XL-0A: split repair-input origin domains before candidate union

[gunbai-bot]

Outcome

Implements XL-0A of the adjudicated split-domain recut. The emitter now tags all six candidate-bearing channels before their historical union:

• channels 1–5 enter a closed five-arm source-candidate branch;
• rendered type-surface identifiers enter the separately typed RenderedTargetVocabularyCarrier branch;
• a single compatibility projection reunites spellings at the former union boundary, preserving the existing eligibility/disposition/use-line path;
• the qualified-type route now projects only qualified ItemEmitSurfaceOrigin rows from that same assembly, so dotted value/rendered spellings cannot bypass the origin carrier.

This PR deliberately does not claim declaration continuity or a subject-bound denominator roster. StageXL0Denominator remains NotDerivable, awaiting RepairInputOriginRosterProducer; XL-0B/C/D remain serial follow-ups.

The control-plane label now reads: source-declaration carriers plus rendered target-vocabulary carriers, separately typed, over one base, before eligibility or repair disposition.

Permanent discriminators

The split suite is under the admitted v2.test.* required-floor home:

• rendered-only token: a Vec-like token proposed only by channel 6 enters the rendered partition and no source row;
• emitted-text-only token: a token present only in emitted text has no producer constructor and contributes no row;
• qualified item-surface route: the same dotted spelling from item and value origins reaches the qualified route only through the item origin, and removing that item row empties the route while preserving the raw value-origin compatibility spelling;
• partition conservation: one spelling through all five source origins plus rendered yields six origin rows before compatibility deduplication and one spelling after it.

The renamed status witness holds the stage at NotDerivable on the exact new missing instrument.

Required-path correction and F-0 disclosure

The existing test.claim.compiler_frontend_program_status_witness now has an exact required_gate_prefixes row, without renaming. PRs #9698 and #9716 landed this witness outside the required gate closure; their floor runs predated the changed-witness execution wall, so F-0's status-witness exit receipts were direct-run evidence only until this head. This head must show its changed identities Planned/executed/terminal/passed; their floor wall/cpu cost lines will be recorded here from the terminal CI artifacts.

Verification

• compiler routing control: remote BuildBuddy rejected cargo check -Z definitely-not-a-real-flag as required
• moved split witnesses: 4 PASS
• status witness direct run: PASS
• declared regeneration transaction: first_generation_equal=true, planned=143, executed=143, candidate target/stage0-regen-candidate
• cargo fmt --all --check
• git diff --check

Collision check

Performed immediately before the first push with gh pr list --state open --limit 100 --json number,title,headRefName,files. Open compiler/self-host PRs #9724, #9723, #9719, and #9710 also touch src/v1/05_emit_rust.dag and its generated mirror; #9476 touches generated population/module-list files. They do not implement this repair-input split, but merge ordering may require regeneration/reconciliation.

Required-floor terminal receipts (head fc792ab)

Run 33299808312 is FloorClean: planned=3001 executed=3001 terminal=3001 failed=0. Every changed XL-0A identity is standing=planned-and-passed, disposition=planned, outcome=passed:

• test.claim.compiler_frontend_program_status_witness.no_subject_is_scheduled_for_the_waves_and_xl5_is_not_derivable_from_the_empty_set — wall_ms=48, cpu_ms=48
• test.claim.compiler_frontend_program_status_witness.xl0_is_not_derivable_and_awaits_the_repair_input_origin_producer — wall_ms=49, cpu_ms=49
• v2.test.claim.repair_input_origin_split_witness_test.emitted_text_only_token_is_not_an_origin — wall_ms=0, cpu_ms=0
• v2.test.claim.repair_input_origin_split_witness_test.partition_conservation_keeps_six_origins_before_compatibility_dedup — wall_ms=0, cpu_ms=0
• v2.test.claim.repair_input_origin_split_witness_test.qualified_item_surface_route_is_origin_derived — wall_ms=0, cpu_ms=0
• v2.test.claim.repair_input_origin_split_witness_test.realized_only_token_has_one_rendered_origin_and_no_source_origin — wall_ms=0, cpu_ms=0

Artifacts: required-floor-disposition 9728780019 and required-floor-claim-cost 9728780584. Both status rows are below the manager-required 500ms CPU line and the artifact’s stricter 100ms line.

Merged-main receipts (head e920d99; supersedes prior-head receipts)

Main was merged at 5029d7f (#9728) with a merge commit. Run 33301240123 has all four checks successful. The required-floor job is FloorClean: planned=3004 executed=3004 terminal=3004 failed=0. All six XL-0A changed identities report standing=planned-and-passed, disposition=planned_as_changed_witness, outcome=passed in required-witnesses-floor. Main’s three host-budget modules are fully dispositioned and terminal: host_budget_source 17 planned/17 passed; typed_module_cache_capacity 8 planned/8 passed; whole_corpus_compile_admission 5 planned/5 passed. Artifacts: required-floor-disposition 9729261483 and required-floor-claim-cost 9729262031. Declared regeneration: first_generation_equal=true, planned=143, executed=143. Immediate post-CI fetch confirmed origin/main remains 5029d7f.