Seed infer joins a service receiver by owner module + name; a same-named import refuses at the receiver

dag/gunbc/plans/blackjack_onboarding.dag

@@ -4,6 +4,7 @@ import std.dissolution { unbound_dissolution }
 import gunbc.plan { Plan, PlanRetiresWhen, PlanProjectsCommittedMarkdown }
 import std.markdown { MarkdownBlock, MarkdownTableRow, CodeBlock, TableBlock, AlignNone }
 import gunbc.plans.md_helpers { h2, h3, p, li, ul, ol, cell, row, quote, hr }
+import extdeps.entropy { Urandom }
 
 fn code(text: String) -> MarkdownBlock { CodeBlock { code: text } }
 

dag/gunbc/recurring_failure_mode/surface_shorthand_preempts_resolved_identity.dag

@@ -27,6 +27,10 @@ data surface_shorthand_preempts_resolved_identity: RecurringFailureMode = Recurr
 
     "FOURTH SPECIMEN (2026-09-24, gunbc#12185, found by side-chat review). The service-receiver stamp joins on the bare NAME, not the owning declaration: v1.compiler.infer infer_var_binding_kind stamps ServiceValueBinding when the service registry holds the local's name and the local's type is the nominal reference the scope fold inserted (local_is_service_root_binding), without comparing that reference's owner module to the registry row's. gunbc.runner_guest_image calls `Filesystem.Write(...)` and reads `.success`/`.error`, which is extdeps.filesystem.filesystem_io's service Filesystem. When #12185 first named a source for that bare read, it imported std.resources { Filesystem } (a resource whose capability is lowercase `write` with output `written`), and the module still type-checked and emitted, because the registry row matched by name. The import was corrected to extdeps.filesystem.filesystem_io { Filesystem }, checked by reading the call: `.success` and `.error` exist only on that service's Write, not on the resource's `write`. The join itself is unrepaired. THE DISCRIMINATING RED IS UNAUTHORABLE ON EVERY ROUTE TODAY: on the seed, the name-only join is the defect, so a mutant import back to std.resources type-checks and emits green; on v2, v2.extdeps.languages.dag has no resource production (the resource shape refuses at parse) and v2.compiler.namespace_graft places only fn/data/type declarations in the containment tree, so a service receiver has no declaring path to assert. Next rung, two capabilities, either of which makes the red authorable: (a) the seed's service stamp requires the local's resolved declaration and the registry row to be the SAME declaration (owner module plus name), so a two-declaration fixture refuses the mutant import at the call; (b) v2 grafts service declarations into the containment tree and gains a resource production, so the receiver's declaring path is assertable.",
 
+    "FOURTH SPECIMEN CLIMBED (2026-09-24, node adhoc-a42f3901-8f2). The seed's service registry was the closure-wide census keyed by leaf name, and every bare-declared service's root was seeded as a local of every module, so the join could not see owners. A bare-declared service is now in a module's scope only when the module declares it or imports its owner by that name (v1.compiler.infer census_service_in_scope, imported_service_in_scope), and a receiver that would have reached the old join through another module's same-named declaration refuses ServiceOwnerMismatch, typed and located at the receiver, with no fallback (service_owner_mismatch_refusal). Collisions are decided by POSITION, never by insertion order: two VALUES under one name refuse at every receiver, while a type or resource in a type or uses position does not compete with a service in receiver position. The census itself was a second instance of the class -- it held ONE service per spelling, so a second same-named service replaced the first before any ambiguity was judged -- and now holds every declaration of a name (v1.compiler.infer_env service_census_candidates); a module's candidates are collected from its declarations and ALL its imports, `import *` included, and decided only over the whole set: exactly one service is admitted, two or more services or a service beside a function or data value refuse as AmbiguousReference, and the bare-reference closure (cli_run census_single_service_owner) refuses a plural pull rather than picking one. Evidence: test.claim.service_owner_identity_witness (service import accepted with the service's output typed; resource-only import refuses at the receiver; both imported, the uses-typed resource and the service receiver each resolve; two same-named designed services refuse in either import order and through `import *`, either one alone is admitted while both exist, and service + resource + data refuses in either order). The dotted service roots (shell., git., github., ...) never reach this registry, and scoping their root locals is a separate, resolver-censused change.",
+
+    "RESIDUAL, recorded and not fixed: one spelling meaning two declarations in one module is still a meaning fork (DESIGN 3), made unambiguous but not removed. gunbc.runner_microvm_slot_controller writes Filesystem for std.resources's resource in its uses clauses and for extdeps.filesystem.filesystem_io's service at its receivers. Trigger, a capability: qualified or aliased import references, so a module can spell std.resources.Filesystem and the filesystem_io service differently in source.",
+
     "Next-rung trigger: host literals and intentional primitive representations are typed parser/resolver constructions, and evaluator value construction is total over every resolved binding with no raw-spelling arm able to override it.)",
   ],
 

