OWNERSHIP-68: v1 seed wrap-catalog construction wall (rc-ownership-wrap-decision)

[briansrls]

Summary

Replaces the blanket shared_types → Rc<> rule in the v1 seed emitter with per-carrier × per-use-site wrap decisions driven by dag/extdeps/languages/rust/wrap_catalog.dag (apply_seed_wrap_decision, rust_seed_value_needs_rc_wrap, value-site alignment helpers).

Status: NOT merge-ready. Post-merge main integration is done (e4cdd50706), but two blockers remain:

1. Regen fixed point is not compile-green. cargo build -p v1-compiler passes on the hybrid stage0 head (69 stale generated files), but a clean 2-generation regen_stage0 reaches regen_divergence_count=0 and then fails cargo build with ~9,305 errors (mass E0308 from demoted Rc::new at struct-literal value sites while return types remain Rc<T> — e.g. extdeps_cargo.rs ExternalAuthority thread_local).

2. Canonical-seven E0308 regression (NO GREEN-WITHOUT-DELTA violated). Fresh local probe after merge (CSSL_STD_SEED_LINK=1, gunbc compile → cssl_assemble → cargo build --release --lib, classifier-v3 residual histogram). Binaries verified by path + mtime + sha256 before counting.

module	main E0308	branch E0308	Δ
06_translate.dag	114	4558	+4444
04_infer.dag	91	4012	+3921
05_eval.dag	117	4526	+4409
05_emit.dag	114	4559	+4444
emit_host.dag	202	5271	+5069
emit_module.dag	122	4571	+4449
materialization_carriers.dag	77	804	+727
TOTAL	837	28301	+27464

• main: git_sha=4331373a87, gunbc_sha=a6d07de583315df19f7fb59223d7de5f794d6d2cfa398df608da4fa8c8c0ae62
• branch: git_sha=e4cdd50706, gunbc_sha=f16e0fcf9784946d96feb62ed3b9aa34deaa0f0cef8fd07c7b564f24da1e7102

Test plan

• CTRL_BUILD_BYPASS_SHIMS=1 cargo build -p v1-compiler --release — PASS on hybrid head e4cdd50706
• cargo test -p v1-compiler-tests ownership_wrap — 9/9 PASS
• target/release/regen_stage0 --verify — FAIL (69 stale files on hybrid head)
• 2-gen regen_stage0 — verify PASS (divergence_count=0) but subsequent cargo build -p v1-compiler FAIL (~9305 errors; not committed)
• Canonical-seven probe — see table above (regression)

Next steps (blocked)

Emitter must reach a regen fixed point that is simultaneously regen --verify green and cargo build green, with canonical-seven E0308 net-neutral-or-better vs main before merge.

[gunbai-bot]

Addressed review feedback on e66b2219d2:

review 42712 (composer-2.5) — Fixed in prior commits on this branch:

• Dissolved ownership_wrap_sites_match; catalog fold now uses coproduct equality (row.use_site == use_site) matching target_model.dag.
• Threaded use_site through render_rust_type_with_applied_binding from render_rust_decl_type / render_rust_fn_sig_type_applied_binding callers (fn-sig paths no longer hardcode struct-field catalog rows).

review 42726 (composer-2.5) — Fixed in e66b2219d2:

• Added rust_type_is_box_wrapped idempotency guard in apply_seed_wrap_decision (mirrors existing ReferenceLayerRc / rust_type_is_rc_wrapped guard) so generic struct fields that already received Box<Node> via render_rust_decl_type(..., OwnershipAtStructField) are not double-wrapped at emit_struct_field_from_child.
• Added catalog_node_generic_struct_field_wraps_box_once regression (type Tree<T> { child: Node }); asserts Box<Node> present and Box<Box<Node>> absent.

review 42724 (claude-opus-4-7, non-blocking) — PR title updated to name the rc-ownership-wrap-decision lane; bare emit for shared_types members absent from the catalog remains the intended construction wall per rust_seed_wrap_decision_note.

— sent from witty-wolf-289

[gunbai-bot]

review 42904 (claude-opus-4-7 REQUEST_CHANGES) — verified against current branch; partial fix landed, one item deferred with rationale.

1. Parallel enum twins (OwnershipWrapUseSite / OwnershipReferenceLayer / OwnershipWrapSourceProjection vs target_model) — deferred (layer DAG), not a nickname dodge

Verified: the three projection helpers at rust.dag:4186-4212 are arm-by-arm identity maps, and OwnershipWrapUseSite is not byte-identical to TargetOwnershipUseSite — the extdeps surface adds OwnershipWrapUseSiteAbsent, which the v1 seed emitter uses as a lookup-refusal sentinel at expression/alias positions (rust_seed_wrap_decision_note in 05_emit_rust.dag).

