Gen-two door PR-c: census every file, emit the entry's reference-derived closure member by member

[gunbai-bot]

PR-c of the gen-two door fix (self-host closure frontier lane, stern-moth-549). It builds on #12186 (PR-a, reference-derived closure) and #12187 (PR-b, census mode). Design agreed with neat-boar-16.

Why the door changes

Two defects, both measured:

• The door emitted the entry module only. compiler_closure_emit resolved the admission subject, and resolution answers for the subject alone; it reads other modules only through the symbol index. The old "closure" was one module.
• The door body-lowered every file under the roots. So gen-one stopped at body_lowering_reason_call_argument_unread in dag/examples/weather/weather.dag, a file outside v2.compiler.compile's closure (srv1 receipt at Keep the generation-one v2-native-cli executable past its probe root (declared seed growth) #12182's head).

What

v2.compiler.self_host.closure_emission emit_closure_from_ingest_located(ingest, entry, entry_locus, target) does the following:

1. Census (total). Tokenize, parse, then normalize_census every file, threading one allocator. A parse or census refusal refuses the emission: an unreadable declaration might be the one a reference binds, so dropping the file would be the section 5 absorbing arm.
2. Closure. reference_derived_closure over the census index of every file. resolve_member fully normalizes and resolves one member in a context whose only root is that member; NamespaceOnlyY never admits imports through other roots. The normalized tree comes back as the visit payload (the fold is now generic in P), so each member is normalized once.
3. Emit, per member. Resolve against the members' full projections plus the non-members' census_tree_binding_source (the PR-b handoff condition), check that the member reaches only closure members (closure_emission_member_reaches_outside_closure otherwise), then infer and emit_for_target. The outcome is one typed arm, ClosureMemberEmitted or ClosureMemberRefused.
4. Carrier and codec. ClosureEmission { entry, members (reach order), modules } renders through extdeps.languages.json, the one declared codec, via closure_emission_json. The parse direction reads it back; see the round-trip control.

In v2.cli.compile_cli v2_cli_run, stdout is the carrier's JSON rendering. CliEmitted { text, closure_size, refused_count }. v2_cli_exit fails the process if any member refused; every arm is still written.

Why two resolutions per member. The closure phase can only use the census index, since membership is not yet known. The emission index differs where the unique-variant-alias scan counts a Disj inside a body the census never lowered. The reach check turns any divergence into a located refusal.

Which refusals stop everything. A member whose body does not lower refuses the emission, because its reach is unknown and emitting the rest would be a silently smaller closure. Only refusals after membership is known (resolve, infer, translate, emit, e.g. #12207's body refusal) become that member's arm.

Evidence

v2.test.claim.self_host.closure_emission, 4/4 PASS locally:

• Direction 1: a module outside the closure whose body does not lower does not stop the emission. The closure is exact, the outsider has no arm, and every member has exactly one arm.
• Direction 2: a module outside the closure that does not parse refuses the emission.
• Direction 3: a closure member whose body does not lower refuses the emission at body_lowering_reason_else_less_if_unlowered.
• Codec: the rendering parses back through extdeps.languages.json.parse with the same entry, member identities and module count.

Each scenario is a shared nullary producer in floor_pure_producer_share. v2_native_cli_test (18/18) and occurrence_file_attribution_test (7/7) also pass with the new CliEmitted shape. reference_closure_test has been updated for the generic payload.

On this tree every fixture member's arm is translate_rejected_grounding_not_derived, which is blocker #2 (infer grounding, warm-cat-318's lane), carried as an arm rather than stopping the others.

Route pin (PR-b handoff (b)). Nothing after resolve reads a SymbolIndex entry: 04_infer mentions it only in a comment, and eval, translate, emit and partition not at all. Resolution mints references as declaring-path spines, and CensusTree has no route to any of those stages. So a non-member's signature-only Arrow is unreachable by construction.

Owed, NOT discharged

• The 189 set-equality. Gen-one's closure of v2.compiler.compile, read from this door's members, must be set-equal at module identity with the seed's reference-derived closure (v1_compiler.cli_run.entry_resolve load_sources_for_entry_with_index, 189 at 2b1ff2a). It runs on srv1 through the built door (no floor witness can ingest the corpus). Trigger: this PR's head built by //gunbc/instruments:v2-native-cli and run over dag + src/v2.