dag/gunbc/roadmap/roadmap_served_observation.dag

@@ -30,6 +30,7 @@ import gunbc.roadmap_belt_actuate {
   belt_workflow_attempts_observed_json_for_instance, belt_workflow_attempts_http_status,
   BeltWorkflowAttempts, WorkflowAttemptsObserved, WorkflowAttemptsRefused,
 }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 // THE DASHBOARD IS DISAGGREGATED INTO ONE PRODUCER AND ANY NUMBER OF STATELESS READERS. Before this
 // module the serve process observed the host on every request: each page render forked ~26

dag/gunbc/runner/runner_attempt_launch.dag

@@ -69,8 +69,8 @@ import extdeps.systemd.systemd_run { SystemdRunProperty }
 import extdeps.shell.exec { ProcessOutcome, ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
 import extdeps.posix.test_utility { PathExistenceReading, PathPresent, PathAbsentOrUnstattable, PathExistenceUnreadable }
 import extdeps.tools.stat { stat_owner_uid_command, stat_mode_command, stat_size_bytes_command, StatFieldReading, StatFieldRead, StatFieldUnread, stat_field_reading }
-import std.resources { Filesystem }
 import gunbc.command_runner { run_shell_command_capture }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 data runner_attempt_launch_disposition: ConstructionMechanism = SingleAuthority
 

dag/gunbc/runner/runner_microvm_boot_probe.dag

@@ -35,6 +35,7 @@ import gunbc.runner_microvm_host_ready {
 import gunbc.command_runner {
   ProcessObservation, run_shell_command_observe, run_shell_commands, LocalExec,
 }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 data runner_microvm_boot_probe_disposition: ConstructionMechanism = SingleAuthority
 

dag/gunbc/runner/runner_microvm_cell_readiness_store.dag

@@ -6,7 +6,6 @@ import std.checked_arithmetic { checked_int_magnitude, CheckedNat, CheckedNatRea
 import std.algebra { trim }
 import std.disposition { ConstructionMechanism, SingleAuthority }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.resources { Filesystem }
 import extdeps.exec.command { LocalExec }
 import extdeps.shell.exec { ProcessOutcome, ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
 import extdeps.tools.stat {
@@ -43,6 +42,7 @@ import gunbc.runner_microvm_cell_readiness {
   CellReadinessWrite, CellReadinessWriteResult, WriteAccepted, apply_cell_readiness_write, record_of_write,
   record_cell,
 }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 data runner_microvm_cell_readiness_store_disposition: ConstructionMechanism = SingleAuthority
 

dag/gunbc/runner/runner_microvm_lifecycle_realize.dag

@@ -4,7 +4,6 @@ import std.types { String, NonEmptyStr, Bool, List, Int }
 import std.nat { Nat }
 import std.disposition { ConstructionMechanism, SingleAuthority }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.resources { Filesystem }
 import std.measure { Second, second, second_count, ByteSize, byte_size }
 import std.algebra { trim }
 import extdeps.exec.command { ArgvCommand, LocalExec, argv_words }
@@ -86,6 +85,7 @@ import gunbc.runner_microvm_lifecycle {
   UnitInvocationReading, UnitInvocationRead, UnitInvocationUnread,
   attempt_teardown_readback, settle_teardown, TeardownSettlement,
 }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 data runner_microvm_lifecycle_realize_disposition: ConstructionMechanism = SingleAuthority
 

dag/gunbc/runner/runner_microvm_slot_controller.dag

@@ -86,6 +86,7 @@ import gunbc.runner_microvm_lifecycle_realize {
   ControllerRefusedAdmission, ControllerRefusedBinding, ControllerQuarantinedUnattributedResidue,
   ControllerStartNotRecorded, ControllerRecovered, ControllerRanAttempt,
 }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 data runner_microvm_slot_controller_disposition: ConstructionMechanism = SingleAuthority
 

