v2-native route: closure-scoped ingest and native adjudication over a seed-prepared artifact (lands after #10990)

dag/gunbc/recurring_failure_mode/a_long_phase_prints_nothing_until_it_ends.dag

@@ -0,0 +1,32 @@
+module gunbc.recurring_failure_mode.a_long_phase_prints_nothing_until_it_ends
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_long_phase_prints_nothing_until_it_ends: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_long_phase_prints_nothing_until_it_ends" as NonEmptyStr,
+
+  receipts: [
+    "**a long phase prints nothing until it ends** (a process announces that it is entering a phase, then emits its next line only when the phase TERMINATES. For the whole span in between, a healthy run and a hung run produce byte-identical output: nothing. The receipt is complete and correct once it arrives, so nothing is missing at the end -- the defect is entirely in the middle, where the log cannot answer the one question anybody asks of a long run.)",
+
+    "INVALID STATE: a receipt surface on which liveness and death share a representation. Silence is emitted by both the working process and the dead one, so no reader -- human or automated -- can distinguish them from the surface the process itself publishes.",
+
+    "WHY IT SURVIVES REVIEW: every line the process prints is correct, none is missing, and the terminal receipt is complete. The phase boundary IS announced, which is what makes it feel covered: a reviewer reads 'adjudicating through the emitted compiler' and sees a process that reports its phases. Nothing in the diff looks like a gap, because the gap is a duration rather than a line.",
+
+    "SPECIMEN (gunbc#10940, 2026-09-12, the required-v2-native route at 36e6ad91ea). The SourceRootEvalDriver printed `v2-native-route: adjudicating through the emitted compiler` at 07:04:59 and then nothing. At 08:25 the operator asked whether the run had reached adjudication and what the partition reported. The log could not answer, and neither could the absence of an answer be read as failure: the run was alive and healthy. This is not hypothetical rot -- it cost a real exchange, and it was about to cost a queue slot ordering on a run whose state nobody could name.",
+
+    "WHAT DISCRIMINATED IT WAS OUT OF BAND, WHICH IS THE POINT. Liveness was established by reading the process's own CPU accounting -- 99.7 percent of one core, single-threaded, CPU time equal to wall time to within thirteen seconds, RSS steady -- via ps and /proc on the host. That is an instrument the PROCESS does not publish and the LOG does not carry: it is available only to a reader with a shell on the machine the run happens to be on, so a CI reader, a dashboard, or anyone reading a captured log has no equivalent and is left with the ambiguity intact.",
+
+    "THE TEMPTING NON-FIX IS A TIMEOUT, and it is the absorbing fallback of DESIGN section 5 wearing an operations hat: a deadline converts 'I cannot tell whether this is alive' into 'I declare it dead', which fabricates a verdict from ignorance rather than measuring the thing. It also has to be tuned against a phase whose true duration is unknown, which is the same missing measurement, now load-bearing on a constant.",
+
+    "RUNG: found at 1, mitigatable. The ambiguity is contained only by an out-of-band reader who knows to look at /proc, which is to say it is contained by operator expertise rather than by anything the program does.",
+
+    "CEILING 2, mechanically preventable, and the reason it is not higher is worth stating rather than eliding: no type can make a process emit a line, so this cannot be constructed away. What CAN be built is a phase carrier that is obligated to report progress at a declared grain -- an identity count, a frontier size -- so that a phase which publishes nothing for longer than its own declared grain is itself a typed refusal rather than a silence.",
+
+    "NEXT-RUNG TRIGGER (a CAPABILITY, not an artifact): a long-phase carrier whose entry declares the progress grain it will report at, so that emitting nothing is a refusable state rather than the default. A single progress line added to one driver satisfies none of this -- it fixes one specimen and leaves every other long phase in the corpus with the same surface, which is exactly the artifact-for-capability substitution DESIGN section 4b(3) forbids in a restoration trigger.",
+
+    "REVIEW TELL: a phase announcement with no companion progress obligation -- a log line of the form 'starting X' whose next sibling in the source is the line that reports X finished. Ask what the surface looks like at the midpoint, and whether anyone reading it could tell a live run from a dead one.",
+  ],
+
+  evidence: [],
+}

dag/gunbc/recurring_failure_mode/a_shared_probe_root_lets_one_run_compile_anothers_source.dag

