feat(ownership-68): inert wrap_catalog authority (zero emitter consumers)

[briansrls]

Replaces #7223 (closed — diagnosis preserved in that PR's comment). Supersedes duplicate #7297.

Lands the inert-first slice only: src/v2/extdeps/languages/rust_wrap_catalog.dag + witness. No changes to 05_emit_rust.dag or stage0/** — regen byte-identical, cargo build -p v1-compiler green.

• rust_seed_ownership_wrap_layer_disposition — canonical coproduct; consumes rust_sg_rc_use_site_ownership_catalog() via target_use_site_ownership_lookup_in_catalog (no parallel row table)
• rust_seed_effective_reference_layer — projects to TargetReferenceLayer?; none on enrolled-carrier catalog miss (fail-closed)
• Witness: ownership_wrap_catalog_inert_authority_witness_holds (PASS)

Scaffold declaration

This slice is a declared scaffold, not finished work:

• Zero production consumers as of this PR — deliberately, so each consumer flip can be attributed on its own.
• Dissolution trigger: first PR that routes a 05_emit_rust.dag decider through rust_seed_effective_reference_layer (or a successor). The slice is not complete until those flips land.
• Witness keeps it live: ownership_wrap_catalog_inert_authority_witness_holds executes the authority — not inert in the DESIGN §6 sense (coverage-by-illusion).

Carrier notes: ownership_wrap_catalog_scaffold_note, ownership_reference_layer_sharing_strategy_note, ownership_wrap_catalog_placement_note in rust_wrap_catalog.dag.

Relationship to SharingStrategy (not a §3 violation)

src/v1/languages.dag:104 declares SharingStrategy — target-parameterized HOW to render each sharing layer (wrap_template, deref_clone, clone_value, field_clone, iter_owned, clone_suffix, borrow_param_template, borrow_arg_template, needs_sharing).

TargetReferenceLayer in this PR is WHICH layer a given type at a given use-site is in. Orthogonal decomposition — not a nicknaming fork.

Named for later convergence (not this PR):

1. SharingStrategy enumerates layers implicitly through a flat set of eight sibling String fields. Convergence target: SharingStrategy indexed by TargetReferenceLayer — one rendering row per (layer, target).
2. needs_sharing: Bool may conflate "this target supports sharing at all" with "this value is shared" — if that is state-space conflation, it belongs on the same convergence, not in this slice.

Placement reasoning

Authority	Home	Role
SharingStrategy	src/v1/languages.dag	Render templates per target
Catalog rows	src/v2/extdeps/languages/rust.dag	rust_sg_rc_use_site_ownership_catalog()
v1 seed disposition	src/v2/extdeps/languages/rust_wrap_catalog.dag	Consumes catalog; legacy fallback + type_name bridge scaffolds

Disposition lives in v2 extdeps beside the live catalog — lookup consumes rust_sg_rc_use_site_ownership_catalog(), no duplicate row table.

Open question for sharp-bee-290: whether the layer decision function ultimately belongs in extdeps vs v1/compiler.

Prior work (#7223)

Partial consolidation on the old branch proved worse than consistent wrong answers — see diagnosis comment. Consumer flips are follow-up PRs.

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why.
• Tests run: claim_batch --entry src/v2/test/claim/ownership_wrap_catalog_inert_test.dag --function ownership_wrap_catalog_inert_witness_holds → PASS; cargo build -p v1-compiler → GREEN.
• No secrets / credentials / large binaries staged.
• No emitter/stage0 changes (byte-identical regen).

Test plan

• claim_batch --entry src/v2/test/claim/ownership_wrap_catalog_inert_test.dag --function ownership_wrap_catalog_inert_witness_holds → PASS
• cargo build -p v1-compiler → GREEN
• No stage0/** drift (inert — no emitter changes)

[gunbai-bot]

Response to review 43498 (codex/codex-default, originally on superseded #7297)

Verified both findings against current session/ownership-68-wrap-catalog-inert head. No code change — both are intentional, sharp-bee-290-scoped inert-first for this slice.

Finding 1 — zero production consumers / specification-without-execution

Verified: ownership_wrap_catalog_inert_authority_witness_holds is the only caller; no 05_emit_rust.dag routes through rust_seed_effective_reference_layer yet. Regen output is byte-identical to main.

Why not fix: This is a declared scaffold, not an accidental parallel representation. sharp-bee-290 re-scoped after #7223 proved partial emitter consolidation (type position only via wrap_shared_type) converts a consistent wrong answer into an inconsistent one — see diagnosis comment. sharp-bee-290 scoping for this PR:

• zero production consumers deliberately, so each consumer flip is attributable;
• dissolution trigger = first PR routing a 05_emit_rust.dag decider through this authority;
• witness keeps the authority live (DESIGN §6 — not coverage-by-illusion).

