XL-2: a match reads its scrutinee and arm body from their grammar positions

[gunbai-bot]

XL-2 fold cleanup, owner quiet-seal-543 (the split with bright-boar-848 was ruled 2026-09-28). This retires two gunbc.recurring_failure_mode rows; the trigger capability of each is delivered here:

• data_initializer_match_reads_its_scrutinee_from_an_arm_at_v2_body_lowering
• match_arm_statement_body_lowers_to_its_first_expression_at_v2_body_lowering

Both are the same class, a positional fact obtained by searching for its shape, at two sites in v2.compiler.body_lowering_fold.

What

1. Scrutinee. data d: Bool = match h(a) { X => true .. } lowered to a match on true: h and a were gone, and the module was accepted.

• Cause: body_lower_match_scrutinee_optional took the first binary_expr found anywhere in the match subtree. A data initializer is folded bottom-up before its declaration is dispatched, so its scrutinee shell is already reduced, and the search found the next binary_expr, inside the first arm.
• Repair: read the scrutinee from its grammar position. match_expr is seq(match, seq(binary_expr, seq({, ..))).
  • body_lower_match_scrutinee_value already reads both an unfolded shell and a lowered node.
  • A spine not headed by match answers Absent, and the caller refuses it as match_arm_navigation_refused.
  • The spine-walk fallback (_from_spine, _on_token) had no other caller and is deleted.

2. Arm statement body. X => then let t = v then e lowered to v: the binder and the continuation were gone.

• Cause: body_lower_match_arm_body_capture_optional took the first expr, then primary_expr, then postfix_expr found in the arm.
• Repair, positional read: the body is now the right of the =>.
• Repair, statement authority: body_lower_match_arm_body_lowered (both arm routes) lowers a statement body through body_lower_stmt_spine, the authority fn bodies and if arms already use.
• Measured on a parsed arm: the parser realizes match_arm_stmt_body unwrapped. parse_match_arm_stmt_body returns the bare stmt repeat with no production shell. So a statement body is recognized structurally, as a spine headed by a stmt production that has a successor.

Evidence

Local claim_batch, one binary built from this branch. Main is a git worktree of origin/main 8ebd8b6 with this PR's two claim files copied in.

claim	main fold	head
a_statement_after_a_let_in_a_match_arm_is_conserved_holds	FAIL	PASS
a_data_initializer_match_scrutinee_is_conserved_holds	FAIL	PASS
the_same_match_as_a_fn_body_conserves_its_scrutinee_holds (paired control)	PASS	PASS
a_data_initializer_match_lowers_its_scrutinee_from_the_match_position_holds	FAIL	PASS
the_same_match_as_a_fn_body_lowers_its_scrutinee_from_the_match_position_holds (paired control)	PASS	PASS
a_match_arm_statement_body_lowers_to_the_let_binding_its_continuation_holds	FAIL	PASS
the six neighbouring pins in reference_conservation_accepted_drops	PASS	PASS (unchanged)

• Conservation controls: each asserts that the module is accepted and that the named atoms are not dropped, so a refusal cannot green it.
• Structural controls (v2.test.claim.body_lowering.match_position_structure) read the lowered tree the production route hands the resolver (module_roots_from_source_root_ingest). They cover what conservation cannot see:
  • the scrutinee must be the Match's first positional child, as the authored call;
  • the arm body must be a Bind of key, value and continuation in that order.
• The data vs fn-body pair is the control the side chat required, at both grains. It uses distinct callee names per route, so neither module can satisfy the other's claim.
• Floor enrolment: mps_normalized and fn_body_match_scrutinee_subject are enrolled warm in v2.workflow.floor_pure_producer_share. The rows are anchored away from XL-2: an expression containing a match/if lowers to itself, not to the block (walker search + primary reducer) #12436's append point.

Census: posted as PR comment 5864468628. All 316 paths paired; 31 atoms recovered (30 through the arm statement body, 1 a fn-body pipe scrutinee); 0 newly absent; 0 refusal changes.

Coordination

• XL-2: an expression containing a match/if lowers to itself, not to the block (walker search + primary reducer) #12436 (bright-boar-848): disjoint fold functions. Both PRs edit reference_conservation_accepted_drops_test.dag (different claims) and the same import line. That is a one-line merge; I will integrate with a merge commit once either lands.
• Stage0: no generated file derives from the changed functions.

Carrier wording (for compiler_frontend_program_status, not edited here)

v2 body lowering reads a match's scrutinee and each arm's body from their grammar positions on every route, data initializers included, and lowers an arm's statement body through the statement authority.

🤖 Generated with Claude Code

[gunbai-bot]

Census receipt, head 6bc7da970f vs base 8ebd8b671d

Scope: the pinned reference_conservation_stratified_sample_paths, extracted at the base: 316 paths, all of which exist at both SHAs. The sample was repinned at 8fcd8e7 after #12436's receipt, so its six stale rows are gone.

