fix(codegen): withhold in_place outputs from dependents

[raphaelvigee]

Stacked on #398.

A codegen = "in_place" output is a tracked source file. It stays visible to glob()/file() — it must, since it is what the transform reads — and unlike a copy output there is no provenance stamp that could hide it, because hiding it would hide the source.

So when a dependent could also take those bytes as artifacts, the same file reached it by two paths, and those paths disagreed for as long as the transform had run and the write-back had not. heph's one-producer-per-file rule had nothing to arbitrate with: for copy the xattr decides, and here nothing can.

The change

A dependent of an in_place target now receives every output group except the in_place ones. Naming one explicitly is an error:

'//pkg:fmt' output 'src' is `codegen = "in_place"`: those are tracked source files,
not artifacts a dependent can consume. Read them from the tree with glob()/file();
keep the dep if you need the transform to run.

This costs the dependent nothing. After the write-back the tree holds exactly the transformed bytes, so reading them through glob() yields what the artifact would have — by the single path that is always right.

The edge keeps its other two jobs:

• the target is still resolved, so the transform runs and (after fix(codegen): reconcile the tree wherever a codegen target is in the run #398) lands in the tree;
• its hashout still folds into the dependent's hashin — inputs_result_meta reads hashouts with OutputMatcher::None and never consulted this list, so cache keys are untouched by this PR.

Groups

Transparent groups do not go through link — they inline their members' results directly — so they would have been a way around the rule: wrap the formatter in a group, depend on the group. They now ask consumable_outputs for the same answer.

Two cases deliberately keep OutputMatcher::All: a member with no in_place output (nothing to withhold, and it keeps the group path allocation-free), and a member that is itself a group (it applies the rule to its own members, and declares no outputs of its own to enumerate — enumerating would have starved nested groups, which a_group_still_passes_a_plain_members_outputs_through pins).

Tests

• in_place_outputs_are_not_staged_into_a_dependent — confirmed to fail without the change, not just to pass with it: the consumer's test -z "$SRC_SRC" trips on the staged file.
• naming_an_in_place_output_as_a_dep_fails — the explicit-group error and its wording.
• a_group_does_not_leak_its_in_place_members_outputs — the group path.
• a_group_still_passes_a_plain_members_outputs_through — a group of a group still surfaces the leaf's output.

Blast radius

Nothing in tree consumed an in_place output. example/fmt has no dependents, and the Go lint --fix driver — the only other producer — is depended on by nothing; its e2e suite passes (4/4).

Known wart, not addressed here

A dependent's @heph/fs glob and its codegen dep resolve concurrently in inputs_result_meta, and glob results are memoized per request_id — so whether the dependent hashes pre- or post-write-back bytes is an ordering race, self-correcting on the next run. deps = ["//pkg:fmt"] therefore cannot be relied on to sequence formatting before a read. The real fix is a phase boundary (codegen settles, then the graph hashes), not a dependency edge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01W9pJTeJGLJva1b2ZCJGtgz