fix(pre-push-safety-net): bind dependency gaps to the candidate (M1b 10.7)

The runner handed every candidate the whole transaction's coverage reason list as
its unresolved dependencies, so admission always answered dependency_unresolved.
That list even included other candidates' comparison outcomes, so one unresolved
comparison anywhere marked every other claim as having an unresolved dependency.

Gaps are now attributed. A boundary carrying a question id counts only when that
question is in this candidate's required comparison scope, the same scope 10.2
established. A gap nothing attributed to any question always counts, because
unknown ownership is not evidence of independence. Integrity degradations count.

A declared exclusion, a correspondence ambiguity and a bounded reachability do
not, because each was already weighed against this specific claim: the first is a
scope choice, the second is decided per operation, and the third is decided per
claim by the comparison.

Found by the M1b production rerun rather than by the suite: the comparison reached
a correct new verdict and admission still rejected it for a dependency belonging
to unrelated questions. It is not an M1b exit blocker, since eligibility stays
disabled, but it would have blocked admission forever once capabilities qualify.

1,371 tests passed, nine skipped. Rollout stays NO-GO.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/push/policy.py

@@ -330,6 +330,46 @@ def _blocking_degradations(scan: ModelScanResult) -> tuple[str, ...]:
     return tuple(str(d.get("reason")) for d in scan.degradations if str(d.get("reason")) not in DECLARED_EXCLUSION_GAPS)
 
 
+def _owning_question(gap: str) -> str | None:
+    """The question id a gap is attributed to, or None when nothing attributed it."""
+    tail = gap.rsplit(":", 1)[-1]
+    return tail if len(tail) == 64 and all(character in "0123456789abcdef" for character in tail) else None
+
+
+def dependency_gaps(
+    delta: CandidateDelta, *, context: ChangeContext, head: ModelScanResult, base: ModelScanResult | None = None
+) -> tuple[str, ...]:
+    """Unresolved dependencies of THIS claim, not every gap anywhere in the transaction.
+
+    A gap attributed to an unrelated question is another question's problem. A declared
+    exclusion is a scope choice, correspondence ambiguity is decided per operation, and bounded
+    reachability was already weighed against this specific claim by the comparison, so none of
+    them is an unresolved dependency here. Everything else in this candidate's required scope
+    counts, and so does a gap nothing attributed to any question, because unknown ownership is
+    not evidence of independence.
+    """
+    op = delta.head_operation
+    if op is None:
+        return ()
+    required = {question.question_id for question in _required_scope(op.question, context)} | {op.question.question_id}
+
+    def pertains(gap: str) -> bool:
+        if gap.endswith(":" + AMBIGUOUS_CORRESPONDENCE) or gap.startswith(REACHABILITY_BOUNDED):
+            return False
+        if gap.split(":")[0] in DECLARED_EXCLUSION_GAPS:
+            return False
+        owner = _owning_question(gap)
+        return owner is None or owner in required
+
+    gaps = [gap for gap in context.unresolved_boundaries if pertains(gap)]
+    for scan in (head, base):
+        if scan is None:
+            continue
+        gaps.extend(gap for gap in (scan.scope.unresolved_boundaries if scan.scope else ()) if pertains(gap))
+        gaps.extend(_blocking_degradations(scan))
+    return tuple(dict.fromkeys(gaps))
+
+
 def _required_scope(question: QuestionIdentity, context: ChangeContext) -> set[QuestionIdentity]:
     """Base questions this comparison requires: the counterpart and its recorded dependencies.
 

src/openultrasast/push/runner.py

@@ -36,6 +36,7 @@ from openultrasast.push.policy import (
     admission_push_result,
     admit_candidates,
     compare_targeted_base,
+    dependency_gaps,
     semantics_digest,
 )
 from openultrasast.push.report import PushReport, ReportDelivery, ScanRecord, _completed_scan, deliver_report, render_report
@@ -369,7 +370,7 @@ def _analyze(
                             delta.semantics,
                         ),
                         comparison,
-                        tuple(reasons),
+                        dependency_gaps(c, context=context, head=head_scan, base=delta.base_scan),
                     )
                     for c in delta.candidates
                 )