AUDIT-WP-0018-T03: report bounded-executor runs that started without a receipt

A sender may declare closing_classes; nk-bounded-executor declares
execution.run.started closed by execution.attribution.receipt within
7200s. GET /v1/stream-findings reports opening_without_closing past the
bound, counted from the receiver's accepted_at plus the heartbeat grace
allowance; a per-run data.window.not_after tightens but never extends.
Identifiers and timing only. The overlay may add or shorten, never
remove, rebind or lengthen. Both backends: 403 passed (1 unrelated
live-catalog env failure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e

deploy/senders-scope.json

@@ -61,6 +61,12 @@
     "may_write": true,
     "may_read": false,
     "secret_policy": "reject",
-    "evidence_kind": "load-bearing"
+    "evidence_kind": "load-bearing",
+    "closing_classes": {
+      "execution.run.started": {
+        "closed_by": "execution.attribution.receipt",
+        "within_seconds": 7200
+      }
+    }
   }
 ]

deploy/senders-scope.yaml

@@ -11,6 +11,10 @@
 # (AUDIT-WP-0018-T02): nk-bounded-executor receipts are kept by hash, so a
 # secret-shaped field must refuse the event rather than be silently masked.
 #
+# closing_classes may be added or their bound shortened here, never removed,
+# rebound or lengthened (AUDIT-WP-0018-T03): a started run with no receipt past
+# the bound is a stream finding.
+#
 # evidence_kind may be raised here (attributive -> load-bearing) but never
 # lowered: a ConfigMap refresh must not be able to drop a source's §9.6
 # atomicity and detection obligations without anyone deciding to.
@@ -87,6 +91,12 @@ data:
         "may_write": true,
         "may_read": false,
         "secret_policy": "reject",
-        "evidence_kind": "load-bearing"
+        "evidence_kind": "load-bearing",
+        "closing_classes": {
+          "execution.run.started": {
+            "closed_by": "execution.attribution.receipt",
+            "within_seconds": 7200
+          }
+        }
       }
     ]