Feed both writers' decision bodies through tiles, retiring WriterBuffer

[dpmills]

Both mutation writers fed their decision body by pushing rows onto a WriterBuffer that the body's input leaf also held, so a value computed by one producer reached another without traversing an edge: the dependency was real but invisible to the producer graph, and the ordering it needed came from the driver's own code rather than from the dataflow. This splits each writer so the body's input is an ordinary tile, and gates the rule in CI — it was already documented in src/interpreter/CLAUDE.md, and broken anyway.

The split

Each writer becomes a drive that produces the body input and a store/writer that consumes decisions. InductionDrive reads the changelog back through a FanOut::new_cyclic and holds no part of the recurrence: the store's decided frontier is the next position to iterate, and the previous accumulator is that key's value at it, so a row is a pure function of the store tile and the source tile. TransactDrive is the same shape over the transaction source, and owning that source makes it the writer's completeness signal. WriterBuffer, BodyInputBuffer and BodyInputSource are deleted; the mechanism is in design-operators.md. A shared DriveWindow holds everything the two drives do the same way, leaving each with only its own rule for which row to emit next.

One position per outer pull

The cyclic fan serves a snapshot taken before the traversal began, so a position decided during a pull is invisible until the next. Induction drove every arrived position in one pull because it owned the engine; it now runs at the rate every other cyclic operator here does, which the doc argues as a retention problem rather than a rate one. StoreDenseRead gains a decided-positions filter so a Memo above it cannot latch a fold the store has not decided.

The gate

./ci.sh shared_state flags shared mutable state under src/interpreter/ unless its inner type is a known-legitimate kind or the site says why. It cannot prove an absence, only stop one being added silently — the checker's own docstring argues the rest. CycleSlot collapses the late-wiring cell both stores hand-rolled and is the shape the gate recognises; shared_consumer / forwarding_consumer give the notification wiring one spelling.

Tests

The mutability, transaction and async-source suites are the gate and needed no behavioural changes. a_contended_item_keeps_the_drive_window_flat is new: the first operator-level test of the real drive / writer / commit-operator cycle, with six writers contending on one key so an item loses five times before winning. Two alternating writers make the loser retry once, so the end-to-end suite cannot reach that depth.

[dpmills]

This change is part of the following stack:

• Freshening asks a different question than type_level, so it needs its own #71
  • SharedHole: let lowering state that two type positions are the same #72
    • Traits: state what an operator requires of its operands, not that they are the same #73
      • Mutable-variable typing: an honest seed, a fixed history read-through, and a polarity-directed base #52
        • Annotations stop standing in for binder structure, and stop outliving inference #60
          • Four defects in how Mut is typed: message polarity, an unclosable refinement, and op= as a rebind #63
            • A mutable variable read is an explicit operation, not a subtyping rule #64
              • Split transactional commit stores by connected components of transaction blocks #91
                • Build the await_final terminal read as a completion-point sample, and give the as-of read its own term #92
                  • Feed both writers' decision bodies through tiles, retiring WriterBuffer #93 ◀
                  • Add an end-to-end walkthrough of mutability, from CHL source to operators #97
                  • Close a commit store's keys individually, so an await waits only for its own variable's writers #102
                  • Retire the reg and Recurse names, and pin the out-of-block read rule #106

_{Change managed by git-spice.}