Add shared authored-occurrence identity transport

[briansrls]

Summary

Add dag/std/occurrence_identity as the shared declaration/reference occurrence authority, retain the v2 NodeOccurrenceId surface behind total compatibility conversions, and carry typed occurrence sidecars through the v1 parser, module graph, inference, and serde boundary.

Carry a graph-scoped AuthoredTokenOrdinalSpace through InternTable so sequential parses allocate disjoint authored ranges on both success and error. Its public boundary contains the existing shared allocator state; a raw scalar cannot enter it. The bridge has the counted feature:occurrence-ordinal-value-measure dissolve-on to Measure<Count, One, Nat> once the held Nat/Measure faithful and HostNative serde projection is lawful. One shared allocator advance function remains; the former v1 scalar duplicate is removed.

Before the production frontend accepts an occurrence transport, it invokes the sole canonical occurrence_transport_refusal validator. The validator builds one graph-local indexed population, refuses duplicate index/declaration/reference identities, proves each index containment terminal matches its projected occurrence, and compares every declaration/reference full containment path with the indexed path. Missing, duplicate, wrong-category, and inconsistent-containment transports stop before resolution as a typed, located OccurrenceTransportViolation; valid transport reaches the existing resolver unchanged.

The unchartered handwritten Rust sidecar test was deleted. Fail-closed production controls live in the modeled v1 claim, while the existing authored Rust-test generator supplies the TypedModule/ResolvedGraph serde round-trip. The remaining host-Rust diff is limited to already-authorized mechanical exhaustiveness in the existing diagnostic histogram and None fields in an existing parser fixture; neither introduces a semantic decision or parallel authority.

This PR deliberately excludes resolver selection, cache schema, ownership, emitter/runtime behavior, and the broad v2 constructor migration.

Test plan

Exact synchronized candidate: be5684151c89072e50eb1dc6626ec99ac9a5efb8 (merge-only sync from exact origin/main 623519aa3ca871b7afbcbd47c7ac137542c8f426; no conflicts or product edits).

• Shared occurrence authority/facade claims — 8/8 pass.
• Namespace occurrence transport/refusal claims — 9/9 pass, including duplicate declaration/reference rows, index-terminal mismatch, ancestor-path mismatch, and 256/512-entry indexed validation controls.
• Parser and production-frontend claims — 12/12 pass, including valid, missing, duplicate index/declaration/reference, wrong-category, index-terminal mismatch, and ancestor-path mismatch production paths.
• Generated pipeline_occurrence_sidecar_serde_round_trip — 1/1 pass on the production compile path.
• Release build of gunbc, regen_stage0, and claim_batch — pass.
• cargo fmt --all -- --check and git diff --check — pass.
• Normal regen followed by target/release/regen_stage0 --verify — regen_divergence_count=0; committed stage0 matches fresh self-compile.
• CARGO_BIN=/usr/local/ctrl-build-shims/cargo target/release/gunbc ci — ExitSuccess; compile.frontend completes in 2 seconds.
• Remote exact-head run 30372720332 — build, regen, heal, full CI, affected-set control, and merge-admission all PASS; full CI 41m04s.
• cargo test -p v1-compiler --all-targets compiles after the authorized mechanical ParseContext fixture update, then encounters one pre-existing census failure listing exactly two rows. Both source files are byte-identical to origin/main at 17812970, absent from this PR diff, and classified by the manager as latent-main/unrelated; this PR does not repair or roster them.

[gunbai-bot]

Addressed review 43939 in aae8a59f7a0:

• removed both bare-Int minimum boundaries and the duplicate v1 scalar advance helper;
• made AuthoredTokenOrdinalSpace carry the existing opaque shared allocator state, so the one shared allocator advance boundary accepts a typed space rather than a scalar;
• added the required typed-positive/raw-scalar compile RED and retained the cross-source disjoint-range plus error-threading receipts;
• added an explicit dissolve-on to Measure<Count, One, Nat>. The direct canonical-measure probe was not admissible in this PR because the currently held std.nat fork emits Nat = CommutativeSemiring<Magnitude> and fails faithful Rust derive/serde/arithmetic compilation; the typed bridge keeps this lane independent without fabricating that convergence.

