The v2-native route producer sets -D warnings itself, records the emitted build on its receipt, and separates receipt from telemetry

[gunbai-bot]

P0b of the route-operability program (parent: eager-raven-113), scoped to the ROUTE PRODUCER claim_executor --v2-native-route (gunbc.witness_v2_native_route, v1_compiler.cli_run.native_lane_runner). No workflow edits; the CI job was deleted by #11003 and this lands after D4 per the side-chat ruling (the receipt's validity binds the producer's provenance, so the producer must not change mid-train).

What changes

1. -D warnings is set by the producer at the emitted-crate cargo invocation. emitted_closure_compile_host::run_cargo now SETS RUSTFLAGS on the spawn (never inherits it). The value is one row, gunbc.repo_self_build repo_self_warning_denial (["-D","warnings"]), which the all-targets clippy command already consumed and which now also renders as repo_self_warning_denial_rustflags(); the env-var name is cargo's own, extdeps.rust.cargo RustflagsEnv (new arm, spelling witnessed). Before this the flag came from the setup-rust-toolchain action's DEFAULT input, so the same crate compiled clean on a workstation and refused 101 in CI. The build lane's emit-compile phase shares run_cargo, so it now runs under the same explicit flag it already ran under in CI (behaviour-preserving there; local runs now match CI).
2. The receipt carries the build; admission adjudicates it. NativeRouteReceipt gains emitted_build: NativeRouteEmittedBuild { cargo_argv, rustflags, rustc_identity, exit_status, warning_count } and three admission clauses with named refusal causes: emitted_build_rustc_unrecorded, emitted_build_warnings_not_denied (equality against the denial row — an inherited empty value and a widened -D warnings -C … both refuse), emitted_build_not_clean (status 0 and zero warning headers).
3. Semantic receipt separated from realization telemetry. The receipt (closure digest, emitted binary sha, universe, population/verdict rows, controls, emitted build) is what admission reads; rss/trim/wall are printed on their own required-ci: v2-native telemetry … line (process peak RSS via getrusage, current RSS, slot cgroup current/peak — labelled slot-lifetime — and wall) and are on no receipt field.

Not in this PR (C7 correction, 2026-09-11): resource preflight — the predicted critical path and the memory envelope/reserve — is std.realization cost vocabulary and lands with route integration; what it will read is the slot authority gunbc.runner_slot_allocation (gunbc_runner_slot_desired().memory_high as the envelope, memory_max − memory_high as the reserve, by construction). No memory admission arm lives on this receipt.
Not in this PR (ruling D, 2026-09-11): per-identity provenance / hit-miss counts land with the provider-spine lane, where their consumer exists (§3c).

Held from merge

Per the side-chat ruling (producer-provenance rule): this lands AFTER D4. Reviews welcome now.

Baseline receipt (run 34521851736 on 1eb184f, srv1-17 aarch64, before this change)

• emitted closure 812d6addfae6f2f25295d63bbf29b2f70e9b1cfdd6aafaa11074658ecea8ec91 (172 files); emitted binary sha256 46175db15d7d209617bfc6f5f520955d83e0ed81fbc6beb64e45e9cd3c5beb81
• rustc 1.93.0 (254b59607 2026-01-19); emitted-crate build under AMBIENT RUSTFLAGS=-D warnings (toolchain-action default), 0 warning lines in the job log
• native run 21:16:51→23:46:28 = 2h29m37s; 3492 verdict rows, 2925 file refusals; emission-arena rss_kb_before=14124724 trim→9272220; slot cgroup memory.max=17179869184 memory.high=16106127360
• cancelled by the 180-min job envelope at 3h00m during the post-run typechecks — no terminal admission line (that envelope question is closed by Delete the required-v2-native CI job; the route stays as an operator-invoked instrument #11003).

Evidence

• Rust unit tests: the spawn's env table is read back to prove RUSTFLAGS is SET and the receipt argv equals the spawned argv; warning header counting. cargo clippy -D warnings clean.
• dag/test/claim/devboot_host_tool_spelling_witness_test.dag: RUSTFLAGS spelling (PASS on BuildBuddy).
• src/v1/stage0/src/extdeps_cargo.rs is the producer-regenerated mirror of extdeps.rust.cargo (regen run on BuildBuddy; candidate sha256 9f3e9f42… equals the committed file).
• src/v2/test/v2_native_route_test.dag: 3 new witnesses (one RED per new clause, positive controls). Their closure cannot be resolved on BuildBuddy (MemoryStallRefusedPageThrash), so their executing evidence is the CI floor: at e6ac6ac9916 all 16 changed v2.test.v2_native_route witnesses were planned-and-passed; that run's floor was FloorRefused only on 14 v2.test.parse.*/body_lowering cpu-deadline interruptions that main's own latest floor (run 34560949186) shares by identity.

