wrap_decision: enroll UseSiteVerdict carrier and close ownership-gate follow-on

dag/tools/self_host_use_site_verdict_behavioral_transport.dag

@@ -26,7 +26,7 @@ data ssuv_shim_collection_rel: String = "dag/tools/self_host_use_site_verdict_sh
 
 data ssuv_shim_driver_rel: String = "dag/tools/self_host_use_site_verdict_shims/witness_main.rs"
 
-data ssuv_ownership_rc_default_fail_open_finding: String = "section 5 construct finding (Wave 2 use_site_verdict pilot): the Rust emitter silently applies default Rc<> wrapping on Node / UseSiteVerdict / fn params and returns with NO typed ownership refusal (target_use_site_ownership_lookup_miss unwired). Benign for this immutable-value module (emit-attempt 0 diagnostics) but a latent fail-open for mutation/aliasing-bearing modules in the wide fan-out — needs a principled wrap-decision predicate or typed refusal, never a silent default. Recorded here; not a blocker for this pilot."
+data ssuv_ownership_rc_default_fail_open_finding: String = "section 5 construct finding (Wave 2 use_site_verdict pilot, SUPERSEDED by wrap_decision_gate #6776 + 06_translate routing #6775): the v1 Rust emitter silently applied default Rc<> wrapping on Node / UseSiteVerdict / fn params with no typed ownership refusal. v2 translate now routes through wrap_decision_gate (WrapGateInapplicable passes through unchanged; catalog miss rejects). UseSiteVerdict enrolled in rust_sg_rc_use_site_ownership_catalog (owned-at-all-sites). v1 shared_types silent wrap remains on gunbc compile --target rust until v1 retirement (S3); not a blocker for this pilot."
 
 data ssuv_scaffold_dissolution_trigger: String = "dissolve-on: dag/tools/self_host_use_site_verdict_shims/* + ssuv_cargo_toml + witness_main shim — seed-linked dep shim files, driver-crate manifest (ssuv_cargo_toml fn, mirrors slb_cargo_toml: static Cargo.toml via concat handed to Filesystem.Write, not modeled-emit-fn output spliced through string ops; tracked scaffold debt on this carrier, not untracked medium-as-string), and witness driver. DISSOLVES WHEN v2.std.node self-emits and gunbc emits seed-linked extern imports against v1-compiler for seed-retained modules without hand shims, and a modeled self-host behavioral-equivalence harness producer emits the comparison driver + manifest (parallel to slb_scaffold_dissolution_trigger)."
 

docs/plans/rc-ownership-wrap-decision-design.md

@@ -114,11 +114,11 @@ The gate does not alone flip these — Track B body emit and namespace resolutio
 
 ## Implementation sequence (for the follow-on PR)
 
-1. **Land predicate + witnesses** (this session) — `wrap_decision_lookup_in_catalog_node`, `wrap_decision_gate`, `wrap_decision_predicate_test.dag` green.
-2. **Rewire `06_translate`** — replace inline `translate_sg_rc_bundle_apply_disposition` + lookup chains with `wrap_decision_gate` (behavior-preserving refactor; `sg_rc_layering_test` stays green).
-3. **Retire v1 `shared_types` wrap for v2 emit entry** — `gunbc compile --target rust` paths that run translate must not also call `render_rust_shared_type_if_needed`; `shared_types` becomes seed-only until v1 delete.
-4. **Enroll `UseSiteVerdict` carrier** — one row set in `rust.dag` catalog; RED: param site without row rejects (already proven for `ProbeHeap` in `sg_rc_layering_test`).
-5. **Frontier flip** — unblock `parse_engine_hooks`, `discovery_enumeration` per `frontier_band_a_emit_readiness`.
+1. **Land predicate + witnesses** — LANDED (#6776): `wrap_decision_lookup_in_catalog_node`, `wrap_decision_gate`, `wrap_decision_predicate_test.dag` green.
+2. **Rewire `06_translate`** — LANDED (#6775): inline `translate_sg_rc_bundle_apply_disposition` + lookup chains replaced with `wrap_decision_gate` (behavior-preserving refactor; `sg_rc_layering_test` stays green).
+3. **Retire v1 `shared_types` wrap for v2 emit entry** — v2 `emit` → `translate` path does not call `render_rust_shared_type_if_needed`; v1 `gunbc compile --target rust` still uses seed `shared_types` until v1 delete (S3).
+4. **Enroll `UseSiteVerdict` carrier** — LANDED: `target_carrier_use_site_verdict` + owned-at-all-sites rows in `rust.dag` catalog; witnesses in `wrap_decision_predicate_test.dag`.
+5. **Frontier flip** — unblock `parse_engine_hooks`, `discovery_enumeration` per `frontier_band_a_emit_readiness` (still gated on rustc-green behavioral receipts + Track B body emit).
 
