v2: anonymous '_' parameter slots lower to minted, unwritable per-slot binders; retire #12287's interim refusal

[gunbai-bot]

Child of gentle-koi-724 (MQ pass). Shape approved by neat-boar-16 through gentle-koi-724, including D1 (see below). Retires the interim refusal from #12287.

Defect

v2's function domain is a Conj keyed by name. fn f(_: A, _: B) therefore lowered to two Named { _ } edges, and a Conj can't carry two edges with the same label. v1 accepts this signature (v1.compiler.infer direct_call_shape_wall_note). The gen-two census specimens are std.key_relation global_key_scope_eq and gunbc.provider_readiness_claim_evidence provider_readiness_independence_claim. #12287 made them refuse at a located point under body_lowering_reason_arrow_domain_anonymous_param_repeated, as a v2-behind-v1 frontier.

Construction

• v2.std.anonymous_binder (new) has one mint, one recogniser and one producer:
  • The mint, anonymous_param_label(slot), produces <anonymous-parameter-N>. That spelling is not a dag identifier, so no body mention, named argument or field can write it. This follows the declaration_reference_marker (Resolver-minted declaration references carry an unauthorable marker; the reader never keys on the spine shape a literal also has #12220) and type_params_marker (v2 type binders: a type declaration's <T> rides on its member under one unauthorable edge (trigger 1) #12240) precedent.
  • The recogniser is is_anonymous_param_label.
  • The producer is anonymous_binder_mint_domain. It is the only place a parameter's authored _ spelling is read.
• N is the slot's 1-based position within its own binder list (D1, ruled). It is never a module-wide or walk-order counter, and never an occurrence id. The label is part of the Arrow's type: an occurrence-derived label would give fn(_: Int) a different type and a different content_hash at every site, and any edit above a site would rename it (§4c). The slot's occurrence stays on the edge target, where it already was.
• Body lowering: body_lower_param_edges mints once over the whole parameter list. Two functions read through it: the domain builder, body_lower_domain_from_param_list, and the ingest-side check list, body_lower_param_binding_symbols_from_param_list. They therefore still agree.
• Resolve: a _ in value position never finds a binder, because none can spell the minted label. It refuses under the new cause resolve_reason_anonymous_parameter_referenced, located at the mention's own authored occurrence and not at the slot label. Pattern wildcards are unchanged.
• Reference conservation: the pool now keys on the minted identity, not the spelling. Each minted label adds one copy of the anonymous-slot class (anonymous_slot_pool_key), and each authored _ parameter consumes one. So two _ are conserved, and an extra one is still a DroppedReference. This retires the spelling match that fierce-gull-556 recorded on lambda_has_no_lowered_function_value_form.
• Emit: every bound-token spelling goes through bound_spelling_from_map. A minted label is spelled as its authored source, _, and never as its marker text.
• Interim refusal removed: the anonymous arm of body_lower_fn_signature_bindings_refusal, its CorrectionNotModeled branch, its compile_door_cause_ownership FatalGrain row, and its claim, which is now restated as an accepted control. The named-repeat arm stays.

Census: every reader of domain labels, and what happens to it

Reader	Disposition
body_lowering body_lower_param_binding_optional / typed_param_edge / collect_param_edges	unchanged; the mint runs over their output
body_lowering domain_from_param_list, param_binding_symbols_from_param_list	read through body_lower_param_edges (the mint)
body_lowering arrow_domain_matches_ingest_param_bindings, arrow_domain_matches_frontend_symbol_index	unchanged; both sides are minted, and a minted label is a path segment
body_lowering body_lower_fn_signature_bindings_refusal (#12287)	anonymous arm removed
resolve add_arrow_domain_named_params, harvest_conj_named_bindings	unchanged; the minted label is bound, but no source spelling reaches it
resolve resolve_atom (unbound arm)	new located cause for _
resolve resolve_pattern_binders / pattern_field_target_walk (wildcard patterns)	unchanged
symbol_index_fill Arrow arm	unchanged; the paths are now distinct
infer infer_conj_named_type_for_binding / arrow_domain_type_for_binding	unchanged; lookups are now unique
infer infer_formals_from_domain	unchanged; formals are positional
inhabitance application_argument_does_not_inhabit_diagnostic	unchanged; the correction already carries the position edge beside the label
eval eval_bind_param_edge_step	unchanged; distinct keys fix a latent case where the second binding overwrote the first
target_model bound_spelling_from_map (reached by produced_decl_param_segment_tokens, 06_translate arrow params, closure param tokens)	minted label rendered as _
lenses wiring_liveness, fn_index_depth_agreement, effect_reach, live_read_classification	unchanged; they read FnArrowDecl.params, which the host marshals from v1, not v2 domain labels
lenses no_dual_representation scan, copied_port_derivation, unused_parameters	unchanged; they work over the symbol, by position, or by use
reference_conservation rebuilt_spelling_pool / pool_spelling_of	re-keyed on the minted identity
lambda / fn-literal params	on main they lower only through fold_lowering carrier atoms, not a domain. #12210 (held on a cost review) builds lambda domains with its own wildcard_primes scheme. Agreed with fierce-gull-556: whichever PR lands second routes that domain through anonymous_binder_mint_domain and deletes the primes scheme. #12210's fresh type-parameter name derives from the minted label.

