test(ownir): give every composition input a witness that dies without it

RED for #259 cp4's wiring. No production code: the oracle grows, the port has
nothing new to satisfy it with, and the next commit is what turns it green.

WHAT THE CORPUS ACTUALLY OBSERVED. The 37 frozen cases read like a corpus and
are a historical accident. Measured across them: `di` reaches DI001 and
nothing else — seven of its eight cases being one coordinate band walked
through the same code — and `effects` reaches its single storm witness. So
`di=9` looked like coverage and was one mechanism out of five.

Six of the eleven fields the DI adapter builds are invisible to every frozen
case: `weak_deps` (DI002), `disposable` (DI003/DI004), `root_resolves` +
`root_resolve_sites` (DI004), `scope_cached` + `scope_cache_sites` (DI005). A
composition that wired none of them replayed all 37 clean. That is the hole
b66b10d closed for `effects`, six fields wide — and closing a checkpoint the
same way twice would stop being an accident.

`disposable` is the sharpest. There is no typed `disposable` on
`own_ir::Service`; it arrives through the flattened `extra` map, so an adapter
reading the named fields loses it with NO compile error, and DI003/DI004 go
quiet. The reference is `s.get("disposable") is True` — the JSON boolean and
nothing else, so a stray `"false"` must not coerce.

NINE WITNESSES, one per unobservable input, existing cases untouched:

  DI002  weak_deps
  DI003  disposable
  DI004  root_resolves + root_resolve_sites, site line 1 -> call.cs:1
  DI004  the same document, site line 0    -> falls back to reg.cs:5
  DI005  scope_cached + scope_cache_sites, site line 1 -> store.cs:1
  DI005  the same document, site line 0    -> falls back to reg.cs:5
  EFF    init: call   -> silent   (isolates bindings[].init)
  EFF    io: false    -> silent   (isolates the IO gate)
  EFF    deps: []     -> silent   (isolates the dependency set)

The DI004/005 pairs sit at 1 and 0 — the first value the `>= 1` site sentinel
admits and the last it rejects — and their sites differ from the registration
in FILE as well as line, so a mis-anchored verdict shows up in the frozen
`(path, line, code)` rather than only in a number. Deliberately not another
walk through i64::MIN..MAX: the signed carrier is already proven by the
coordinate band, and the sentinel is a switch, not a range. Measuring a switch
with a ruler is how the first census read 0/0/0.

`ctor_file`/`ctor_line`/`ctor_type` are NOT here. Measured on the reference
they surface as `related` evidence, so they cannot change a cp4-shaped verdict
and must not become a cp4 blocker; they belong to cp5's Finding mapping.

TWO GUARDS make the rule mechanical instead of remembered. `REQUIRED_CODES`
fails — not warns — when a gating channel exhibits no case for a code, naming
the input nothing would then observe; the `effects` hole was a warning for
exactly as long as it took to write the code it let through.
`DISCRIMINATING_PAIRS` fails when the two halves of a boundary pair agree,
because a pair whose halves match has stopped being evidence while the file
stays green. The summary line now prints the observed CODE SET, since a row
count is what made `di=9` look like coverage.

A SECOND TRAP, found while building these and now witnessed:
`root_resolve_sites` is a list of OBJECTS on the OwnIR wire (`own_ir::Site`,
spec §4.2) and a list of `(type, file, line)` TRIPLES at the fact-level
boundary in `di_eff_fact_parity.json`. A composition that reuses the
fact-level shape parses every field as absent and loses the site in silence.
The `-site-primary` witnesses die on exactly that.

VERIFIED BY MUTATING THE DOCUMENTS, not by reading them: 13 mutations over the
witness set — each of the six fields dropped, `disposable` swapped to the
string `"false"`, the sites downgraded to fact-level triples, `init` moved
between stability classes, and every registration line moved onto the site
line. Each mutation proved it applied before any verdict was computed. All 13
land as declared, and the isolation half holds too: the io=false and deps=[]
negatives do NOT react to an `init` change, which is what makes them isolate a
wire rather than answer to any input.

