docs/compiler: retire pipeline include_str side channel

ROADMAP.md

@@ -371,7 +371,7 @@ Per-row tagging is a scheduled follow-up sweep — **trigger:** post-merge of th
 ### P3 — modeling gaps
 
 - **`declaration_by_name(...)` pattern in emit** — 20 sites on `origin/main`, including `emit.rs`, `emit/rust_target.rs`, `emit/python_target.rs` looking up `"OrderedRing"`, `"SubstrateAccessorBinding"`, `"Dag"`, `"fold"`, `"id"`. Violates Layer Opacity / Semantic Authority (post-lowering). Dissolution: typed substrate access via cached declaration-id (`algebra_field_for_operator` pattern) at every call site.
-- **`pipeline_authority.rs` parses body-span text for stage order**: Semantic Authority leak. Dissolution: typed stage list from `pipeline.dag` declarations.
+- **`pipeline_authority.rs` (case 2c):** runtime stage order is **structural** (`PipelineStageBinding` declaration order only). `fn compile` body vs binding drift check is **suspended** (PR #1171): `compile` stays `ArrowBody::Unparsed` — no lowered ordered stage list without a source-text channel; neither `include_str!` nor `read_to_string`+slice satisfies R3 for that reconcile. Dissolution: single typed carrier or structural compile body.
 - **LLM service flattening**: `dsl/extdeps/llm/llm.dag` declares `Role`, `ContentBlock`, `LlmMessage`, `StopReason`; Anthropic/OpenAI service operations still take `model: String`, `messages: Json`, and extract outputs by string path. Dissolution: service operations consume the typed carriers; outputs returned as typed responses. **Typed request JSON vs wire (e2e risk):** closure trigger identifier `rest_request_wire_serde_alignment` — Anthropic gap residue remains (`structural_coverage_gap_anthropic_messages_request_wire` in `dsl/extdeps/llm/anthropic.dag`). OpenAI Chat Completions narrow-row `messages[].role` for `OpenAiChatMessageRole` is ratcheted by pipeline test `openai_chat_message_role_wire_matches_llm_snake_contract` (`src/v2/tests/src/pipeline.rs`) against `data wire_contract: VariantEncoding = llm_snake_wire_contract` in `dsl/extdeps/llm/openai.dag` (same M2 pattern as Anthropic: module-local `wire_contract` names the single `llm_snake_wire_contract` authority in `extdeps.llm.llm`; emitter derefs `init.inferred` / `Resolved` per `resolve_wire_serde_tag_for_coproduct` in `05_emit_rust.dag`). `v2.compiler.emit_rust` authorizes coproduct serde only from a binding identified as `wire_contract` (authored name or `i.name`), not from structural scans or declaration order. The old `structural_coverage_gap_openai_chat_request_messages_wire` row was removed when that receipt landed; tracker [#987](https://github.com/gunb-ai/gunbc/issues/987).
 - **GitHub auth model bypass**: `dsl/extdeps/github/github.dag:42-46` declares `GitHubAuthToken { token, scopes, expires_at }` but `dsl/extdeps/github/auth.dag:13-23` returns only `{ token: Secret }` and hardcodes GCP secret-manager policy. Dissolution: `github_token()` returns the full typed token; remove the hardcoded provider policy.
 - **`errors.dag` dead generic layer**: `HttpErrorShape`, `AuthError`, `RateLimitError`, `ConflictError`, `ProviderError` declared at `dsl/std/errors.dag:5-30`; no non-doc consumer; extdeps use only provider-specific shapes. Dissolution: wire the generic layer or delete it.

docs/db-history/db-14.md

@@ -2,7 +2,7 @@
 
 Collected receipts and reconciliation notes moved out of [ROADMAP.md](../../ROADMAP.md).
 