Why not fix in this PR: wrap_catalog.dag lives in dag/extdeps/ (extdeps layer). TargetOwnershipUseSite / TargetReferenceLayer / TargetUseSiteOwnershipSourceProjection live in src/v2/std/compilers/target_model.dag (compiler/v2 layer). The layer DAG is std ← extdeps ← compiler — extdeps cannot import v2 target_model without layer inversion. Hoisting the shared ownership surface into dag/std (or a dag/extdeps carrier module both sides import) is the correct consolidation; it is a named follow-on, not a wrap-patch.

Dissolution trigger: hoist ownership use-site / reference-layer / source-projection types to dag/std (or extdeps-facing std projection), delete the three identity projection fns, replace OwnershipWrapUseSiteAbsent with TargetOwnershipUseSite? at v1 call sites.

2. carrier: String closed-set tag — fixed in working tree

• Added closed OwnershipWrapCarrier coproduct (9 variants) on RustSgRcOwnershipWrapCatalogRow in wrap_catalog.dag; catalog rows now use enum literals, not string tags.
• Lookup boundary: rust_sg_rc_wrap_carrier_from_type_name maps inferred type-name strings → carrier enum; unknown names return none (catalog miss, not a writable bad row).
• v2 projection: rust_sg_rc_wrap_catalog_row_carrier_node is now total over OwnershipWrapCarrier (no string switch + silent Absent fallthrough).
• Witness tightened: rust_sg_rc_wrap_catalog_all_rows_project() requires every catalog row to realize; rust_sg_rc_wrap_catalog_projection_complete() = all-rows-project and length match (addresses review 42896 length-only gap).

Remaining gate (not this review item): expression-level Rc alignment in 05_emit_rust.dag still blocks a green full regen_stage0 + v1-compiler build — construction wall on types is landed, expression paths are in flight. Measured OWNERSHIP-68 receipt still owed in PR body.

— sent from witty-wolf-289

[gunbai-bot]

review 42919 — verified and fixed

Finding (scripts/ probe runners): Confirmed on 09b3cfdeac. git diff origin/main...HEAD -- scripts/ was non-empty (scripts/curated_cargo_probe_one.sh, scripts/lib/render_cssl_probe_lib_cargo_toml.sh); git ls-tree origin/main -- scripts/ is empty. Both files carried SCAFFOLD headers delegating to dag/tools/self_host_curated_probe_cargo.dag but still reintroduced the shell wrapper ROADMAP.md:44 and dag/gunbc/roadmap_authority.dag:477 record as deleted 2026-07-23 — out of OWNERSHIP-68 scope and parallel to the bin-first cssl_assemble / tools.self_host_curated_seed_linked_harness path.

Action: Dropped both files in 09b3cfdeac; git diff origin/main...HEAD -- scripts/ is now empty. No other PR paths reference these runners (only historical probe docs cite them).

Wrap-catalog scope (unchanged): dag/extdeps/languages/rust/wrap_catalog.dag remains the single authority; v1 apply_seed_wrap_decision (src/v1/05_emit_rust.dag:794) and v2 projection/witnesses + ownership_wrap_emit_test.rs are untouched by this commit.

Merge readiness (re-evaluated): This review item is addressed. Tally floor still not met: build CI red (~9k E0308 — type signatures demoted by construction wall but expression emit still misaligned pending regen fixed-point), regen skipped behind build, 0 api-review APPROVEs on file, open REQUEST_CHANGES from review 42904 (enum-twin / carrier consolidation — deferred with layer-DAG rationale). PR does not yet satisfy the OWNERSHIP-68 deliverable bar (canonical-seven receipt, mechanical burn-down, OccurrenceId fork list, discriminating RED).

[gunbai-bot]

review 42936 (claude-opus-4-7 APPROVE) — verified; no code change for the non-blocking item.

Agree on the catalog shape: single RustSgRcOwnershipWrapCatalogRow authority in wrap_catalog.dag, v2 rows derived by projection with length + all-project completeness — that is the intended §3/§2 landing.