dag/gunbc/scm/repository_load.dag

@@ -48,6 +48,7 @@ import extdeps.filesystem.filesystem_io {
   FilesystemReadSucceeded,
   FilesystemReadRefused,
   filesystem_read_outcome,
+  Filesystem
 }
 import extdeps.languages.json.parse {
   parse_json_document,

dag/gunbc/seed_growth_admission.dag

@@ -4,6 +4,7 @@ import gunbc.evaluation_store_address_census_seed_growth { evaluation_store_addr
 import gunbc.primitive_egress_census_seed_growth { primitive_egress_census_seed_growth_justification }
 import gunbc.required_lane_resolution_census_seed_growth { required_lane_resolution_census_seed_growth_justification }
 import gunbc.bare_reference_channel_outcome_seed_growth { bare_reference_channel_outcome_seed_growth_justification }
+import gunbc.service_owner_pull_seed_growth { service_owner_pull_seed_growth_justification }
 import gunbc.unimported_bare_provider_gate_seed_growth { unimported_bare_provider_gate_seed_growth_justification }
 import gunbc.persisted_resolved_graph_consumer_test_seed_growth {
   persisted_resolved_graph_format_wall_seed_growth_justification,
@@ -311,6 +312,7 @@ fn seed_growth_justification_roster() -> List<SeedGrowthJustification> {
     primitive_egress_census_seed_growth_justification,
     required_lane_resolution_census_seed_growth_justification,
     bare_reference_channel_outcome_seed_growth_justification,
+    service_owner_pull_seed_growth_justification,
     floor_corpus_census_allowance_seed_growth_justification,
     unimported_bare_provider_gate_seed_growth_justification,
     enrolment_dead_band_seed_growth_justification

dag/gunbc/service_owner_pull_seed_growth.dag

@@ -0,0 +1,25 @@
+module gunbc.service_owner_pull_seed_growth
+
+import gunbc.roadmap_model { RoadmapNodeId }
+import gunbc.seed_growth { SeedGrowthJustification }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+
+// FORWARD-FREEZE RECEIPT for the hand Rust the plural service census required in the bare-reference
+// closure (gunb-ai/gunbc#12265). PURPOSE (gunbc.v1_maintenance_standing v1_seed_standing): the
+// closure is seed host code that already read `census.services` to decide which module a bare
+// service head pulls; v1.compiler.infer_env now holds every declaration of a service name, so that
+// reader had to decide over a set instead of reading one entry. Taking an element would have
+// reintroduced the order-dependent join the change removes (gunbc.recurring_failure_mode
+// surface_shorthand_preempts_resolved_identity), so the decision is one named, unit-tested function
+// that defers to inference whenever the file imports an owner and refuses an unimported plural name rather than picking a winner.
+data service_owner_pull_seed_growth_justification: SeedGrowthJustification = SeedGrowthJustification {
+  hand_authored_declarations: [
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "ServiceOwnerPull", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "decide_service_owner_pull", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "census_single_service_owner", field: WholeDeclaration }
+  ],
+  reason: "The bare-reference provider walk (visit_bare_reference_providers) read the services census as one entry per name; the census now carries every declaration of a name, so its reader decides over the whole set. The walk runs for import-less files and, through unimported_bare_providers, for importing files too, so it reads the file's imports by module identity in both forms: when any owner of the name is imported the import provides it and v1.compiler.infer service_owner_conflicts_of decides (one admitted, several refused as AmbiguousReference); only a name no import reaches is resolved here, to exactly one owner or a refusal naming every owner. Pinned by cli_run service_owner_pull_tests.",
+  owning_dissolution_lane: "v1-hand-queue-drain" as RoadmapNodeId,
+  trigger: "Delete these items when the loader's bare-reference pull is decided by a .dag fold over typed import identity -- the same candidate authority v1.compiler.infer uses -- so the closure reads that decision instead of re-deriving which module a service head names from file text.",
+  current_boundary: "Called only from the bare-reference closure's resolve loop; reads the census and the file's import lines, writes nothing, and never substitutes a module for a refused plural pull."
+}

