Split type_reference_decl_file's String into TypeDeclarationProvenance: the state that meant 'no identity' becomes a constructor

[briansrls]

The finding: an analysis scoped to the wrong range is indistinguishable from one that does not exist

Before authoring a coproduct arm named Refused, I ran a corpus-wide collision census — over type names. It came back clean, so I authored the name. required-regen then refused:

variant 'Refused' appears in both 'TypeRealizationDecision' and 'EmitterOutcome'

Re-running the census over variant spellings found Refused live in six declaring types. RealizationRefused is in none.

The defect was not a missing analysis. The compiler already computes exactly this collision — it is what refused. But it computes it during v2 self-compile over one resolved closure, and the question being asked was about the corpus. Same subject, two ranges. From the author's seat, the narrow analysis's silence was indistinguishable from a negative result.

This is filed as a receipt on empty_observation_narrow rather than as a new class, because it is that row's own conflation with the scope quantifier moved: not an observation that could not express what changed, but one that could not reach where the answer lived. DESIGN §2 prices a fresh authority for an existing concept as a failed decomposition.

Next-rung trigger, named as the capability rather than an artifact: a corpus-wide namespace census over every type declaration and every coproduct arm, sufficient to answer "is this spelling already declared anywhere in the corpus" before a name is authored rather than after emission. One census over the one Node tree — two checks over one namespace is the range split that produced this instance. Not built here.

The generalisable half: the ordinary word is the dangerous one. A distinctive coined name is the safe case.

The change

v1.compiler.coercion keyed type realization on decl_file: String, where the empty string silently meant "no declaration identity" — indistinguishable from a real answer. That is state_space_conflation's third form, already filed. This replaces it with std.coercion TypeDeclarationProvenance = CorpusDeclared | KernelMinted | DeclarationIdentityAbsent, and the recognizer is homed beside its minter kernel_span so the kernel arm derives from the minter rather than re-spelling its "<kernel:" test a fifth time. TypeRealizationDecision gains a RealizationGround, so a bare-table answer now carries GroundedByUnidentifiedBareRow instead of passing as grounded.

The census that justified it (#10002) is upstream; this is the root cut.

A second specimen, and it is unusually good

accepted_source_emits_uncompilable_target gains its second instance. carrier_realization_census identity_query_provenance declared a return type of TypeDeclarationProvenance and answered it in five arms: three returned the bound provenance, two returned "". The front end accepted it with zero blocking diagnostics, emit produced the mirror, and rustc refused at E0308.

The empty-string arms were the exact conflation this change exists to make unwritable, surviving inside the change that makes it unwritable.

Recognition rule: a match mixing a coproduct constructor with a kernel literal is invisible to a reader checking that every arm is present, because exhaustiveness holds and only the arm types disagree.

The rung does not move. The refusal fired in the target compiler, one phase and one language too late, and the .dag front end that had every fact needed to refuse it did not. The class stays mechanically preventable; this sharpens the existing trigger rather than replacing it.

Citations: a name may be a String, an identity may not

The floor's declarations phase raised 14 CITED-DECLARATION-ABSENT findings. A census that enumerated a defect, landing in the change that deletes the defect's subjects, would have every decl_ref pointing at a declaration no module declares — which is unlanded_citation_indistinguishable_at_the_citing_end wearing the reverse costume.

A retired spelling denotes nothing in the current tree and belongs in prose; a successor resolves and belongs in a decl_ref the index walks. So the pointers are re-aimed and the dead spellings stay verbatim in the keys_on, holder_expression and why_* fields, with both carriers stating the mapping.

Cross-carrier note. gunbc.bare_name_identity_consumer_census is another lane's. It keeps the five re-aimed pointers — a citation repair that re-judged nothing. The sentence judging what this change did to those sites' rung was deliberately moved out of it and homed here, because a rung claim about another lane's subject, authored by someone else, is how two rosters end up disagreeing about one class. The judgement is the weaker of the two available readings: the stamp is a rung on visibility and not a repair of the keying, and neither roster claims the second from the first. Reading this climb as a repair would retire rows that are still live.

Evidence

• parse OK 4511 file(s) parse-clean
• mirrors: 12 regenerated, verified in three passes — install, then a binary rebuilt off the installed seed (first_generation_equal=true, 150/150/150, declared_divergent=1 [main.rs] pre-existing), then --required-regen-fixed-point (fixed_point_equal=true referenced_first_generation_equal=true). Three because a single pass runs a binary predating the change it emits and can self-verify at divergence 0 for the wrong reason.
• docs/design-ledgers.md regenerated through main_wet_one, never hand-edited. Vintage control: it rewrote all bytes and only the authored lines changed.
• the predicted RED is enrolled — reference_realization_witness_test asserts RealizationRefused { cause: DeclarationIdentityUnavailable }.

Where this regeneration can run, recorded so the next lane does not rediscover it slowly: BuildBuddy refuses it. main_wet_one peaks at 8.37 GiB and the remote runner answered MemoryStallRefusedPageThrash — 176690 major faults/minute while computing for 5% of the wall. It fits a session container's cgroup allowance and was run locally.

---

The range finding, one layer up: the floor runner had the same defect

Landing the split tripped the floor's changed-witness sublane, and the cause is this PR's own finding wearing a different costume.

required_floor_runner derives changed_witness_set from the run's git diff, which is root-agnostic. It emits disposition rows only while enumerating discovered files, which is scoped to --source-root dag --source-root src/v2. The selector's range is strictly wider than the enumerator's, so a witness homed under src/v1 is selectable and undeclarable by construction — and the guard that would have named it, ChangedWitnessOutsidePreparedSubject, sits inside the per-discovered-file loop those modules never enter. Any PR editing a src/v1 witness that declares test fns refused with identities no in-diff edit could satisfy.

