MQ-1 PR-1: a caret symbol in value position refuses at the caret instead of lowering to its ^ token

[gunbai-bot]

MQ-1 PR-1 (of two). This fixes a live §5 defect on main: a caret symbol (^name) in value position lowered silently wrong. This PR makes it refuse, located at the caret. PR-2, the symbol-literal slice (a lexeme stamp plus a LitSymbol atom), flips exactly this refused population to a faithful lowering.

What main does today (measured, not inferred)

fierce-gull-556 ran a seed-interpreted probe of tokenize → parse → normalize on main b1b7aea (branch probe/snappy-swift-136-mq1-caret @ 2349f53 and 0ee714d):

• Refuses at normalize with body_lowering_reason_operator_operand_unread: a bare operand used as a whole body. Specimens are v2.std.grammar formal_binding_is_free_name_slot and formal_binding_is_lexeme_stamp_slot, and v2.std.compilers.target_model target_model_bundle_core_keep_edge.
• Accepts, silently wrong: v2.std.compilers.target_model ordering_predicate_from_wire_symbol (if id == ^ordering_predicate_is_less {..} else if id == ^ordering_predicate_is_less_or_equal {..}). Its tree carries ^dag_token_caret and neither symbol, so both conditions became id == ^: two different symbols, one node.
• The same silent drop in all ten value positions: named argument, positional argument, let value, whole body, data initializer, field initializer, match-arm body, match scrutinee, if-branch value, list item.

The single cause is the first-atom fallback in v2.compiler.body_lowering_fold body_lower_primary_expr, which answered the caret sequence seq(^, name) with its ^ token.

The change

• body_lower_caret_symbol_token_optional recognises the caret shape by its left terminal. The first-atom fallback in body_lower_primary_expr, and only that fallback, now refuses it with a new, distinct cause body_lowering_reason_caret_symbol_not_lowered, anchored at the ^ token.
• A bare x == ^sym unifies on the new cause. On main it refused as operator_operand_unread. Its operand now reaches the same fallback, which was measured: a pin asserting the old cause ran red. So every caret refuses with one cause at the caret, and PR-2 flips one countable population. v2.test.claim.namespace_xl0.call_argument_value_resolve_refusal a_caret_symbol_operand_refuses_at_normalize is flipped to the new cause in this PR.
• v2.workflow.compile_door_cause_ownership: a FatalGrain row for the new cause (lane SharedSelfHostCriticalPath, flip trigger caret lowers to LitSymbol), so the native lane gains no unattributed refusals.
• RFM caret_symbol_has_no_lowered_form records the observed below-floor instance.
• New RFM reference_conservation_population_omits_class_stamped_terminals explains why the conservation instrument could not see the drop. Its population admits only atoms whose identity is not a declared token class. The caret's name terminal is class-stamped as ^dag_token_ident, so the dropped symbol was never a member. The drop was invisible by construction, not missed by the comparison. The next-rung trigger is PR-2's lexeme stamp.

Controls

v2.test.claim.body_lowering.caret_symbol_value_refusal calls the producers directly (tokenize → parse → normalize) over one declaration each:

• 10 claims, one per value position: each refuses with caret_symbol_not_lowered and is anchored at ^dag_token_caret. The if-condition specimen is the real ordering_predicate_from_wire_symbol, trimmed to two arms.
• Positive control: the same if-chain with int literals still normalizes, so the refusal belongs to the caret and not to the if-chain.
• Pin: the bare operand refuses with the same cause at the caret.

Population and BASE-vs-HEAD

File census: neat-boar-16 ran it on srv1 with the self-host driver in census mode. Both arms completed. Per-file rows are on srv1 in ~/nb16-tmp/ct_{base,pr}.pf.

• BASE main b1b7aea: 2706 file refusals. HEAD 738eb88: 3152.
• Newly refusing: 446 files, all body_lowering_reason_caret_symbol_not_lowered. No new refusal has any other cause.
• No longer refusing: none.
• Relabelled to the caret cause: 288 files that already refused now surface the caret first: call_argument_unread 234, value_unlowered 26, operator_operand_unread 23, wrapper_retention_not_normalized 4, type_annotation_not_carried 1. No other cause relabels.
• So 734 files now carry the caret cause, and nothing else moved. PR-2 flips exactly this population.

Claim run (base vs head): neat-boar-16 ran it on srv1 with gunbc run --claim-run over every test fn of 23 claim modules. The modules were found by what they consume (the relabelled causes, the caret shape or cause, the ownership table, conservation, or a normalized fixture containing a caret), not by the files this PR touches.

• BASE b1b7aea: 352 verdicts, 347 pass, 5 fail. HEAD 738eb88: 365 verdicts, 360 pass, 5 fail. The 13 extra verdicts are the new module.
• TRUE→FALSE: none. FALSE→TRUE: none. The same five claims fail on base and head, so none of those failures come from this PR. The flipped a_caret_symbol_operand_refuses_at_normalize passes on both: the old cause on base, the new one on head.
• At cd51f40, the only change is caret_symbol_value_refusal plus the share-roster row, and that module was rerun: 13/13 PASS (212.9 s wall, 7.8 GB maxrss for the whole load).

Ordering with the native frontier ratchet (#12184)

gunbc.native_frontier_ratchet has no declared disposition for new debt: an added refusal is only ever a FrontierLost finding. Today the roster is RosterUnminted, so this PR edits no roster. The first mint must land after this PR, so these refusals are minted as owned baseline debt. If the mint lands first, the next nightly reads them as FrontierLost with no admitted path. gentle-koi-724 has told zesty-otter-346 and neat-boar-16. The missing disposition for a correctness flip that grows debt is a gap for that lane to model.

Evidence status

• The first floor run at 738eb88 failed as floor_class=structural. The cause was inferred, since the logs were unreadable during the GitHub token outage: each of the 13 caret claims ran its own full tokenize → parse → normalize, far over the new-witness step budget. cd51f40 computes the verdicts once in one producer, csv_verdicts, enrolled warm in v2.workflow.floor_pure_producer_share beside cav_outcomes. Each claim reads its own field. Assertions are unchanged.
• Claims, seed-interpreted by fierce-gull-556 at head 738eb88 in a clean worktree, with gunbc run --source-root dag --source-root src/v2 --entry <module> --claim-run:
  • v2.test.claim.body_lowering.caret_symbol_value_refusal: 13/13 PASS (221 s).
  • v2.test.claim.namespace_xl0.call_argument_value_resolve_refusal: 21/21 PASS (290 s), including the flipped a_caret_symbol_operand_refuses_at_normalize.
  • At 39ab5c0 the old-cause pin ran red (12/13). That is the measurement that established the bare operand unifies on the new cause.
• No dag/std edits, so no stage0 regen.

🤖 Generated with Claude Code