Carry the item kind the parse constructor already knew, and delete the predicates that guessed it from absence

[briansrls]

The parse constructors already knew which item they were building and then threw it away. Node had
no item-kind field, so by the time any later stage asked, the kind survived only as a combination of
which optional fields happened to be absent -- and every consumer re-derived it that way. This
carries the kind instead.

What lands

v1.std.core Node gains one field, module_item_kind: ParsedModuleItemKind. No second enum was
minted: the coproduct already existed in v1.compiler.parse and MOVES to v1.std.core beside
Node, because Node cannot import the parser. It gains one variant, NotAModuleItem, carried by
every expression, type-expression, field, variant, param and synthetic node -- a different statement
from ModuleItemUnrecognized, which the parser's own item-error path stamps.

• Stamped at the eight item constructors in v1.compiler.parse, from the ItemForm body_kind
  the parser was already dispatching on: TypeBody/AliasBody -> TypeDeclaration, ExprBody/BlockBody ->
  Function, ValueBody -> DataValue, ServiceBody -> Service, ResourceBody -> Resource, NoBody ->
  Unrecognized.
• Propagated at every construction that rebuilds a node, so an item keeps its kind through
  resolve, inference and emission.
• Consumed by an exhaustive match in all three emitters. A new ParsedModuleItemKind variant now
  fails to compile at every dispatcher instead of falling through a residual arm.

parsed_module_item_kind and parsed_item_carries_resource_entries are deleted -- the classifier is
a field read.

The refusal census, which is what this change is actually accountable to

Before deleting a predicate family I enumerated what each member refuses. Full census in the lane
thread; the load-bearing results:

• The resource-exclusion validator dissolves entirely. is_resource_def_item's second disjunct
  (children == 0 && properties > 0 && body == none) becomes kind == ModuleItemResource. Its live
  defect is the discriminating RED: resource Network and resource AuthContext in std.resources
  declare no capabilities and no properties, satisfied NEITHER disjunct, and reached
  is_type_alias_item first in every emitter's if-chain -- so all three targets treated them as
  types.
• A section 3 nickname dies. is_service_item and is_service_def_item were byte-identical, both
  exported, both consumed. Claiming this as a result rather than letting it disappear inside the diff.
• The type-structure axis is NOT folded into the kind. is_type_def_item / is_type_alias_item /
  is_type_decl_item / is_leaf_type_item (renamed from is_bare_leaf_item -- the shape-not-kind
  name that let two capability-less resources through) all range over ONE kind and split it by the
  type's own structure. Each gains a kind conjunct and loses the now-dead transport == none one.
  Two orthogonal axes in one enum is a modelling failure, not a simplification.
• The coproduct is necessary and NOT sufficient at twelve unwrap sites. is_function_item and
  is_data_def_item were consumed as proof that item.body.value was safe. Node.body and
  Node.type_annotation stay optional, so a kind-stamped item with an Absent body is still
  authorable: every one of those arms keeps a Present match and REFUSES on Absent. Reporting
  those as closed would be rung inflation.
• A refusal that would otherwise have been dropped silently. is_service_item's children > 0
  conjunct meant a zero-operation service reached the residual arm. Corpus census: 123 services,
  ZERO with no operations. So the service arm now refuses it explicitly rather than inheriting a
  behaviour by accident.
• A pre-existing fail-open, found by the census and fixed here. emit_py_typed_item's residual
  arm rendered # unhandled node: X -- A COMMENT. An item no predicate claimed was silently omitted
  from the emitted Python module, while the same position in Rust rendered compile_error! and in Go
  a panicking init(). All three now refuse; Python's stop is a module-level raise.

Ledger

• gunbc.recurring_failure_mode absence_classifier_default_bucket named this change as its
  next-rung trigger. The trigger fired; the row records what the climb covers (the CLASSIFICATION
  axis, structurally impossible) and what it does not.
• New row emitter_residual_renders_inert_text for the Python fail-open -- filed at the moment it
  disappears, because a silently repaired defect has a recorded frequency of zero and never ranks
  for a wall.
• New row kind_carried_but_its_fields_stay_optional for the payload residue, with the per-kind item
  carrier named as its trigger -- the capability, not an artifact.

