Seed infer joins a service receiver by owner module + name; a same-named import refuses at the receiver

[gunbai-bot]

What

Seed (v1) infer joined a service receiver to the service registry by bare name, so import std.resources { Filesystem } (a resource: write -> written) silently got extdeps.filesystem.filesystem_io's service Filesystem (Write -> success, bytes_written, path, error). Receipt: #12185 runner_guest_image. This is the fourth specimen and the next rung of gunbc.recurring_failure_mode surface_shorthand_preempts_resolved_identity.

Earliest unjustified boundary (§6b)

The problem was not only the bare-name key. build_module_context's census fold seeded every bare-declared service in the closure into every module, both as a registry row and as a root local. local_is_service_root_binding had no way to see owners, because a module could reach a service it never imported. The repair is made where scope is built:

• Scoped registry and roots. A bare-declared service (namespace root == name) is in a module's scope only when the module declares it or imports its owner by that name. The deciding functions are v1.compiler.infer census_service_in_scope for the census fold and imported_service_in_scope for merge_scope_from_imports. The join is therefore on declaration identity, owner module plus name.
• Receiver refusal, no fallback. New CompilerDiagnostic ServiceOwnerMismatch { name, service_owner, bound_owner, span } blocks at the receiver's span (service_owner_mismatch_refusal). It fires where a receiver would have reached the old join through another module's same-named explicit import.
• Collisions are decided by position, not order (agreed with neat-boar-16). When the service and a same-named import are both in scope:
  • if the other declaration is a value (fn or data), there are two values under one name, and every receiver read refuses;
  • a type or resource does not compete. A resource is a value only through a uses binder, which is a body local judged by its own type.
• Dotted services (shell.Exec, git.*, …) are keyed by dotted name, never reach this bare-name join, and are not scoped here.

Evidence (executed locally with the seed built from this branch's regenerated mirror)

test.claim.service_owner_identity_witness, one-axis producer over the real same-named pair:

test	unchanged seed	this branch
the_imported_service_write_is_accepted: service import, Filesystem.Write, reads .success, 0 blocking	true	true
the_resource_homonym_write_refuses_at_the_receiver: resource import (service in closure, not in scope), exactly 1 ServiceOwnerMismatch/Filesystem	false	true
two_values_under_one_name_refuse_at_the_receiver: designed pair test.fixture.service_owner_identity.{service,value}	false	true
a_resource_beside_the_imported_service_does_not_collide: both imported, uses fs: Filesystem + service Write; 0 mismatch, Write exists	—	true
importing_the_resource_alone_is_not_refused	true	true
an_unimported_service_is_not_reached_by_its_bare_name (control, unchanged: undefined variable)	true	true

• Regen: claim_executor --required-regen gives first_generation_equal=true for the installed mirror. --required-regen-fixed-point gives fixed_point_equal=true. The drift was exactly v1_compiler_emit.rs, v1_compiler_infer.rs, v1_std_core.rs. The hand-authored cli_run/compile_clean.rs gains the class and subject arms.
• Floor strict-preparation, this branch: completed, 0 errors, modules_resolved=2134.
• runner_guest_image control: it already imports extdeps.filesystem.filesystem_io { Filesystem } (One HTTP method set, homed at its upstream: extdeps.ietf.http_semantics #12185), so its receiver resolves to the service's owner. It is in the prepared closure and resolves clean.

Census: every site that loses the bare-name join

Found by a static scan: bare-declared-service receivers Name.Op( in modules that neither declare nor import the owner by name. The executed census is the scoped floor: with the repairs reverted, strict-preparation refused at dag/test/claim/spark/pair_serving_authority_log_real_execution_witness_test.dag:392 ("method 'Write' cannot be resolved: receiver type 'Primitive(std.resources.Filesystem)'") and stops at the first refusal. Every site below means the service (each reads .success, .content, .entries, .ok), so each is repaired by importing the owner:

• Wrong owner: a resource or type was imported, and the service was taken by spelling.
  • gunbc.runner_attempt_launch, gunbc.runner_microvm_cell_readiness_store, gunbc.runner_microvm_lifecycle_realize: std.resources { Filesystem } replaced by the service import.
  • gunbc.runner_microvm_slot_controller: keeps std.resources { Filesystem } for its uses requirements, and adds the service import.
  • test.claim.filesystem_write_witness: v2.extdeps.file_system { Filesystem } (a type) replaced by the service import.
  • test.claim.filesystem_list_hermetic_witness_test: drops the unused v2.extdeps.file_system { Filesystem }; it already imports filesystem_io.
• Missing import:
  • Filesystem: gunbc.roadmap_served_observation, gunbc.runner_microvm_boot_probe, gunbc.scm.repository_load, gunbc.srv3_os_install_actuate, gunbc.tools.card_intake, test.claim.emit_host_typed_smoke_test, test.claim.filesystem_write_closure_scale_witness, test.claim.spark.pair_serving_authority_log_real_execution_witness_test, test.claim.tailscale_acl_witness_test, test.fixture.effect_reach_conjunction.host_sink_provider, v2.test.claim.complexity.accumulator_copy_unreadable_subject_test.
  • Urandom: gunbc.plans.blackjack_onboarding, test.claim.random_bytes_csprng_witness_test.
  • Clock: test.claim.clock_freshness_witness.
  • GovernedUniversalProbe: test.claim.m4_universal_corpus_witness.

Recorded, not fixed

• RFM residual (on surface_shorthand_preempts_resolved_identity): runner_microvm_slot_controller still spells Filesystem for two declarations. It is unambiguous by position, but it is still a §3 meaning fork. Trigger: qualified or aliased import references.
• Next step, a separate PR: scope the dotted service root locals (shell, git, github, …) to imports and declarations. Its census should be the refusals on a scoped build, not a heuristic count.
• Refusal class for unimported bare names: a bare Filesystem with no import resolves by global uniqueness to std.resources.Filesystem. Write then refuses as MethodExistenceUndecided at the receiver: typed and located, but not ServiceOwnerMismatch, since no explicit import states the other owner.

🤖 Generated with Claude Code

[gunbai-bot]

Pushed 7083849 for the floor red on 84eabd5.

Cause. Adding the service-owner import gave several previously import-less modules their first import. A module with no imports reaches other modules' declarations by bare name; once it has an import, that no longer applies. test.claim.tailscale_acl_witness then pulled extdeps.tailscale.acl in under strict judgement. That exposed two real defects there: List.first()'s Optional was passed where a TailscaleGrant or List was declared. Each is now eliminated with a match; the Absent arm is false, which the existing length == 1 guard already implies.

Repair. Of the repaired modules, eight had no imports at base. The ones with bare cross-module calls now name the imports they used: tailscale_acl_witness, srv3_os_install_actuate, random_bytes_csprng_witness_test. The lists were derived from the resolver's own "effect summary incomplete" refusals and re-run until each module resolves; the other five already resolved. The tailscale witness returns true on the rebuilt seed.

Merge. main is merged and the mirror regenerated on it: first_generation_equal=true, fixed_point_equal=true.

Unrelated, still red. gunbc.runner_microvm_lifecycle_realize (systemd.Journalctl, a dotted service it never imports) fails identically on the unchanged seed. It is pre-existing and outside the gate closure, not this PR.

— sent from wise-lynx-177

[gunbai-bot]

Receipt for the hand-Rust census_single_service_owner in cli_run.rs (review 71175, advisory):

• Why hand Rust at all. It is not a new route. The bare-reference closure (bare_reference_closure resolve loop) is existing hand-authored host code that already read census.services at two sites with .map(|entry| entry.module_path). This PR changes SymbolIndex.services in v1.compiler.infer_env from one entry per name to every declaration of that name. Those two reads had to adapt, and the helper is that adaptation, written once instead of twice.
• What it replaces. A single-owner projection that, under the new type, would have had to pick an element: the order-dependent join this PR exists to remove. It decides zero, one, or many over the whole set. The many case refuses by name, mirroring the neighbouring closure_bare_disposition AmbiguousOnChain refusal.
• Deferral. It lives and dies with the bare-reference closure, which is seed host code under gunbc.v1_maintenance_standing v1_seed_standing. No new seed surface is added beyond the reader's own shape change.

— sent from wise-lynx-177