On OwnershipWrapUseSiteAbsent: confirmed it is not a catalog row (no rust_sg_rc_ownership_wrap_catalog_rows() entry); rust_sg_rc_wrap_layer_lookup short-circuits it to none and v2 use_site projection maps it to optional_absent(). It is a v1-seed lookup-refusal sentinel for expression/alias render paths that intentionally lack an explicit use-site (rust_seed_wrap_decision_note in 05_emit_rust.dag). Splitting “no site” out of the sum (e.g. OwnershipWrapUseSite? at call sites) is the right end-state and is already named as follow-on in the review 42904 reply — blocked on hoisting the shared ownership surface to dag/std so extdeps does not import v2.std.compilers.target_model. Not worth churning in this PR while expression/regen fixed-point is still open.

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43009 (REQUEST_CHANGES)

Verified each finding against current af00bc3754 on session/witty-wolf-289-ownership-68.

1. variant_ref_self_wraps — fixed

Stage0 had drifted to freemonoid_empty || set_contains(shared_types, enum_name). It now matches 05_emit_rust.dag:6318-6323: FreeMonoid arm → rust_seed_catalog_wraps_rc_at_use_site(..., OwnershipAtBindingProjection); else → rust_seed_value_needs_rc_wrap(..., OwnershipAtBindingProjection).

2. Match scrutinee refs — fixed

emit_typed_match scrutinee deref (&*( vs &() now routes through rust_seed_value_needs_rc_wrap(ty_name, ..., OwnershipAtBindingProjection) (was set_contains(&shared_types, ty_name)).

3. Other value-site Rc::new(...) paths — fixed

Stage0 now uses rust_seed_value_needs_rc_wrap (not shared_types blanket) at the remaining modeled sites:

• enum variant value refs (6422)
• struct-field record literals (8352, OwnershipAtStructField)
• anonymous single-field / multi-field struct literals (8455, 8483)
• ctor-alias struct literals (8644)

Added rust_seed_value_needs_rc_wrap to stage0 (was missing entirely).

4. rust_seed_legacy_container_blanket_rc regen bridge — kept, now aligned

Still present in apply_seed_wrap_decision Absent arm (05_emit_rust.dag:818-823) as the documented regen bridge. With stage0 value sites synced to the catalog wall, executable emit now matches the modeled authority on the paths compile_dag_target actually runs; the bridge only fires on catalog miss at typed use sites, same as the .dag note.

Tests

Added value-expression witnesses in ownership_wrap_emit_test.rs:

• non_catalog_variant_value_no_blanket_rc_new — would have failed under the old blanket
• catalog_node_variant_value_wraps_rc_new — catalog Node at binding projection

All 9 ownership_wrap tests green locally via cargo test -p v1-compiler-tests ownership_wrap.

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43234

Finding 1 — rust_sg_rc_wrap_layer_lookup fold short-circuit (blocking): fixed in c0c0de2.

Verified against current code: on a non-matching row the inner arm returned bare none, overwriting a previously-Present accumulator. With multiple rows per carrier (e.g. WrapCarrierNode at struct-field and binding-projection), the first hit was lost on the very next non-match — a real §5 fail-open.

• .dag authority: else none → else acc in dag/extdeps/languages/rust/wrap_catalog.dag
• seed realization: else { None } → else { acc } in src/v1/stage0/src/extdeps_languages_rust_wrap_catalog.rs
• Added rust_sg_rc_wrap_layer_lookup_witness_holds (Node struct-field → ReferenceLayerBox, then binding-projection → ReferenceLayerRc after scanning past intervening rows) and wired it into wrap_decision_predicate_test.dag so the witness exercises the lookup fold, not only row_to_realization.

Finding 2 — stage0 carrier: String fork (non-blocking): confirmed tracked debt, dissolve-on is real.

rust_sg_rc_wrap_catalog_realization_fork_note names the trigger: stage0 emits a closed OwnershipWrapCarrier enum inhabited from the .dag rows without string-key compare at the realization boundary. Today lookup still enters via rust_sg_rc_wrap_carrier_key + string compare in generated Rust; the .dag row authority is already the closed enum. No change in this commit — lands with compile-green stage0 regen (same lane as the 69-file drift).

— sent from witty-wolf-289

[gunbai-bot]

CI fix (0917cb8): Reverted accidental full stage0 regen commit 2dcfbdb — it wrote 72 generated files (~11k LOC churn), broke cargo build (~8k E0308 mismatches), and pushed the PR diff past GitHub's 20k-line gh pr diff cap (modeling-coherence fail-closed).

Branch is back to the scoped OWNERSHIP-68 surface (~14 files vs main). Build should green again; modeling-coherence check can fetch the diff.

Regen remains red at this head (emitter construction wall vs main-era committed stage0 for ~74 files) — that needs the self-host frontier lane (full regen + hand-maintained bridge fixes), not another blind regen_stage0 write.

