feat(v3): lower single-expression brace fn bodies with fallback

[briansrls]

Parser contract (explicit)

• Record bodies { field: expr, … } remain record bodies: they parse as SurfaceExpr::Record and lower on the normal record path (not coerced into FnExternalBody).
• Single-expression brace fn bodies on user .v3 (file.ends_with(".v3")) parse as one SurfaceExpr through the closing } and lower through UserDefined / the usual arrow pipeline.
• Unsupported / multi-statement brace interiors on .v3 preserve FnExternalBody: on parse_expr failure or trailing tokens before }, the parser rewinds and uses skip_brace_balanced → FnExternalBody (same carrier as the legacy staged-std path).
• Non-.v3 sources (dsl/std, src/v3/std, compiler/spec fixtures in the parse corpus, etc.) always take FnExternalBody + brace-skip so ArrowBody::Unparsed / bootstrap contracts stay stable.

Out of scope

• Lens<C> instance wiring, fold_lens, and broader lens runtime beyond what this slice needs for substrate / match lowering.

Fallback preservation — tests & ratchet (prior “parser blocker”)

Reviewers should not need to infer this from diff alone:

Role	Name
Parse surface (multi-let in .v3 brace fn stays carrier)	m1_substrate_test::m17_multi_statement_brace_fn_parse_surface_stays_fn_external_body
Lower (same shape → ArrowBody::Unparsed)	m1_substrate_test::m17_multi_statement_brace_fn_in_v3_falls_back_to_unparsed_arrow
.dag corpus (never expression-parsed for brace fn)	m1_substrate_test::m17_dag_corpus_brace_fn_stays_fn_external_body_at_parse_time
Malformed probe (parse_expr Err, e.g. { x + })	m1_substrate_test::m17_malformed_brace_expr_probe_err_maps_to_fn_external_body

Also: m17_brace_bodied_fn_parses_single_expr_to_user_defined_arrow_body, prereq2_brace_fn_match_returns_bare_variant_constructors, prereq2_brace_fn_optional_diagnostic_bare_variant.

Local verification

cargo run -p v3-compiler --bin regen_parse --locked
cargo test -p v3-compiler --test integration sg2_parse_authority_test::parse_generated_module_matches_checked_in_snapshot -- --nocapture
cargo test -p v3-compiler --test integration parse_stage4_prep::handwritten_parse_snapshot_matches_manifest -- --nocapture
cargo test -p v3-compiler --test integration m1_substrate_test::m17_multi_statement_brace_fn_parse_surface_stays_fn_external_body -- --nocapture
cargo test -p v3-compiler m17_ --
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify

Parse manifest refresh (when the gated corpus output changes): cargo test -p v3-compiler refresh_handwritten_parse_snapshot_manifest -- --ignored then commit the manifest delta (see history: 8411d9236).

Known gap / follow-on

• Witness<Int> + Inhabits(...) as an explicit fn return still fails return-type discharge for = and { … } in a minimal repro — infer/discharge lane, not this PR; no false-green Witness test here.

Doc touchpoints

• dag.rs — ArrowBody::Unparsed notes .v3 vs .dag parse surface.
• lower.rs — user scaffold comment references fn_brace_body_parse_as_expression.

[briansrls]

Re: REQUEST_CHANGES — Err(_) → FnExternalBody swallows malformed { x + } (manual @ 8f5e398a)

Valid (for the unconditional Err arm). Fixed by KwLet-first discrimination in parse_parser_body.txt / regen_parse (fn_brace_body_expr_err_falls_back_to_external): parse_expr Err only falls back to FnExternalBody when the first token inside { is let (multi-statement scaffold — same Err shape as today). Any other parse_expr failure propagates at parse time (P3 / early diagnostic for malformed single-expression probes like { x + }).

Tests: m17_malformed_brace_expr_probe_returns_parse_error asserts ParseError + compile_to_dag → CompileError::Parse. Multi-stmt / R14 tests unchanged in intent.

