Preserve whole-value reads across ownership branch joins

[gunbai-bot]

A branch with more projections could replace another branch's entire binding-usage list, discarding its whole-value Read. With a preceding return, build_movable_set then classified the binding as movable and emitted Rust moved an Rc before a later projection. Rustc refused with E0382.

ownership.max_usage_by_fan_out retains reads from either binding usage and deduplicates shared-prefix evidence. Projected stays distinct. The emitter uses its existing clone decision; no emitter rule changes. This ownership root precedes the Optional representation migration, whose newly triggering source needs a seed carrying the repaired fold.

Validation and coverage:

• Required corpus-grain coverage is announced by CI as required-ci: phase regen-fixed-point (second generation vs first). Executing build phase. It re-derives the committed compiler mirrors and refuses divergence.
• Final route transaction regenB0c.3wJWlT intentionally removes the authored .dag fixture and its emitted mirror/registrations. After rebuilding, it reports 155 planned/executed/adjudicated, first_generation_equal=true, and fixed_point_equal=true. Sources and generated deletions land together. Full instrument including the initial removal refusal.
• cargo test --release -p v1-compiler --test ownership_branch_read -j2 passed 4/4 locally under a 22 GiB address-space bound. The three original BindingUsage fixtures cover smaller-branch Read retention, Projected-before-Consumed movability, and conservative whole-Read behavior. The fourth test invokes compile_sources on baseline and both constructor orders and asserts their emitted clone bytes. Local execution receipt. The post-cleanup rerun on d5830737419 also passes 4/4 (0.04s test execution). Final-tree execution receipt.
• Discriminating native RED: exact-main emitted move-first fails E0382 while baseline and reordered control compile. Main rustc receipt, assert-based main RED. On the rebuilt repaired seed, the unchanged probe was built as a cargo example and all three emitted modules compile; both constructor orders carry Some(item.clone()). Native recipe and GREEN, emitted move-first.
• The broader native-route fold receipt, exact-head CI, and gatekeeper sign-off remain pending.

The Rust integration tests are compiled by required clippy --all-targets but not executed by any CI step. gunbc.rung_drop.rust_unit_tests_off_the_merge_path declares that execution drop. Their named executing route is the local cargo test command above; this is landing evidence, not scheduled coverage. The attempted .dag placement could not supply required execution and has been removed together with its generated fixture mirror. No floor roots, exclusions, or quarantine rows change.

The fixtures return to .dag when a required seed-rooted phase writes same-identity, candidate-bound terminals into the disposition receipt. Work item node://adhoc-babdd2de-8db, owned by eager-raven-113, carries that model-first harness in an existing lane without global root widening. The recurring failure-mode row names this capability; the missing harness is a next-rung trigger, not a permanent ceiling.

The safety defect was loudly mitigated by rustc. Branch-Read retention is now constructed at the ownership join and mechanically preventable at corpus grain through required regeneration. Both constructor orders conservatively clone because Read is non-tail residue, not a last-use proof. This is bounded cost, not a correctness gap; per-path last-use evidence at the ownership fold is its separate next-rung trigger.

Hand-written Rust is confined to tests/ownership_branch_read.rs: fixture helpers usage and movable, plus the four tests branch_read_survives_larger_projection_path, projected_before_consumed_stays_movable, whole_read_then_consume_stays_non_movable, and authored_constructor_orders_emit_clones. These test the emitted seed, not a second production ownership implementation. Production Rust changes are transaction-generated mirrors.

The original transaction changes 18 mirrors (+172/-120), with 147 changed lines mentioning clone(). This is a changed-line census, not a count of new clone operations. max_usage_by_fan_out is the generated repair itself; the other declarations carry its conservative-clone consequences. The temporary fixture mirror and registrations are absent from the final change.

Generated module	Changed declarations
extdeps_container_oci_digest	oci_digest_algorithm_syntax_valid
extdeps_version_semver	semver_version_label
std_dissolution	dissolution_trigger_fired
std_induction	compose_sub_value_relations, cost_bound_params_into
std_nat	nat_range_accumulate
std_occurrence_identity	occurrence_transport_role_index_build
std_termination	descent_evidence_lattice_join, optional_evidence_meet
v1_compiler_compile	census_retain_module
v1_compiler_emit	apply_char_sanitization, emit_typed_cast_shared, emit_unified_typed_func_body, escape_emoji_codepoints_inner, int_to_upper_hex_inner, render_named_type_base, shared_tco_block
v1_compiler_emit_core_support	apply_named_template_nested, to_string_helper
v1_compiler_emit_rust	cli_option_rust_type, emit_enum_from_children, emit_func_body, emit_rust_tco_block, emit_struct_from_children, emit_type_def_from_connective, emit_variant_pattern, emit_variant_pattern_rc_aware, maybe_mark_shared_type
v1_compiler_infer	alias_chain_carrier, borrowed_callable_call_type, maybe_insert_composed_field_relation, substitute_generics
v1_compiler_infer_patterns	render_constructor_witness
v1_compiler_infer_resolve	resolve_paramless_generic_use_decl
v1_compiler_infer_types	extract_optional_inner_node, node_type_shape_argument_list
v1_compiler_ownership	max_usage_by_fan_out
v1_compiler_parse	int_to_string_acc, last_consumed_token_end, parse_let
v1_compiler_trait_derive_emit	v1_clone_bound_fixpoint_loop