The two retained native build subjects get a planted-defect control, and their entrypoints get executed

[gunbai-bot]

THE SUBJECT: //gunbc/instruments:self-host (emits and builds v2.compiler.compile, the
SourceRootEvalDriver test driver) and //gunbc/instruments:v2-native-cli (emits and builds
v2.cli.compile_cli, the NativeCliDriver front door). Two gaps, both measured on the tree.

GAP 1 -- NEITHER SUBJECT HAD A PLANTED-DEFECT CONTROL. prepare_emitted_compiler_for_entry passed
the literal "v2_native_lane_carries_no_mutation_probe" to run_cargo, so both were admitted on a
green cargo run ALONE. A fingerprint alias, a replayed cached verdict, or an emitter that stopped
reaching rustc all report Completed status=0 byte-identically to a real compile. The required
emit-compile phase already owns a real control, and its roster
(gunbc.ci_layer_roots required_emit_compile_entries) is eight small entries containing NEITHER
native subject.

REPAIR: call the SAME producer, emitted_closure_compile_host::establish_discriminating_red --
one type error into the entry's own emitted module, cargo must fail ALONE on a diagnostic naming
the injected symbol, bytes restored byte-exactly. Not a second copy of its shape (DESIGN 3). The
binary's sha is re-read afterwards and must be unchanged, so the artifact handed on is shown to be
the one the green baseline produced rather than assumed to be. The baseline's attribution symbol is
aligned to MUTATION_PROBE_SYMBOL, because the old literal became false the moment a mutation ran.

GAP 2 -- THE BUILT ARTIFACTS WERE NEVER EXECUTED BY THEIR OWN INSTRUMENTS. The CLI binary was
spawned by nothing at all; the eval driver only by the separate operator-invoked
--required-v2-native route, never by self-host. v2.test.cli.v2_native_cli exercises the CLI's
FOLDS over supplied argv and a supplied ingest -- the right subject for those rows, and not an
inhabitance claim that the program runs (DESIGN 3's pairing obligation, 5's
specification-without-execution).

REPAIR: walk_eval_driver_door and walk_cli_door spawn what was built.

POSITIVE CONTROL, green by execution (gunbc test //gunbc/instruments:self-host, exit 0):
self-host: driver accepted the clean root — mode=census universe=0
self-host: driver refused the poison specimen — reason="tokenize_lex_e1_unrecognized_char"
self-host v1->v2: closure=a4402ad806e6541eba0bc2576c0004e4eec3a17b913427bb1a214485a6626385
binary=e574f9bf770926a190b6f665699cd7cedf4882836fc15c489709118c91781a85
exit_status=0 warning_count=0 door_universe=0
Two census runs of one binary differing ONLY in their root, with different answers. The CLI's
no-entry arm is the same shape: it reaches cli_no_entry, a located cause only that module's own
fold produces, so the process demonstrably started, parsed argv, decided and set its own status.

MUTATION CONTROL, red by execution, on both subjects:
self-host: Discriminated subject=EntryOwnModule module=v2_compiler_compile red=1616
v2-native-cli: Discriminated subject=EntryOwnModule module=v2_cli_compile_cli red=326

AN EXPECTING-RED PROBE, ENROLLED RATHER THAN DELETED OR WEAKENED (DESIGN 4b(4)). The CLI's emit arm
FAILS and stays: the built door CANNOT emit a closure. Measured on the artifact -- over the fixture
root infer_grounding_not_derived, over the real corpus a located parse_g0_tokens_remain at
dag/extdeps/access/posix_effective_principal_read_op.dag on the service ... { operation ... }
form. These are limitations in the emitted front end, not defects of this instrument, and
v2.cli.compile_cli already records the same shape at gunbc#11507. The probe pins the cause BY
NAME, so a crash, a spawn failure or a different refusal fails the instrument; and an exit 0 fails
it too, with an explicit instruction to flip it into a regression control requiring the emitted text
to name the subject. That limitation is routed to the session that owns the front end.

A SECOND READER, DECLARED RATHER THAN LEFT TO BE FOUND. walk_eval_driver_door spells census as a
literal, which makes it a second reader of the eval driver's verb surface. RETIREMENT TRIGGER AT
CAPABILITY GRAIN: the entrypoint control derives its argv from that driver's own plan once the plan
is on main, sufficient that no verb spelling survives in this file -- deliberately not "when
gunbc#11952 lands", which could be satisfied while the literal still stood. That join is owned by
gunbc#11952, not by this change.

DISPOSITION OF WHAT IT REPLACES: the "v2_native_lane_carries_no_mutation_probe" literal is gone --
it was a true statement about a lane with no mutation probe and became false. WELL_FORMED_CONTROL_ROOT
is named for its property, not its first reader, because both walks consume it. One new fixture,
fixtures/native_cli_door/door_probe.dag, in its own directory because a CLI source root is walked
recursively and a shared directory would make the control's ingest depend on other authors.

EXACT-HEAD HANDBACK: every figure above was measured on this branch's content. This branch sits on
the Pkg1a repair (gunbc#11971); without it neither closure builds and none of these controls run.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

Stacked on #11971 (Pkg1a): without that repair neither closure builds, so none of these controls execute. Base will move to main once #11971 lands.

🤖 Generated with Claude Code

[gunbai-bot]

Duplicate of #11972, which the dashboard attached for this same head branch. Consolidating onto #11972 so dashboard tracking and auto-review stay bound to one PR. Keeping that one based on main rather than stacking: a stacked base gets zero CI checks in this repo, and a main base runs the gates over the combined diff.