Evidence (local gunbc built from b51b8ff7f49 in a private target dir, run over the merged head)

• v2.test.claim.anonymous_param_binder runs the production route (assemble_program_from_ingest). Its specimens are enrolled in floor_pure_producer_share. All four claims hold:
  • apb_two_anonymous_slots_are_accepted_as_distinct_binders: the program is Accepted and well formed, with labels [<anonymous-parameter-1>, <anonymous-parameter-2>].
  • apb_slot_label_is_the_position_in_its_own_binder_list: the same signature at two sites gives equal domain content_hash and equal labels, and fn h(x: Int, _: Int) gives [x, <anonymous-parameter-2>].
  • apb_body_reference_to_an_anonymous_slot_refuses_located: the cause is resolve_reason_anonymous_parameter_referenced, and the locus is an atom spelled _ with a non-synthetic occurrence.
  • apb_recogniser_separates_minted_from_authored.
• MQ: gen-two census residues: anonymous record return types lower; repeated names refuse at the second binding #12287's nfbcp_repeated_anonymous_param_refuses_at_the_second_binding_holds is deleted, not restated. A producer-interface restatement cost 72,941 eval steps against the 72,300 new-witness budget (floor run 36162778566), and apb_two_anonymous_slots_are_accepted_as_distinct_binders implies it. The rest of parse_test_fn_decl_return_clause is green.
• v2.test.claim.namespace_xl0.reference_conservation two_anonymous_parameter_slots_are_conserved_by_minted_identity_holds holds.

Mutations (each in its own tree copy):

Mutation	Result
M1: the mint ignores the slot (both slots get slot: 1)	the accepted, position and located-refusal claims turn false
M2: no mint (the pre-change state)	the same three turn false
M3: the conservation pool keyed by spelling	two_anonymous_parameter_slots_are_conserved_by_minted_identity_holds turns false

Pre-existing, not this PR: the_if_arm_call_argument_is_reported_dropped_holds, a_list_literal_call_argument_refuses_its_whole_module_holds and a_repeated_spelling_with_one_copy_dropped_is_exactly_one_row_holds are false on plain origin/main 69e0bb7566e with the same interpreter, and equally false here.

Not done / pending

• The two census files are not the evidence for _. The discriminating evidence is this PR's own claims and mutations above. Per-file conserved_normalize_of_text, run locally at 2e003a9 and read by neat-boar-16:
  • std.key_relation: still refuses with 11 conservation_reason_dropped_reference. None of them is _, and there's no not_well_formed or anonymous-param cause. The drops are field and argument labels (scope_of, key_eq, …), a separate conservation class that this PR does not fix.
  • srv1 control (neat-boar-16, each file alone): at the merge-base 69e0bb7566, std.key_relation refuses with body_lowering_reason_arrow_domain_anonymous_param_repeated. At this PR (3ba02dbf54) it moves past that cause to conservation_reason_dropped_reference, the separate class. provider_readiness_claim_evidence refuses with list_literal_unlowered on both arms, so it can't tell.
  • gunbc.provider_readiness_claim_evidence: stops at body_lowering_reason_list_literal_unlowered before its domain is lowered, so its _ behaviour is UNMEASURED.
• No per-target anonymous-parameter spelling. A target that admits only one _ per signature gets two, and its own compiler refuses them.
• The full floor is left to CI.

🤖 Generated with Claude Code

[gunbai-bot]

srv1 census from neat-boar-16 at 3ba02db, gen-one emit --entry for std.key_relation and gunbc.provider_readiness_claim_evidence. It found no anonymous_param or not_well_formed lines, but both runs refused first at dag/examples/weather/weather.dag with body_lowering_reason_call_argument_unread, the lambda class that #12210 is fixing. That zero only covers what ran before that refusal, so it doesn't yet show the two modules admit. A per-file rerun has been requested.

[gunbai-bot]

Addressed review 71324 in 2e003a9:

• Unused edge_is_anonymous_param: deleted. Nothing called it.
• Quadratic mint: anonymous_binder_mint_domain now conses and reverses once, so it's linear in the parameter count.
• Duplicate BodyLowered import: removed.
• Comment fix (my own): the recogniser's comment claimed wiring_liveness reads it. It doesn't, because that lens reads v1-marshalled params. The comment now names only the two real readers.

Re-ran locally: all four anonymous_param_binder claims pass, the whole of parse_test_fn_decl_return_clause passes, and the conservation claim holds.

Admission, local per-file run (conserved_normalize_of_text on each file, same interpreter):

• std.key_relation refuses with 11 conservation_reason_dropped_reference. The dropped atoms are description module_path decl_name scope_of key_of scope_eq key_eq state_of state_eq key_of key_eq. None is _, and there's no not_well_formed and no anonymous-param cause. The anonymous class is admitted; the remaining drops are field and argument labels, a different class.
• gunbc.provider_readiness_claim_evidence refuses first on body_lowering_reason_list_literal_unlowered (as MQ: gen-two census residues: anonymous record return types lower; repeated names refuse at the second binding #12287 noted on main), so this run can't tell whether its domain is admitted. I've sent the same debug module to neat-boar-16 for the srv1 run.

— sent from deep-heron-191