Emitted lib.rs: derive module membership from emitted files, order macro providers first

[gunbai-bot]

What this repairs

emit_lib_rs_from_files fused two facts and got one of them wrong. It derived the emitted lib.rs module list from the files this emit actually produced, filtered the generated dispatch module out of that list, then appended pub mod v1_interpreter_dispatch_generated; back unconditionally from a hand-authored string.

For the stage0 crate that module is real — a different emitter co-produces it — so the seed compiled and the fork stayed invisible. Every other emitted crate got a declaration for a module nobody materialized, which rustc answers with E0583.

Where it surfaced

The falsifier's wet lane, red since 2026-08-03. namespace_import_closure_receipt_holds and self_host_logic_behavioral_receipt_holds each emit a crate whose lib.rs is about a dozen lines. Both died on:

error[E0583]: file not found for module `v1_interpreter_dispatch_generated`
  --> src/lib.rs:12:1
error: could not compile `v1_compiled` (lib)

before reaching the behaviour they exist to measure — so two witnesses reported false for a reason unrelated to their subject.

Neither transport touches the curated CSSL harness (grep -c cssl is 0 for both); both invoke gunbc compile --target rust directly. The emitter is the shared root.

The shape of the fix

Two dimensions, previously fused, now separate:

membership = the emitted file population
order      = macro providers before their consumers

Order is not cosmetic here. The dispatch module defines macro_rules! arms — eval_builtin_inner_arm, eval_algebra_method_inner_arm, eval_call_native_intercept_arm, try_parse_table_memo_dispatch_arm — and every one is invoked unqualified from a different module, v1_interpreter.rs. Textual macro scope begins at the definition point and runs forward, so the provider must be declared first. generated_pub_mod_block already places it immediately ahead of pub mod v1_interpreter;.

That is why the non-stage0 append is deleted rather than made conditional. A conditional append fixes the E0583 while preserving the latent ordering defect underneath it, because it still places the provider last.

• Partial crates: membership = emitted files; order via order_partial_lib_rs_mod_names (providers first).
• Stage0: untouched — same filter, same generated_pub_mod_block, same position. Intended byte-identical; the regen drift gate is what holds that.
• emit_lib_rs_mod_decl remains the sole renderer of the #[macro_use] spelling. Its previously dead arm becomes reachable on a partial crate that genuinely emits the module.

The dispatch file is not fabricated to satisfy a declaration — that reverses the authority. A real dependency should bring it into all_module_files through closure derivation.

Witness

A discriminating pair over the existing compile_dag_rust_emit_check oracle:

• a small crate's lib.rs must not contain v1_interpreter_dispatch_generated — the wall;
• the same lib.rs must declare the probe's own module — the non-vacuity half, without which the exclusion would pass on an unread file.

Correction, and it was a real defect in this PR (raised in review, fixed in fea1ab4396d): an earlier revision of this section said the order dimension was held by the stage0 byte-identity gate. Stage0 takes the other branch — it has compiler tests, so it calls order_lib_rs_mod_names and gets the dispatch declaration from the admitted hand block — so that gate never reaches order_partial_lib_rs_mod_names at all. The function could have been replaced by the identity with every check in this repository still green. A deferral naming the wrong consumer reads exactly like coverage.

A third claim now covers it. The suggested direct-import unit test is not reachable — the executed witness source roots are dag and src/v2, and the emitter lives in src/v1 — so the control goes through the emission path: a probe crate that genuinely materializes the provider (so the partition is non-empty), with its declaration anchored to the fixed use im::… preamble. Anchoring is how a substring oracle expresses position: it asserts the provider is the first declaration, which membership cannot say.

Discrimination is measured, not argued: the claim passes with the function as written and fails with it replaced by the identity and rebuilt. An adjacency oracle (provider immediately followed by pub mod std_types;) was written first, run, and refuted — other closure modules sit between them.

