test(ha-commit-engine): RED tests for per-LSN majority evaluation (task 1.1)

commit.h umbrella-verbatim interface + inert stub commit.c (test target
only); 7 Unity tests covering per-LSN vs acked_lsn>0 counting, majority
median, monotonicity, append clamp, lagging standby, RETAIN immediacy.
All 7 fail RED as intended. Documented 3 pre-existing masked suite
failures (bug-411) and the per-group exit-code masking root cause.

.wolf/anatomy.md

@@ -1,7 +1,7 @@
 # anatomy.md
 
-> Auto-maintained by OpenWolf. Last scanned: 2026-06-11T13:00:00.755Z
-> Files: 506 tracked | Anatomy hits: 0 | Misses: 0
+> Auto-maintained by OpenWolf. Last scanned: 2026-06-11T14:16:52.677Z
+> Files: 511 tracked | Anatomy hits: 0 | Misses: 0
 
 ## ./
 
@@ -262,7 +262,7 @@
 - `requirements.md` — Requirements Document (~2715 tok)
 - `research.md` — Research Log: ha-commit-engine (~1345 tok)
 - `spec.json` (~140 tok)
-- `tasks.md` — Implementation Plan: ha-commit-engine (~2682 tok)
+- `tasks.md` — Implementation Plan: ha-commit-engine (~2947 tok)
 
 ## .kiro/specs/ha-config-bootstrap/
 
@@ -703,3 +703,17 @@
 - `6664f5dc160a6acfc03af4d9881c53f8f6c650ac384b1ad9b3db47d896800af9.json` (~656 tok)
 - `669931b38fdf0060e974d68dd28abc43e49a1907405848ce9d8b3b3901518313.json` (~376 tok)
 - `66cc2d1ad85554725cecb1f215d375511474a58829464647a0d8c109818d9804.json` (~57 tok)
+
+## src/controller/
+
+- `commit.c` — STUB commit engine (ha-commit-engine task 1.1 RED): init/fini real, commit_submit -ENOSYS, commit_on_ack no-op; real impl in task 1.2 (~474 tok)
+- `meson.build` (~1094 tok)
+
+## src/controller/include/
+
+- `commit.h` — commit engine service interface (umbrella-verbatim): commit_engine_t, WAIT/RETAIN modes, init/fini/submit/on_ack/set_writable_lsn/on_membership_change (~771 tok)
+
+## src/controller/testsuite/
+
+- `controller_test.c` — include <argp.h> (~1323 tok)
+- `test_commit_engine.c` — RED tests for per-LSN majority + commit-index integrity (Reqs 1.2, 2.1-2.3, 5.1): 7 cases against stub persist_t+replicator_t (~2459 tok)

.wolf/cerebrum.md

@@ -34,6 +34,10 @@
 - Heartbeat freshness source of truth (2026-06-09): `ha_heartbeat_is_fresh` derives from `ha->last_activity` (whole CLOCK_MONOTONIC seconds, written by ha_on_heartbeat_received, lock-free time_t read). The old `last_heartbeat` timespec field was REMOVED from ha_state_t — do not reintroduce it. The standby vote-deny gate is `role==CTRL_STANDBY && primary_ctrl_fd >= 0 && ha_heartbeat_is_fresh(ha)`; RDHUP resets primary_ctrl_fd to -1 so a standby whose primary died can grant votes immediately even if last_activity is still fresh.
 - raft_init restore contract (2026-06-09): persistence writes (term, voted_for) as a pair, so `raft_init` must set `voted_for_term = initial_term` when `initial_voted_for != -1`. Leaving it 0 lets a restarted node double-vote in the same term (Election Safety violation). Covered by test_proto_H6.
 
+- repl_add_standby returns the SLOT INDEX (>=0) on success, not 0 (2026-06-11, ha-commit-engine task 1.1): asserting `== 0` breaks on the second standby. Assert `>= 0` or the expected index.
+- Unity harness quirks in controller_unit_test (2026-06-11): (a) failure lines misattribute the FILE — Unity.TestFile comes from whichever group's UNITY_BEGIN ran, so a failure printed as test_repl_unit.c:294 may live in test_p2_integration.c; locate the actual test by grepping for the test NAME. (b) Each group's UNITY_BEGIN resets counters, so the process exit code only reflects the LAST group — failures in earlier groups are masked (exit=0); meson reports green despite real failures. Grep output for FAIL with `grep FAIL` on the raw log (ANSI codes sit between ':' and 'FAIL', so `grep ":FAIL"` misses them).
+- 3 pre-existing controller suite failures on persistent_ha baseline (2026-06-11, verified by stash/rebuild without ha-commit-engine changes, see bug-411): test_committed_lsn_does_not_advance_on_timeout (rc -110 vs expected 0 — persist_wal_sync_append now returns -ETIMEDOUT, test expects old rc==0+sync_rc contract), test_repl_ack_after_promote_gate_allows_jobsub and test_rdhup_primary_dispatch_gate_opens (both -10013: ha_has_write_quorum false, standby_endpoints empty with n_peers=2).
+
 ## Do-Not-Repeat
 
 <!-- Mistakes made and corrected. Each entry prevents the same mistake recurring. -->

.wolf/memory.md

@@ -860,3 +860,13 @@
 | 05:57 | Edited .kiro/steering/roadmap.md | 6→8 lines | ~365 |
 | 11:40 | kiro-spec-batch complete: 4 sub-specs generated (3 waves), cross-spec review passed after 6 doc fixes (1 by fix-agent before spend limit, rest verified/applied); roadmap marked [x] | 4 spec dirs, roadmap.md, umbrella design.md | 51 sub-tasks total, ready for /kiro-impl ha-commit-engine | ~700k |
 | 05:57 | Session end: 99 writes across 12 files (brief.md, project_ha_consistency_invariants.md, product.md, spec.json, requirements.md) | 69 reads | ~240145 tok |
+| 06:26 | Created src/controller/include/commit.h | — | ~771 |
+| 06:27 | Created src/controller/commit.c | — | ~474 |
+| 06:28 | Created src/controller/testsuite/test_commit_engine.c | — | ~2440 |
+| 06:28 | Edited src/controller/meson.build | 2→4 lines | ~30 |
+| 06:28 | Edited src/controller/testsuite/controller_test.c | 1→2 lines | ~20 |
+| 06:28 | Edited src/controller/testsuite/controller_test.c | 3→4 lines | ~22 |
+| 06:32 | Edited src/controller/testsuite/test_commit_engine.c | modified for() | ~75 |
+| 13:30 | Task 1.1 ha-commit-engine RED: commit.h + stub commit.c + test_commit_engine.c (7 failing tests) | src/controller/{include/commit.h,commit.c,testsuite/test_commit_engine.c,meson.build,testsuite/controller_test.c} | 7/7 RED for right reasons; 3 suite failures proven pre-existing via baseline stash run | ~60k |
+| 07:16 | Edited .kiro/specs/ha-commit-engine/tasks.md | inline fix | ~23 |
+| 07:16 | Edited .kiro/specs/ha-commit-engine/tasks.md | modified now() | ~344 |