Evidence

v1.tests.claim.item_kind_dissolves_shape_predicates_control_test: the discriminating RED is a node
satisfying every conjunct of the old shape predicate while carrying ModuleItemResource -- the
shape-only predicate claimed it, the kind-gated one refuses it. Beside it, the accepted positive
control, which is what stops the RED being satisfied by a predicate that answers false for
everything. Both stay enrolled per section 4b(4). That file is not discovered by CI, for the reason
its two neighbours in the same directory state, and it says so rather than implying enrollment.

Rung

CLASSIFICATION axis: structurally impossible. An item cannot acquire a kind it was not constructed
with, and no item can land in the type bucket by default. PAYLOAD axis: unchanged, mechanically
preventable, rostered with its own trigger. The reported rung is the minimum across the paths.

The ledger rows

• absence_classifier_default_bucket and dispatch_correctness_resting_on_arm_order (the row
  codex review 60254 produced on Home the kernel-identity authority beside the minter it asks, instead of above the module that had to re-spell it #10350) both named this change as their next-rung trigger. Both are
  updated: the trigger fired, the classification axis reaches STRUCTURALLY IMPOSSIBLE, and each row
  records what did NOT climb.
• New: emitter_residual_renders_inert_text — the Python fail-open, filed at the moment it
  disappears, because a silently repaired defect has a recorded frequency of zero and never ranks
  for a wall. The row carries the fact that it was found by a census taken for another purpose.
• New: kind_carried_but_its_fields_stay_optional — the R2 payload residue, with the per-kind item
  carrier named as the CAPABILITY that retires it.
• docs/design-failure-modes.md is re-derived by generated_artifact_gate main_wet_one after each
  merge, never hand-resolved; both sides of every roster merge were verified present in the derived
  projection by name.

Executed evidence

Everything below was run with a gunbc built from this tree. The binary on PATH is not usable for
this: it predates §4c source annotations and reports 23363 errors on the current corpus, the first
against a leading // block in dag/extdeps/access/posix.dag.

• v1.tests.claim.item_kind_dissolves_shape_predicates_control_test — three rows PASS. The
  discriminating row was confirmed RED by the revert arm: restoring the shape-only body of
  is_leaf_type_item in the .dag and re-running the same claim reports FAIL.
• item_kind_dispatch_totality_test (Rust test tree) — a dispatch omitting one variant is refused
  and the refusal names the omitted variant; the full-arm control compiles clean. The same pair was
  run against the REAL ParsedModuleItemKind under live source roots: refused with
  non-exhaustive match: missing variant(s) NotAModuleItem, control PASS.
• a_resource_item_is_not_read_as_a_type_item, the generated row that landed with Home the kernel-identity authority beside the minter it asks, instead of above the module that had to re-spell it #10350, survives
  the climb restamped with each fixture's kind; its third assertion — that the parse-side and
  emit-side readers agree — is deleted, because there is no longer a second reader and an authority
  agreeing with itself asserts nothing.
• Empty-service census: 123 service declarations, zero with no operations.
• cargo clippy --all-targets -- -D warnings: clean. claim_executor --required-regen: compile
  clean, drift only in the mirrors of the files this PR changes, all installed from the candidate
  tree.

Not caused here, found while verifying

cargo test -p v1-compiler-tests has pre-existing failures on this tree that are not on the merge
path (the rust-unit-tests job was deleted by the 2026-09-04 runner-capacity ruling):
whole_tree_wiring_enum_test passes pool_roots to fn_arrow_decl_facts_live, which has required
pool_files since #10245; four materialization_provider_* rows panic on HostBudgetUnreadable
because the runner exposes no cgroup memory limit.

The declared boundary: none of this evidence executes on the merge path

§4b(1) measures a rung against a declared boundary, so the boundary is declared here rather than
left to be discovered from a log.

• The three .dag controls report standing=declined-in-declared-non-executing-root on the
  required floor: changed_witnesses=3 changed_witness_blocking=0 changed_witness_declined_in_declared_nonexecuting_root=3. They exercise v1 compiler types, so
  their home is the v1 prefix, which gunbc.ci_layer_roots non_executing_witness_module_prefixes
  declares non-executing. That is a rostered exemption with its own §4b(2) trigger,
  non_executing_witness_module_prefixes_restoration — bare references binding by containment,
  vehicle the namespace cut — and it is explicitly NOT satisfied by adding --source-root src/v1
  to the required fold. Moving the controls out of v1 is not available: the subject they
  discriminate is a v1 type.
• The Rust enrolled form, item_kind_dispatch_totality_test, is #[ignore] in a test target that
  no CI step runs: cargo test --release -p v1-compiler --lib was deleted with the rust-unit-tests
  job by the 2026-09-04 runner-capacity ruling (gunbc.rung_drop
rust_unit_tests_off_the_merge_path).