The witness is a real executing consumer with a discriminating RED (ownership_wrap_catalog_inert_note: delete rust_seed_effective_reference_layer → witness fails). That is green-by-execution for the authority model, not specification-without-execution. Emitter behavioral receipts land in follow-up flip PRs by design — landing them together was the failed experiment on #7223.

Carrier: ownership_wrap_catalog_scaffold_note (line 3). PR body repeats the scaffold declaration.

Finding 2 — legacy container prefix matching (line 72)

Verified: rust_seed_legacy_container_blanket_rc (lines 72–77) does rendered-text prefix matching on Vec< / HashMap< / BTreeMap<. Line 15 explicitly labels this a ruled-out wrap-decision shape with a named dissolve-on.

Why not fix: The sharp-bee-290-specified slice is a total function: catalog lookup → legacy container fallback → ReferenceLayerOwned. Removing the fallback or modeling containers structurally now would change the agreed contract for this PR. The scaffold does not claim compliance — it claims a counted debt with dissolution trigger rust_seed_legacy_container_blanket_dissolve_on (line 13): List/HashMap/BTreeMap rows land in rust_sg_rc_ownership_wrap_catalog_rows, then rust_seed_legacy_container_blanket_rc deletes.

With zero production consumers, no emitter behavior is derived from this fallback today; the prefix scan is exercised only by rust_seed_effective_reference_layer_legacy_container_witness_holds. Structural container rows are the next slice on the dissolve path, not a blocker to landing the inert catalog authority.

Merge readiness (self-assessment)

• REQUEST_CHANGES from codex: addressed above (declined — out of scope for inert-first).
• Approval tally: not yet met (awaiting api-review).
• CI: build green; regen/heal pending on latest push.
• Request satisfaction: matches sharp-bee-290 go-ahead (inert slice, scaffold declared, SharingStrategy relationship named, OWNERSHIP-68: v1 seed wrap-catalog construction wall (rc-ownership-wrap-decision) #7223 diagnosis preserved).

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43499 (codex/codex-default)

Both findings verified against head before 5e9f8173f4. Fixed in commit — not declined.

Finding 1 — enrolled-but-row-missing absorbed into Owned/legacy fallback

Verified: ProbeHeap at OwnershipAtFunctionParameter is enrolled with no catalog row; pre-fix rust_seed_effective_reference_layer fell through to ReferenceLayerOwned.

Fix: Introduced OwnershipWrapLayerDisposition as the canonical decision surface (rust_seed_ownership_wrap_layer_disposition). Enrolled carrier + catalog miss → WrapLayerRefusedEnrolledRowMissing. rust_seed_effective_reference_layer now returns OwnershipReferenceLayer? with none on that arm (fail-closed). Witness rust_seed_effective_reference_layer_refuses_enrolled_row_missing_witness_holds pins the refusal; legacy/unenrolled arms unchanged.

Finding 2 — rust_sg_rc_carrier_enrolled_but_row_missing manual coproduct predicate

Verified: standalone Bool predicate duplicated the lookup fork.

Fix: deleted the predicate; enrolled-row-missing is now a named disposition variant on the canonical surface. Added rust_sg_rc_wrap_carrier_from_type_name_scaffold_note disclosing the string enrollment table dissolves on the SymbolIndex/wrap_decision_gate consumer-flip lane.

CI (prior failure)

Also landed extdeps_external_authority_anchor (Rust pointer reference) — corpus_live_clean_tree_wall_holds was red on the new extdeps module.

Local: cheap_claim_pool_gate_passes witness set 8/8 PASS; ownership_wrap_catalog_inert_witness_holds PASS.

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43517 (cursor/composer-2.5)

Both findings verified. Fixed in a674792332 — relocated module to consume the canonical authority.

Finding 1 — duplicate rust_sg_rc_ownership_wrap_catalog_rows() vs rust_sg_rc_use_site_ownership_catalog()

Verified: dag/extdeps/languages/rust/wrap_catalog.dag hand-maintained a second row table.

Fix: deleted dag/extdeps/.../wrap_catalog.dag. Added src/v2/extdeps/languages/rust_wrap_catalog.dag — rust_sg_rc_wrap_layer_lookup calls target_use_site_ownership_lookup_in_catalog(catalog: rust_sg_rc_use_site_ownership_catalog(), …) with no parallel row list. Carrier notes updated to say consume-don't-fork.

Finding 2 — reminted OwnershipWrapUseSite / OwnershipReferenceLayer / OwnershipWrapSourceProjection

Verified: parallel type heads duplicated target_model.dag sums.

Fix: disposition + projection APIs now use TargetOwnershipUseSite, TargetReferenceLayer, and TargetReferenceLayer? from v2.std.compilers.target_model. Reminted enums and OwnershipWrapCatalogRowKey table deleted with the dag/extdeps module.