Landing-review repair (head d71e98bb5c7): the spawn owns every channel cargo reads

Finding: the receipt recorded RUSTFLAGS=-D warnings and a compiler probed via RUSTC/PATH, while cargo reads CARGO_ENCODED_RUSTFLAGS first and may select build.rustc or front the compiler with RUSTC_WRAPPER/RUSTC_WORKSPACE_WRAPPER — so the receipt could disagree with the build. Repair (probe_cargo_command / probe_cargo_command_bound): one compiler executable is resolved (RUSTC if set, else the first rustc on PATH; a non-file is a typed ProbeCompilerUnresolved refusal), its --version --verbose identity is taken from the crate's own directory (a rustup proxy selects per cwd), cargo is bound to it via RUSTC (which wins over build.rustc), both wrapper channels are set present-and-empty (cargo's env read short-circuits the config wrappers), and the denial is set on CARGO_ENCODED_RUSTFLAGS (-D\x1fwarnings) and RUSTFLAGS alike. The receipt now carries compiler_path with clause emitted_build_compiler_unbound (RED witness + positive control). RED controls in Rust plant conflicting ambient CARGO_ENCODED_RUSTFLAGS, RUSTFLAGS, RUSTC, CARGO_BUILD_RUSTC, RUSTC_WRAPPER, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WORKSPACE_WRAPPER and prove the spawn's own env table overrides each (planted_ambient_flags_compiler_and_wrappers_cannot_reach_the_probe_build). Local cost, stated: the emitted-crate build runs without a wrapper (no sccache) — the price of the verdict being about the crate. BuildBuddy at this head: clippy -D warnings rc=0, 20/20 + 2/2 unit tests, 5471 parse-clean, regen first_generation_equal=true, spelling witness PASS. This touches stage0, so the srv2 closure receipt is re-taken at this head by the coordinator.

Seed-growth receipt (review 63809)

Hand-written v1 seed grows in two existing seed-retained modules, both maintained under gunbc.v1_maintenance_standing v1_seed_standing's PURPOSE test (the v2 self-host route producer): src/v1/stage0/src/emitted_closure_compile_host.rs 2509 → 2652 lines (its row: gunbc.emitted_closure_compile_seed_growth emitted_closure_compile_seed_growth_justification), src/v1/stage0/src/cli_run/native_lane_runner.rs 1140 → 1271 (rostered as consumer native_lane_runner_ref in gunbc.v1_consumer_census; producer of gunbc.witness_v2_native_route's receipt, dissolving with that route's v2 emission). No scaffold path was added; the one deliberate seed mirror (WARNING_DENIAL_RUSTFLAGS) is guarded by emitted_build_warnings_not_denied.

Pre-push evidence for the remerge head 34bd1b77117 (= d73288125de + main 199aee77ab0, one conflict hunk: the extdeps_cargo use line, resolved to import cargo_environment_variable_name, CargoDependency, CargoEnvironmentVariable)

BuildBuddy, tree materialised as base 199aee77ab0 + this PR's diff (content-identical to the merge): build rc=0; cargo clippy -D warnings rc=0; unit tests 19/19 (emitted_closure_compile_host) + 2/2 (native_lane_runner); v1_src_dag_parse 5471 files parse-clean; claim_executor --required-regen first_generation_equal=true planned=155 executed=155 adjudicated=155 (declared_divergent=1 [main.rs], the standing divergence); cargo_environment_variable_names_are_the_cited_upstream_spellings PASS. The srv2 --v2-native-route closure receipt at this head is run by the coordinator against the main baseline at 199aee77 and posted on this PR.

