Split the reference-site identity fallback by structure, census it, declare the production key (CARRIER-KEY-1 step 1)

[gunbai-bot]

CARRIER-KEY-1, step 1 only: split the collapsed reference-site identity fallback by structure, report the split per occurrence in the census, and declare the key production still uses as a rung drop. Production answers are unchanged, and this does not fix any E0308.

The brief's symbols are stale

The brief names v1.compiler.coercion type_reference_decl_file. #10006 replaced it with v1.std.core type_reference_provenance, which returns std.coercion TypeDeclarationProvenance. Its own-span fallback arm, the defect this PR splits, is unchanged. The brief's "0 of 111 resolved / 8 true by accident" figure was measured on the pre-reconcile tree, and docs/plans/carrier-realization-arbiter-repair-design.md withdraws it. The step 2 finding below was taken on the typed tree instead.

What lands

• Outcome type: std.coercion TypeReferenceIdentity has four arms: ReferenceResolvedToDeclaration, ReferenceIsTheDeclaration, ReferenceIsTypeVariableBinder, and ReferenceIdentityUnavailable { cause }. The cause is NoResolutionBoundAtReference, ResolvedNodeIsNotADeclaration or DeclarationNodeCarriesNoSpan.
• Query: v1.std.core type_reference_identity decides from structure: the parser's ModuleItemTypeDeclaration mark, the existing kernel recognizer (through declaration_provenance_of), and an inferred TypeVariable binder. It never decides from "is a Resolved node bound" or "is a span present", because the step 2 finding shows both proxies put each state on both sides. Everything else refuses.
• Census: v1.tests.claim.carrier_realization_census gets a split_identity column. gunbc.type_reference_decl_file_occurrence_census gets a FallbackArmSplit record naming the query, the instrument and the witness. It carries no counts; the instrument re-derives them.
• Witness: v1.compiler.compiler_tests_rust ct_type_reference_identity_split_test, with seven cases. The RED case is an unresolved reference outside its declaring module: it must refuse, and the same case asserts the legacy read keys it on its own file.
• Rung drop: gunbc.rung_drop type_reference_location_fallback_keys_production_realization (§4b(3)), previous MechanicallyPreventable, temporary OutsideTheLadder. It is restored when every production reader of the key uses a declaration-node or env-binding authority and the own-span fallback arm is deleted.
• Failure-mode rows: a receipt on state_space_conflation, and a new row, resolved_value_computed_then_discarded_for_the_authored_one, for the field-type discard (step 2).

Evidence (local, head of this PR)

• Witness passes. cargo test --release -p v1-compiler --lib type_reference_identity_split: 1 passed.
• RED control. In the emitted v1_std_core.rs, I replaced declaration_node_provenance's declaration test with true. The witness then failed with "an unresolved reference must refuse, never key on the file it sits in". The mirror was restored afterwards.
• Mirrors regenerated through the writer. claim_executor --required-regen gave first_generation_equal=true, exit 0, with a rebuilt binary. The drift was confined to std_coercion.rs, v1_std_core.rs, v1_compiler_compiler_tests_rust.rs, compiler_tests.rs and v1_tests_claim_carrier_realization_census.rs, and every production function is byte-identical. The self-host K=64 A/B has not been run; that is fierce-seal-607's run.
• Honest rung for the witness. It runs in the seed's generated tests, and CI no longer runs those (gunbc.rung_drop rust_unit_tests_off_the_merge_path). Its execution is local only.

First run of the split column

Run carrier_realization_census over the import closure of src/v2/compiler/01_tokenize.dag and join split_identity to the identity and legacy key columns. Results are qualitative here, not transcribed:

• Every row answering IsTheDeclaration agrees with the environment's declaration. No false declaration answers.
• Every row whose legacy key was the referencing module's own file is refused, or answered as a type-variable binder where the node carries the binding.
• It over-refuses. Alias-substituted leaves keep the declaration's span but carry the target's item kind, so some references with a correct old key are refused. A refusal means "not provable from the node", not "production was wrong".
• It does not refuse the kernel-minted alias boundary. For example, std.algebra.FreeMonoid minted on its kernel pseudo-file answers ResolvedToDeclaration:KernelMinted while the environment names dag/std/algebra.dag. That behaviour comes from the existing kernel recognizer (state_space_conflation third form), and the census record documents it.

Step 2 finding (why n.inferred is not Resolved), typed tree

1. Leaf references are resolved by substitution. v1.compiler.infer_resolve replaces the reference with the declaration node, keeping the declaration's span, and adds no Resolved wrapper. So "not Resolved" does not mean "inference unavailable".
2. The Resolved node of an applied reference is built on the reference's own span. That makes the resolved arm location-keyed too.
3. The wrong fallback keys come from a resolver defect, split by position. resolve_item_types resolves each record and coproduct field type, then rebuilds the field from child.children and child.inferred, keeping only diagnostics and properties. resolve_field, which keeps the resolved type, has no callers. v1.compiler.emit_rust type_reference_provenance_in_env patches the symptom downstream (§6b). The same kernel String, Int and Bool are keyed correctly as function parameters and wrongly as record fields.
4. Type variables are a distinct shape. A generic parameter is a binder, not a declaration.

Repair targets (step 3, not touched here): stop discarding tr.resolved in the field arms, make resolve_field their single route or delete it, remove the env re-resolution downstream, and key identity on the declaration node rather than a span. Each changes emission, so each needs the step 3 measurement.

Not in scope

Step 3: the pinned-tree census, the A/B/C/D counterfactual, and the renderer reroute. No resolver edit, no short-circuit deletion, no monomorphization, and no constructor-only repair.

🤖 Generated with Claude Code

[gunbai-bot]

Addressed review 67150 in 55743bf. node_is_type_declaration (a Bool helper with _ => false over ParsedModuleItemKind) is deleted. declaration_node_provenance and declaration_node_unavailable_cause now match all seven arms explicitly, so a new item kind is a compile error here instead of a silent refusal. Verified locally: regenerated v1_std_core.rs through the writer; required-regen gives first_generation_equal=true, exit 0, on the rebuilt binary; type_reference_identity_split passes. Production reads are still untouched.

[gunbai-bot]

On review 67170's note that type_reference_decl_file_fallback_split.declared_drop is a bare String rather than a decl_ref: agreed, it would put that citation inside the cited-symbol check. I'm not pushing it now, because any push reopens the exact-head design sign-off and CI on f2ed35c for a one-line citation change. It lands with the next edit to that record, which step 3's reroute (the rung drop's restoration trigger) makes. — sent from tidy-bee-696