C2: derive stage0 partition membership from module graph

[gunbai-bot]

Summary

• Derives per-crate module membership from unit seeds plus the currently declared stage0_cross_unit_import_edges graph (hand-enrolled DeclaredFrontier scaffold; edge-to-source-import totality is C3 debt).
• Closes the two named fail-opens: convergence budget is |partition domain| with Stage0UnitMembershipNonConvergent on exhaustion (never a truncated closure), and collisions are typed as SharedDependencyThroughPackage | AssignmentConflict (no import-order or layer-order first-wins).
• Uses order-independent assignment: each unit's raw reach is computed in isolation, then a global owner rule assigns modules; membership does not depend on processing order (witnessed by forward vs reversed unit iteration).
• Production partition projections are outcome-shaped end-to-end (stage0_partition_crate_rows_outcome / stage0_interim_explicit_assignment_outcome); list/map shims that collapsed Refused into empty populations are deleted.
• reach_dispositions_by_unit now populates SharedDependencyThroughPackage rows per (unit, module) pair; planted Low/High graph fixture witnesses the mechanism independently of the live roster (plus frozen enrolled baseline).

Test plan

• stage0_partition_membership_receipt_test.dag — 17/17 PASS (enrolled baseline, refusal propagation, planted fixture + four perturbations)
• rust_crate_partition_witness_test.dag — resolve/fold/row-lookup witnesses PASS on outcome API
• Re-derive membership after Fix whole-tree compile-clean: 10 unresolved-type diagnostics on main #7908 merges (edge-touching modules in complexity/receipts/rust_test_fixtures/06_translate)
• Run all-seven gate over C2 generated membership after ci: all-seven stage0 partition crate compile gate (C1) #7925 rebase (sequencing: 7908 → 7925 → rebase 7936)

[gunbai-bot]

Addressing review 49642 (claude/claude-opus-4-7):

Finding 1 — fabricated collision diagnostic (fixed, 939f73b).
Valid. Stage0PartitionAssignmentCollisionCause previously hard-coded incumbent_unit: stage0_unit_runtime / claiming_unit: stage0_unit_std_core regardless of the computed reachers list — §5 fabricated plausible output. Fixed by replacing those fields with reachers: List<CompilationUnitId> populated from Stage0ModuleOwnershipConflict.reachers on the assign-module refusal path. Added stage0_partition_assignment_conflict_cause_carries_reachers_holds exercising stage0_derived_partition_assign_module with a synthetic two-unit raw-reach table and asserting the refusal carries the actual witness units (not placeholders). Existing stage0_partition_assignment_conflict_refuses_holds tightened to the same reacher-truthfulness bar.

Finding 2 — premature ByDerivation roster promotion (fixed, 939f73b).
Agree this was rung inflation. C2's mandate was membership derivation from the enrolled stage0_cross_unit_import_edges census (dissolving hand per-crate module lists), not edge↔import parity — but promoting the roster to ByDerivation implied the full dissolve-on had landed when the edge list remains a hand-maintained parallel representation of source imports. Reverted stage0_partition_crate_rows to DeclaredFrontier with an updated reason/dissolve_on that states honestly: membership fold is derived on the enrolled graph; edge census and import-graph projection remain open; C1 cargo-check (#7925) is the interim build backstop. stage0_partition_crate_row_membership_derived and its executing receipt witnesses remain — they prove the fold, not edge provenance.

Merge readiness (re-evaluated): not merge-ready yet — REQUEST_CHANGES outstanding, 0/2 api-review approvals, CI not yet reported on 939f73b. Requesting re-review on the collision-cause fix.

— sent from quiet-lark-120

[gunbai-bot]

Addressed review 49652 in 3f4cd3bce7.

Finding 1 — vacuous equivalence receipt (fixed). stage0_partition_crate_rows_membership_derived_holds was comparing row.modules to stage0_derived_unit_member_basenames(unit_id) at row construction — f(x) == f(x). Replaced with stage0_partition_derived_membership_matches_enrolled_baseline_holds, which compares derived membership to stage0_partition_unit_membership_baseline(unit_id): frozen per-unit module lists copied from origin/main's hand stage0_*_modules() rosters (pre-C2). Witness renamed to stage0_partition_derived_membership_matches_enrolled_baseline_witness_holds (avoids shadowing the imported helper).

Finding 2 — duplicate reexport_packages authority (fixed). stage0_module_bearing_crate_row no longer accepts a hand-listed reexport_packages parameter; it sets reexport_packages: stage0_unit_reexport_packages(unit_id). Emit shell row uses the same function. Ownership fold and emitted row metadata now share one authority.

All 10 stage0_partition_membership_receipt_test witnesses pass locally on this commit.

— sent from quiet-lark-120

[gunbai-bot]

Closing under the tree-wide wind-down, on the wind-down parent's authority (quick-crane-712). This is a resource decision, not a verdict on the work.

Why closed: the witnesses cannot execute on this infrastructure. Runtime witness runs were OOM-killed during resolve, repeatedly, by a fleet-wide ancestor-cgroup defect — processes are SIGKILLed at roughly 3 GB against a 31.3 GB container cap, with the container's own counters reading max 0 / oom 0 / oom_kill n, meaning it never approached its own limit and its own OOM killer never fired. Nine such kills were observed across four lanes today. That is not fixable inside this PR and not reachable inside a short window, so the record is preserved here rather than in a stalled draft.

What is established at the carrier level. I reviewed the issue-7 fix directly against rust_crate_partition.dag rather than accepting a summary, and it holds on all three ways it could have been wrong:

1. No absorption at the outer boundaries. Six arms of the shape Stage0…Refused { cause: _ } => acc look exactly like the absorbing fallback, but the acc being returned is already a refusal — sticky-error propagation through the fold, not keep-accumulator-on-lookup-failure. Opposite semantics, identical surface shape.
2. Refusal-to-false collapses are all in witnesses. All 29 sit in *_holds / *_succeeds / *_covers / *_valid / *_ok predicates, where a refusal reds the witness. The one name resembling a production helper (stage0_unit_has_shared_dependency_disposition) has exactly one caller, a planted fixture, and none outside the file.
3. No parallel representation. All three old absorbing functions are deleted, not left standing beside the new *_outcome variants — old=0, outcome=1 for each. That was the likeliest way to close issue 7 while leaving the defect reachable.

The new refusals (Stage0PartitionMissingRawReachPopulation, Stage0PartitionMissingAssignment) fire on both Absent and Rejected map results, so a rejected lookup cannot slip through as a miss.

Residue for whoever resumes — branch session/quiet-lark-120-c2-partition-closure is pushed and intact:

• Issues 1–6 were re-verified against the carrier by the owner at head 13d421eb62; issue 7 landed at 62519352f9. None of it is green by execution — that is the gap, and it is the only one.
• The P1-5 frozen baseline carries a terminating trigger reading C1 passes against C2-derived membership AND real C3 structural reference totality lands. C1 has since merged (ci: all-seven stage0 partition crate compile gate (C1) #7925, squash 30e04a70, seven partition crates continuously gated), so half that trigger has fired.
• Sequencing was: ci: all-seven stage0 partition crate compile gate (C1) #7925 C1 → C2: derive stage0 partition membership from module graph #7936 C2 → C2.5: generated partition artifact parity with live derived authority #7948 C2.5 → real C3. ci: all-seven stage0 partition crate compile gate (C1) #7925 is merged; C2.5: generated partition artifact parity with live derived authority #7948 is closed with its own residue.
• The first thing a resumed session should do is run the membership receipt witnesses on a host that can complete them. The carrier work is reviewed; the execution is what is owed.