docs/plans: lens-input-authority — resolve once, share by reference (P1 declaration lane)

[gunbai-bot]

Summary

Records the lens-input-authority design lane (co-authored with merry-moth-539, #6375): every v2 lens is a pure reader over the resolved graph, so N lenses demanding one resolve-identity with no share is the materialization ladder's rule-1 AuthoredDuplication. Affected-set is the flagship — it needs the whole-tree resolve and OOMs at corpus scale (24 GiB, exit 137), which is why affected-set-in-CI is fed an empty roster and failing witnesses slip through.

The doc grounds the fix in merry-moth's ladder (#6375) and splits the resolve-identity into two providers:

• P1 — in-process share (ReferenceTier @ SharedStateFrame, process_shared_index): already rewired by union-resolve S1 (Union resolve S1: one shared index per process (prelude + discovery + shards) #6234); this lane declares it so it's typed + countable and a new lens that resolves privately is the undeclared-provider shape. Grain-corrected per merry-moth: identity = union-index-build (index built once), distinct from the K per-entry closure resolves (their receipt) and the K readers (this lane's reader_count).
• P2 — cross-process store (resolved_graph_cache, content-keyed, on main): the isolation-LCA discharge, owned by graph-major S2b. This lane only records the P1↔P2 one-identity relation (fnv1a64 dual-surface discipline) with its dissolution trigger.

Scope: design doc only (precedent: dozens of docs/plans/*.md on main). The .dag this doc specifies (dag/gunbc/floor_materialization.dag + witness) imports std.materialization_ladder, which is on #6375, not main — committing it to a main-based branch reds the compile-clean gate. It is authored, verified green-by-execution against #6375's ladder in-session (all 3 witnesses PASS incl. the providers=[] RED control), and held off-branch; it lands as a follow-up PR the moment the ladder is on main.

Test plan

• Markdown only — no code changed; compile-clean is unaffected (the doc is not ingested).
• The specified .dag was run in-session via claim_batch against Duplicate Computation #6375's ladder HEAD (confirmed byte-identical): floor_index_build_share_is_shared_by_reference, floor_index_build_has_plural_readers, floor_index_build_reds_without_reference_provider — 3/3 PASS, RED control discriminates. Held off this branch by construction (imports a Duplicate Computation #6375-only module).
• Backing oracles cited (run under the rust nextest gate): memo_deduplicates_resolve_count, memo_warm_cold_results_are_identical (claim_executor.rs); union_view_result_equals_private_resolve_in_every_order, union_resolve_typechecks_each_node_once (src/v1/tests/src/union_resolve_receipts_test.rs).

Note on branch history

Intermediate commits briefly carried an in-session verification overlay (the held .dag + #6375's ladder file); it was removed — the net diff is the single design doc. Squash-merge flattens the churn.

[gunbai-bot]

Draft intentionally — blocked-in-progress on #6375, not abandoned.

This lane's payload (dag/gunbc/floor_materialization.dag + dag/test/claim/floor_materialization_witness_test.dag) imports std.materialization_ladder, which lands with #6375 (the materialization ladder). Committing the .dag on a main-based branch reds compile-clean (the import can't resolve — fixed in e275970 by holding it off-branch), so this PR carries only the design doc until #6375's ladder reaches main.

Status: the .dag + witness are authored per merry-moth-539's ladder rulings (union-index-build grain, ReferenceTier provider_row, live-roster fold, ValueSharedByReference + RED control) and staged; design doc §6 records the exact shape + re-land steps. Blocked on #6375, which is currently an open draft, mergeState BLOCKED.

Flips ready when #6375's ladder is on main: merge main → drop in the two authored files → claim_batch green-by-execution (+ RED control) → enroll the CommitWitnessClaim row.