Refs #250, #259.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017umyRWQed6WaoRbVagGYVw

Author: claude

tests/fixtures/ownir/verdicts.json

@@ -447,6 +447,356 @@
       "origin": "witness",
       "protocols": []
     },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [],
+      "document": {
+        "effects": [
+          {
+            "bindings": [
+              {
+                "init": "call",
+                "line": 1,
+                "name": "opts",
+                "refs": []
+              }
+            ],
+            "component": "A",
+            "deps": [
+              "opts"
+            ],
+            "file": "A.tsx",
+            "io": true,
+            "line": 10
+          }
+        ],
+        "module": "M",
+        "ownir_version": 0
+      },
+      "effects": [],
+      "family": "effects channel (bindings[].init: call -> no verdict)",
+      "name": "composition-effect-opaque-call-silent",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [],
+      "document": {
+        "effects": [
+          {
+            "bindings": [
+              {
+                "init": "object",
+                "line": 1,
+                "name": "opts",
+                "refs": []
+              }
+            ],
+            "component": "A",
+            "deps": [
+              "opts"
+            ],
+            "file": "A.tsx",
+            "io": false,
+            "line": 10
+          }
+        ],
+        "module": "M",
+        "ownir_version": 0
+      },
+      "effects": [],
+      "family": "effects channel (io: false -> no verdict)",
+      "name": "composition-effect-no-io-silent",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [],
+      "document": {
+        "effects": [
+          {
+            "bindings": [
+              {
+                "init": "object",
+                "line": 1,
+                "name": "opts",
+                "refs": []
+              }
+            ],
+            "component": "A",
+            "deps": [],
+            "file": "A.tsx",
+            "io": true,
+            "line": 10
+          }
+        ],
+        "module": "M",
+        "ownir_version": 0
+      },
+      "effects": [],
+      "family": "effects channel (deps: [] -> no verdict)",
+      "name": "composition-effect-no-deps-silent",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "reg.cs",
+          5,
+          "DI002"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App",
+            "weak_deps": [
+              "Db"
+            ]
+          },
+          {
+            "file": "reg.cs",
+            "lifetime": "scoped",
+            "line": 6,
+            "name": "Db"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (services[].weak_deps -> DI002)",
+      "name": "composition-di002-weak-deps",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "reg.cs",
+          5,
+          "DI003"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "deps": [
+              "Conn"
+            ],
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App"
+          },
+          {
+            "disposable": true,
+            "file": "reg.cs",
+            "lifetime": "transient",
+            "line": 6,
+            "name": "Conn"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (services[].disposable -> DI003)",
+      "name": "composition-di003-transient-disposable",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "call.cs",
+          1,
+          "DI004"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App",
+            "root_resolve_sites": [
+              {
+                "file": "call.cs",
+                "line": 1,
+                "type": "Conn"
+              }
+            ],
+            "root_resolves": [
+              "Conn"
+            ]
+          },
+          {
+            "disposable": true,
+            "file": "reg.cs",
+            "lifetime": "transient",
+            "line": 6,
+            "name": "Conn"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (root_resolve_sites line 1 -> site anchor)",
+      "name": "composition-di004-site-primary",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "reg.cs",
+          5,
+          "DI004"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App",
+            "root_resolve_sites": [
+              {
+                "file": "call.cs",
+                "line": 0,
+                "type": "Conn"
+              }
+            ],
+            "root_resolves": [
+              "Conn"
+            ]
+          },
+          {
+            "disposable": true,
+            "file": "reg.cs",
+            "lifetime": "transient",
+            "line": 6,
+            "name": "Conn"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (root_resolve_sites line 0 -> registration anchor)",
+      "name": "composition-di004-site-fallback",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "store.cs",
+          1,
+          "DI005"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App",
+            "scope_cache_sites": [
+              {
+                "file": "store.cs",
+                "line": 1,
+                "type": "Db"
+              }
+            ],
+            "scope_cached": [
+              "Db"
+            ]
+          },
+          {
+            "file": "reg.cs",
+            "lifetime": "scoped",
+            "line": 6,
+            "name": "Db"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (scope_cache_sites line 1 -> site anchor)",
+      "name": "composition-di005-site-primary",
+      "origin": "witness",
+      "protocols": []
+    },
+    {
+      "advisories": [],
+      "core": [],
+      "di": [
+        [
+          "reg.cs",
+          5,
+          "DI005"
+        ]
+      ],
+      "document": {
+        "module": "M",
+        "ownir_version": 0,
+        "services": [
+          {
+            "file": "reg.cs",
+            "lifetime": "singleton",
+            "line": 5,
+            "name": "App",
+            "scope_cache_sites": [
+              {
+                "file": "store.cs",
+                "line": 0,
+                "type": "Db"
+              }
+            ],
+            "scope_cached": [
+              "Db"
+            ]
+          },
+          {
+            "file": "reg.cs",
+            "lifetime": "scoped",
+            "line": 6,
+            "name": "Db"
+          }
+        ]
+      },
+      "effects": [],
+      "family": "di channel (scope_cache_sites line 0 -> registration anchor)",
+      "name": "composition-di005-site-fallback",
+      "origin": "witness",
+      "protocols": []
+    },
     {
       "advisories": [],
       "core": [],