Per-user parametric host content leaks across users through a custom forward class (#603 regression)

[sini]

Found while fixing #642 (PR #643). Distinct mechanism, not fixed by that PR.

Symptom

A host-attached parametric aspect feeding a declaring custom forward class delivers every user's content to every user — silently, with no error:

expected { pinguSees = ["pingu"];        tuxSees = ["tux"]; }
actual   { pinguSees = ["pingu" "tux"];  tuxSees = ["pingu" "tux"]; }

Repro

test-parametric-host-content-two-users-no-battery = denTest (
  { den, lib, igloo, ... }:
  let
    shellClass =
      { class, aspect-chain }:
      den._.forward {
        each = lib.singleton class;
        fromClass = _: "myshell";
        intoClass = _: "homeManager";
        intoPath = _: [ "programs" "bash" ];
        fromAspect = _: lib.last aspect-chain;
        guard = { options, ... }: options ? programs.bash;
      };
  in
  {
    den.default.includes = [ shellClass ];

    den.aspects.per-user = { user, ... }: {
      myshell.shellAliases.${user.name} = "mine";
    };

    den.hosts.x86_64-linux.igloo.users = { tux = { }; pingu = { }; };
    den.aspects.igloo.includes = [ den.aspects.per-user ];

    expr = {
      tuxSees   = lib.attrNames (igloo.home-manager.users.tux.programs.bash.shellAliases or { });
      pinguSees = lib.attrNames (igloo.home-manager.users.pingu.programs.bash.shellAliases or { });
    };
    expected = { tuxSees = [ "tux" ]; pinguSees = [ "pingu" ]; };
  }
);

Attribution

• Passes at 88161da (parent of 41aa255), fails at 41aa255 and at HEAD ⇒ a fix: sibling policy.when guard dedup collision; spawn subtree routes; multi-def forwarded identity #603 regression.
• Reproduces with no host-aspects battery, therefore no spawn and no involvement of mergedSpawnRoutes or PR fix: four silent-drop defects in forward classes and standalone homes #643's suppression. The same config with the battery behaves identically.
• Control: the same parametric host aspect projected through the ordinary host-aspects path with no custom forward is per-user correct, so the spawn projection itself is sound.

That points at the parent pipeline's complex-forward source collection — getCollectedSource / filterRootModules in nix/lib/aspects/fx/edges/route.nix pulling a host root bucket that has already been fanned across users, unprojected.

Why this one matters

Before #603 this shape errored loudly ("already declared"). It now evaluates to a wrong configuration instead — every user gets every other user's content, with nothing in the output saying so.

[sini]

Fixed in #643 (71ff2b47) — root modules are now filtered by the entity bindings their identity carries, so a fanned instance only reaches the child it was bound to. Regression suite issue-644-parametric-host-forward-per-user covers the no-battery case, the with-battery case, and a static-content control for legitimate sharing.