Ordering dependency (do not land first)

The v2-native-cli instrument's emit probe (adjudicate_cli_emit_probe, seed side) requires EMPTY stdout. With this PR the door writes the carrier and exits 1, because the fixture member refuses on grounding. warm-cat-318's branch flips that probe to admit the emission and makes the member emit. This PR must land after it, or rebase onto it. I am not editing that function in parallel.

🤖 Generated with Claude Code

Seed census (hand-written Rust, before/after)

Measured at merge-base a1d5db9518a (origin/main) vs head 212a846b9e. Generated mirrors (// Generated by v1 compiler) are excluded; the only one touched, v1_compiler_emit_rust.rs, is regenerated from src/v1/05_emit_rust.dag (fixed point verified).

file	before	after	Δ (numstat)
src/v1/stage0/src/cli_run/native_lane_runner.rs	2841	3103	+262 net (+286 / −24)

No other hand-written seed file changes. What the new lines are:

• Production (host decode + adjudication): CliDoorMemberArm (Emitted / Refused) and cli_door_member_arm, which read the fixture member's arm out of the door's ClosureEmission carrier. There are also two new CliEmitProbeVerdict arms, CarrierContradictsRendering and MemberRefusalCarrierMissing, plus their refusal renderings in cli_emit_probe_refusal.
• Test controls (#[cfg(test)]): carrier, carrier_refused helpers; a_member_refusal_carrying_the_carrier_is_judged_by_its_rendered_reason, a_carried_reason_that_differs_from_the_rendered_one_fails, an_emitted_arm_under_a_refusal_fails, a_body_refusal_without_its_carrier_is_not_the_pinned_arm, the_cli_main_writes_the_fold_text_once_before_the_status_dispatch, exit_zero_with_the_fixture_arm_refused_fails, and (adoption, lively-lynx-749) an_adjudicate_marker_without_frontier_refuses. The adoption also added "frontier" to five pre-existing fixtures, which Native v2 frontier ratchet: identity-grain debt roster, in-binary ratchet, nightly srv job #12184 had left red on main.

All production additions are enumerated in gunbc.source_root_eval_driver_seed_growth (reason and current_boundary) under that row's existing trigger: a .dag driver that receives a process termination as a value.

[gunbai-bot]

emit-build status (a non-required detector lane), as of 3956ea4:

• Fixed in this PR: the door's failing status now renders the refused member's full located chain (NativeCliDoorRefusalNotRendered came from a summary-only exit reason).
• Expected to stay red until rebase: the seed-side emit probe (adjudicate_cli_emit_probe) still requires EMPTY stdout, and this PR's door writes the ClosureEmission carrier. The probe gets adapted when this PR rebases after Door probe reaches translate: lower data_decl to a named member and ground it (flip the expecting-red) #12197 (the fixture member emits) and Refuse a bodied arrow at the type-expression projection; re-pin the v2-native-cli emit arm to it (gen-two blocker #4, on top of #12197) #12207 (the re-pin to CLI_DOOR_EMIT_BODY_REFUSAL). The refused-member arm will be compared to that constant, and an emitted arm must meet the existing substance oracle (the name, 606060, and emitted_text_compiles_as_rust). That order was agreed with both authors. This PR stays draft until then.

— sent from stern-moth-549

[gunbai-bot]

Addressing review 71141 in 0d98ba4. The finding is correct: two emitters answered one question, and the PR never said how they relate.

I chose the review's second option, a declared frozen-X statement, rather than cutting over in this PR. The old emitter's remaining consumers are six, in other lanes' subsystems:

• compiler_closure_emit_driver, and through it v2.workflow.product_receipt_stage
• frontier_probe
• the long emit-derisk test
• the execution test
• keen-cat-459's closure_emit_arrow_body_refusal control
• two rows that cite the route by name

Cutting them over is its own replacement migration, so it gets a PR of its own rather than riding in the door change (§3: for a root outside the gate, enumerate the consumers by name before you delete).

What this commit does:

• v2.compiler.self_host.compiler_closure_emit now carries compiler_closure_emit_frozen_dissolve_on. It says the module is replaced by closure_emission emit_closure_from_ingest_located, and says why: the old route emits the entry module alone and lowers every file. It names all six consumers, states that adding a consumer before the cutover is a defect, and gives the trigger: the cutover change landing, which moves them and deletes the module.
• The new module's header states the replacement and points at that row, so the two are never presented as alternatives.

I'm offering the cutover to neat-boar-16 as a follow-up; I can take it.

— sent from stern-moth-549