-**DB-16 (`FnExternalBody` reconciliation, PR #524; structural-read cleanup, PR #637).** [design-fn-external-body-reconciliation.md](docs/design-fn-external-body-reconciliation.md) — documents the **`FnExternalBody` / `ArrowBody::Unparsed` split for pipeline work only:** parse lag (case 1), pipeline host stages (case 2a → bootstrap `ExternalRealization` via `PipelineStageBinding`), **`pipeline.dag` `compile` (case 2c → `Unparsed` persists; runtime ordering reads `PipelineStageBinding` declaration order via `ordered_pipeline_stages`; `fn compile` body is the human-readable pipeline contract, fail-closed reconciled against the bindings via `reconcile_with_compile_body` — bridge shape, scheduled until derivation collapses the two authored carriers to one)**. Invariant `pipeline_stages_lower_to_external_realization_not_unparsed` derives stage names from `pipeline_compile_order_stage_names()` (same authority as bootstrap; excludes `compile` itself). Intentionally **does not** canonically document substrate accessor `Unparsed` semantics (see deferral below). **Scheduled deletions:** `ArrowBody::Unparsed` is **split into three rows** (case 1 vs `compile` 2c + reconcile bridge vs DB-14 interim) in §Scheduled deletions — the M2 grammar milestone removes **case 1**; **2c** dissolves when derivation collapses the `compile` body and bindings to a single authored source; accessor interim has its own trigger.
+**DB-16 (`FnExternalBody` reconciliation, PR #524; structural-read cleanup, PR #637).** [design-fn-external-body-reconciliation.md](docs/design-fn-external-body-reconciliation.md) — documents the **`FnExternalBody` / `ArrowBody::Unparsed` split for pipeline work only:** parse lag (case 1), pipeline host stages (case 2a → bootstrap `ExternalRealization` via `PipelineStageBinding`), **`pipeline.dag` `compile` (case 2c → `Unparsed` persists; runtime ordering reads `PipelineStageBinding` declaration order via `ordered_pipeline_stages`; `fn compile` body is the human-readable pipeline contract; compile-body vs binding reconcile suspended per PR #1171 until a structural witness — bridge shape, scheduled until derivation collapses the two authored carriers to one)**. Invariant `pipeline_stages_lower_to_external_realization_not_unparsed` derives stage names from `pipeline_compile_order_stage_names()` (same authority as bootstrap; excludes `compile` itself). Intentionally **does not** canonically document substrate accessor `Unparsed` semantics (see deferral below). **Scheduled deletions:** `ArrowBody::Unparsed` is **split into three rows** (case 1 vs `compile` 2c + reconcile bridge vs DB-14 interim) in §Scheduled deletions — the M2 grammar milestone removes **case 1**; **2c** dissolves when derivation collapses the `compile` body and bindings to a single authored source; accessor interim has its own trigger.
 
 **Deferral: E-9 substrate accessor bootstrap rewrite (substrate, DB-14 follow-on).** DB-14 substrate accessor callables currently keep `ArrowBody::Unparsed` through bootstrap; emitters pair accessor declarations with per-target realizations via `SubstrateAccessorBinding` (see `bootstrap.rs` DB-14 comment — target-specific realization choice cannot collapse to one id at `Dag::new()` without a redesign). **`INVARIANTS.md` §E-9** requires that external realization appear only as `ArrowBody::ExternalRealization(ref)` on the Arrow, to a target-neutral marker, with per-target specs resolving from that marker — no second “externality” channel. **Dissolution trigger:** a follow-up PR extends bootstrap (or one materialization pass) to rewrite accessor Arrow bodies from `Unparsed` to `ExternalRealization(accessor_marker_id)` for each declared substrate accessor, preserving multi-target resolution through the marker + spec tables (structurally parallel to `materialize_pipeline_realizations`). Until that lands, DB-16 and `parse.rs`/`dag.rs` DB-16-scoped comments avoid framing accessor `Unparsed` as a second legitimate steady-state meaning alongside parse lag. Design: [design-substrate-external-primitives.md](docs/design-substrate-external-primitives.md) (DB-14), E-9.
 
@@ -12,7 +12,7 @@ Collected receipts and reconciliation notes moved out of [ROADMAP.md](../../ROAD
 |---|---|---|---|
 | `ArrowBody::Pending` | M3 ratchet | Every realization arrow bound to `ExternalRealization` | **Lens** — writable now; walk `d.nodes` for Arrow declarations with `body = Pending` reachable from user-range roots |
 | `ArrowBody::Unparsed` (**case 1** — `FnExternalBody` parse lag in std/) | M2+ parser surface | Match / pipe / lambda / block-body parsing so `FnExternalBody` lowers away | **Lens** — user-range + applicable std/ per R14; ratchet fires when block bodies become `SurfaceExpr` |
-| `ArrowBody::Unparsed` + `reconcile_with_compile_body` bridge (**case 2c** — `pipeline.dag` `fn compile` body vs `PipelineStageBinding` order) | Derivation: one carrier authored, the other emitted at regen/emit so there is only one authored surface | Requires a regen/emit path producing the `compile` body from binding order (or an inverse substrate making `compile` the sole authored carrier with bindings derived) | **Runtime reconcile today** — `reconcile_with_compile_body` in `pipeline_authority.rs` fails closed on drift; clears when the two carriers are unified to a single authored source |
+| `ArrowBody::Unparsed` + case **2c** bridge (`pipeline.dag` `fn compile` body vs `PipelineStageBinding` order) | Derivation: one carrier authored, the other emitted at regen/emit so there is only one authored surface | Requires a regen/emit path producing the `compile` body from binding order (or an inverse substrate making `compile` the sole authored carrier with bindings derived) | **Runtime reconcile suspended (PR #1171)** — `ordered_pipeline_stages` is binding-order only until a structural compile-body witness exists; clears when the two carriers are unified to a single authored source |
 | `ArrowBody::Unparsed` (**DB-14 accessor interim**, pre–E-9) | E-9 bootstrap materialization | **Deferral: E-9 substrate accessor bootstrap rewrite** below — `ExternalRealization(marker)` on `Arrow.body` | Clears with that deferral (not the case-1 lens) |
 | `ValueBody::Unparsed` | M2+ parser surface | Record / map / list literal parsing | **Lens** — writable now; walk `data` declarations |
 | `TransformTarget::Operator` | M2+ parser surface | Operator desugar into algebra-field calls | **Lens** — writable now; walk Transform targets |
@@ -23,7 +23,7 @@ Collected receipts and reconciliation notes moved out of [ROADMAP.md](../../ROAD
 | `encoding_meet` / `encoding_join` (Rust fns) | Track 8 Phase 2 (user-defined generic emission) | User-defined generic emission for `Lattice<Encoding>` instance | **Compiler-source ratchet** (temporary; becomes lens-able when compiler.dag self-hosts and emission-generated code replaces these hand-written fns) |
 