— sent from witty-wolf-289

[gunbai-bot]

Addressed review 43392 in 715210e:

Finding 1 — hand-Rust receipt gate: ownership_wrap_emit_test.rs no longer labels scoped fixtures as a shrink “Receipt.” Module doc now carries an explicit §7 scaffold deferral: corpus census shrink deferred to lane sharp-bee-290 / Weak→Strong Self Host Gate 3 (compile-green stage0 regen fixed point), citing ROADMAP.md §④ regen_verify and rc-ownership-wrap-decision-design.md implementation sequence step 3, with a named dissolve-on (regen_verify green with ownership_wrap on affected-set corpus).

Finding 2 — string carrier fork: Committed seed extdeps_languages_rust_wrap_catalog.rs now uses closed OwnershipWrapCarrier on RustSgRcOwnershipWrapCatalogRow and rust_sg_rc_wrap_carrier_from_type_name enum lookup — matching wrap_catalog.dag:35. Updated rust_sg_rc_wrap_catalog_realization_fork_note to record hand-sync landed; remaining dissolve-on is stale full-regen still emitting carrier: String until Gate 3 compile-green regen.

Verification: cargo build -p v1-compiler green; ownership_wrap 9/10 (catalog_node_struct_field_literal_wraps_box_new still red — data-def serde init path, pre-existing follow-on).

— sent from witty-wolf-289

[gunbai-bot]

review 43402 — enrolled-carrier catalog miss (fixed in a6079f3)

Finding: rust_seed_effective_reference_layer at 05_emit_rust.dag:812-816 silently defaulted catalog misses to legacy-container ReferenceLayerRc or ReferenceLayerOwned.

Fix: Introduced SeedWrapOutcome (Decided | Refused) with single authority rust_seed_resolve_wrap_outcome. At explicit use sites, when rust_sg_rc_carrier_enrolled_but_row_missing holds (carrier is in the closed OwnershipWrapCarrier enum but no row exists for that use site), emit propagates a typed refusal via emit_error_expr — no silent layer default. Example: ProbeHeap at FunctionParameter (mirrors v2 wrap_decision_probe_heap_param_miss_rejects).

Unchanged (intentional):

• Unenrolled module-local types (e.g. DigitStep) still default Owned — partition-derived interim per design doc §implementation sequence step 4 / census table.
• Legacy container prefix scaffold (Vec< / HashMap< / BTreeMap<) remains a named SCAFFOLD with dissolve-on rust_seed_legacy_container_blanket_dissolve_on — distinct from enrolled-carrier miss (unenrolled container carriers, not catalog-enrolled types).

Witness: catalog_enrolled_carrier_missing_row_refuses in ownership_wrap_emit_test.rs (10/11 ownership_wrap tests green; catalog_node_struct_field_literal_wraps_box_new pre-existing serde/json path gap).

— sent from witty-wolf-289

[gunbai-bot]

review 43418 — v2 projection re-encoded catalog validity (fixed)

Finding: rust_sg_rc_wrap_catalog_row_display_name at rust.dag:4111 independently encoded which (carrier, use_site) pairs are valid via Optional Absent arms; rust_sg_rc_wrap_catalog_all_rows_project validated that second authority at runtime; row_to_realization_required trapped on disagreement.

Fix: Added closed coproduct OwnershipWrapCatalogRowKey (22 variants = one per enrolled row) to wrap_catalog.dag as the row identity on RustSgRcOwnershipWrapCatalogRow. Invalid carrier×use_site combinations are now unwritable — only keyed rows exist in rust_sg_rc_ownership_wrap_catalog_rows().

v2 projection is now derived, total on row.key:

• rust_sg_rc_wrap_catalog_row_display_name(key) → Symbol (no Optional)
• rust_sg_rc_wrap_catalog_row_target_use_site_from_key(key) → TargetOwnershipUseSite (no Optional)
• rust_sg_rc_wrap_catalog_row_to_realization(row) → TargetUseSiteOwnershipRealization directly

Deleted: rust_sg_rc_wrap_catalog_all_rows_project, row_to_realization_required, and the absent_row_refusal trap chain. rust_sg_rc_wrap_catalog_projection_complete now checks row-count parity only (projection is structurally total).

Seed hand-sync: extdeps_languages_rust_wrap_catalog.rs carries OwnershipWrapCatalogRowKey on each row.

— sent from witty-wolf-289

[gunbai-bot]

review 43428 — dual-encoded catalog rows (fixed)

Finding: RustSgRcOwnershipWrapCatalogRow stored key plus redundant carrier/use_site/… fields; v1 lookup read fields while v2 derived use_site from key — two independently writable authorities.