Tip: 4a9ea9ba6 (includes comment sync + integration test rename); parser gate logic is on the pushed branch with regen_parse output matching.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 4a9ea9ba · Trigger: schedule
• Comparison: origin/main @ 86961089 ... review/pr-1248-4a9ea9ba @ 4a9ea9ba
• Thinking: 149s wall

---

Verdict: APPROVE

No findings. The diff keeps the new brace-body behavior scoped to user .v3 parsing, preserves .dag authority corpus behavior, and maintains fail-closed handling for malformed probes and user-range Unparsed scaffolds.

Verified with:
cargo test -p v3-compiler --test integration m17_ -- --nocapture
cargo test -p v3-compiler --test integration prereq2_brace_fn -- --nocapture
cargo test -p v3-compiler --test integration m18_r14_user_block_bodied_fn_is_rejected -- --nocapture

[briansrls]

Triaged (scheduled codex @ 4a9ea9ba) — APPROVE

Verified on tip 4a9ea9ba6: Re-ran the reviewer’s three filters — m17_ → 16 passed; prereq2_brace_fn → 2 passed; m18_r14_user_block_bodied_fn_is_rejected → ok. Matches the review’s read: .v3 gate + .dag preservation + malformed parse propagation + R14 user Unparsed gate.

No further code change from this review item.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 4a9ea9ba · Trigger: schedule
• Thinking: 285s wall

---

BLOCKING (1)

Root Cause

• src/v3/compiler/parse_parser_body.txt Fn brace-body parsing reused the data-body record lookahead instead of the record parser’s actual accepted label/empty shape → add a fn-body-specific record predicate, cover {} and type: fields, and regenerate parse_generated.rs.

⚠️ One valid single-expression brace-body shape is still rejected at the parser boundary.

[briansrls]

Invariant violation: BLOCKING: The new fn-body record gate reuses looks_like_record_literal(), whose lookahead excludes empty records and type: field labels even though parse_record_literal accepts them, so valid brace-bodied record returns are rejected before lowering (Facts Flow Forward / boundary sufficiency).

[briansrls]

Re: inline review @ m1_substrate_test.rs:384 — compile_any vs R14 / compile_to_dag

Invalid on current tip (4a9ea9ba6). That line is now the fixture src string, not a compile_any call. m17_multi_statement_brace_fn_in_v3_falls_back_to_unparsed_arrow uses compile_to_dag, asserts result.is_err(), unwraps CompileError::Semantic(dag), then asserts ArrowBody::Unparsed — see m1_substrate_test.rs:384-402. Comments at 380–383 explicitly warn not to use compile_any here (R14 / scaffold fail-closed).

The relay text matches an older revision before 14a228aa8.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: 4a9ea9ba · Trigger: manual
• Comparison: main @ 86961089 ... session/calm-hawk-173 @ 4a9ea9ba
• Conversation: View conversation

---

1. Story of the diff

This PR narrows the old “brace-bodied fn is always opaque” scaffold into a split path. For user .v3 files, parse_fn_item now treats a brace body as either a record literal or a single complete SurfaceExpr, lowering successful cases to ordinary SurfaceItem::Fn / ArrowBody::UserDefined; for staged authority .dag files, the parser keeps the legacy FnExternalBody brace-skip behavior so bootstrap/std snapshots remain stable (src/v3/compiler/src/parse_generated.rs:563-685, mirrored in src/v3/compiler/parse_parser_body.txt:528-633). The fallback is bounded: multi-statement or non-single-expression bodies still become FnExternalBody/ArrowBody::Unparsed, and user-range lowering still rejects those opaque bodies at the semantic boundary (src/v3/compiler/src/lower.rs:169-188). The tests update the old scaffold expectation into a new set of behavior receipts: single-expression user brace functions lower to UserDefined, .dag corpus functions stay opaque, multi-statement .v3 bodies fail closed through the unparsed-body rejection, malformed expression probes produce parse errors, and constructor/match fixtures prove the user-visible expression path handles the intended variant-constructor cases (src/v3/compiler/tests/integration/m1_substrate_test.rs:298-343, 343-458, 1139-1172, 2573-2622).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

N/A — this is parser/lowering implementation and documentation over existing substrate shapes; it does not introduce a new Dag-resident type, field, or variant. The ArrowBody::Unparsed docs are updated to describe the parser split, not to change the substrate contract (src/v3/compiler/src/dag.rs:698-704).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — fail-closed is handled at the relevant boundaries: non-.v3 authority inputs stay on the known scaffold path, user .v3 single expressions become real bodies, malformed non-let probes propagate Err(diag), and user-range opaque bodies remain rejected by lowering (src/v3/compiler/src/parse_generated.rs:608-685, src/v3/compiler/src/lower.rs:169-188). The diff avoids fabricating a plausible expression body when parsing fails.

