Native ingest: refuse two files claiming one module path

[gunbai-bot]

Summary

• The lively-bear-908 collision was path-derived source-root identity, not two files declaring std.algebra. dag/std/algebra.dag is module std.algebra; src/v2/std/algebra.dag is module v2.std.algebra. A copied single root used to guess DagTree from the file path, so resolve later reported resolve_unbound_name_is_declared_elsewhere.
• Tree identity is now the discovering --source-root (SourceRootFile.origin from gunbc.source_root_read) admitted by admit_source_root_argument: a dag or src/v2 directory, otherwise a typed refuse (SourceRootArgumentUnrecognized). There is no DagTree default and no /src/ path-component classifier.
• Discriminating arms: a copied parent dump refuses; a src/ folder under a dag root still emits; two admitted roots emit; a duplicate declared module names both files (closure_census_duplicate_module, same grain as the seed's module_path_collision_panic_message).
• Filed gunbc.recurring_failure_mode.two_source_files_claiming_one_module_path_misdiagnosed. Native inhabitance is walk_native_ingest_layout_controls on the existing walk_cli_door instrument, accounted on gunbc.source_root_eval_driver_seed_growth.

Operator merge only.

Test plan

• Floor / emit-build on this PR (poison census under a dag-named scratch root).
• Native layout walks (copied unrecognized root, /src/ under dag, two roots, both-files duplicate) via gunbc test //gunbc/instruments:v2-native-cli / walk_native_ingest_layout_controls.
• Claims: source_root_tagging_test and closure_emission_test census collision. The two v2_native_cli_test CLI emit claims were deleted in 323bf36 because they exceeded the new-witness step budget; the native walk covers them.

The native-CLI filesystem controls DO run on PR CI: emit-build runs //gunbc/instruments:v2-native-cli and prints "native-ingest layout controls held". Only the rust-unit-tests lane is skipped on pull_request. To reproduce locally, use this exact remote command (BuildBuddy linux/amd64, ctrl-build --remote, cgroup memory.max required or HostBudgetUnreadable):

ctrl-build --remote -- bash -lc '
  set -euo pipefail
  CG=/sys/fs/cgroup/gunbc-claim
  mkdir -p "$CG"
  echo $((16*1024*1024*1024)) > "$CG/memory.max"
  echo $$ > "$CG/cgroup.procs"
  cargo build --release -p v1-compiler --bin gunbc
  ./target/release/gunbc test //gunbc/instruments:v2-native-cli
'

[gunbai-bot]

review 78075

The first finding is already gone on this head (8f4bae3e19). source_root_for_storage_path is deleted. Tree identity is SourceRootFile.origin from the walk (gunbc.source_root_read) and admit_source_root_argument: a --source-root that is a dag or src/v2 tree, otherwise a typed usage refusal. A checkout under ~/src/ or dag/**/src/** is not classified from the file spelling.

The dangling-fixture finding was true of the earlier head: v2_cli_run claims still supply ingest (DESIGN §3, one interface). This commit enrolls the four layout roots as inhabitance on the built native CLI (walk_native_ingest_layout_controls in v1_compiler.cli_run native_lane_runner). Deleting fixtures/native_ingest_duplicate_module, fixtures/native_ingest_two_roots, fixtures/native_ingest_copied_single_root, or fixtures/native_ingest_src_in_dag now fails //gunbc/instruments:v2-native-cli.

[gunbai-bot]

review 78082

Both findings were true of the previous head; they are fixed on 88a8dbada3.

• tools.source_reference_repoint was the remaining SourceRootWalkTask constructor without origin, and it still treated walk results as String. It now stamps origin: path on each root task and folds walked.path (same discovering-root identity source_root_read already carries).
• declared_module_source_root is deleted. source_refs_from_declared takes the live pool_roots, finds the discovering pool root for each declared path, and runs admit_source_root_argument on that argument. No matching root or an unrecognized tree is a typed Outcome refusal (declared_module_pool_root_unknown / declared_module_source_root_undetermined), not a DagTree default.

[gunbai-bot]

review 78086

The first finding was already gone on 88a8dbada3 (before this review). declared_module_source_root is deleted. source_refs_from_declared matches each declared path to a pool_roots argument and runs admit_source_root_argument; unknown or unrecognized origins are typed Outcome refusals, not a silent DagTree.

The second finding was true: the internal-impossible arm constructed source_ref_for_storage_path(..., source_root: DagTree) for a sentinel that is not a walked file. On 27e3a950f6 that diagnostic is located by path only (source_ref_read_failed_diagnostic takes path, and never needed a tree tag — it only interned ref.path for the locus).

[gunbai-bot]

review 78104

The advisory on walk_native_ingest_layout_controls is noted. No deferral row: this is inhabitance on the existing walk_cli_door instrument, not a parallel seed path, and it is the control deleting the fixtures would fail. The remainder of the review (origin-based tree identity, refuse-not-widen admission, RFM trigger, executed arms) matches the landed cutover.

— sent from clever-tern-634

[gunbai-bot]

review 78111

Receipt for walk_native_ingest_layout_controls: enumerated on gunbc.source_root_eval_driver_seed_growth source_root_eval_driver_seed_growth_justification (lane v1-hand-queue-drain), with a seed-delta note on the function. Same host kind as walk_cli_door; no second justification.

— sent from clever-tern-634

[gunbai-bot]

review 78126

PR body updated to the walk-origin cutover (SourceRootFile.origin + admit_source_root_argument); the /src/ classifier description is gone.

— sent from clever-tern-634

[briansrls]

APPROVE at exact head 323bf36d98bb71c244ec12e73ac3a3bba515eb02. No blocking finding in the root-origin repair, duplicate-module refusal, or the replacement coverage for the two deleted expensive CLI claims.