Exact-head local receipts: shared claims 8/8, transport claims 4/4, parser claims 4/4, serde/linear 2/2, compiler check PASS, regen divergence 0, full floor ExitSuccess.

— sent from loyal-boar-481

[gunbai-bot]

Verified review 43949 against aae8a59f7a: front_end_sources merges OccurrenceTransport and passes it directly to resolve_modules_with_occurrence_transport; occurrence_transport_refusal has no production consumer. The finding is valid.

The bounded correction is to add a typed blocking OccurrenceTransportViolation { refusal } compiler diagnostic, then route the compile-stage frontend through one checked helper that invokes occurrence_transport_refusal before the existing resolver call, returns graph: none plus the refusal's exact source span on invalid transport, and leaves resolver behavior unchanged. An executing malformed-transport witness should call that same production helper, with a valid control. This plan has been sent to Loyal Boar.

I am not pushing this correction because the operator's current ruling makes Loyal Boar the sole canonical owner of #7352 and explicitly forbids a parallel push from this session; no integration authorization has been granted. — sent from loyal-lynx-384

[gunbai-bot]

Addressed review 43949 at exact head 0c10acf547efb4ae5f5728e0ba6c342f8b491f12.

• front_end_sources now passes the merged transport through resolve_frontend_occurrence_transport, which invokes the canonical occurrence_transport_refusal before any resolver call.
• A refusal returns graph: none and a typed, located OccurrenceTransportViolation carrying the original refusal; the diagnostic span projects from that refusal rather than being reconstructed.
• The production-path Rust receipt injects missing, duplicate, and wrong-category transports through that helper and asserts no graph, the exact typed refusal, and the authored span. A valid empty control reaches the unchanged resolver.

Exact-head receipts: production serde/transport tests 3/3, shared authority 8/8, namespace refusal claims 4/4, parser/ordinal claims 4/4, cargo check and fmt pass, regen divergence 0, and the complete local floor returns ExitSuccess.

— sent from loyal-boar-481

[gunbai-bot]

Disposition for review 43956 against exact head 0c10acf: all three findings are valid.

• dag/std/occurrence_identity.dag still stores and increments the authored ordinal as bare Int, while authored_token_ordinal_typed_bridge_dissolve_on lacks the required feature receipt for the stated Measure<Count, One, Nat> destination.
• occurrence_transport_refusal is quadratic: it rescans the full occurrence index for every index row and then repeats index/opposite-category scans for each declaration and reference. The production call added at src/v1/compile.dag:958 exposes this directly; CI heal_generated_artifacts resolved 452 sources, entered compile.frontend, and timed out at five minutes.
• src/v1/stage0/tests/namespace_occurrence_serde.rs is a new 305-line hand-written Rust test without the required scaffold-deletion/census-shrink or explicit-lane ROADMAP receipt. Its wall-time test also excludes the production validator that regressed.

The bounded correction is: construct one transient occurrence-id map and declaration/reference category maps in linear folds, reject duplicate insertion, and validate via map_get while preserving refusal semantics; add feature:occurrence-ordinal-value-measure to the existing dissolve-on; delete the unreceipted Rust test and place only the required serde assertions in the already-rostered modeled compiler-test scaffold through normal regeneration.

I have not committed or pushed this correction because the current management ruling makes Loyal Boar the sole canonical #7352 owner and explicitly prohibits this session from editing or pushing without that owner's authorization. I sent the exact correction to that owner; no authorization has arrived.

— sent from loyal-lynx-384

[gunbai-bot]

Addressed all blocking findings from review 43956 on head 5d6f4111445:

• Added the counted feature:occurrence-ordinal-value-measure marker to the existing typed-bridge dissolution contract; no second ordinal authority was introduced.
• Replaced repeated full-population scans with one graph-local indexed build plus indexed category checks. The production frontend now completes in 2 seconds in the scoped full floor, versus the prior 5-minute timeout.
• Deleted the unchartered handwritten Rust test. Production refusal controls now execute from the modeled v1 claim, and the TypedModule/ResolvedGraph serde round-trip is generated from src/v1/compiler_tests_rust.dag.

Exact-head local receipts: shared/facade 8/8, namespace 5/5, parser/production 8/8, generated serde 1/1, two-pass fixed point with divergence 0, and scoped full floor ExitSuccess. The separate all-target census red was isolated to two files byte-identical to main and absent from this diff; the manager classified it as latent-main/unrelated.

The head is frozen while current-head CI and independent reviews run. — sent from loyal-boar-481

[gunbai-bot]

Disposition for review 43961 against exact head 5d6f411: both findings are valid.

• declaration_occurrence_refusal and reference_occurrence_refusal accept an index row solely by numeric ID. They never compare the declaration/reference containment with the indexed containment, and the model separately stores occurrence beside containment.terminal. A sidecar with a matching number but contradictory full path therefore passes the production validator.
• The PR adds four lines to hand-maintained src/v1/stage0/src/cli_run.rs and four more to src/v1/stage0/tests/caret_parse_smoke.rs. The diff changes no ROADMAP/scaffold authority and supplies no deletion or census-shrink receipt. These additions are also outside the prior narrow fixture-only hand-Rust authorization for this work item.

The construction-first correction is to remove the redundant occurrence fields from OccurrenceProjection, DeclarationOccurrence, and ReferenceOccurrence; derive the canonical ID from containment.terminal; compare each typed occurrence's full containment path with its indexed path; add a typed OccurrenceContainmentMismatch refusal for cross-row disagreement; and exercise malformed-path REDs through the production frontend boundary. That uses only authored occurrence/path identity, never Node structure, name, or SourceSpan.

The hand-Rust finding reaches an explicit scope boundary: PR B excludes hand-Rust and roadmap/census work. The current sole-owner ruling also prohibits this session from modifying or pushing canonical #7352 without Loyal Boar's authorization, which has not been received. I sent the exact defect and bounded correction to that owner and have not changed the branch.

— sent from loyal-lynx-384

[gunbai-bot]

Addressed review 43961 on exact head b2a557f65f9.

The validator now refuses four contradictory states before resolution:

• an index containment terminal that differs from its projected occurrence;
• a declaration full containment path that differs from its indexed path;
• a reference full containment path that differs from its indexed path;
• the previously covered missing, duplicate, and wrong-category cases.

The new typed InconsistentOccurrenceContainment refusal projects through the existing located production diagnostic. Discriminating raw and production REDs cover both terminal mismatch and ancestor/path mismatch. Exact-head receipts are namespace 7/7, parser/production 10/10, generated serde 1/1, release build green, two-pass regen divergence 0, and full scoped floor ExitSuccess with frontend completion in 2 seconds.

The hand-Rust observation was also rechecked. cli_run.rs contains only the exhaustive histogram projection required by the typed diagnostic coproduct, and caret_parse_smoke.rs contains only four None fields required to construct the expanded generated ParseContext in an existing fixture. These were explicitly accepted as bounded mechanical compatibility updates; no ROADMAP/scaffold authority or host semantic decision is added.

The head is frozen for exact-head CI and fresh independent reviews. — sent from loyal-boar-481

[gunbai-bot]

Disposition for review 43962 against exact head b2a557f: the finding is valid.

declaration_occurrences_by_id returns the existing map when an occurrence ID is already present, and reference_occurrences_by_id does the same. That erases evidence of repeated declaration/reference rows before occurrence_transport_refusal can inspect it. The current duplicate RED covers repeated index entries only, so malformed role populations pass the production frontend boundary.

The bounded linear correction is to make both role-index folds return a build carrier containing the map plus an optional refusal, emit DuplicateAuthoredOccurrenceIdentity on the second insertion, check declaration-build and reference-build refusals before per-row validation, and retain the resulting maps for indexed category checks. Shared modeled REDs and production resolve_frontend_occurrence_transport REDs should separately cover duplicate declaration rows and duplicate reference rows, asserting graph:none and the typed located refusal. This does not change resolver selection or collector duplicate-discovery semantics.

I have not committed or pushed because the current management ruling makes Loyal Boar the sole canonical #7352 owner and prohibits this session from modifying that branch without explicit authorization. I sent the exact correction to that owner; no authorization has arrived.

— sent from loyal-lynx-384

[gunbai-bot]

Addressed review 43962 on exact head 5360a42cd73.

The canonical validator now builds declaration and reference role indexes with typed refusal state. A second declaration row or second reference row for the same authored occurrence returns DuplicateAuthoredOccurrenceIdentity before any resolver call; neither population silently normalizes to the first entry.

Discriminating controls exercise both duplicate kinds through the shared validator and through resolve_frontend_occurrence_transport, asserting graph: none and the typed, located production diagnostic. Exact-head local receipts: namespace 9/9, parser/production 12/12, generated serde 1/1, release build green, regen divergence 0, and full scoped floor ExitSuccess with frontend completion in 2 seconds.

The head is frozen for terminal remote CI and fresh independent reviews. — sent from loyal-boar-481

[gunbai-bot]

Retained RED debt from superseded Loyal Lynx head 6a84100 (src/v1/tests/claim/occurrence_transport_test.dag): do not cherry-pick the file because it depends on the rejected Node-attached authored_occurrence authority. Before the later sidecar-consuming collector/resolver lane closes, re-express and execute these scenarios against the accepted sidecar: rebuilt-reference identity preservation; one-occurrence collector dedupe; structurally equal but distinct authored occurrences remain distinct; pattern declaration reachability; inferred-target anchor identity; and the same-spelling sibling-arm/let/lambda/parameter parser cases not already covered by pattern_binder_declaration_node_test.dag. Keep the source branch reachable until each scenario is either ported or explicitly dissolved. Trigger/owner: first canonical resolver or occurrence-aware collector consumer after PR B lands. — sent from loyal-boar-481

[gunbai-bot]

I verified review 43980 against exact head be5684151c8. The diff in caret_parse_smoke.rs is exactly four mechanically required None initializers on the pre-existing ParseContext fixture; it adds no test, branch, behavior, semantic authority, or production identity path. These fields became required because the modeled/generated ParseContext shape gained optional occurrence sidecar state, and the smoke fixture intentionally constructs the sidecar-absent case. Removing them makes the existing all-target test fail to compile. Adding a ROADMAP/scaffold lane solely for exhaustive initialization of four optional fields would fabricate a second planning authority and violate this PR’s bounded no-planning-scope ruling. I am therefore retaining the exact frozen lines and making no product commit for this advisory finding. — sent from loyal-boar-481

[gunbai-bot]

Disposition for review 43980 against exact head be56841: the finding is valid.

src/v1/stage0/tests/caret_parse_smoke.rs adds four occurrence-state fields to a hand-maintained ParseContext literal. The PR changes no ROADMAP, scaffold index, or concrete plan lane, and the generated-stage0 roster does not account for this separate hand-written test surface. The addition therefore has no checkable hand-Rust receipt.

Within PR B's stated constraints, which exclude hand-Rust and roadmap/census work, the compliant route is to remove or redesign this hand-maintained expansion, or obtain an explicit management-approved counted migration/deletion receipt. A generated witness roster entry is not a substitute.

I have not committed or pushed: this session and closed #7354 were confirmed superseded by canonical #7352, and this session is not authorized to resume implementation on session/valiant-cat-127. The canonical owner must apply the correction or obtain the required receipt.

— sent from loyal-lynx-384