@@ -0,0 +1,34 @@
+module gunbc.recurring_failure_mode.a_shared_probe_root_lets_one_run_compile_anothers_source
+
+import std.types { NonEmptyStr }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data a_shared_probe_root_lets_one_run_compile_anothers_source: RecurringFailureMode = RecurringFailureMode {
+  identity: "a_shared_probe_root_lets_one_run_compile_anothers_source" as NonEmptyStr,
+
+  receipts: [
+    "**a shared probe root lets one run compile another run source** (two executions materialize their generated crate into a directory keyed by WHAT is built rather than by WHO builds it. The second writer overwrites the first; the loser compiles the winner source against its own dependencies, and the type errors are attributed to the loser tree. The exclusion that would stop it EXISTS in this corpus and the failing caller does not take it.)",
+
+    "INVALID STATE: a build whose SOURCE came from one revision and whose DEPENDENCIES came from another, with a diagnostic naming only the second.",
+
+    "THE PROTECTION IS BUILT AND BYPASSED, WHICH IS THE WHOLE POINT OF THIS ROW. gunbc.emitted_closure_compile_host acquire_probe_root_lock creates an exclusive lock in the probe root and REFUSES a second concurrent run with a typed located cause; its own annotation argues the design -- refusing beats waiting, which serializes into the same shared state, and beats a private directory per run, which throws away the warm target dir. That reasoning is sound and it is already written down. run_required_emit_compile takes the lock. THE v2-NATIVE ROUTE DOES NOT: v1_compiler.cli_run.native_lane_runner selects the same root through lane_emit_compile_probe_root and passes it to emission without acquiring anything. So this is not a missing mechanism; it is a mechanism one caller reaches around.",
+
+    "WHY IT SURVIVES REVIEW: the guard exists, it is well argued, and a reviewer who greps for it FINDS it. Establishing that a given caller takes it requires following the call, which nobody does when the protection is known to be present. A built wall with one gate left open reads, from a distance, exactly like a built wall.",
+
+    "SPECIMEN (gunbc#10940, 2026-09-12). A baseline run of the base revision and a successor run of the branch executed concurrently on one host. The successor refused EmittedCompilerBuildFailed with E0063 naming three missing fields on a cost-row type. The first reading -- mine -- was that the branch emitted a broken driver. It had not: the emitted main on disk was the BASE revision, written minutes earlier by the baseline, and predated the three fields the branch added. Neither run took the lock, so nothing refused and the wrong verdict was computed against an innocent tree.",
+
+    "DISTINGUISHING FACT, so the next reader arrives faster: READ THE GENERATED ARTIFACT. If its content belongs to a revision other than the one being built -- a field set, a call, a spelling from another head -- the build is compiling somebody else source, and its timestamp falling inside another run window confirms it.",
+
+    "THE LOUD FORM WAS ALREADY FIXED AND THE SILENT ONE LEFT OPEN. The same shared directory previously produced EACCES against another job artifacts, and that repair routed the required lane to a declared per-job root. A collision class repaired where it announces itself and left reachable where it does not is the more dangerous half surviving.",
+
+    "RUNG: found BELOW the ladder for the unlocked caller. The run does not merely fail; it fails with a confident, specific cause about the wrong subject. The locked caller sits at 1, mitigated by a typed refusal.",
+
+    "CEILING 4, structurally impossible, and MOST OF THE DISTANCE IS ALREADY TRAVELLED -- which is why the honest ceiling is high rather than aspirational. Selecting the probe root and taking exclusive ownership of it are one operation, so a selector that RETURNS an owned root (the lock taken, released on drop) leaves no spelling by which a caller can hold the path without the exclusion. Then the invalid state has no constructor, rather than depending on each caller remembering.",
+
+    "NEXT-RUNG TRIGGER (a CAPABILITY, not an artifact): probe-root selection yields an owned root, so acquiring the path and acquiring the exclusion cannot be separated. Adding the existing lock call to the one bypassing caller is a REPAIR of this instance and does NOT discharge the row -- it leaves the next caller free to reach around it the same way. Setting a per-run environment variable is a weaker mitigation still: it protects the launches that remember.",
+
+    "REVIEW TELL: a guard function whose callers are fewer than the callers of the thing it guards. Grep the protected resource, not the protection, and ask which callers of the resource never mention the guard.",
+  ],
+
+  evidence: [],
+}

dag/gunbc/recurring_failure_mode/closed_variant_partition_read_as_a_default_arm.dag

