complete stack is green.

Verification

pytest -q -n 0 tests/test_corridor_cohort_integration.py -k 'final or freeze or validation_only'
pytest -q -n 0 tests/test_deferred_final_guards.py
pytest -q -n 0 tests/test_member_geometry.py -k 'seed_15 or seed_77 or reservation_reroute_reseats'
pytest -q -n 0 tests/test_corridor_cohort_integration.py -k 'opposing_bypass or opposite_running'
ruff check src/nf_metro/layout/routing/corridor_cohort_integration.py src/nf_metro/render/svg.py tests/test_corridor_cohort_integration.py
ruff format --check src/nf_metro/layout/routing/corridor_cohort_integration.py src/nf_metro/render/svg.py tests/test_corridor_cohort_integration.py
mypy

Check the collected count on every -k run; zero collected exits 5, which reads like success.

#1653 guardrail and stop condition

The freeze is a fact to enforce, not a mechanism to extend. If enforcement reveals a stage that still needs to move geometry, stop: that is evidence an earlier owner model or translation basis is incomplete. Do not add another finalization pass, exemption, or adapter.

[pinin4fjords]

Closed as consolidated into #1756 (freeze enforcement) and #1758 (mechanical ownership audit) after the 2026-08-17 programme review.

Reason: verified against repository history, every deletion target this issue named was either checkpoint-branch-only or never existed at all, so a clean stack built from main would arrive here with nothing real to delete:

• finalized_owned_segments, _scalar_component_plan, _settle_reserved_trunk_axes, _planned_landings: created inside the research(layout): preserve corridor cohort planning checkpoint #1743 branch, never on main; the revised children decline to create them (grep-asserted) rather than "delete" them.
• _shared_left_exit_opening: created by branch commit fc69e645 and removed again by 3f11f175, entirely within the research branch.
• _landing_domains, landing-obstacle|: zero hits anywhere in repository history (git log -S across all refs); stale names from an earlier draft.

The issue's real content moved: enforcement that cohort-final is a genuine freeze (injected post-freeze compile/solve/mutation raises) now lands with the child that creates the freeze (#1756), and the source audit is now a mechanical check in #1758 against the union of per-child "Coordinates transferred / setters deleted" lists, so it can actually fail. The genuinely live legacy owners on main (_move_trunk_axis and the shared-opening/flank/landing setter family in convergences.py) are now named in #1754, which deletes them in the same child that displaces them.

[pinin4fjords]

Reopened by the 2026-08-17 review follow-up with a corrected purpose: the original deletion targets were checkpoint-branch-only or nonexistent, but final-freeze publication and enforcement is a valid separate behavioral boundary, and keeping it separate keeps #1756 within one working day without any dual-ownership window (the stack merges only as a whole). Rewritten body follows.