 ## Witness / RED controls (`wrap_decision_predicate_test.dag`)
 

src/v2/compiler/self_host/frontier_band_a_emit_readiness.dag

@@ -16,7 +16,7 @@ type BandAEmitReadinessRow {
   gate: BandAWave1EmitReadiness
 }
 
-data compiler_frontier_band_a_emit_readiness_note: String = "Band A Wave-1-pre-flip recon: FlippableNow = no dependency on Wave 1 gates 1-3 (general body producer ingest, namespace SymbolIndex, FLAG D). Program policy sequences Band A after Wave 1 gate 4 (weak self-host behavioral receipt). BodyProducerGated count must remain 0 on this roster. OtherGate cites the matching compiler_frontier_row_* migration_trigger. Gate-4 follow-up (swift-lynx-212): pure-decl modules are NOT flippable before gate 4 — Rust Track A6 data_decl emit is absent (rust.dag has no data_decl rows; parse_engine_hooks is 100% data Symbol=^atom), frontier_probe_emit_from_ingest is unstaged (#6464), and no per-module SeedRetained->SelfEmitted receipt path exists today. Wave 2 use_site_verdict pilot follow-up: remaining FlippableNow rows (parse_engine_hooks, discovery_enumeration) MUST NOT flip until the Rust emitter ownership gate lands — see ssuv_ownership_rc_default_fail_open_finding in tools.self_host_use_site_verdict_behavioral_transport (silent default Rc<> wrap with target_use_site_ownership_lookup_miss unwired is construct-side fail-open; benign only for immutable-value modules)."
+data compiler_frontier_band_a_emit_readiness_note: String = "Band A Wave-1-pre-flip recon: FlippableNow = no dependency on Wave 1 gates 1-3 (general body producer ingest, namespace SymbolIndex, FLAG D). Program policy sequences Band A after Wave 1 gate 4 (weak self-host behavioral receipt). BodyProducerGated count must remain 0 on this roster. OtherGate cites the matching compiler_frontier_row_* migration_trigger. Gate-4 follow-up (swift-lynx-212): pure-decl modules are NOT flippable before gate 4 — Rust Track A6 data_decl emit is absent (rust.dag has no data_decl rows; parse_engine_hooks is 100% data Symbol=^atom), frontier_probe_emit_from_ingest is unstaged (#6464), and no per-module SeedRetained->SelfEmitted receipt path exists today. Wave 2 use_site_verdict pilot follow-up: wrap_decision_gate landed (#6776) and 06_translate routes through it (#6775); UseSiteVerdict enrolled in rust_sg_rc_use_site_ownership_catalog (owned-at-all-sites). Remaining FlippableNow rows (parse_engine_hooks, discovery_enumeration) still gated on rustc-green behavioral receipts and Track B body emit — not the ownership gate alone."
 
 data compiler_frontier_band_a_emit_readiness_count_expected: Int = 6
 

src/v2/extdeps/languages/rust.dag

@@ -178,6 +178,7 @@ import v2.std.compilers.target_model {
   target_carrier_model_core_node,
   target_carrier_algebra_inhabitance_decl_node,
   target_carrier_probe_heap_node,
+  target_carrier_use_site_verdict_node,
   target_use_site_ownership_catalog_node,
   target_value_semantics_carriers_node,
   target_reference_layer_tokens_node,
@@ -4174,6 +4175,27 @@ fn rust_sg_rc_use_site_ownership_catalog() -> List<TargetUseSiteOwnershipRealiza
       use_site: OwnershipAtBindingProjection,
       reference_layer: ReferenceLayerRc,
       display_name: ^rust_sg_rc_probe_heap_binding
+    },
+    TargetUseSiteOwnershipRealization {
+      source_carrier: target_carrier_use_site_verdict_node(),
+      source_projection: UseSiteOwnershipExactCarrier,
+      use_site: OwnershipAtFunctionReturn,
+      reference_layer: ReferenceLayerOwned,
+      display_name: ^rust_sg_rc_use_site_verdict_return
+    },
+    TargetUseSiteOwnershipRealization {
+      source_carrier: target_carrier_use_site_verdict_node(),
+      source_projection: UseSiteOwnershipExactCarrier,
+      use_site: OwnershipAtFunctionParameter,
+      reference_layer: ReferenceLayerOwned,
+      display_name: ^rust_sg_rc_use_site_verdict_param
+    },
+    TargetUseSiteOwnershipRealization {
+      source_carrier: target_carrier_use_site_verdict_node(),
+      source_projection: UseSiteOwnershipExactCarrier,
+      use_site: OwnershipAtBindingProjection,
+      reference_layer: ReferenceLayerOwned,
+      display_name: ^rust_sg_rc_use_site_verdict_binding
     }
   ]
 }
@@ -4193,7 +4215,8 @@ fn rust_sg2_binding_spellings() -> Map<Symbol, String> {
   let m10 = map_insert(m9, ^target_carrier_model_core, "ModelCore")
   let m11 = map_insert(m10, ^target_carrier_algebra_inhabitance_decl, "AlgebraInhabitanceDecl")
   let m12 = map_insert(m11, ^target_carrier_probe_heap, "ProbeHeap")
-  let m13 = map_insert(m12, ^rust_collection_surface_btree_set, "std::collections::BTreeSet")
+  let m12b = map_insert(m12, ^target_carrier_use_site_verdict, "UseSiteVerdict")
+  let m13 = map_insert(m12b, ^rust_collection_surface_btree_set, "std::collections::BTreeSet")
   let m14 = map_insert(m13, ^rust_collection_surface_hash_set, "std::collections::HashSet")
   let m15 = map_insert(m14, ^rust_collection_surface_vec, "Vec")
   let m16 = map_insert(m15, ^target_collection_set_carrier, "Set")