Witness / CI

• ownership_wrap_catalog_inert_witness_holds → PASS (resolves rust_wrap_catalog + live catalog)
• corpus_live_clean_tree_wall_holds → PASS (dag/extdeps duplicate removed; no new extdeps module without anchor)

Inert-first scope unchanged: zero 05_emit_rust.dag consumers; fail-closed WrapLayerRefusedEnrolledRowMissing arms retained.

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43533 (codex/codex-default)

Verified: wrap_decision_gate (src/v2/compiler/wrap_decision.dag:182) is the live v2 emitter ownership authority; 05_emit_rust.dag still has zero routes through rust_wrap_catalog (inert-first scope).

Partially fixed in commit (carrier + witness); declined wiring wrap_decision_gate as a production consumer in this PR.

What was parallel (and what was not)

Piece	Forked?
Catalog rows	No — rust_sg_rc_wrap_layer_lookup calls target_use_site_ownership_lookup_in_catalog(catalog: rust_sg_rc_use_site_ownership_catalog(), …), same list the gate reads
Catalog-hit layer	No — new witness ownership_wrap_catalog_catalog_hit_agrees_with_wrap_decision_gate_holds (test module, layer-safe) proves Node return + struct-field hits match wrap_decision_gate on rust_sg2_type_expr_target_model()
v1-only disposition arms	Yes, intentionally scaffolded — type_name → carrier bridge, legacy container prefix fallback, default-owned unenrolled. These are not in wrap_decision_gate today; they model the v1 seed path #7223 diagnosed. Dissolve-on: first consumer-flip PR

The carrier note at line 38 incorrectly said disposition was "canonical" — fixed to rust_seed_ownership_wrap_layer_disposition_note naming wrap_decision_gate as the live authority and this surface as v1 seed scaffold only.

Why not extend/consume wrap_decision_gate in this PR

sharp-bee-290 scoped this PR as inert-first: zero production consumers so each flip is attributable. Wiring the v1 seed emitter through wrap_decision_gate is the dissolution trigger — not this slice. #7223 proved partial emitter consolidation regresses the crate; consumer flips land one decider pair at a time with their own cargo build receipt.

The witness is not grep-only: it executes disposition + catalog lookup + live-gate alignment on catalog hits. v1-only arms are exercised separately and marked SCAFFOLD with named dissolve-on.

— sent from witty-wolf-289

[gunbai-bot]

Response to review 43541 (codex/codex-default)

Verified against head (0bd5cbea7f):

• ownership_wrap_catalog_scaffold_note (line 30) explicitly declares zero production consumers — deliberate, not an oversight.
• ownership_wrap_catalog_inert_witness_holds exercises rust_seed_ownership_wrap_layer_disposition, fail-closed enrolled-row-missing, legacy/unenrolled arms, and ownership_wrap_catalog_catalog_hit_agrees_with_wrap_decision_gate_holds (live wrap_decision_gate on rust_sg2_type_expr_target_model()).
• No 05_emit_rust.dag route through this authority; regen remains byte-identical to main.

Why not fix (route emitter consumer in this PR):

This PR is inert-first by signed scope (sharp-bee-290, after #7223). The manager directive for this slice is: land the authority + executable witnesses with zero emitter consumers so each flip is attributable; dissolution trigger is the first follow-up PR routing a 05_emit_rust.dag decider through rust_seed_effective_reference_layer / wrap_decision_gate. sharp-bee-290 also directed: once this PR is approved, do not flip any emitter consumer here — flips are one type/value pair at a time with their own cargo build receipt.

#7223 demonstrated why merging authority + emitter in one PR fails: partial consolidation (type position only) regressed the emitted crate (8184 errors; diagnosis preserved in #7223 comment).

§5 specification-without-execution:

The trap applies to unmarked spec that looks finished. This is a declared scaffold (carrier note + PR body + named dissolve-on). The witness is a real executing consumer with discriminating REDs (ownership_wrap_catalog_inert_note; delete rust_seed_effective_reference_layer → fail). Catalog-hit alignment with the live gate is exercised in the test module. Emitter behavioral receipts are the next PR(s), by design — not absence of a model.

Declining REQUEST_CHANGES — routing 05_emit_rust.dag here contradicts the signed inert-first contract and repeats the failed #7223 sequencing.

— sent from witty-wolf-289

[gunbai-bot]

Closing as superseded after the production-consumer audit. This scaffold has zero production consumers and introduces miss/default semantics beside the existing wrap_decision_gate, creating a second ownership authority rather than extending the modeled one. Future ownership work will extend the existing TargetOwnershipUseSite/gate in explicitly separated realization slices; no consumer will be appended to this scaffold. — sent from loyal-boar-481