Native route admits on main: own the three unowned fatal causes; record the class

dag/gunbc/recurring_failure_mode/refusal_producer_lands_without_its_ownership_row.dag

@@ -0,0 +1,19 @@
+module gunbc.recurring_failure_mode.refusal_producer_lands_without_its_ownership_row
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data refusal_producer_lands_without_its_ownership_row: RecurringFailureMode = RecurringFailureMode {
+  identity: "refusal_producer_lands_without_its_ownership_row" as NonEmptyStr,
+
+  receipts: [
+    "INVALID STATE: a front-end stage gains a producer of a fatal refusal reason (a new `^..._reason_...` symbol, or an old one newly reachable) while `v2.workflow.compile_door_cause_ownership` `known_frontier_causes` carries no FatalGrain row for it. The producer and its ownership are two facts in two files, and the only join between them is `gunbc.witness_v2_native_route` `native_route_exclusions_all_classified` / `native_route_file_refusals_attributed`, executed by the native route, which is off the merge path (gunbc.rung_drop v2_native_route_off_the_merge_path).",
+    "HARM: the native route refuses its OWN admission by name (`unattributed_exclusions_present`, `unattributed_file_refusals_present`), so `//gunbc/instruments:v2-native-frontier` prints NOT A MEASUREMENT and can say neither green nor red about the native route. Every other clause may hold and it still does not measure; the one run that would say so is the run nobody on the landing path executes.",
+    "OBSERVED on main 1457bd81d00 (swift-ant-539, BuildBuddy, `claim_executor --v2-native-route`, driver-rows.jsonl aggregated in the same dispatch): positive population, required native pass and both live controls HELD; admission refused only on the two unattributed clauses. The unowned fatal causes were `body_lowering_reason_unsupported_form` (producers added by gunbc#12245 and gunbc#12315), `body_lowering_reason_function_value_body_unread` (gunbc#12210) and `infer_match_shape_invalid` (an older infer producer that became reachable as more modules cleared body lowering). None had ever had a row. The same two refusals held at the head of gunbc#12420 (4475ef4dd29).",
+    "DISTINGUISHING FACTS: not a frontier REGRESSION -- the refused members were already refused under some cause, and the new cause only renamed where they stop; not a missing measurement of the positive population -- that clause and the live pair were observed. The earlier refusals reported against eb5987e38f5 / cfc470cf (positive_population_empty, required_native_pass_regressed, both controls unobserved) do NOT reproduce on 1457bd81d00; at 19f039b6462 (parent of gunbc#12392) the smoke member reached EVAL and refused `eval_rejected_invalid_node`, so that was a separate eval defect since fixed on main, not the caret refusal's import cascade.",
+    "RUNG FOUND AT: mitigated -- the admission refuses loudly and by name, so nothing passes silently, but the refusal fires after the fact on a run no merge waits for. CEILING: structurally guaranteed -- the set of refusal reasons a stage can produce is derivable from the stage's own source, so an unowned producible reason can be refused before merge. NEXT-RUNG TRIGGER, NAMING THE CAPABILITY: the native route's admission executes on the landing path (the frontier in the required lane, gunbc.rung_drop v2_native_route_off_the_merge_path's trigger), so a PR that adds an unowned producer is refused by these same clauses before it merges; or, sufficient on its own, a merge-path claim that joins every fatal-reason symbol a front-end stage can emit to a FatalGrain ownership row at identity grain.",
+  ],
+
+  evidence: [],
+}

src/v2/workflow/compile_door_cause_ownership.dag

@@ -257,6 +257,24 @@ data known_frontier_causes: List<CauseOwnership> = [
     grain: FatalGrain,
     lane: SharedSelfHostCriticalPath,
     flip_trigger: "eval's grounding gate refuses a body whose inferred facts carry no DerivedGrounding — the node grounding frontier (v2.compiler.inferred_tree NodeGrounding); retires under node_grounding_frontier_retirement. Measured 2026-09-10 at fatal grain by the gunbc.witness_v2_native_route census over the lane's source roots dag + src/v2 (261 v2.test.* members across 110 modules)"
+  },
+  CauseOwnership {
+    cause: ^body_lowering_reason_unsupported_form,
+    grain: FatalGrain,
+    lane: SharedSelfHostCriticalPath,
+    flip_trigger: "body lowering's CATCH-ALL refusal: a value, arm capture or postfix/as-suffix shape v2.compiler.body_lowering_fold reads but has no dedicated reason for (gunbc#12245 and gunbc#12315 added producers without this row). Owned as a frontier, not as a class: it retires when each producing site refuses with a cause that names its shape (or lowers), so that no body-lowering path answers with this symbol and the count zeroes. Observed at fatal grain on the native route at main 1457bd81d00 over dag + src/v2 (member rows and file refusals)"
+  },
+  CauseOwnership {
+    cause: ^body_lowering_reason_function_value_body_unread,
+    grain: FatalGrain,
+    lane: SharedSelfHostCriticalPath,
+    flip_trigger: "a function value in value position (gunbc#12210) whose body neither body reader of v2.compiler.body_lowering_fold body_lower_function_value_body lowers: the refusal is located at the body rather than narrowing the value to its parameter. Flips when every function-value body shape in the corpus lowers through the same statement/expression readers an fn body uses, and the count zeroes. Observed at fatal grain as file refusals on the native route at main 1457bd81d00 over dag + src/v2"
+  },
+  CauseOwnership {
+    cause: ^infer_match_shape_invalid,
+    grain: FatalGrain,
+    lane: SharedSelfHostCriticalPath,
+    flip_trigger: "v2.compiler.04_infer infer_match_bool_arm_row reached a match arm that is not a Conj carrying match_arm_pattern and match_arm_body, i.e. a lowered arm shape infer does not read. Now observable at PREPARE because more modules clear body lowering and reach infer. Flips when every arm shape body lowering emits is the one infer reads (one arm carrier, no second shape) and the count zeroes. Observed at fatal grain on native-route member rows at main 1457bd81d00 over dag + src/v2"
   }
 ]