This is a denominator mismatch, not a missing check — the same shape as the variant collision above, and the reason both are worth one entry rather than two incidents.

The undiscoverable selection is now a typed decline, DeclinedChangedWitnessOutsideDiscovery, counted in the disposition receipt and printed by identity. A decline and not a filter, deliberately: dropping the selection would have greened the floor by making the over-selection invisible, which is the absorbing arm.

Why this PR grew: the arm's authority did not exist as data

Declining is not enough — every decline blocks, so the fix converted one refusal into 17 blocking rows. The exemption had to be keyed on the identity's home being a declared non-executing root, and that roster did not exist.

The fact "the required fold does not reach src/v1" lived in three String declarations in gunbc.ci_layer_roots. That is exactly the §4c case — an invariant in prose a machine cannot join on — and one of them was load-bearing for a gate arm, which is why the arm had to be stopped rather than allowed to infer it. Discovering that is the result, not the overrun.

So the authority is now non_executing_witness_module_prefixes, with a typed DissolutionCondition naming the capability: bare cross-module references binding by containment, vehicle the namespace cut — satisfied by neither a faster floor nor adding --source-root src/v1, since both leave the twelve last-segment collisions standing.

Keyed on membership, never on absence. The arm requires the home to be in that roster; an unreadable or empty roster exempts nothing. It is deliberately not !witness_layer_roots().contains(home) — that grants the exemption by absence, so an unrostered tree or a typo'd path would go silently non-blocking, and it substitutes "not declared executing" for "declared non-executing", which are different claims: only the second carries the §4b(2) stall and its trigger.

The grain is forced, not chosen. I first modeled a filesystem root and re-grounded it: this population is undiscovered by definition, so no path exists at the arm to compare against a directory, and the authored module identity is the only available fact. Measured rather than assumed — every v1.* module lives under src/v1, zero outside. The converse is inexact (four fixture modules under src/v1 carry other names) and those stay blocking, because the narrower exemption is the fail-closed side of an inexact join.

witness_fold_src_v1_coverage_gap_note is retired, not left beside the row: two authorities for one fact is the nickname §3 forbids. Its irreducible rationale is preserved at the roster; its "116 test fn" figure was a dated observation and is not re-asserted as live. v1_claim_scoped_witness_batch_deleted_note and v1_dead_witness_tree_triage_receipt are the same §4c debt, deliberately left standing.

The exemption evaporates on its own trigger. When the namespace cut lands, v1 leaves the roster and the arm goes dead by construction. It has no independent dissolution condition because it has no independent existence.

Controls, executed on the merged head

required-floor: changed_witnesses=20 changed_witness_blocking=0
                changed_witness_declined_in_declared_nonexecuting_root=17
17x [changed-witness] standing=declined-in-declared-non-executing-root
 3x [changed-witness] standing=planned-and-passed
required-floor: verdict=FloorClean

• the src/v1 witness declines with the typed row, named;
• positive control: the 3 changed witnesses inside the discovery roots still disposition normally and pass — a decline that swallowed everything would show 20;
• discovered-file population unchanged, arithmetically from this run's own line: declared=15368, and 3488 + 366 + 0 + 49 + 11293 + 5 + 167 = 15368 exactly. The 17 are outside that sum because they were never in the declared population — which is why they were unrepresentable before.

A note on regeneration cost

A generated file whose producer is itself a generated mirror needs its producer installed a pass earlier, so an emitter change costs one regen pass per level of the chain. Three passes here. The second specimen was main's #10056 touching v1_compiler_infer.rs, not this branch — which is what establishes it as a property of generated emitters rather than of this diff.

🤖 Generated with Claude Code

https://claude.ai/code/session_015KnTJBDVSyUkrxKNUF4NCf

[gunbai-bot]

review 58658's REQUEST_CHANGES is fixed by construction, not argued.

provenance_is_kernel_minted was a Bool view that re-matched the coproduct this PR introduces — the parallel representation the split exists to remove, and DESIGN §5 prefers a single authority from which the realization is derived over a check that re-states it. The finding was right.

It had exactly one caller, so the dissolution is total rather than a relocation:

• rust_operand_realization_of_type matches KernelMinted { minted_name: _ } directly at the site;
• the predicate is deleted from v1.std.core and its import removed;
• the census row that cited it now names std.coercion TypeDeclarationProvenance — the constructor that actually answers the question.

No Boolean view survives anywhere. An earlier reviewer had considered and dropped the same note; an approval is a hygiene check rather than evidence, so it did not settle it.

Two things the fix surfaced, both the substrate enforcing rules I could not have broken silently:

• my rationale comment sat inside the match body, and §4c admits annotations only at module-item grain (source annotation sits inside a declaration body, four diagnostics from one block). Moved above the declaration.
• the emitted seed tests are generated from v1.compiler.compiler_tests_rust, so the earlier hand-edit of compiler_tests.rs was a fix in the wrong layer. Reverted and fixed at the emitter; the assertions are now derived.

The residues the approving reviews flagged — CorpusDeclared still carrying a contains-matched decl_file, and the two byte-identical kernel_span bodies whose agreement nothing enforces — are unchanged and stay declared in the diff. They are named where a later reader meets them rather than quietly fixed or quietly dropped.

— sent from quick-crab-396