Bare-provider gate: read bare references from the full parse; delete the byte scanner

[gunbai-bot]

What

The unimported-bare-provider gate (visit_bare_reference_providers) got its candidates from bare_identifier_candidates, a byte scanner with no grammar. After #12421 added a top-level fn response, every service operation's response { .. } block read as a bare reference, and unrelated PRs refused with UnimportedBareProvider. #12381 and #12542 renamed the helper, which only moved the collision.

The gate now reads each file's free names from its full parse, using the one structural reference walk (collect_node_refs). That walk is shared with the reference-edge producer through entry_resolve::parsed_file_references. bare_identifier_candidates and destructuring_bound_spans are deleted.

Why the full parse (and not the resolved set or a token reader)

• The resolved reference set can't feed the gate. build_reference_closure_index needs a PreparedRepository, and that only exists after the gate has decided which modules to pull, so it would be circular.
• The pool parse can't feed it either. It reads declaration headers only and skips bodies (a DESIGN §6 cost fix).
• A token-level reference reader would be a second parser. response isn't a keyword token; the parser recognizes it by position. Classifying identifiers by grammar position means driving every production.
• Parent ruling: option A, a per-file full parse read by collect_node_refs.

What the walk now records (BarePositions)

• undotted: free variables, unbound ExprCall callees, record-literal types, variant constructors and type names. This is the gate's names.
• dotted_heads: free chain heads and method receivers. The services census answers these first, so Filesystem.Write(..) still resolves as a service.
• callees: unbound ExprCall names only, which feed call_position. The pullable check and BUILTIN_REQUIRED_SERVICE_KEYS read call_position.
• Method names are not bare references. xs.length(), and a pipe xs |> filter(f) (which parses to the same ExprMethodCall), resolve through the receiver's type: a structural (algebra) method, else a service operation (resolve_known_method_node). They never go through a bare lookup, so no import can be owed for them. Only the method chain is kept, for the services-prefix lookup (method_chains).
• authored_types: type names at the raw parse's authored type positions: parameter children, and inferred: Resolved for return, field, data and operation types. collect_node_refs doesn't read those slots because it was written for the prepared tree. A record field contributes its type, not its label (service output { context: T }, variant payloads), and a parameter's default value is skipped. These names are kept out of bare, so the reference-edge producer's edges are unchanged.
• Bound callees: a callee held by an enclosing binder no longer enters bare. It names the binder, not a declaration.

Controls (bare_reference_scanner_tests, closure_edge_demand_tests)

• The Observe Namecheap DNS through fleet convergence and approval-gated WIF #12421 specimen doesn't refuse. Two top-level fn response declarations plus a service response {} block, in both an import-less file and an import-bearing one: whole-pool admission and unimported_bare_providers both pass.
• A genuine unimported bare reference still refuses. An import-bearing file that calls duplicated() from outside its import closure is named, with its provider.
• None of these is counted as a reference:
  • a named-argument label, a field after ., a record-literal key, a let binder and its reads, lambda parameters, pattern leaves;
  • xs.length() and piped filter/length;
  • a service output { context: T } label, a variant payload label, a parameter default.
• Each test has a positive control in the same source, e.g. BrowserContext in the output field is counted.
• 43 of 43 tests in the touched modules pass. cargo clippy --all-targets -D warnings is clean.

Cost (live tree, dag + src/v2, 6984 files, BuildBuddy amd64; main measured at 88436e5 on the same runner)

	main	this PR
run_required_bare_reference_admission wall	38.1 s	41.2 s
peak RSS (VmHWM)	5.12 GB	5.12 GB
verdict	Ok, 6984/6984 judged	Ok, 6984/6984 judged

Parse trees aren't retained: each file's tree is dropped once its reference set is read. This follows the existing rule that pool-level readers don't pre-fill parse_cache.

Roster effect (floor_unimported_bare_provider_debt)

Unimported pairs over the whole pool go from 2066 (main) to 1848.

381 gone, all false positives:

• all 42 response rows (Observe Namecheap DNS through fleet convergence and approval-gated WIF #12421);
• method and pipe names (filter, any, skip, get, …);
• binders, labels and operation names.

163 new, all true positives the scanner missed:

kind	count
data x: T annotation types (the scanner skipped them as a key position; 113 are LiveTreeDisposition)	147
constructors in value or match-arm positions (input: NodeRegistered, Conflict => ..)	9
type names in parameter or function types (fn(Finding) -> Bool, a: PublishedMockCase)	3
free length(..) calls	2
record-field value (rlm1_merge_commit: rlm1_merge_commit)	1
{BoardSerialAbsent} inside a string literal, which the grammar interpolates	1

The roster judges only route files plus ImportsFixed rows, so this PR isn't refused. A new pair refuses as Unrostered only when its file is next touched, as for every other file.

Not in this cut

annotation_erased_scan_text stays (follow-up filed: node://adhoc-fa696787-bb7). Its remaining consumers are two other byte scanners: referenced_module_paths_in_text (load's dotted-module-path closure) and module_self_declared_names. Replacing those is a separate cut.

v1 admission

gunbc.v1_maintenance_standing: this change serves the v2 floor. A false UnimportedBareProvider or AMBIGUOUS refusal on the required path blocks unrelated v2 work.

🤖 Generated with Claude Code