Obligations bound to the EVENTUAL post-D4 head

This PR is held until after D4 and will remerge main then; the obligations below bind whatever head results, not any sha named above, and are executed once there:

1. the CI floor on that head shows every v2.test.v2_native_route witness planned-and-passed, and the build lane's generated-artifact phase is green;
2. a coordinator-run srv2 claim_executor --v2-native-route --source-root dag --source-root src/v2 at that head, whose log shows required-ci: v2-native emitted crate built — … RUSTFLAGS="-D warnings" … with rustc's identity and warning_count=0, the required-ci: v2-native telemetry … line, and a terminal required-ci: v2-native admission admitted line.

Baseline receipt (run 34521851736 on 1eb184f, srv1-17 aarch64, before this change)

• emitted closure 812d6addfae6f2f25295d63bbf29b2f70e9b1cfdd6aafaa11074658ecea8ec91 (172 files); emitted binary sha256 46175db15d7d209617bfc6f5f520955d83e0ed81fbc6beb64e45e9cd3c5beb81
• rustc 1.93.0 (254b59607 2026-01-19); emitted-crate build under AMBIENT RUSTFLAGS=-D warnings (toolchain-action default), 0 warning lines in the job log
• native run 21:16:51→23:46:28 = 2h29m37s; 3492 verdict rows, 2925 file refusals; emission-arena rss_kb_before=14124724 trim→9272220
• cancelled by the then-180-min job envelope at 3h00m during the post-run typechecks — no terminal admission line (the CI job was since deleted by Delete the required-v2-native CI job; the route stays as an operator-invoked instrument #11003).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TeSjTvn6wik6dGnnGgK5vx

[gunbai-bot]

review 63410 (slot-budget fork): fixed in 5a3dd54. v2_native_lane_memory_envelope() now reads gunbc.runner_slot_allocation gunbc_runner_slot_desired().memory_high and v2_native_lane_memory_reserve() is that slot's memory_max minus memory_high, so the requirement equals the slot's memory.max by construction; the witness a_bound_below_the_requirement_is_refused_and_an_exact_fit_is_admitted now also asserts envelope == slot.memory_high and requirement == slot.memory_max. The two literals are gone. Same push removes the i-a provenance arms per the side-chat ruling D (they land with the provider-spine lane).

[gunbai-bot]

review 63536: both findings fixed in d732881. (1) The probe spawn now reads its env-var names through the stage0 mirror of extdeps.rust.cargo — cargo_environment_variable_name(CargoEnvironmentVariable::RustflagsEnv) (and CargoTargetDirEnv likewise) — so RustflagsEnv has an executing consumer and the spawn no longer spells the name; the unit test the_probe_cargo_spawn_sets_the_warning_denial_and_the_receipt_names_that_spawn asserts the row's spelling. The denial VALUE stays a documented mirror of repo_self_warning_denial (no repo_self_build mirror exists in stage0), closed mechanically by the receipt clause emitted_build_warnings_not_denied. (2) The run_cargo rationale now states the fingerprint fact: RUSTFLAGS is part of cargo's fingerprint, CI's seed build shares it, a workstation pays one dependency-graph rebuild under the denial on the first probe build and is incremental after.

[gunbai-bot]

srv2 closure receipt at 34bd1b7 (post-D4, post-#10988 baseline)

Instrument: closure_pr.sh 11011 on srv2 — overlay of this PR's diff (base 199aee7, head 34bd1b7) on main 199aee7 (overlay commit d4457a83), pinned producer claim_executor_pinned sha256 9ccde5a618abee2e, route --v2-native-route --source-root dag --source-root src/v2, native fold over the 167-module closure root, EXIT=0, _terminal: complete, wall 318 s, rss 1.23 GB.

Compared with the main baseline taken the same way at 199aee7 (closure_main.sh: 29 refusals, 0 regressions vs the post-#11032 66-row set):

• emitted closure digest c17ed878e348… — identical to main's;
• emitted compiler binary sha256 222baf0b1d78057b — byte-identical to main's;
• file-refusal after-set: 29 rows, identity-join with the baseline: no row added, no row removed, no cause changed (28 parse_g0_tokens_remain + 1 normalize_reason_post_normalize_not_well_formed on src/v2/std/runtime.dag).

So this head changes nothing in the emitted compiler's provenance; its receipt is the baseline's. Regressed files: none. Population: unchanged. srv2 artifacts: /home/briansrls/p-11011/{fold.out,refusals_after.txt}.

— sent from eager-raven-113