Instrument: bright-boar-848's census kit, with the harness unchanged. Each path is one ingest that records both the native file refusal and the per-atom conservation report.

• The dispatch ran on BuildBuddy with EstimatedMemory=48GB and a child cgroup memory.max per batch, bound after the build (controllers: memory confirmed). GUNBC_MEMORY_BUDGET_BYTES was not forwarded.
• Both SHAs are fetched and verified inside each dispatch.
• The kit's parameterised form was smoke-tested on 3 files before the full run.
• Only completed waves were analysed: 36 shards across 3 waves, each with its end marker and a done row. A path pairs only when both sides printed a CONS summary.

Result:

• 316 of 316 paths paired, 0 unpaired.
• 31 atoms recovered: absent at the base, present at the head.
• 0 newly absent atoms.
• 0 refusal changes. Every file keeps its refusal set, so none moves between accepted and refused.
• The totals are dropped 8,530 → 8,499 and conserved 11,578 → 11,605, with authored 26,605 on both sides.

The 31 recoveries, dispositioned by production chain:

route	atoms	files
arm statement body: chain through match_arm/stmt	30	dag/gunbc/host/host_runner_memory_provision.dag (13), dag/gunbc/instruments/direct_rust_door_transport.dag (11), src/v2/test/claim/complexity_gate/budget_roster_completeness_test.dag (6)
match scrutinee: chain fn_body/.../match_expr/binary_expr/...	1	dag/extdeps/container/oci/linux.dag namespace_at

The one scrutinee recovery is on the fn route, not the data route. namespace_at is match namespaces |> get(index) { .. }. At the base, the subtree search dropped get from the pipe scrutinee. The positional read keeps the whole pipe.

• So the fn route was not loss-free for every scrutinee shape, only for the plain call that the paired control uses. The paired control still holds on both sides, and this receipt is the evidence for the pipe shape.
• The data-route scrutinee drop cited in the RFM row (test.claim.manual.outcome_diagnostics_eq) is not in the repinned sample. That route's evidence is the fixture claims, red on the base fold and green on head.

CI: run 36379815078 succeeded on every job. In the floor log, all six new or flipped claims show [changed-witness] … standing=planned-and-passed and [enrolment-margin] … standing=admitted by name:

• v2.test.claim.namespace_xl0.reference_conservation_accepted_drops:
  • a_statement_after_a_let_in_a_match_arm_is_conserved_holds
  • a_data_initializer_match_scrutinee_is_conserved_holds
  • the_same_match_as_a_fn_body_conserves_its_scrutinee_holds
• v2.test.claim.body_lowering.match_position_structure:
  • a_data_initializer_match_lowers_its_scrutinee_from_the_match_position_holds
  • the_same_match_as_a_fn_body_lowers_its_scrutinee_from_the_match_position_holds
  • a_match_arm_statement_body_lowers_to_the_let_binding_its_continuation_holds

— sent from lively-bear-30

[briansrls]

APPROVE-MERGE at exact head 6bc7da9, through the merge queue only.

Reviewed the production delta, the six enrolled witnesses, the exact-head floor, and the census handback.

The two #12364 drops are repaired at the positional authority rather than papered over. The match scrutinee is read from the grammar position after the match keyword, including the data-initializer route where bottom-up folding has already reduced the scrutinee shell. The match-arm body is read from the right of =>, and statement bodies lower through the statement-spine authority instead of a pre-order first-expression search.

The paired data-initializer versus fn-body control requested on #12364 IS present at both required grains:

• conservation: a_data_initializer_match_scrutinee_is_conserved_holds and the_same_match_as_a_fn_body_conserves_its_scrutinee_holds both require an accepted report and retain callee + argument;
• structure: a_data_initializer_match_lowers_its_scrutinee_from_the_match_position_holds and the_same_match_as_a_fn_body_lowers_its_scrutinee_from_the_match_position_holds inspect the Match's first positional child, using distinct callees/arguments for the two routes.
  The arm-body structural claim separately checks a Bind with key, value, and continuation in positional order, so conservation alone is not the oracle.

Exact-head workflow 36379815078 has compiler, generated, floor, clippy, emit-build, and witnesses all successful. The floor records all six named claims as planned-and-passed, claims_failed=0, FloorClean, and required-ci adjudication PASSED with blockers=0.

Comment 5864468628 is a complete 316/316 paired sample handback at this exact head/base: 31 recovered atoms, zero newly absent, zero refusal changes. I retain its qualification that the sampled scrutinee recovery is on a fn-body pipe shape; the data-initializer defect itself is established by the red/green fixture controls, while the paired plain-call fn control is green on both sides.

No new local .dag/native run or census was performed by me. Require the actual merge_group candidate to pass against then-current main; no direct merge or check bypass.