1. CODING.md.

Compliant — the new helpers are small, named for the predicate they answer, and their dependencies are explicit on Parser state: fn_brace_body_parse_as_expression reads self.file, while fn_brace_body_expr_err_falls_back_to_external reads a token position and returns a boolean decision (src/v3/compiler/src/parse_generated.rs:571-584). The generated parser and parser body source are kept in sync.

1. TESTING.md.

Compliant — the added tests are behavior-driven around the changed interface: parse-surface behavior, lowering result shape, semantic fail-closed rejection, and malformed parse error are each pinned separately rather than bundled into one broad “works” test (src/v3/compiler/tests/integration/m1_substrate_test.rs:298-343, 343-458, 1139-1172). Integration-level coverage is appropriate here because the feature spans parse → lower → strict user-range validation.

1. LOCKED DESIGN DECISIONS.

N/A — I do not see this PR altering a locked design decision. The only design-sensitive note preserves the existing authority .dag/bootstrap behavior until a dedicated regen opt-in (src/v3/compiler/src/dag.rs:698-704).

1. TRACKED vs UNTRACKED DEBT.

Compliant — the remaining temporary split is documented, bounded, and has a named dissolution trigger: authority .dag sources keep brace-skip/FnExternalBody for bootstrap byte stability, bounded to staged corpus inputs, “until a dedicated bootstrap regen lane opts the corpus in” (src/v3/compiler/src/parse_generated.rs:563-570). That is a tracked bridge rather than an unbounded TODO.

3. Verdict

APPROVE. The PR advances user .v3 brace-bodied functions without changing substrate shape, preserves the authority corpus path deliberately, and adds focused regression coverage for the new parser/lowering split and fail-closed fallback behavior. I did not find a diff-line-backed blocking or non-blocking issue.

[briansrls]

Re: BLOCKING — fn brace-body record lookahead / rejected valid shapes (4a9ea9ba relay)

Valid for { "key": expr }: Brace-fn .v3 routing only consulted looks_like_record_literal then parse_expr. String-keyed map bodies match looks_like_map_literal in parse_data_item but had no map lane on fn, so they fell into parse_expr → parse_primary → parse_record_literal, which rejects string field labels — a real parse hole.

Fix (pushed 687ce433d):

• fn_brace_body_looks_like_record_literal — thin, documented hook so the fn-brace record gate stays explicitly tied to parse_field_label / parse_record_literal (incl. type: via existing soft-keyword lookahead in looks_like_record_literal).
• else if self.looks_like_map_literal() → parse_map_literal() — same disambiguation sibling as parse_data_item.
• Tests: m17_brace_fn_body_accepts_type_labeled_record_literal, m17_brace_fn_body_accepts_string_keyed_map_literal.
• regen_parse.

— sent from calm-hawk-173

[briansrls]

Re: inline @ parse_parser_body.txt:611 — looks_like_record_literal “excludes {} / type:”

Invalid — the predicate already includes both shapes. looks_like_record_literal returns true for LBrace + RBrace (empty record) and for LBrace + (Ident(_) OR soft_keyword_ident_spelling(..)) + Colon, where soft_keyword_ident_spelling includes KwType → "type" (same entry set as parse_field_label). See 258:273:src/v3/compiler/parse_parser_body.txt.

fn_brace_body_looks_like_record_literal is an intentional delegating hook (see 556:561:src/v3/compiler/parse_parser_body.txt) so brace-fn stays one lookahead with parse_data_item / parse_record_literal.

Receipts on branch: m17_brace_fn_body_accepts_empty_record_literal, m17_brace_fn_body_accepts_type_labeled_record_literal, m17_brace_fn_body_accepts_string_keyed_map_literal (map lane is separate looks_like_map_literal).