Fix: RustSgRcOwnershipWrapCatalogRow is now a type alias for OwnershipWrapCatalogRowKey. The row list is 22 keys only. All facts derive from key via total functions in wrap_catalog.dag:

• rust_sg_rc_wrap_catalog_row_carrier
• rust_sg_rc_wrap_catalog_row_use_site
• rust_sg_rc_wrap_catalog_row_source_projection
• rust_sg_rc_wrap_catalog_row_reference_layer

v1 rust_sg_rc_wrap_row_lookup_for_carrier and v2 rust_sg_rc_wrap_catalog_row_to_realization both call these — one authority, no drift surface. Seed hand-sync mirrors the same derived API.

main_wet + 10/11 ownership_wrap tests green locally.

— sent from witty-wolf-289

[gunbai-bot]

review 43442 — addressed in 0183a98686 + 7773fe1bec

1. rust_inferred_node_needs_rc_wrap (was 05_emit_rust.dag:902-907)

Fixed. No longer calls rust_type_is_rc_wrapped on a type rendered with OwnershipWrapUseSiteAbsent. It now renders at OwnershipAtFunctionReturn and delegates to rust_seed_value_needs_rc_wrap → rust_seed_resolve_wrap_outcome (same catalog authority as apply_seed_wrap_decision). Seed mirror: rust_inferred_node_needs_rc_wrap in v1_compiler_emit_rust.rs.

2. rust_wrap_runtime_collection_result demotion path (05_emit_rust.dag:6733-6747)

Fixed. The else arm no longer calls rust_seed_demote_outer_rc_wrap; it passes call_str through unchanged. Wrap is applied only when rust_inferred_node_needs_rc_wrap (catalog at function-return) is true. Seed emit_typed_call_expr, emit_rust_generic_method_call, and method-template paths now call the updated rust_wrap_runtime_collection_result instead of unconditional Rc::new(...).

3. List-literal templates (emit.dag:161-162 bare vec![])

No template revert — intentional with corrected consumer. Bare vec![] / vec![{0}] is the value-layer default; rust_seed_wrap_typed_expr_result / rust_seed_align_list_literal_wrap re-wrap via catalog when rust_seed_inferred_type_needs_rc_wrap (now at OwnershipAtBindingProjection) says Rc. The bug was the old needs_rc check reading absent-site rendering, not the bare template itself.

4. rust_seed_legacy_container_blanket_rc string-prefix scaffold (05_emit_rust.dag:798-803)

No change (per your non-blocking note). Scaffold remains with existing dissolve trigger on catalog row landing.

Verification

• cargo test -p v1-compiler-tests ownership_wrap: 10/11 green (pre-existing catalog_node_struct_field_literal_wraps_box_new failure — serde/json struct-literal path, not this wrap gate)
• cargo build -p v1-compiler: green locally

— sent from witty-wolf-289

[gunbai-bot]

Diagnosis (preserved from this line of work)

Closing this PR in favor of a fresh branch off origin/main with only the inert slice. The findings below are the valuable output of the partial-consolidation experiment and must not disappear with the branch.

Control table

Commit	cargo build -p v1-compiler	regen_verify
7773fe1 (hand-synced, pre-merge)	GREEN	FAIL (72 stage0 files stale)
2d88a8e (merge main only)	FAIL (8184 errors)	FAIL
fb1353b (merge + regen)	FAIL (8184 errors)	GREEN

Error-set diff (2d88a8e vs fb1353b)

Sorted cargo build error sets compared:

• 7920 shared errors (identical diagnostic text)
• 241 only in 2d88a8e
• 244 only in fb1353b
• Totals both report 8184 — coincidental; regen mostly shifts line numbers, not error classes (~97% overlap)

Four-decider fork (partial consolidation)

Type position was consolidated via wrap_shared_type / catalog, but value/deref deciders still use raw set_contains(shared_types, …):

Decider	Location
Record-update spread needs_rc	05_emit_rust.dag:6911, 7539 (verbatim duplicates), 9845
rc_match.needs_deref	7847, 8702
field_access_field_is_boxed	6333

Conclusion: consolidating only the type position converts a consistent wrong answer into an inconsistent one — and the emitted crate gets worse. The follow-up is pairwise consumer flips on a fresh inert authority, not more partial consolidation on this branch.

Forward

Replacement PR will land the inert wrap_catalog authority only (zero emitter consumers, byte-identical regen). Consumer flips are separate PRs.

[gunbai-bot]

Superseded by #7297 (inert-first slice only). Diagnosis preserved in #7223 (comment).