 - **`ArrowBody::Pending` lens-name-filter follow-up (#518) is cleared on PR #548.** The remaining anonymous operator-fallback site was reclassified to `ArrowBody::NoBody`, and `lens_structural_resolution` now keys on surviving `Arrow(Pending)` structurally rather than through a `Declaration.name` proxy. The scheduled-deletions row above stays live until the variant itself is removed; this follow-up only cleared the false-positive/false-negative gap around anonymous arrows.
-- **`ArrowBody::Unparsed` is three stories, not one.** DB-16 / PR #524 (and PR #637 structural-read cleanup): **case 1** (parse lag, M2 grammar, lens ratchet) is separate from **`pipeline.dag` `compile` (case 2c)** — runtime ordering is structural (`PipelineStageBinding` declaration order via `ordered_pipeline_stages`); the `compile` body is the human-readable pipeline contract, fail-closed reconciled against the bindings (`reconcile_with_compile_body`); 2c is still debt in bridge shape (two authored carriers, reconcile is the behavioral bridge) until derivation collapses it to a single authored source — and from **DB-14 accessors** (interim `Unparsed` until the **E-9** deferral lands). The M2 milestone deletes case-1 uses; it does **not** delete the `compile` body carrier or accessor interim encoding.
+- **`ArrowBody::Unparsed` is three stories, not one.** DB-16 / PR #524 (and PR #637 structural-read cleanup): **case 1** (parse lag, M2 grammar, lens ratchet) is separate from **`pipeline.dag` `compile` (case 2c)** — runtime ordering is structural (`PipelineStageBinding` declaration order via `ordered_pipeline_stages`); the `compile` body is the human-readable pipeline contract; fail-closed reconcile is **suspended** (PR #1171) until derivation; 2c is still debt in bridge shape (two authored carriers) until derivation collapses it — and from **DB-14 accessors** (interim `Unparsed` until the **E-9** deferral lands). The M2 milestone deletes case-1 uses; it does **not** delete the `compile` body carrier or accessor interim encoding.
 - **`declaration_by_name` is a helper name, not a single debt class.** The function at `dag.rs:1459` has 83 call sites that split into distinct classes with separate dissolution paths. [DB-17 (reference-resolution provenance)](docs/design-reference-resolution-provenance.md) narrows its scope to **only the user-range AtomPayload fallback class** (lowering produces `ResolvedByName(id)` when a structural walk falls back to name lookup). DB-17's lens walks user-range AtomPayloads; compiler-internal call sites (bootstrap substrate_markers in `dag.rs`, pipeline authority wiring, emitter algebra lookups in `emit_go.rs`/`emit_python.rs`) are a separate compiler-source class that dissolves at self-hosting (or via per-site substrate amendments — e.g., substrate_markers becoming typed edges rather than name-keyed caches). Keying the scheduled deletion to the helper name conflates these.
 - **`Node.name` cluster**: closed in the current v3 compiler/substrate. The old generic `Node.name` carrier is gone; surviving `name` fields are declaration names and `BindNode.name`, which are distinct facts. Some older design docs still describe the deletion as in-flight; treat those as stale prose, not live debt.
 - **`keyword_to_name` (recon outcome 2026-04-17, no row added):** the bare `keyword_to_name` was renamed to `tok_keyword_to_name` during v2 Phase 0 parser restructure — see `src/v2/parser-design.md:403-408`. The new name still carries the scaffold (parser-side keyword-name logic that duplicates facts from the tokenizer's `SyntaxSpec`), but it lives in `src/v2/02_parse.dag:455` and `src/v2/stage0/src/v2_compiler_parse.rs:1321` — **v2 code**, not v3. Grep confirms zero equivalents in `src/v3/`. V2 is the reference-implementation / test oracle per `ROADMAP.md` §"Sketch vs Oracle framing"; v2 scaffolds dissolve when v3 supersedes v2 entirely, not individually. The v3 Scheduled Deletions list tracks v3-scope scaffolds only.