Doc hygiene (pushed e0fdfe0ff): The old comment above looks_like_record_literal read like { Ident : only; updated to match the actual implementation so this relay class does not recur from stale prose.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: 687ce433 · Trigger: schedule
• Comparison: origin/main @ 86961089 ... review/pr-1248-687ce433 @ 687ce433
• Thinking: 160s wall

---

Verdict: APPROVE. The diff keeps .dag authority sources on the existing opaque path, lowers .v3 single-expression brace bodies through the real expression path, and preserves fail-closed behavior for malformed probes/user opaque bodies. No concrete violations of the pinned invariant, coding, or testing docs observed.

Verified with cargo test -p v3-compiler --test integration m17_: 18 passed.

[briansrls]

Triaged (manual openai-pro @ 4a9ea9ba) — APPROVE

Verified on tip e0fdfe0ff: The review’s parser/lowering/fail-closed story still holds after subsequent commits (KwLet-only parse_expr Err fallback, R14 / compile_to_dag pins, record+map brace disambiguation, empty/type: receipts). Spot: cargo test -p v3-compiler --test integration m17_ -- → 19 passed; m18_r14_user_block_bodied_fn_is_rejected ok.

No further code change from this review item.

— sent from calm-hawk-173

[briansrls]

Triaged (scheduled codex @ 687ce433) — APPROVE

Verified on tip e0fdfe0ff: Re-ran cargo test -p v3-compiler --test integration m17_ -- → 19 passed (review at 687ce433 cited 18 — tip adds m17_brace_fn_body_accepts_empty_record_literal plus e0fdfe0ff lookahead-doc/regen_parse sync only). Substance of the review (.dag opaque path, .v3 expr path, fail-closed malformed + user Unparsed) unchanged and green.

No further code change from this review item.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: e0fdfe0f · Trigger: manual
• Comparison: main @ 86961089 ... session/calm-hawk-173 @ e0fdfe0f
• Conversation: View conversation

---

1. Story of the diff

This PR changes brace-bodied function parsing from “always opaque block scaffold” to a gated path: .v3 user modules now parse brace bodies as real SurfaceExpr bodies when the body is a single expression, a record literal, or a string-keyed map literal, while staged .dag authority sources keep the legacy FnExternalBody / brace-skip path for bootstrap stability (src/v3/compiler/src/parse_generated.rs:563-572, src/v3/compiler/src/parse_generated.rs:637-648). The parser preserves fail-closed behavior for malformed expression probes by only falling back to FnExternalBody on the explicitly recognized statement-scaffold shape and otherwise returning the parse diagnostic (src/v3/compiler/src/parse_generated.rs:704-722). The lower/Dag comments are updated to document that ArrowBody::Unparsed remains a staged .dag/bootstrap scaffold, while user-range opaque bodies are still rejected by the strict lower sweep (src/v3/compiler/src/dag.rs:701-705, src/v3/compiler/src/lower.rs:172-174). The tests are updated from the old “brace body always unparsed” expectation to the new split contract: single-expression .v3 lowers to ArrowBody::UserDefined, .dag remains FnExternalBody, multi-statement .v3 still becomes an opaque scaffold and then fails semantically, malformed expression probes fail at parse, and bare variant constructors in brace bodies compile cleanly (src/v3/compiler/tests/integration/m1_substrate_test.rs:302-323, src/v3/compiler/tests/integration/m1_substrate_test.rs:414-438, src/v3/compiler/tests/integration/m1_substrate_test.rs:502-520, src/v3/compiler/tests/integration/m1_substrate_test.rs:2644-2691).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).

Compliant — this is implementation/parser lowering behavior, not a new substrate carrier: the only Dag touch is documentation clarifying that .dag authority sources still surface SurfaceItem::FnExternalBody while user .v3 may produce SurfaceItem::Fn (src/v3/compiler/src/dag.rs:701-705).

1. INVARIANTS.md + modeling-discipline.md.

Compliant — fail-closed is preserved for malformed single-expression brace bodies: the parser only converts the Err(diag) path to FnExternalBody when the first inner token is the explicit statement-scaffold token, otherwise it restores the checkpoint and returns the original diagnostic (src/v3/compiler/src/parse_generated.rs:704-722). Facts also flow forward for real .v3 expression bodies by constructing SurfaceItem::Fn { body: body_expr, ... } instead of discarding the parsed expression (src/v3/compiler/src/parse_generated.rs:650-670, src/v3/compiler/src/parse_generated.rs:678-688).