src/v2/std/compilers/target_model.dag

@@ -9510,6 +9510,10 @@ fn target_carrier_probe_heap_node() -> Node {
   target_carrier_type_node(identity: ^target_carrier_probe_heap)
 }
 
+fn target_carrier_use_site_verdict_node() -> Node {
+  target_carrier_type_node(identity: ^target_carrier_use_site_verdict)
+}
+
 fn target_ownership_use_site_from_atom(id: Symbol) -> Optional<TargetOwnershipUseSite> {
   if id == discriminant(v: OwnershipAtFunctionReturn) {
     optional_present(value: OwnershipAtFunctionReturn)

src/v2/test/claim/wrap_decision_predicate_test.dag

@@ -18,6 +18,7 @@ import v2.std.compilers.target_model {
   WrapGateInapplicable,
   target_carrier_diagnostics_node,
   target_carrier_probe_heap_node,
+  target_carrier_use_site_verdict_node,
   target_use_site_ownership_catalog_node
 }
 import v2.std.diagnostic { Accepted, Rejected }
@@ -30,7 +31,7 @@ import v2.std.node {
 }
 import v2.std.text { String }
 
-data wrap_decision_predicate_note: String = "Derisk witnesses for rc-ownership-wrap-decision-design.md: wrap_decision_gate is the single authority for Rc/Box/owned type wrapping at emit sites. RED: omit Diagnostics param row -> param witness rejects; add silent default wrap on WrapGateInapplicable -> bundle_absent witness fails."
+data wrap_decision_predicate_note: String = "Derisk witnesses for rc-ownership-wrap-decision-design.md: wrap_decision_gate is the single authority for Rc/Box/owned type wrapping at emit sites. UseSiteVerdict enrolled (owned-at-all-sites). RED: omit Diagnostics param row -> param witness rejects; add silent default wrap on WrapGateInapplicable -> bundle_absent witness fails."
 
 fn wrap_decision_sg_rc_target() -> TargetModel {
   rust_sg2_type_expr_target_model()
@@ -179,10 +180,28 @@ test fn wrap_decision_bundle_partial_rejects() -> Bool {
   )
 }
 
+test fn wrap_decision_use_site_verdict_param_is_owned() -> Bool {
+  wrap_decision_gate_is_by_value(
+    target: wrap_decision_sg_rc_target(),
+    source_carrier: target_carrier_use_site_verdict_node(),
+    use_site: OwnershipAtFunctionParameter
+  )
+}
+
+test fn wrap_decision_use_site_verdict_return_is_owned() -> Bool {
+  wrap_decision_gate_is_by_value(
+    target: wrap_decision_sg_rc_target(),
+    source_carrier: target_carrier_use_site_verdict_node(),
+    use_site: OwnershipAtFunctionReturn
+  )
+}
+
 test fn wrap_decision_predicate_witness_holds() -> Bool {
   wrap_decision_diagnostics_return_is_rc()
     && wrap_decision_diagnostics_param_is_owned()
     && wrap_decision_probe_heap_param_miss_rejects()
     && wrap_decision_bundle_absent_inapplicable()
     && wrap_decision_bundle_partial_rejects()
+    && wrap_decision_use_site_verdict_param_is_owned()
+    && wrap_decision_use_site_verdict_return_is_owned()
 }