So: the rung-4 claim rests on evidence that EXECUTED — the refusal on the real
ParsedModuleItemKind under live source roots, and the revert arm going FAIL — and on nothing that
executes on today's merge path. Green, green-that-ran-my-witness, and green-that-keeps-running-it
are three facts; this PR has the first two. Both probes stay enrolled per §4b(4) so that they
execute the moment either declared drop retires; neither is deleted, and neither is cited as
merge-path coverage.

[gunbai-bot]

Answering codex review 60760

Conceded and fixed. This was a real defect, it was reachable only because of this PR, and it is the
most useful finding any review made on this branch.

What it found. With the kind carried, capability-less resources route to emit_py_resource_def
for the first time. resource Network and resource AuthContext in std.resources declare no
capabilities and have zero children — they are this PR's own specimen — so that function emitted
class Network(ABC): followed by an indent and nothing, which Python rejects with
IndentationError.

Worth stating plainly: the climb did not create this defect, it made a pre-existing
misclassification reachable. Before the kind carrier those two rows lost the emitter if-chain to
the type arm and were emitted as types in all three targets. The change converted a silent
misclassification into a loud one. That is the class working as intended.

Fixed as a gap, not refused, and another emitter decides it. Rust's emit_resource_def already
branches to a unit struct declaration on zero children, so an empty resource is a valid modeled
state and the Python emitter simply had no empty form. Go is unaffected — an interface with no
methods is valid. Refusing here would fail a correct corpus, which is the mirror image of the
fail-open this PR removes, and the worse error: DESIGN §5 forbids the absorbing fallback, it does
not license refusing valid input to look strict.

Where it landed. 023bed5b0d — emit_py_resource_def branches to pass on zero children, with
the reason recorded as an annotation. The regenerated projection is in a later commit on this
branch; v1_compiler_emit_python.rs carries the "pass" branch.

The regression control you asked for, in
src/v1/tests/claim/item_kind_dissolves_shape_predicates_control_test.dag:
an_empty_resource_emits_a_python_body_rather_than_bare_indentation. Both arms were executed on
a tree-built gunbc — it PASSes with the fix, and with the empty branch reverted it goes FAIL.
The revert arm is the point: a control that only passes with the fix establishes nothing about
discrimination.

Two notes on how it is written. The assertion uses string_contains rather than the bare
contains, because v1-seed fn names are not module-scoped and the corpus carries a receipt where a
widened import closure let v2.std.algebra's contains capture that bare name and abort a
9782-witness floor run. And the row stays enrolled per §4b(4) rather than being retired once green.

Boundary, stated rather than left to be inferred: this control lives under the v1 prefix, which
gunbc.ci_layer_roots non_executing_witness_module_prefixes declares non-executing, so it does not
run on the merge path. It was executed directly, both arms. Direct execution is evidence the
assertion holds; it is never evidence that CI runs it.

— sent from calm-wolf-333

[gunbai-bot]

Answering review 60865 (advisory finding).

Declining the suggested change, on the merits rather than on cost.

The five sites named are Bool-valued guards inside is_type_def_item / is_leaf_type_item / is_type_alias_item / is_type_decl_item and their two call sites. Rewriting item.module_item_kind == ModuleItemTypeDeclaration as a match there does not buy exhaustiveness over the sum — it buys a variant-to-Bool fold, which is the shape a codex reviewer has issued REQUEST_CHANGES on in this corpus before: a match whose every arm collapses to true/false re-encodes the discriminator as a predicate and loses exactly the positive authority this PR was opened to establish. The one place where exhaustiveness is load-bearing is dispatch, and dispatch already is a match — emit_typed_item, emit_go_typed_item, emit_py_typed_item — with the discriminating RED (non-exhaustive match: missing variant(s) NotAModuleItem) enrolled as the executing evidence.

So the residual equality reads are membership tests against one named variant, not dispatch, and a new variant added later must not silently join ModuleItemTypeDeclaration's bucket — which an equality read is the construction that guarantees, and a widened match arm is the construction that would not.

— sent from calm-wolf-333