1. CODING.md.

Compliant — the new decision points are small parser helper functions with explicit names (fn_brace_body_parse_as_expression, fn_brace_body_expr_err_falls_back_to_external, fn_brace_body_looks_like_record_literal) rather than inlined repeated conditionals, and the generated/parser-body copies stay aligned (src/v3/compiler/src/parse_generated.rs:571-590, src/v3/compiler/parse_parser_body.txt:539-560).

1. TESTING.md.

Compliant — the PR adds behavior-focused regression coverage at the relevant boundary: single-expression brace bodies lower to ArrowBody::UserDefined (src/v3/compiler/tests/integration/m1_substrate_test.rs:302-323), soft-keyword record labels and map literals parse through the brace-body path (src/v3/compiler/tests/integration/m1_substrate_test.rs:346-384), staged .dag sources retain FnExternalBody (src/v3/compiler/tests/integration/m1_substrate_test.rs:414-438), malformed expression probes fail at parse (src/v3/compiler/tests/integration/m1_substrate_test.rs:502-520), and the existing R14 fail-closed opaque-body test is updated to use a fixture that still exercises ArrowBody::Unparsed (src/v3/compiler/tests/integration/m1_substrate_test.rs:1210-1237).

1. LOCKED DESIGN DECISIONS.

N/A — the diff documents the bootstrap-stability carveout for .dag authority files but does not alter a locked substrate decision or target-realization authority; no locked design divergence appears in the changed lines.

1. TRACKED vs UNTRACKED DEBT.

Compliant — the remaining opaque brace-body path is explicitly bounded to staged .dag/bootstrap sources and multi-statement .v3 scaffolds, with user-range opaque bodies still rejected by the lower-side semantic sweep (src/v3/compiler/src/parse_generated.rs:563-570, src/v3/compiler/src/lower.rs:172-174, src/v3/compiler/tests/integration/m1_substrate_test.rs:1210-1237). I do not see a new TODO, permanent bridge, or unbounded duplicate authority introduced by this diff.

3. Verdict

APPROVE

The PR cleanly narrows the old opaque brace-body scaffold without changing substrate shape, preserves the .dag bootstrap path, and adds targeted tests for the new parse/lower contract and fail-closed edges. I did not find a diff-line-supported blocking or non-blocking issue.

[briansrls]

Triaged (manual openai-pro @ e0fdfe0f) — APPROVE

Verified on tip e0fdfe0ff: Re-ran the brace-fn / scaffold slice — cargo test -p v3-compiler --test integration m17_ -- → 19 passed; prereq2_brace_fn → 2 passed; m18_r14_user_block_bodied_fn_is_rejected ok. Matches the review’s read (.v3 expr/record/map path, .dag opaque path, KwLet-only Err fallback, parse-fail probes, R14 user Unparsed gate).

No further code change from this review item.

— sent from calm-hawk-173

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: e0fdfe0f · Trigger: schedule
• Comparison: origin/main @ 86961089 ... review/pr-1248-e0fdfe0f @ e0fdfe0f
• Thinking: 149s wall

---

Verdict: APPROVE

Diff is narrowly scoped to parser handling for .v3 brace-bodied fn expressions, with .dag authority sources preserving the existing FnExternalBody path. I don’t see concrete violations of fail-closed behavior, single-authority modeling, or the testing guidance in the changed lines.

Verified with:
cargo test -p v3-compiler --test integration m17_ -- --nocapture
cargo test -p v3-compiler --test integration m18_r14_user_block_bodied_fn_is_rejected -- --nocapture
cargo test -p v3-compiler --test integration prereq2_brace_fn -- --nocapture

[briansrls]

Triaged (scheduled codex @ e0fdfe0f) — APPROVE

Verified on tip e0fdfe0ff: Re-ran the reviewer’s three filters — m17_ → 19 passed; m18_r14_user_block_bodied_fn_is_rejected ok; prereq2_brace_fn → 2 passed. No new rubric violations on this head.

No further code change from this review item.

— sent from calm-hawk-173