@@ -13,7 +13,7 @@ data closed_variant_partition_read_as_a_default_arm: RecurringFailureMode = Recu
     "WHAT WAS OBSERVED, and it is a silent wrong answer rather than a low rung (DESIGN section 5). Emitting src/v2/compiler/00_compile.dag — whose declaration reads `data compiler_pipeline_entry: CompilerEntryDriver = SourceRootEvalDriver` — at a 404-module import closure rendered the DIRECT-INGEST main: a 25-line main that reads one source path and translates it. The same emission rendered `compiler_pipeline_entry() -> CompilerEntryDriver::SourceRootEvalDriver` into the same crate, so the emitted VALUE and the emitted ENTRY POINT disagreed inside one artifact, with zero diagnostics of any severity. The crate compiles; the binary runs; it answers a different question than the lane that spawns it asks.",
     "THE SUBJECT IS THE READING, NOT THE CLOSURE SIZE, and the cheap reproducer is what establishes that. `fixtures/unknown_pipeline_driver/probe.dag` declares `compiler_pipeline_entry: CompilerEntryDriver = std.compiler_entry.SourceRootEvalDriver` -- an ORDINARY ACCEPTED PROGRAM, spelled with its declaring module's qualifier, which resolves to the variant it names. At SEVENTEEN modules the pre-fix emitter rendered the DIRECT-INGEST main for it, with zero diagnostics of any severity. The 404-module observation that surfaced the class is therefore an instance and not the subject: any reading the span-read cannot match by bare name selects the residue arm, and a qualified spelling is the smallest such reading.",
     "THE FIRST OBSERVATION, kept because it is what made the class visible and because it shows the damage in production shape. Emitting `src/v2/compiler/00_compile.dag` at a 404-module import closure rendered the direct-ingest main while the SAME emission rendered `compiler_pipeline_entry() -> CompilerEntryDriver::SourceRootEvalDriver` into the same crate -- the emitted VALUE and the emitted ENTRY POINT disagreeing inside one artifact. The identical entry renders the eval-driver main at 173 and 177 modules. Shrinking that closure back to 183 restored the correct arm, which is why the closure split MUST NOT be read as the fix: it moved the corpus off the defect, it did not remove it.",
-    "THE REPAIR IS THE PARTITION CLOSED BY NAME. compiler_pipeline_entry_driver_is_known tests the reading against all three declared drivers and emit_main_rs refuses first, rendering a compile_error that names the module and the reading it got, so an unrecognised reading stops the line instead of selecting an arm. That wall is executed by `v1.compiler.tests` `unknown_pipeline_driver_refusal_test`, whose fixture is the accepted program above and whose red control is the pre-fix direct-ingest shape, so the rung is mitigation WITH executed evidence rather than a declared one; the CEILING is higher and the trigger is nameable: the driver is a CLOSED coproduct, so an emitter that matched the resolved variant rather than a string read back off the source span could not express this state at all. NEXT-RUNG TRIGGER: emit_main_rs selects on the resolved CompilerEntryDriver variant (an exhaustive match the emitter cannot compile with an arm missing) instead of on authored_name_at of the declaration body.",
+    "THE REPAIR IS THE PARTITION CLOSED BY NAME. compiler_pipeline_entry_driver_is_known tests the reading against all three declared drivers and emit_main_rs refuses first, rendering a compile_error that names the module and the reading it got, so an unrecognised reading stops the line instead of selecting an arm. That wall has a control in `v1.compiler.tests` `unknown_pipeline_driver_refusal_test`, whose fixture is the accepted program above and whose red control is the pre-fix direct-ingest shape. THE RUNG IS MITIGATION, AND THE CONTROL IS COMPILED RATHER THAN RUN: the v1-compiler-tests crate is compiled by `cargo clippy --all-targets` in witnesses.yml and executed by no CI step (DESIGN Building & checks; gunbc.rung_drop rust_unit_tests_off_the_merge_path), so the evidence is real but off the acceptance path and may not be reported as executed. NEXT STEP BEFORE ANY HIGHER CLAIM: ENROLMENT — a claim-level witness or a required lane that runs those targets, after which this control establishes the mechanism rather than merely describing it. Beyond that the CEILING is higher and the trigger is nameable: the driver is a CLOSED coproduct, so an emitter that matched the resolved variant rather than a string read back off the source span could not express this state at all. NEXT-RUNG TRIGGER: emit_main_rs selects on the resolved CompilerEntryDriver variant (an exhaustive match the emitter cannot compile with an arm missing) instead of on authored_name_at of the declaration body.",
     "THE REVIEW TELL, general to the class: a selector whose last arm is reached by `else` / `return` rather than by naming its variant, over a type whose declaration is a closed coproduct. Ask what the selector does when the discriminator reads as NONE of the names — if the answer is 'the last arm', the exhaustiveness the type carries has been dropped at that boundary.",
   ],
 

dag/gunbc/repo/repo_self_build.dag

@@ -2,6 +2,7 @@ module gunbc.repo_self_build
 
 import std.types { String, List, NonEmptyStr }
 import gunbc.stage0_crate_partition_generated { generated_partition_crate_rows }
+import gunbc.repo_self_warning_policy { repo_self_warning_denial, repo_self_warning_denial_rustflags }
 import extdeps.cargo_build { cargo_clippy_command }
 import extdeps.exec.command { argv_words }
 
