fix(compile-clean): dissolve the §3 loader-closure fork — gate loader runs both closures

[gunbai-bot]

What

Dissolves a §3 closure-authority fork between the two source loaders. The compile-clean gate loader load_compile_clean_entry_sources ran only extend_with_reference_closure (module-path references), while the witness loader load_sources_for_entry_with_pool runs both that and extend_with_bare_reference_closure in a fixpoint. Both functions' doc-comments each claimed to be "the ONE closure authority" — the code was forked.

The service-name and bare-name provider edges (e.g. gcp.STS → dag/extdeps/cloud/gcp/sts.dag) live only in the bare closure. So an affected entry that reaches a provider purely through a service call or bare name — dag/gunbc/auth/patterns.dag → gcp.STS.Exchange, zero imports — dropped that provider from the scoped compile set, and its names went unresolved (or silently mis-bound to a same-named declaration).

This surfaced non-locally when #6937's import strip made patterns.dag affected: a strip under src/v2 produced a diagnostic in an untouched dag/gunbc/auth/ file in a different tree.

Fix

The gate loader runs the same both-closure fixpoint as the witness loader, via a primary-precedence MultiEntryIndex (build_multi_entry_index_primary_precedence). One file.

Proven by execution

scoped_gate_loader_pulls_bare_referenced_providers (#[ignore]d, heavyweight — builds the whole-tree index):

• RED control (old ref-only behavior, inline): patterns.dag's closure has 3 unresolved type hard diags and no sts.dag.
• Fixed: sts.dag pulled in, 0 hard diags.

Whole-tree compile-clean (None filter, the poisoning-risk path) after the change = 0 hard diagnostics — no cross-tree Empty/Cons poisoning.

Scope / notes

• This is the first increment of the namespace-only resolution lane's move toward reference-derived dependencies (DESIGN.md open thread). It is grounded in the code — the fork is real independent of any decision.
• Likely fixes Import strip: src/v2/test + src/v2/lens (464 files) #6937's blocker. calm-deer-217's patterns.dag:47 expected Secret got String red is the same closure-drop seen at a different name (when sts.dag drops, gcp.STS misses the registry and access.access_token mis-binds to a String homonym). Being confirmed by rebase.
• Memory (cc @sunny-wolf-225 governor lane): brings the gate path to parity with the witness loader's both-closure cost — not a new cost class, but more resolution work on the gate path. Relevant to the namespace wave 1: containment-tree resolution — layered census + name-derived loader (salvage) #6848 floor-memory regression under measurement. Bisect any gate-path memory movement as this change, expected, not a fresh regression.
• Follow-up (separate PR): a §5 fail-closed backstop so an absent service provider refuses with a typed located error instead of letting inference mis-bind to any type. The silent Secret→String degradation is the argument for it.

---

Verification confirmed on latest main (be9631e + this change):

• regression test scoped_gate_loader_pulls_bare_referenced_providers: pass (RED control reds, fix greens)
• whole-tree compile-clean: HISTOGRAM_TOTAL_HARD 0, RSS 4345 MiB — unchanged vs pre-fix 4346 MiB, i.e. no whole-tree memory cost (the bare-closure growth is scoped-path only)