Cut the kernel node's authority from retirement, and rehome the P2 occurrence debts

[briansrls]

Retroactively completed 2026-08-01: this PR merged carrying the auto-opened session title and a TODO body. The code was correct; the handback was not written. Operator ruling — worker attestation is currently advisory rather than admission, so this is repaired in place and recorded rather than silently left.

What this changed

1. Cut the kernel node's authority from retirement. namespace-binding-kernel claimed both that it owns the canonical decision AND that no second place in the compiler decides the same question. The second half is namespace-legacy-choice-retirement's job, and fusing them made the kernel node unacceptable until an unrelated node finished — a deadlock, since the kernel is the thing retirement depends on.

Removed from the node: "and no second place in the compiler makes that same decision" and the handback's "evidence that nothing else decides the same question". out_of_scope now states plainly that the older deciding mechanisms remaining is the retirement node's business. namespace-legacy-choice-retirement's boundary gained the seed mirror it must actually delete: "...and the hand-written seed mirror that counts none/one/many for itself inside the bootstrap compiler."

2. Sharpened the red control to name the arms the kernel genuinely owns: malformed occurrence transport refuses; a wrong-kind declaration is excluded; a candidate given in the wrong role refuses distinctly from one that is absent; the same declaration supplied twice refuses as a malformed population rather than counting as two; and supplied lists of nothing / one / two distinct things give unresolved / resolved / ambiguous.

3. Rehomed six OccurrenceIdentityConsumerRedDebt rows. Five moved from namespace-canonical-binding to namespace-reference-derived-closure: rebuilt-reference-identity-preservation, one-occurrence-collector-dedupe, structurally-equal-distinct-occurrences, pattern-declaration-reachability, same-spelling-parser-declaration-isolation. inferred-target-anchor-identity stayed.

The deciding test, recorded in occurrence_identity_consumer_red_debt_rehome_note: can the receipt execute before the production sites are switched over? If yes it belongs to the derived-closure node; if it needs the production changeover it stays with canonical-binding.

Test packet

• occurrence_identity_witness_test.dag — occurrence_identity_consumer_red_debt_has was parameterized on owner. It previously hardcoded row.owner == "namespace-canonical-binding", which the rehome would have turned red; all six call sites now pass explicit owners (5 derived-closure, 1 canonical). This is strictly stronger than the prior form, which could not have detected a wrong owner.
• std_occurrence_identity.rs regenerated via a locally-built regen_stage0 — 6 derived-closure / 3 canonical rows, matching the .dag. The seed was 35 sources stale and was rebuilt before regenerating.
• ROADMAP.md regenerated from the authority.

Both findings in review 45828 were correct and are fixed here: the hardcoded owner, and a commit message claiming a regen that had not run.

What this did NOT do

It does not bless the v1 adapter, does not retire any legacy decision path, and mints no new roadmap node — the amendment is to existing rows only.

[gunbai-bot]

Both findings in review 45828 were correct and are fixed at a73cd36. Neither was a disagreement — I changed a carrier and left two of its consumers behind, which is the class of defect this PR's own amendment note is about.

Finding 1, the enrolled witness. Confirmed: occurrence_identity_consumer_red_debt_has hardcoded row.owner == "namespace-canonical-binding" for every row, so the rehome would have turned occurrence_identity_consumer_red_debt_is_counted_holds red. Fixed by making the expected owner a parameter and pinning each of the six rows to its own expected node — five to namespace-reference-derived-closure, one (inferred-target-anchor-identity) to namespace-canonical-binding.

That is deliberately stronger than restoring green would require. The previous form only asserted that all six rows agreed with each other, so it would have stayed green if every row had been rehomed to the same wrong node. The parameterised form makes each row's classification the thing under test, which is what the rehome actually needs guarded. Reasoning recorded on the carrier in occurrence_identity_consumer_red_debt_owner_witness_note.

Finding 2, the stale seed. Also confirmed, and the commit message saying "regen" while no regen had run was exactly the parallel-representation hazard you name. Regenerated with a locally built regen_stage0 — the binary in target/ was 35 sources stale, and regenerating with it would have produced output from an older emitter. Regen wrote 108 files and exactly one changed, so the tree was otherwise already at its fixed point.

Post-fix counts in src/v1/stage0/src/std_occurrence_identity.rs: 6 namespace-reference-derived-closure and 3 namespace-canonical-binding — that is 5 rows + 1 note mention, and 1 row + 2 note mentions respectively, matching the .dag authority exactly.

Change set is 5 files: the two roadmap/authority edits, the debt-row rehome, plus these two consumers.

— sent from calm-badger-682