Restore the stage0 arm of the generated-projection merge-attribute population, as a complement rather than a roster

.gitattributes

@@ -6,6 +6,9 @@
 
 # Integration policy — deterministic generated projections: provisional ours during merge,
 # then regenerate from merged authorities before commit (charter four-case policy row 1).
+# ROW ORDER IS LOAD-BEARING: the last matching line wins, so the stage0 unset rows must
+# follow the stage0 glob. Transposed, they are inert and a hand-maintained file silently
+# acquires the driver.
 
 .gitattributes merge=generated-artifact
 .githooks/generated-artifact-merge merge=generated-artifact
@@ -77,3 +80,40 @@ docs/plans/value-null-split.md merge=generated-artifact
 docs/plans/wiring-liveness-preflight.md merge=generated-artifact
 src/v1/stage0/src/bootstrap_stage0_crate_layout_generated.rs merge=generated-artifact
 src/v1/stage0/src/v1_interpreter_dispatch_generated.rs merge=generated-artifact
+src/v1/stage0/src/*.rs merge=generated-artifact
+src/v1/stage0/Cargo.toml merge=generated-artifact
+src/v1/stage0/src/bounded_shell_host_drain.rs !merge
+src/v1/stage0/src/census_exclude_derive.rs !merge
+src/v1/stage0/src/cli_run.rs !merge
+src/v1/stage0/src/codex_app_server_stdio_session.rs !merge
+src/v1/stage0/src/coproduct_reflection.rs !merge
+src/v1/stage0/src/cssl_seed_linked_closure_assembly.rs !merge
+src/v1/stage0/src/data_initializer_identity.rs !merge
+src/v1/stage0/src/declaration_index.rs !merge
+src/v1/stage0/src/derived_realization_schedule.rs !merge
+src/v1/stage0/src/main.rs !merge
+src/v1/stage0/src/memory_governor.rs !merge
+src/v1/stage0/src/phase_profile.rs !merge
+src/v1/stage0/src/pre_push.rs !merge
+src/v1/stage0/src/recorded_fixture.rs !merge
+src/v1/stage0/src/required_regen_host.rs !merge
+src/v1/stage0/src/resolved_graph_cache.rs !merge
+src/v1/stage0/src/shared_typecheck_store.rs !merge
+src/v1/stage0/src/std_lens_verdict.rs !merge
+src/v1/stage0/src/usv_pilot_v2_std_algebra.rs !merge
+src/v1/stage0/src/usv_pilot_v2_std_collection.rs !merge
+src/v1/stage0/src/usv_pilot_v2_std_node.rs !merge
+src/v1/stage0/src/v1_interpreter.rs !merge
+src/v1/stage0/src/v2_compiler_body_producer.rs !merge
+src/v1/stage0/src/v2_compiler_compile.rs !merge
+src/v1/stage0/src/v2_compiler_discovery_enumeration.rs !merge
+src/v1/stage0/src/v2_compiler_infer.rs !merge
+src/v1/stage0/src/v2_compiler_normalize.rs !merge
+src/v1/stage0/src/v2_compiler_parse_engine_hooks.rs !merge
+src/v1/stage0/src/v2_compiler_program_assembly.rs !merge
+src/v1/stage0/src/v2_compiler_program_partition.rs !merge
+src/v1/stage0/src/v2_compiler_resolve.rs !merge
+src/v1/stage0/src/v2_compiler_source_authority.rs !merge
+src/v1/stage0/src/v2_compiler_target_carriers.rs !merge
+src/v1/stage0/src/v2_compiler_tokenize.rs !merge
+src/v1/stage0/src/v2_compiler_use_site_verdict.rs !merge

dag/gunbc/generated_projection_paths.dag

@@ -1,6 +1,11 @@
 module gunbc.generated_projection_paths
 
 import gunbc.generated_artifact { committed_generated_artifact_paths }
+import gunbc.stage0_cargo_manifest { stage0_cargo_toml_repo_path }
+import gunbc.stage0_rust_source_lifecycle_scaffold {
+  derived_hand_maintained_disposition_repo_paths,
+  stage0_src_repo_prefix
+}
 import std.types { List, String }
 
 // One source remains after the stage0_emit_plan deletion, so a row is its path. The
@@ -52,3 +57,105 @@ fn deterministic_generated_projection_paths() -> GeneratedProjectionPathsOutcome
     |> map(path => GeneratedProjectionPathRow { path: path })
   deterministic_generated_projection_paths_from_rows(rows: rows)
 }
+
+// THE STAGE0 ARM IS A COMPLEMENT, NOT A ROSTER, AND THAT IS THE WHOLE CONSTRUCTION.
+//
+// The stage0 seed mirror is the artifact the generated-artifact merge driver was written for
+// (DESIGN records the #7836 receipt: the ours side dropped authority-derived bytes twice,
+// against this mirror). Its arm routed through gunbc.stage0_emit_plan, which the #8406 regen
+// cut deleted at the root. Nothing refused, because the consumer that needed it — this module —
+// was outside the deletion census, so the population silently narrowed to the committed
+// registry and every emitted stage0 source lost its merge attribute.
+//
+// A PATH LIST CANNOT BE THE REPAIR, IN EITHER OF ITS TWO SPELLINGS. A hand roster is what stood
+// in for the dead derivation before and is what #8674 deleted; and the live derivation that
+// replaced it (gunbc.stage0_rust_source_lifecycle_scaffold derived_generated_stage0_repo_paths)
+// takes two OBSERVATIONS as its inputs — git ls-files and a git show of the emitted-population
+// manifest. Reaching it from here would make a committed byte projection a function of somebody's
+// working tree: two clones at one commit could disagree about what .gitattributes must contain,
+// and the drift gate would then refuse or pass on a fact about a checkout rather than about the
+// model. So the arm is rebuilt from the pure half of the same authority instead.
+//
+// The pure half is the crate layout's own claim. hand_maintained_stage0_filenames() names every
+// direct child of the stage0 source root that is NOT emitted, and Git attributes express a
+// complement directly, because the last matching line wins and `!attr` unsets: one glob claims
+// the directory's direct children and one unset row per hand-maintained member takes them back
+// out. A newly emitted stage0 file is then covered BY CONSTRUCTION — nobody has to remember it,
+// which is exactly the failure that produced this defect, and the reason the class does not go
+// back to a roster that goes stale between authoring and merge.
+//
+// THE ORDER OF THESE ROWS IS A CORRECTNESS PROPERTY AND IT FAILS SILENTLY. Last match wins, so
+// an unset row emitted ABOVE the glob is inert — and inert in the dangerous direction, since the
+// hand-maintained file then silently acquires the driver with no diagnostic anywhere. The glob is
+// therefore constructed ahead of the unsets here rather than sorted into them, and
+// test.claim.generated_projection_merge_rows_witness reds when the two are transposed.
+//
+// THE OVER-CLAIM IS THE SAFE DIRECTION, WHICH IS WHY COVERAGE-BY-DEFAULT IS ADMISSIBLE HERE AND
+// #8674 REJECTED THE SAME COMPLEMENT FOR ITS OWN QUESTION. That module classifies maintenance
+// disposition, where a complement makes an unregistered file "generated" by definition and drives
+// the unclassified refusal's firing rate to zero — an absorbing arm. This module answers a
+// different question with asymmetric failure directions: an over-claimed hand file gets a LOUD
+// driver refusal at merge time, recoverable in place; an under-claimed generated file gets a
+// SILENT text merge that drops authority-derived bytes. The complement errs toward the loud one.
+//
+// THE UNSET POPULATION IS LAYOUT MEMBERSHIP MINUS THE ARTIFACT REGISTRY, and that subtraction is
+// load-bearing rather than defensive: bootstrap_stage0_crate_layout_generated.rs and
+// v1_interpreter_dispatch_generated.rs are BOTH hand_maintained_stage0_filenames() members (they
+// are pub-mod-declared by hand) and registry artifacts already carrying the attribute today. An
+// unset row for either would REMOVE working coverage. derived_hand_maintained_disposition_repo_paths()
+// is the existing authority for exactly that difference; this module joins it rather than
+// recomputing it.
+data stage0_generated_source_complement_note: String = "Cross-authority receipt for the complement, measured at d311b1ceab: the stage0 source root holds 173 direct children and hand_maintained_stage0_filenames() claims 37, so the complement is 136; the emitter's own declaration (src/v1/stage0/src/emitted_population.rs) names 137 direct children. The two agree exactly except main.rs, which is the single emitter_produced_divergent_registrations row — a file the emitter emits and whose committed bytes deliberately diverge from it, so regeneration is NOT its recovery and the unset row is correct. Two independently derived populations agreeing on 136 of 137 is the evidence that the layout claim is the right complement basis. THE FILE HEADER IS NOT THE POPULATION and was tested and rejected as one: 135 files carry '// Generated by v1 compiler -- do not edit.' at that ref, and the header disagrees with the model in BOTH directions — main.rs and std_lens_verdict.rs carry it and are hand-maintained, while compiler_tests.rs, emitted_population.rs and v1_rt.rs lack it and are in the emitted-population manifest."
+
+type GeneratedProjectionMergeSetting
+  = MergeGeneratedArtifact
+  | MergeAttributeUnspecified
+
+type GeneratedProjectionMergeRow {
+  pattern: String
+  setting: GeneratedProjectionMergeSetting
+}
+
+type GeneratedProjectionMergeRowsOutcome
+  = GeneratedProjectionMergeRowsAccepted { rows: List<GeneratedProjectionMergeRow> }
+  | GeneratedProjectionMergeRowsRefused { cause: GeneratedProjectionPathsRefusal }
+
+data stage0_generated_source_pattern: String = concat(stage0_src_repo_prefix, "*.rs")
+
+data stage0_generated_source_pattern_note: String = "A slash-bearing Git attributes pattern does not match across '/', so this claims the DIRECT CHILDREN of the stage0 source root and leaves bin/, cli_run/ and module_path_index/ untouched. That is the correct scope and not a convenient one: every emitted stage0 source is a direct child (measured at d311b1ceab — zero of the emitter-declared sources sit in a subdirectory), and the three subdirectories are hand-maintained Rust the crate layout claim does not enumerate at file grain, so a wider glob would over-claim a population no authority here can take back out."
+
+fn stage0_generated_projection_merge_rows() -> List<GeneratedProjectionMergeRow> {
+  concat(
+    [
+      GeneratedProjectionMergeRow {
+        pattern: stage0_generated_source_pattern,
+        setting: MergeGeneratedArtifact
+      },
+      GeneratedProjectionMergeRow {
+        pattern: stage0_cargo_toml_repo_path,
+        setting: MergeGeneratedArtifact
+      }
+    ],
+    derived_hand_maintained_disposition_repo_paths()
+      |> sort_by(path => path)
+      |> map(path => GeneratedProjectionMergeRow {
+        pattern: path,
+        setting: MergeAttributeUnspecified
+      })
+  )
+}
+
+fn deterministic_generated_projection_merge_rows() -> GeneratedProjectionMergeRowsOutcome {
+  match deterministic_generated_projection_paths() {
+    GeneratedProjectionPathsRefused { cause } => GeneratedProjectionMergeRowsRefused { cause: cause }
+    GeneratedProjectionPathsAccepted { paths } => GeneratedProjectionMergeRowsAccepted {
+      rows: concat(
+        paths |> map(path => GeneratedProjectionMergeRow {
+          pattern: path,
+          setting: MergeGeneratedArtifact
+        }),
+        stage0_generated_projection_merge_rows()
+      )
+    }
+  }
+}

dag/gunbc/gitattributes_emit.dag

@@ -1,23 +1,46 @@
 module gunbc.gitattributes_emit
 
 import gunbc.generated_projection_paths {
-  GeneratedProjectionPathsAccepted,
-  GeneratedProjectionPathsRefused,
-  deterministic_generated_projection_paths
+  GeneratedProjectionMergeRow,
+  GeneratedProjectionMergeSetting,
+  GeneratedProjectionMergeRowsAccepted,
+  GeneratedProjectionMergeRowsRefused,
+  MergeAttributeUnspecified,
+  MergeGeneratedArtifact,
+  deterministic_generated_projection_merge_rows
 }
 
 type GitattributesGenerationOutcome
   = GitattributesGenerated { content: String }
   | GitattributesGenerationRefused
 
-data gitattributes_emit_authority_note: String = "THE committed byte projection through which Git receives the relevant subset of the modeled repository-path policy (generated-file conflict policy charter, lane 2, operator-ruled 2026-08-01). Presentation-policy rows (linguist) and integration-policy rows (merge driver attribute) are orthogonal facts derived from separate authorities — generated provenance does not imply linguist-hidden, and neither row is hand-authored in the committed file. The merge-attribute population is gunbc.generated_projection_paths.deterministic_generated_projection_paths(), joining committed generated artifacts with plan-derived stage0 Rust and refusing duplicate paths before row emission; committed_generated_artifact_paths() remains the heal/registry authority. .gitattributes classifies itself through the same derivation with no handwritten self-row. The merge-driver DEFINITION lives in repository-local Git config (gunbc.repo_local_git_config), not in this file."
+data gitattributes_emit_authority_note: String = "THE committed byte projection through which Git receives the relevant subset of the modeled repository-path policy (generated-file conflict policy charter, lane 2, operator-ruled 2026-08-01). Presentation-policy rows (linguist) and integration-policy rows (merge driver attribute) are orthogonal facts derived from separate authorities — generated provenance does not imply linguist-hidden, and neither row is hand-authored in the committed file. The merge-attribute population is gunbc.generated_projection_paths deterministic_generated_projection_merge_rows(), which joins TWO arms: the committed generated-artifact registry, at exact-path grain with duplicate paths refused before row emission; and the stage0 seed mirror, as a directory glob over the stage0 source root's direct children plus one unset row per hand-maintained member, ordered glob-first because the last matching attributes line wins. THIS SENTENCE PREVIOUSLY DESCRIBED AN ARM THAT DID NOT EXIST — it claimed a join with plan-derived stage0 Rust for months after the #8406 regen cut deleted gunbc.stage0_emit_plan at the root, while the population was in fact the registry alone and every emitted stage0 source carried no merge attribute at all. The prose was the only place the arm survived, which is why it is corrected here rather than quietly widened: a note asserting an arm nobody can execute is what let the gap stand. committed_generated_artifact_paths() remains the heal/registry authority. .gitattributes classifies itself through the same derivation with no handwritten self-row. The merge-driver DEFINITION lives in repository-local Git config (gunbc.repo_local_git_config), not in this file."
+
+
+data generated_projection_paths_join_seam_note: String = "Seam history for the two-arm population. #7609 (operator sequence step 4, 2026-08-01) established deterministic_generated_projection_paths() as the registry roster joined with a stage0 arm derived from gunbc.stage0_emit_plan. The #8406 regen cut deleted that plan at the root and the arm went with it silently, because this consumer sat outside the deletion census. The arm is restored as a COMPLEMENT rather than a path list, for reasons carried at its construction site in gunbc.generated_projection_paths: a path list — hand-authored or derived — leaves the invalid state writable, and the only surviving derived population takes live git observations as inputs, which a committed byte projection may not depend on. Duplicate refusal remains fail-closed inside the registry arm (counted diagnostic), not silent dedup."
 
-data generated_projection_paths_join_seam_note: String = "Seam for #7609 (operator sequence step 4, crisp-bat-830 2026-08-01): merry-deer-815 owns deterministic_generated_projection_paths() = committed_generated_artifact_paths ++ stage0-derived repo paths. Single consumer: generated_projection_merge_policy_lines() below. Duplicate refusal is fail-closed inside that fn (counted diagnostic), not silent dedup. still-carp-272 does not author a parallel join — reviews the stacked #7609 change only."
 
 data dag_linguist_presentation_policy_pattern: String = "**/*.dag"
 data dag_linguist_presentation_policy_attribute: String = "linguist-language=Rust"
 data generated_projection_merge_attribute: String = "merge=generated-artifact"
 
+// `!attr` is Git's UNSET-AND-DO-NOT-INHERIT spelling, which is the one this needs: the row must
+// return the path to `unspecified`, not set the attribute to some other value, so that a
+// hand-maintained stage0 source keeps ordinary text merging. Verified by execution against real
+// `git check-attr`, glob and unset row together.
+data generated_projection_merge_attribute_unset: String = "!merge"
+
+fn merge_attribute_token(setting: GeneratedProjectionMergeSetting) -> String {
+  match setting {
+    MergeGeneratedArtifact => generated_projection_merge_attribute
+    MergeAttributeUnspecified => generated_projection_merge_attribute_unset
+  }
+}
+
+fn merge_policy_line(row: GeneratedProjectionMergeRow) -> String {
+  concat(concat(row.pattern, " "), merge_attribute_token(setting: row.setting))
+}
+
 fn gitattributes_header_lines() -> List<String> {
   [
     "# gunbc .gitattributes — generated from dag/gunbc/gitattributes_emit.dag — do not hand-edit.",
@@ -38,12 +61,15 @@ fn generated_projection_merge_policy_lines() -> GitattributesGenerationOutcome {
   let header = [
     "# Integration policy — deterministic generated projections: provisional ours during merge,",
     "# then regenerate from merged authorities before commit (charter four-case policy row 1).",
+    "# ROW ORDER IS LOAD-BEARING: the last matching line wins, so the stage0 unset rows must",
+    "# follow the stage0 glob. Transposed, they are inert and a hand-maintained file silently",
+    "# acquires the driver.",
     ""
   ]
-  match deterministic_generated_projection_paths() {
-    GeneratedProjectionPathsRefused { cause: _ } => GitattributesGenerationRefused
-    GeneratedProjectionPathsAccepted { paths } => GitattributesGenerated {
-      content: join_lines(lines: concat(header, map(paths, p => concat(concat(p, " "), generated_projection_merge_attribute))))
+  match deterministic_generated_projection_merge_rows() {
+    GeneratedProjectionMergeRowsRefused { cause: _ } => GitattributesGenerationRefused
+    GeneratedProjectionMergeRowsAccepted { rows } => GitattributesGenerated {
+      content: join_lines(lines: concat(header, map(rows, row => merge_policy_line(row: row))))
     }
   }
 }