make TCS compiler GIR control validation and lowering

bootstrap/tcs-stage0/tests/stage0.rs

@@ -142,3 +142,24 @@ fn compiler_gir_tampering_and_negative_program_fail_closed() {
         .expect_err("unregistered operation must still fail through compiler GIR");
     assert_eq!(error.code, "TCS-E2101");
 }
+
+#[test]
+fn tcs_compiler_source_controls_operation_policy_and_gir_lowering() {
+    let compiler_source = compiler_source()
+        .replace(
+            "registered_operations = [\"CORE.ECHO\"]",
+            "registered_operations = [\"ABSORB\"]",
+        )
+        .replace("to = \"exact_target\"", "to = \"policy_selected_target\"");
+    let compiler = tcs_stage0::bootstrap_compiler(&compiler_source).expect("policy compiler GIR");
+
+    let absorb_program = example().replace("CORE.ECHO", "ABSORB");
+    let gir = tcs_stage0::compile_with_compiler_gir(&compiler, &absorb_program)
+        .expect("TCS source policy permits ABSORB at compile time");
+    assert!(gir.get("policy_selected_target").is_some());
+    assert!(gir.get("exact_target").is_none());
+
+    let error = tcs_stage0::compile_with_compiler_gir(&compiler, &example())
+        .expect_err("TCS source policy rejects operation removed from its registry");
+    assert_eq!(error.code, "TCS-E2101");
+}