(a) The surviving discriminators execute on required PR CI

The body understates the evidence: the native filesystem/layout controls are NOT skipped on this PR's required emit-build route. In exact-head workflow 37843915123, emit-build job 113539891208 runs the v2-native-cli instrument. Its log at 2026-10-08T22:01:57.4210025Z reports:

v2-native-cli: native-ingest layout controls held (unrecognized copied root, /src/ under dag, two roots, both-files duplicate)

The log then records successful door execution and instrument completion. This is not just compilation of a Rust test or the author's BuildBuddy dispatch. walk_cli_door unconditionally calls walk_native_ingest_layout_controls(binary, workspace)?; a failed layout control returns an error to the required instrument. Rust-unit-tests being skipped does not skip this call.

The four cases actually launch the emitted executable. They require an unsupported copied root to produce the usage-refusal exit, empty stdout and a diagnostic naming that root; a src subdirectory inside a declared dag root to emit successfully; two admitted roots to emit successfully with nonempty output; and duplicate modules to produce the refusal exit plus the duplicate reason and both collision filenames. Missing fixture directories refuse rather than skip.

The deleted two_files_declaring_one_module_refuse_as_a_census_collision_holds is covered at the native CLI exit boundary by that executed duplicate case, and at the supplied emission boundary by v2.test.claim.self_host.closure_emission::two_files_declaring_one_module_refuse_the_emission_at_the_census_holds. The latter requires Rejected, the exact closure_census_duplicate_module reason, and both ce_duplicate_a_read and ce_duplicate_b_read in the located diagnostic chain; Accepted is false.

The deleted distinct_module_paths_across_two_roots_do_not_refuse_as_a_collision_holds accepted even certain non-collision refusals. The surviving native two-root control instead requires successful emission with nonempty output, while the small source_root_tagging claims check the actual DagTree/V2Tree values. This does not weaken that positive.

I downloaded the exact-head floor artifact 11582556943 and verified its ZIP SHA256 against the current GitHub artifact metadata: 773ab03b676caf76aaa7e17ee7f39799c28c6043193b39f05da634c20b54c525. Its TSV records all six source_root_tagging claims and the duplicate-module closure-emission claim passing, with verdict_reached=true and observed costs. The duplicate claim is 453 eval steps. Thus the small boundary checks and the real native route both remain executing. No restoration of the two expensive claims, extra cost exemption, or new test lane is requested.

This verifies current passing regression controls, including their refusal cases. I did not independently replay a pre-fix compiler or a mutation; the author's BuildBuddy run 4a2b27c6 remains separate author-run evidence.

(b) Root naming is an explicit supported-layout restriction, not eliminated path dependence

The production walker seeds each task with the root argument as origin, preserves that origin while descending, and transfers it through SourceRootWalkedPath to SourceRootFile. source_root_ingest_from_files reads file.origin. source_root_for_storage_path is deleted; the file's own path no longer chooses its tree.

admit_source_root_argument remains a name-based admission of the two supported layouts: dag and src/v2, including the explicitly handled relative/absolute and trailing-slash forms. Any other discovered origin returns SourceRootArgumentUnrecognized, then SourceRootIngestFromFilesUnrecognizedRoot carrying the origin and file, and the CLI maps that refusal to CliUsageRefused. There is no catch-all DagTree and no search for an interior /src/ segment in a file path.

I accept this as the declared CLI root-layout contract at this head, not a semantic detector of arbitrary filesystem contents. The RFM and source comment name that bound and preserve the copied-root rejection. A directory merely renamed dag is treated as an asserted dag root; this PR does not certify its historical provenance or support arbitrary renamed or mixed-root dumps. Likewise this review does not claim that every unused/empty extra root is independently validated by this per-file admission. The guarantee is faithful tagging from a supported discovering root, not elimination of all naming conventions. The old per-file heuristic is not retained as a fallback.

The RFM distinguishes the original mis-tagging incident from an actual duplicate declared path. Its ceiling remains acceptance-time refusal/valid root tagging, not a claim that duplicate files are unwritable or that all native unbound-name failures are fixed. No additional root-introspection project or new root-role flag is required for this bounded repair.

(c) Duplicate modules block emission

The both-files diagnostic is consumed by the rejecting closure-emission outcome and by the CLI refusal path. It is not a census-only warning. The retained floor claim explicitly rejects an Accepted emission, and the required native control checks the process refusal exit with the duplicate diagnostic and both file names. Distinct declarations remain the successful native control. The repair adds the first locus without replacing the second or changing duplicate membership into a nonblocking report.

The origin-field adaptation in the walker/readers and emitted realization preserves errors rather than defaulting an unknown root. Exact-head generated CI passed all-target lint and the one-emission stage0 mirror check. I found no additional blocking fail-open arm in the reviewed changes.

Non-blocking PR-body correction and verification scope

Correct the test-plan sentence saying native-CLI filesystem controls are skipped on PR CI, and remove the two deleted v2_native_cli_test claims from its active test inventory. The code and exact-head required log already provide stronger evidence than that sentence says. Do not conflate any separately skipped full fault/restoration rebuild with these executing layout controls.

Workflow 37843915123 passed seed, generated, floor, emit-build and witnesses; Rust unit tests were skipped. Local execution here was artifact hashing/TSV inspection only. I did not run a local compiler, author mutation, remote dispatch or live infrastructure operation. No merge or enqueue performed. Land through the normal required checks on the composed revision.

[gunbai-bot]

Superseded by #13641 (v1 closeout): this head is an ancestor of integration/v1-closeout.