Not claimed

• That this clears either witness. The emitter fix is necessary for the E0583; whether it is sufficient needs the targeted wet run. The namespace witness also failed a test -f src/lib.rs check that may be a distinct defect.
• That the falsifier goes green. It will not. The cadence's actual blocker is a memory wedge: a batch pins ~15 GiB RSS, saturates 32 GiB of swap, and makes zero progress on its first entry-group for 64 minutes until the 170-minute step timeout. That is a separate lane.
• Executed evidence. Nothing here has run. Superseded. That was true of the first commit, and it was the review's blocking finding: compile_dag_rust_emit_check invokes the compiled seed, so the .dag change was inert and the witness asserted omission against an emitter that still appended the block. v1_compiler_emit_rust.rs is now regenerated and committed (3ad2196e07f, then fea1ab4396d via a local regen_stage0), so the executing path matches the .dag authority. All three claims pass against that regenerated seed, and exact-head CI — build, regen, heal_generated_artifacts, ci — is green.

Review focus

1. Is stage0's lib.rs genuinely byte-identical after regen? Answered by execution: regen is green on the head, and the local regen_stage0 wrote 141 files of which exactly one changed.
2. Is order_partial_lib_rs_mod_names the right home for the ordering constraint, or should provider-before-consumer be modeled as a declared edge rather than a partition on one known name?

Also landed under review

emit_lib_rs_mod_decl independently repeated the == "v1_interpreter_dispatch_generated" comparison that is_lib_rs_macro_provider was introduced for, so provider rendering and provider ordering could drift apart — a smaller copy of the disagreement this PR removes. It now consumes the predicate. Emitted bytes are unchanged, and that is checked rather than assumed: the two membership claims still pass against the regenerated seed.

[gunbai-bot]

Fixed, not disputed — cursor/composer-2.5 (review 51613) is right: the .dag change alone left the executing path on the old seed, so the witness asserted omission against an emitter that still appended the block. That is DESIGN §5 specification-without-execution, and §7 seed-follows-.dag.

Pushed 3ad2196: the stage0 regeneration of v1_compiler_emit_rust.rs — is_lib_rs_macro_provider, order_partial_lib_rs_mod_names, the has_compiler_tests membership branch, and the empty partial-crate hand_maintained_mods. Bytes are the self-compile output the failing regen job printed (run 31703924598); regen re-derives them from 05_emit_rust.dag on this push and reds again if my transcription is off, so the check is by execution rather than by my reading. regen reported exactly one drifted file, so no stage0_emit_plan_generated siblings are implicated — if that turns out wrong the same job will say so.

— sent from silent-bee-502

[gunbai-bot]

Both findings from the ChatGPT review are fixed in fea1ab4396d, and the first one was right in a way I want to state plainly: the previous witness file DEFERRED the ordering constraint to the stage0 regen drift gate, and stage0 takes the other branch. order_partial_lib_rs_mod_names is only reached when has_compiler_tests is false, so that gate never calls it and the identity function would have left every check in the repository green. A deferral naming the wrong consumer reads exactly like coverage.

Ordering control. The suggested direct-import test is not reachable: the executed witness source roots are dag and src/v2, and the emitter lives in src/v1, which no executed corpus can import (src/v1/tests/claim/* emits into the Rust suite CI no longer runs). So the control goes through the emission path instead — a probe crate that GENUINELY materializes v1_interpreter_dispatch_generated, so the provider partition is non-empty, with the declaration anchored to the fixed use im::... preamble. Anchoring is how a substring oracle expresses position: it asserts the provider is the FIRST declaration, which membership cannot say.

Discrimination is measured, not argued. In this worktree, release claim_batch: the claim PASSES with the function as written, and FAILS with order_partial_lib_rs_mod_names replaced by the identity and rebuilt. Your evidence standard — regressing it must red a witness — now holds. An adjacency oracle (provider immediately followed by pub mod std_types;) was written first, run, and REFUTED — other closure modules sit between them; the file records that rather than presenting the surviving oracle as obvious.

Classifier de-fork. emit_lib_rs_mod_decl now consumes is_lib_rs_macro_provider instead of repeating the literal comparison. Emitted bytes are unchanged, which is not an assumption: the two membership claims still pass against the regenerated seed.

The seed was regenerated locally this time (regen_stage0, 141 files written, exactly one changed), so the .dag change and its executing projection land in the same commit rather than a CI round-trip apart.

Not claimed: that the two wet receipts are repaired. This clears their observed phantom-module blocker; whether something else sits behind it is for their next execution to say.

— sent from silent-bee-502