fix(planner): enforce source-only rule strictly for self-referencing eligibility

Remove `|| pre_claimed.contains(i)` from the self-referencing eligibility check:
pre-claimed cells are never self-referencing in valid networks (the pre-claiming
code only pre-claims pure outputs), so the condition was dead code that contradicted
the source-only rule.

Clear self-referencing outputs from `source_cells` when a method is selected so
that a method-derived value cannot satisfy a later self-referencing eligibility
check. Update the design spec to document both invariants.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sean-parent

docs/superpowers/specs/2026-06-25-self-reference-design.md

@@ -69,6 +69,9 @@ Add a `source_cells: HashSet<CellId>` set alongside the existing `determined` se
 
 - When the outer loop promotes a cell as a source: add to both `determined` and `source_cells`.
 - When a method is selected and its outputs are marked determined: add to `determined` only.
+  For self-referencing outputs (cells in both `inputs` and `outputs` of the selected method),
+  also **remove** from `source_cells`: the method has overwritten the source value, so the cell
+  must no longer qualify as a source for subsequent self-referencing eligibility checks.
 
 `source_cells` records which cells were determined via `write()` rather than by a method. This
 distinguishes "may be read as self-referencing input" from "was derived; cannot be used as
@@ -81,7 +84,7 @@ For each method M, classify cells into three disjoint groups:
 | Group | Definition | Eligibility condition |
 |---|---|---|
 | **pure inputs** | `inputs(M) ∖ outputs(M)` | all in `determined` |
-| **self-referencing** | `inputs(M) ∩ outputs(M)` | all in `source_cells` or `pre_claimed` |
+| **self-referencing** | `inputs(M) ∩ outputs(M)` | all in `source_cells` |
 | **pure outputs** | `outputs(M) ∖ inputs(M)` | none in `determined` |
 
 The existing rule is the special case where every cell is either a pure input or a pure output.

property-model/src/planner.rs

@@ -93,7 +93,7 @@ pub(crate) fn plan(
 
                 // A method is eligible when:
                 //   pure inputs  (inputs ∖ outputs): all in `determined`
-                //   self-ref     (inputs ∩ outputs): all in `source_cells` or `pre_claimed`
+                //   self-ref     (inputs ∩ outputs): all in `source_cells`
                 //   pure outputs (outputs ∖ inputs): none in `determined`
                 let is_eligible = |m: &Method| {
                     m.inputs
@@ -103,7 +103,7 @@ pub(crate) fn plan(
                         && m.inputs
                             .iter()
                             .filter(|i| m.outputs.contains(i))
-                            .all(|i| source_cells.contains(i) || pre_claimed.contains(i))
+                            .all(|i| source_cells.contains(i))
                         && m.outputs
                             .iter()
                             .filter(|o| !m.inputs.contains(o))
@@ -130,6 +130,10 @@ pub(crate) fn plan(
                         // (as sources); only re-queue cells that are newly determined.
                         let newly_determined = determined.insert(output);
                         pre_claimed.remove(&output);
+                        // A method's output is no longer a source: remove it so that
+                        // subsequent self-referencing eligibility checks cannot treat
+                        // a method-derived value as a source value.
+                        source_cells.remove(&output);
                         if newly_determined {
                             queue.push_back(output);
                         }