Affected set of one edit: gunbc.regen_affected_set bounds the mirrors a .dag edit can change (reverse closure + declared v1_rt.rs bootstrap edge + generation-input roster), refusing when the edited set is unlocatable

[gunbai-bot]

Step 3 of the regen-round-cost lane (after #9735, #9738): the affected-set bound scoped as DerivableNow in gunbc.regen_round_cost becomes an authority a regen can consume, built as ruled (operator ruling 2026-08-30): the runtime shim is a declared bootstrap edge, never a filename exception, and an edited population the tree cannot name refuses rather than widening to the whole population.

The authority — gunbc.regen_affected_set

regen_affected_set(edited, unlocatable, edges, compared, modules) -> AffectedSetBound, three arms:

• AffectedMirrors { edited, mirrors, bootstrap_products } — the reverse closure of the edited modules over the regen's own closure edges (cli_run both_closure_edge_index: dotted references incl. every import, plus bare references), joined to the committed mirror population, plus the products of any declared bootstrap edge whose source is in the closure. A structural over-approximation computed AS the answer (DESIGN §5), never exact.
• WholePopulation { edited, generation_inputs } — an edit under a declared generation-input prefix (regen_generation_input_prefixes = ["v1.compiler.", "extdeps.languages."]): the emitter itself changed, so every emitted byte's producer changed and no reverse closure sees it. A declared bootstrap source is excluded from this arm by the declaration's own content (its measured effect is closure + product).
• EditedSetUnlocatable { unlocatable, reason } — the refusal arm, taken before any closure: a departed .dag, an unreadable one, or one with no module line. Zero members; it does not fall back to WholePopulation — "whole rebuild required" and "the selection could not answer" are different states (§5, absorbing fallback).

regen_bootstrap_edges declares v1.compiler.runtime_rust -> v1_rt.rs with its measured reason (tree 0fe2c51 drift: {v1_compiler_runtime_rust.rs, v1_rt.rs}, only the first in the graph). regen_reverse_closure is a bounded fold (n steps over n modules) so termination is by construction.

The host — claim_executor --regen-affected-set

required_regen_host::run_regen_affected_set: edited population from the floor's own diff range (floor_git_diff_range, so the selection and the gate read one edit), module names via extract_module_path_public, edges module→module off both_closure_edge_index over regen_source_roots() (an endpoint the index cannot map to a module is a refusal, not a dropped edge), compared rows = module index ⋈ committed_generated_basenames. The host's native reverse walk hands the model the reached subgraph; the model re-derives the closure and answers; lockstep every run — if the model's mirrors differ from the host walk's, the run refuses rather than electing a side. Output: provenance line, edited/unlocatable rows, the bound line, one member line per mirror. Exit 1 on the refusal arm.

regen_round_cost.regen_affected_set_disposition.from now names this authority.

Evidence (by execution)

• dag/test/claim/self_host_regen_affected_set_witness_test.dag — 7 fns, all true on srv1 with the built target/release/gunbc (--source-root dag --source-root src/v2): transitive-only reverse closure; leaf edit bound; RED no-dependents bounds to itself; runtime-template edit carries the declared product; emitter edit → WholePopulation; RED unlocatable refuses with zero members; bound line byte-exact.
• required_regen_host::regen_affected_set_tests — 4/4 remotely (BuildBuddy, cargo test -p v1-compiler --lib regen_affected_set_tests, 218s): host walk and model fold agree on the witness's fixture graph; unlocatable refuses and selects nothing; diff reader classifies named / departed / never-written / .rs; live-tree controls on one index build — the three measured edits of 2026-08-30: std.content_hash → AffectedMirrors ∋ std_content_hash.rs, ∌ v1_rt.rs, proper subset; v1.compiler.runtime_rust → ∋ v1_compiler_runtime_rust.rs and v1_rt.rs; v1.compiler.emit_rust → WholePopulation.
• Remote cargo check -p v1-compiler --all-targets: my code compiles; the one error (declaration_index_integrity importing private compile_dag_multi_module_fixture) and the clippy disallowed_macros in cssl_assemble.rs are on origin/main untouched by this diff.

Not in this PR

Consuming the bound to restrict the emit (a per-module emit option in 05_emit_rust — emit_rust iterates every typed.modules module today) is the D3 that the cost receipt did not justify (emit ≈ 20% of a real round; the whole-crate rebuild is the larger cost until the stage0 partition carries the mirrors).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KGCnzm2zkb37mVHgrGCt9L

[gunbai-bot]

Live receipt of the entry point on this branch (producer claim_executor --regen-affected-set --source-root dag --source-root src/v2, host srv1, tree 5f315ec, clean, built from this branch):

regen-affected-set: edited gunbc.regen_affected_set
regen-affected-set: edited gunbc.regen_round_cost
regen-affected-set: edited test.claim.self_host_regen_affected_set_witness
regen-affected-set: non_dag_paths=3
regen-affected-set: AffectedMirrors edited=3 mirrors=0 bootstrap_products=0

Read: the three .dag modules this PR edits are not in the stage0 seed closure, so no committed mirror can drift from them — mirrors=0 is the correct bound for this PR (the regen gate agrees: no mirror changes here). The three non-.dag paths are the host .rs edits, which are the regen diff's subject, not the selection's.

— sent from smart-boar-394