feat(dsl): on_death is an effect root, and so is the one nobody had noticed

[stellarfeline]

Implements spec-0031 acceptance criterion 3, plus the blind spot its on_death
section names. dsl_version 0.9.0 → 0.10.0.

Two roots, added together because they are the same lesson read from both ends

R7 on_death is new surface that starts inside the enumeration. The engine had
on_respawn and nothing that ran at the moment of death, so "the purse is dropped
on death" would have had to be an engine feature. As a root it is ordinary content
in a general mechanism — which is the test this project applies before adding any
surface.

R6 shortcuts[].on_unlock is not new. It has been a Vec<QuestEffect> emission
lowers since spec-0016 §2, and it was in no enumeration at all — so every proof,
every l10n pass and every diagnostic written for the general path silently did not
cover it: a narrate inside it was never inventoried, a set-flag was invisible to
the flag model, a sequence would have emitted a call to a function nothing
generated. Zero campaigns had used it, which is the only reason it never shipped as
a bug.

tools/check-effect-roots.py could never have found it — that gate greps for the
roots it knows. The gate that did is check-capability-ownership.py check E,
which reads the effect-bundle fields out of stages.rs and fails on any it
cannot account for. Both gates' headers now say which shape each one catches.

Why R6 is a root and not a desugar

The audit's fix sequence recommended the Ambush::to_trigger desugar instead. That
pattern works because an ambush is a trigger — the trigger is the entirety of
what it emits. A shortcut's unlock is not: its detection is a once-only #sc_<id>
sentinel poll that in the same function clears the gate region, retires the
affordance (DW0421) and kills the wrong-side bodies, with permanence structural
(DW0372). Desugaring would have put two independent detectors on one event.
The departure and its general rule are recorded in the audit.

What on_death looks like to an author

"on_death": [
  { "type": "narrate", "style": "chat", "text": "The dark takes you." },
  { "type": "set-flag", "flag": "flag/has-fallen", "requires_flags": ["flag/act-two"] }
]

Campaign-wide, on the quests stage, one bundle. Not a field on a checkpoint: where
you come back is a property of a checkpoint, that you died is not — it is true at
every point of the delve, and a bundle repeated per checkpoint is N copies with N
chances to forget one. Phase-specific behaviour uses the per-effect
requires_flags/forbids_flags every root already carries; no second gating
surface. Audience is Solo, the dying player, as on_respawn and on_caught
already are.

It is optional to the completability model in the strongest sense it has —
nobody is forced to die — so it registers close-gates only, and nothing inside it
is credited as a flag producer. A mainline reachable only by dying is not reachable.

Death detection: the existing edge, one detector, two acknowledgements

dw.deaths (deathCount) is still the only thing in the delve that notices a
death; cp_respawn_check is still its only reader, off one tick line. What
on_death adds is a second acknowledgement of that one counter, not a second
detector — because dw.death_ack is deliberately withheld while a player is dead
(task #145), which is exactly the window the beat fires in. So the corpse side gets
dw.death_seen, and the two branches are mutually exclusive by their own
Health:0.0f guards.

Contingent on the live measurement — stated plainly

The death position is not captured, and nothing here guesses at it.
emit::death_position_capture is a named, deliberately empty seam emitted ahead of
the dispatch, carrying both candidate mechanisms (the pre-respawn death advancement;
the LastDeathLocation player NBT) and what has to be true of each. Nothing
downstream reads a position yet, so filling it in is additive.

What is not contingent, because this repo already measured it: deathCount ticks
up on the death rather than on the respawn, @a matches a player on the death
screen (the existing alive guard exists because it does), and the corpse stands
where it fell. The open question is only how to record that position durably.

One more limitation, reported rather than papered over: the corpse-side positive is
not drivable from PackTest — a generated template drives a fake player and a fake
player is alive. The guard's shape is proven at compile time instead. No generated
PackTest is added: no campaign declares on_death, so a template would bind to zero
campaigns and be vacuous.

Walkers changed

Roots 6 and 7 were one edit in effects.rs's macro. The type then forced exactly
three sites to decide (plan::for_each_effect_root's adapter and the completability
reading, flow's producer policy, continuity's exclusion reasoning) and two enums
to widen (EffectSite in dsl, EffectRoot in compiler) — which is the design
working. Everything else inherited: l10n inventory + localize, for_each_campaign_effect,
the timeline, DW0360's anchor seal, emit::declared_flags, all_campaign_effects,
rehearsal, combat::actor_beats.

What CI now proves

• tests/effect_root_walkers.rs — the matrix. Roots from EffectRootKind::ALL,
  one campaign per root from an exhaustive match (an eighth root is a compile
  error there), six walkers plus DW0360 asked about every root. The per-walker
  tests it sits beside each prove one walker against the roots their author
  remembered and stay green when a root is added; this cannot. Demonstrated red by
  making one walker skip one root: it names the walker and the root.
• tests/v10_on_death.rs — the edge's shape both sides; one detector; the
  Solo audience; a death beat with no checkpoint arming the detector alone
  without dragging in the respawn half; the DW0141 fence and its control; and the
  whole tree identical with an empty beat.
• effect_root_sweep — 7/7, plus a new test that an empty on_death binds
  nothing, so RootBinding keeps being able to say "this campaign has no death
  beat" instead of reporting every campaign as bound.

Byte identity

Every campaign the content repo carries, built with the engine at this branch's
merge base and with this branch, --lang en and --lang zh-cn:

• nobodys-cave-island: 610 files, 608 byte-identical.
• hollow-vigil: known-red DW0331 on both engines, unchanged.
• build-every-campaign.py green: 2 discovered, 1 built, 1 known-red.

The two files that differ are the same file and its hash:
creator-datapack/layout.json's "version" field, which is the engine's own
SUPPORTED_DSL_VERSION stamp (creator.rs:812), plus that file's entry in
manifest.json. It moves on every version bump by construction and is
creator-side, not player-facing. The shipped datapack/** is byte-identical.

Version discipline

0.10.0 with a per-stage fence (reserved_v10, DW0141 — no new DW code). No
campaign uses the surface, so no adoption round is owed. check-harness-dsl-version
caught the harness allowlist lagging, as designed; critical-path.ts and its test
now carry 0.10.0.

Coordination

envelope.rs and stages.rs are shared with feat/runtime-state, which also needs
a version bump — 0.10.0 should carry both features. The gate struct is untouched
here.

Notes for review

• check-capability-ownership.py check D newly examines EffectSite (7 variants
  took it past MODIFIER_MIN_VARIANTS) and flags quest as a partial modifier. It
  is justified rather than silenced: quest is an operand, and the cross-cutting
  question is already lifted to the enum as EffectSite::quest() -> Option<&str>.
• Audit item #16b and fix-sequence item 0 are marked closed with the
  reasoning for the departure.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AjQ5p1Kv5MrkGPumi7yXWL