@@ -130,22 +131,9 @@ fn repo_self_clippy_command() -> String {
   )
 }
 
-// THAT A WARNING IS AN ERROR IS ONE FACT ABOUT THIS REPOSITORY, SPELLED ONCE. It reaches rustc
-// two ways: as the lint arguments after clippy's `--` separator (the row above), and as the
-// RUSTFLAGS environment cargo forwards to every rustc it spawns -- the form the required
-// v2-native lane sets EXPLICITLY on the emitted compiler crate's build
-// (gunbc.witness_v2_native_route NativeRouteEmittedBuild). Until that lane set it, the emitted
-// crate was built under whatever RUSTFLAGS the runner's toolchain step happened to export -- the
-// setup-rust-toolchain action's DEFAULT input, which this authority never declared -- so the same
-// crate compiled clean on a workstation and refused with status 101 in CI, and the receipt's
-// "compiled" was true of a runner rather than of the crate. The environment form is the lint
-// arguments joined by a space because that is how cargo tokenises RUSTFLAGS (whitespace-split);
-// it is derived here from the same row, never re-spelled at the invocation.
-data repo_self_warning_denial: List<String> = ["-D", "warnings"]
-
-fn repo_self_warning_denial_rustflags() -> String {
-  join(repo_self_warning_denial, " ")
-}
+// The warning-denial policy row moved to gunbc.repo_self_warning_policy so a consumer wanting
+// only the policy does not link this module's transport (extdeps.cargo_build,
+// extdeps.exec.command). It is imported above and still spelled once.
 
 // THE DERIVED STAGE0 PARTITION CRATES, WHICH THE PACKAGE-AS-DATA DECISION ABOVE DOES NOT REACH.
 // repo_self_build_package is one package because that was the whole repository's compiler for as

dag/gunbc/repo/repo_self_warning_policy.dag

@@ -0,0 +1,37 @@
+module gunbc.repo_self_warning_policy
+
+import std.types { String, List }
+
+// THAT A WARNING IS AN ERROR IS ONE FACT ABOUT THIS REPOSITORY, SPELLED ONCE. It reaches rustc
+// two ways: as the lint arguments after clippy's `--` separator (gunbc.repo_self_build
+// repo_self_clippy_command), and as the RUSTFLAGS environment cargo forwards to every rustc it
+// spawns -- the form the v2-native route sets EXPLICITLY on the emitted compiler crate's build
+// (gunbc.witness_v2_native_route NativeRouteEmittedBuild). Until that route set it, the emitted
+// crate was built under whatever RUSTFLAGS the runner's toolchain step happened to export -- the
+// setup-rust-toolchain action's DEFAULT input, which this authority never declared -- so the same
+// crate compiled clean on a workstation and refused with status 101 in CI, and the receipt's
+// "compiled" was true of a runner rather than of the crate. The environment form is the lint
+// arguments joined by a space because that is how cargo tokenises RUSTFLAGS (whitespace-split);
+// it is derived from the same row, never re-spelled at the invocation.
+//
+// WHY IT LIVES HERE RATHER THAN BESIDE THE COMMAND THAT USES IT (2026-09-12, #10940 srv2 closure
+// receipt). This row is POLICY: what this repository asserts about warnings. Its neighbours in
+// gunbc.repo_self_build are REALIZATION: how a cargo invocation is constructed
+// (extdeps.cargo_build cargo_clippy_command, extdeps.exec.command argv_words). DESIGN section 3
+// keeps those apart, and a `.dag` import is module-level, so a consumer that wants only the policy
+// had no way to avoid the transport.
+//
+// THAT COST A REAL FAILURE, which is why the split is worth its own module rather than a comment.
+// gunbc.witness_v2_native_route imported this constant for ONE string comparison -- the admission
+// clause asking whether the recorded build denied warnings -- and thereby pulled cargo_build and
+// exec.command into the EMITTED COMPILER'S closure, because v2.compiler.compile imports that
+// witness. The emitted compiler never invokes cargo (the host harness does, before the emitted
+// binary is spawned), so the transport was reachable in a closure that cannot use it, and the
+// route's genesis build refused with 28 rustc errors in exactly those two emitted files. The
+// closure grew 180 -> 189 modules when that import landed. Policy has no transport dependency;
+// keeping it that way is what lets a judge read the policy without linking the actuator.
+data repo_self_warning_denial: List<String> = ["-D", "warnings"]
+
+fn repo_self_warning_denial_rustflags() -> String {
+  join(repo_self_warning_denial, " ")
+}