dag/gunbc/srv3/srv3_os_install_actuate.dag

@@ -1,4 +1,13 @@
 module gunbc.srv3_os_install_actuate
+import extdeps.filesystem.filesystem_io { Filesystem }
+import gunbc.auth.access_token_source { access_token_upsert_required_reason }
+import gunbc.nbd_proxy_virtual_media_install { srv3_os_install_actuator_plan_standing }
+import gunbc.srv3_actuate_shell_paths { srv3_bmcweb_login_body_path }
+import gunbc.srv3_bmc_credential_resolve { bmcweb_login_body_content, materialize_bmc_login_password, observe_and_resolve_srv3_bmc_credential, srv3_os_install_actuate_credential_intent }
+import gunbc.srv3_host_effect_apply { srv3_apply_to_process_exit, srv3_bmcweb_session_login_apply, srv3_bmcweb_token_extract_apply, srv3_nbd_proxy_serve_apply }
+import std.process { exit_failure }
+import gunbc.host_effect_realize { host_effect_apply, host_effect_apply_gated }
+import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_install_media_resolve }
 
 
 data gunbc_srv3_os_install_actuate_scope_disposition: Disposition = std.disposition.Terminal {

dag/gunbc/tools/card_intake.dag

@@ -1,4 +1,12 @@
 module gunbc.tools.card_intake
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.llm.anthropic_messages_api { AnthropicImageBlock, Base64Image, ImageJpeg, UserMessage, UserTextBlock }
+import std.disposition { Disposition, Scaffold, SingleAuthority }
+import extdeps.llm.anthropic_rest
+import extdeps.tcgplayer.catalog
+import extdeps.tcgplayer.pricing
+import extdeps.tcgplayer.store
+import extdeps.tcgplayer.tcgplayer
 
 
 data tcgplayer_client_id_source: CredentialSource = std.credentials.EnvVar { name: "TCGPLAYER_CLIENT_ID" }

dag/test/claim/clock_freshness_witness.dag

@@ -1,4 +1,5 @@
 module test.claim.clock_freshness_witness
+import extdeps.clock { Clock }
 
 
 fn witness_clock_now_positive_epoch() -> Bool {

dag/test/claim/emit_host_typed_smoke_test.dag

@@ -1,6 +1,7 @@
 module test.claim.emit_host_typed_smoke_test
 
 import tools.emit_host_transport { expected_stdout_nul_run }
+import extdeps.filesystem.filesystem_io { Filesystem }
 
 // Discriminating controls for the typed emit-host smokes (tools.emit_host_transport). The smokes
 // assert CONTENT equality against the in-substrate NUL golden; the control below emits five SPACES

dag/test/claim/filesystem_list_hermetic_witness_test.dag

@@ -3,8 +3,8 @@ module test.claim.filesystem_list_hermetic_witness_test
 
 import extdeps.filesystem.filesystem_io
 import std.types { Bool }
+import gunbc.output_policy { ExpectSuccess }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import v2.extdeps.file_system { Filesystem }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 

dag/test/claim/filesystem_write_closure_scale_witness.dag

@@ -1,4 +1,6 @@
 module test.claim.filesystem_write_closure_scale_witness
+import extdeps.filesystem.filesystem_io { Filesystem }
+import std.resources { ResourceHandle }
 
 
 data filesystem_write_closure_scale_anchor: ResourceHandle = ResourceHandle {

dag/test/claim/filesystem_write_witness.dag

@@ -1,6 +1,6 @@
 module test.claim.filesystem_write_witness
+import extdeps.filesystem.filesystem_io { Filesystem }
 
-import v2.extdeps.file_system { Filesystem }
 
 fn witness_write_then_read_roundtrip() -> Bool {
   let target = "/tmp/gunbc_fs_write_witness.txt"

dag/test/claim/m4_universal_corpus_witness.dag

@@ -1,4 +1,5 @@
 module test.claim.m4_universal_corpus_witness
+import test.fixture.m4_universal_governed_probe { GovernedUniversalProbe }
 
 
 fn witness_universal_published_realizes() -> Bool {

dag/test/claim/random_bytes_csprng_witness_test.dag

@@ -1,4 +1,7 @@
 module test.claim.random_bytes_csprng_witness
+import extdeps.entropy { Urandom }
+import std.encoding { base64_decode, base64_encode, base64_octets }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly