De-fork self-host std shims onto the shared bridge; keep the 03_normalize selection edge honest

[gunbai-bot]

Summary

De-forks the self-host behavioral-receipt std shims onto one shared bridge, and keeps the
03_normalize declared-source-ref selection edge honest across that move.

The §3 fork. Five transports each carried a private copy of the same v2_std_node.rs /
v2_std_algebra.rs / v2_std_collection.rs / v2_std_diagnostic.rs / v2_std_integer.rs ABI
shim. One concept, five names — so a widening of the authority (src/v2/std/*.dag) had to be
re-applied five times or the copies rotted independently. It rotted: v2.std.diagnostic's
Locus went struct → coproduct (plus Extent, LocusAnchor, Diagnostics,
NonEmptyDiagnostics) and the shims did not follow.

What lands. Every std shim write in tools.self_host_module_behavioral_transport_roster
now resolves to the single dag/tools/self_host_std_bridge_shims/ bridge that #6807
established; the bridge's diagnostic / node surfaces are re-synced to their authorities;
v2_std_integer.rs joins the bridge; and the twelve now-orphaned per-transport copies are
deleted (a fork left in tree is a fork that gets picked up again).

Why it is an affected-set change. tools.self_host_03_normalize_declared_source_refs is
the §5.1 flagship — the one row opted into precise selection, on a hand-verified
completeness claim. Repointing its shim writes without repointing its declared refs would
have left the list naming files the transport no longer reads: the claim still reading
"complete" while the real input (the bridge) went unselected. That is the partial-key false
skip the design note names, arriving through the front door. The refs move with the writes,
and the list still matches the roster row one-for-one (source + lib + driver + 13 shim
writes = 16).

The gap this does not close, stated loudly. declared_source_refs is a reads axis and
src/v2/std/*.dag is the bridge's authority, not its read — so widening v2.std.diagnostic
still does not select this witness even though it can break it. That is exactly how the
Locus drift stayed invisible until a wet falsifier run days later. Closing it needs a
correctness-dependency axis (authority → mirror) distinct from the read axis; the shim-surface
wall is the intended mechanism and its medium is undecided. sn_declared_source_refs_authority_gap_note
states this in-carrier rather than papering over it by adding authority paths to a list whose
contract is reads. No wall is claimed to exist — the shim headers say only what actually
catches drift today (the wet receipt's own cargo build, on the falsifier cadence).

Union, not a pick — and two receipts for why that rule is load-bearing

A de-fork that drops symbols is not a de-fork; it is a regression wearing one. Both violations
below were found by checking, not by review-by-eye, and both are now fixed:

1. v2_std_collection.rs — the 03_normalize and use_site_verdict copies shared a filename
   and had disjoint surfaces (Optional / optional_absent / optional_present vs
   pub type List<T>). The bridge held the List one, so the repoint silently deleted
   03_normalize's entire Optional surface. Bridge now carries the union.
2. well_formed (review 44739) — both copies defined it, so a name-level check passed;
   only the bodies differed. body_producer's was let _ = n; true, 03_normalize's carried
   the real root Conj/Disj non-emptiness check. Taking the weaker one is a §5 fail-open on a
   fail-closed path: emitted 03_normalize gates graft output on well_formed and raises
   post_normalize_not_well_formed_diagnostic on false. Bridge now carries the stronger body,
   with the residual gap vs the authority's whole-tree locally_well_formed fold stated
   in-file rather than implied.

Finding 2 also refuted my verification method, so the check is now body-level. Result across
all twelve replacements: zero symbols removed; every changed body is either rustfmt
wrapping or a deliberate authority re-sync (NodeOccurrenceId gaining MintedOccurrence per
node.dag:15, the Locus/Diagnostics family, and the strengthened well_formed).

Test plan

Green by execution:

• declared_source_refs_selection_both_directions_for_03_normalize_witness,
  ..._touch_blocks_skip_..., ..._unrelated_diff_skips_...,
  ..._suppress_effect_reach_upgrade_... — 4 passed, 119s. This is the §6 acceptance pair:
  emitter-touch selects, unrelated-touch skips, against the repointed refs.
• normalize_stale_narrow_lib_without_namespace_graft_refuses_cargo — 1 passed, 231s. It
  assembles its shim set by walking self_host_03_normalize_shims/, so after the deletion it
  would have been copying files that no longer exist; it now mirrors the roster (bridge dir,
  then the transport's own). This control is non-discriminating and my patch does not change
  that — see the note below; it is listed for completeness, not as evidence.
• Mechanical: declared refs == the roster row's 16 reads exactly, every path resolving; bridge
  is a body-level superset of all twelve replaced copies.

Wet receipt, measured both sides — the branch is a strict improvement. All four
transports touched are expect_red quarantine entries in
seed_emitter_behavioral_wet_known_red_entries.dag, so neither side greens. But the flagship
row's error set was captured on both, same command, same host:

	03_normalize receipt errors
origin/main (8b1a4c9)	2 — unresolved import crate::v2_std_optional; no List in v2_std_collection
this branch	1 — unresolved import crate::v2_std_optional

The branch's error set is a strict subset. The List error is gone precisely because the
bridge unions the two disjoint collection surfaces — main's 03_normalize copy carried
Optional without List, so the emitted pub use crate::v2_std_collection::{List} could not
resolve. The union rule is not just hygiene here; it removed a real build error. The surviving
v2_std_optional error is a module this PR neither shims nor touches, identical on both sides.

A control that does NOT prove what it looks like it proves.
normalize_stale_narrow_lib_without_namespace_graft_refuses_cargo passes (1 passed, 231s),
but it asserts only !status.success(), and its crate declares just im and v1-compiler —
so the shims' #[derive(serde::Serialize)] alone yield 36 × E0433 serde and the build
refuses whether or not pub mod v2_compiler_namespace_graft is dropped. My change keeps it
copying the right files; it does not make the assertion discriminating, and that weakness is
pre-existing rather than introduced here. Flagged so the green is not read as evidence it
isn't. (Its 21 × E0308 Rc<Diagnostics> mismatches are likewise artifacts of that
deliberately-broken fixture crate, not of the real transport — the receipt table above is the
production path.)

Scope note. An earlier revision also cleared shim_lib_rel on three rows, on the theory
that the hand-written lib.rs files duplicated what the generic cssl assembly derives. Wet
runs refuted that: those files are narrow closure manifests declaring which emitted
modules participate, which is what keeps broken emitted stubs (e.g. v2_std_integer.rs
importing an undeclared crate::std_nat) out of the build. Reverted — the roster diff against
main is now purely the twelve source_rel repointings.

[gunbai-bot]

Fixed in 1fe8247 — review 44739 is correct, and it caught a hole in my own verification, not just the one symbol.

The finding. well_formed in the bridge was body_producer's let _ = n; true while the deleted 03_normalize copy carried the real root Conj/Disj non-emptiness check. Emitted 03_normalize gates graft output on it and raises post_normalize_not_well_formed_diagnostic on false, so the weaker body is a §5 fail-open on a fail-closed path. The bridge now carries the stronger body.

Why my check missed it. I had verified the bridge was a name-superset of every replaced copy. Both copies define well_formed; only the bodies differ, so a name-level check is structurally blind to this class — the same class as the v2_std_collection disjoint-surface finding earlier in this PR, one level down. Comparison is now body-level across all twelve replacements: zero symbols removed, and every changed body is either rustfmt wrapping or a deliberate authority re-sync (NodeOccurrenceId gaining MintedOccurrence per node.dag:15, the Locus/Diagnostics family, and this well_formed).

One thing I did not do. I carried the strongest surviving shim body, not the authority's. The authority folds locally_well_formed over the whole tree (connective_edges_conform / behavior_edges_conform per node); this is a root-level check — strictly stronger than either copy it replaces, strictly weaker than the authority. Reaching for the full fold would mean hand-porting more of the authority into a scaffold whose stated dissolve-on is being deleted, so I stated the residual gap in-file instead of quietly implying parity.

Note for anyone reading the receipts: all four transports touched here are expect_red quarantine entries, so no wet receipt greens this change — the superset property is a structural argument and the PR body says so.

[gunbai-bot]

Two corrections to the record, both from runs rather than reading. Neither needs a code change; the PR body now carries both.

1. The wet receipt was measured on both sides, and the branch is a strict improvement. I had written that no wet receipt could green this (all four transports are expect_red quarantine entries) and left the superset property as a structural argument. That hedge was weaker than necessary — the error sets are comparable even when neither side greens. Same command, same host, flagship row:

	03_normalize receipt errors
origin/main (8b1a4c9)	2 — unresolved import crate::v2_std_optional; no List in v2_std_collection
this branch	1 — unresolved import crate::v2_std_optional

The List error is gone because the bridge unions the two disjoint collection surfaces: main's 03_normalize copy carried Optional without List, so the emitted pub use crate::v2_std_collection::{List} could not resolve. The union rule removed a real build error rather than merely avoiding a regression. The surviving v2_std_optional error is identical on both sides and names a module this PR neither shims nor touches.

2. The CSSL RED control does not prove what several reviews credit it with. review 44750 and review 44736 both state it "fails for the intended reason" / "copies both dirs so it fails for the intended reason". It does not, and my patch does not make it so. It asserts only !status.success(), and its crate declares just im and v1-compiler — so the shims' #[derive(serde::Serialize)] alone produce 36 × E0433 serde and the build refuses whether or not pub mod v2_compiler_namespace_graft is dropped. What my patch fixed is narrower: it was walking a directory whose files this PR deletes. The non-discrimination is pre-existing, and it is not in scope to fix here, but a green from it should not be read as evidence.

Related: the 21 × E0308 Rc<Diagnostics> mismatches I saw earlier in that control's log are artifacts of its deliberately-broken fixture crate, not of the real transport. I briefly took them as a sign the diagnostic widening had guessed the wrong Rust representation; the production receipt above shows one error and it is not that. — sent from stern-carp-806