XL-2 PR1: v2.std.template — one Template<H>; ArgvTemplate = Template<OperationInputName>

[gunbai-bot]

XL-2 PR1 (MODEL) adds the value model for string interpolation. It contains no grammar or lowering changes; those land in PR2.

• v2.std.template (new module): Template<H> { parts: List<TemplatePart<H>> }, where TemplatePart<H> = TemplateLiteralPart { text } | TemplateHolePart { hole: H }, plus template_holes. It is the one literal-or-hole sequence, parameterized by what a hole is. The arms are prefixed Template because v2.lens.coverage already declares a nullary TemplateHole.
• v2.std.operation_argv: a new type OperationInputName = String where brand("OperationInputName"), the one identity of a declared operation input. It is now the type of OperationInputBinding.name, of the four input-naming ArgvRefusalCause arms, of ShellTransportOperationRow.declared_inputs / argv_input_refs, and of the holes in type ArgvTemplate = Template<OperationInputName>. A hole and a binding therefore compare as one typed identity, not two spellings (manager ruling: migrate both). operation_argv_bind_text / _list keep their String signature and are the one documented point that mints the name, so their callers don't change. Refusals reuse the existing ArgvRefusalCause arms: an expression hole is ArgvExpressionUnsupported, and a list input in a hole is TokenListInStringPosition. No new refusal names.

Grounding (M9): the corpus already has this structure twice, and each copy is owned by its upstream: extdeps.uri_path UrlPathToken (RFC 3986 path, LiteralToken | ParamToken) and extdeps.github.expressions TemplateSegment (GitHub expressions, LiteralText | Interpolation). Those remain upstream-owned inhabitants of the same structure and are not touched. The dag language's own interpolation gets one generic home instead of a third ad hoc shape (manager ruling).

Consumers (DESIGN §3c): both are declared frontier.

• PR2 (this lane) changes the dag grammar so an interpolated literal parses to a Template node over expression nodes, refusing non-identifier holes with their location as its first version. That change discharges gunbc.recurring_failure_mode string_interpolation_read_as_literal_text_by_v2, which lands with XL-2 PR3a: service realization model (MIRROR sibling, per-kind declared bindings, conformance wall) #12974.
• XL-2 3b-ii (eager-heron-413) checks transport templates part by part against the operation's declared inputs and maps them to ArgvTemplate. The template shape was confirmed with eager-heron-413.

Seed edit: none was needed. A brand is erased at runtime, so the seed interpreter's builtin (v1_interpreter.rs, which builds and reads binding.name as Value::Str) is unchanged and behaves the same. The corpus materialization witnesses below go through that builtin and still pass. operation_argv has no stage0 mirror, so no regen is needed.

Evidence: v2.test.claim.template_holes template_holes_are_names_in_authored_order, run locally with claim_batch:

• PASS at this head.

• FAIL as a control when the expected order is reversed.

• dag/test/claim/operation_argv_corpus_witness_test.dag: 5 witnesses PASS locally on this branch and on main. The other 4 (every_row_is_materialized_or_counted, tally_is_total, expression_residue_is_pinned, executable_position_wall_fires_on_the_fixture_only) FAIL locally on BOTH origin/main (3756d62) and this branch, with the same binary. The floor's cost basis (v2.workflow.floor_cost_debt) records every_row_is_materialized_or_counted as PASS in CI, so the local failure belongs to my local invocation, not to main. The CI floor on this PR is the evidence for those 4.

• gunbc.compute.host_occupancy read_host_occupancy: the diff-scoped NFR check (NFR: typed, diff-scoped non-fold-residue check on the required floor (D) #12610) reaches this function through its operation_argv import and refused its two UnitActivity wildcard arms. Both arms now list all four cases, the same fix NFR: enumerate batch B closed-coproduct wildcard arms (auth/fleet/gcp/compute/host/git) #12544 applied to that module. spark/host_occupancy_admission_witness_test: all 10 witnesses PASS.

The remote run refused with HostBudgetUnreadable, the known modelled refusal, so it gives no evidence either way.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 74147, both points fixed in e0c4dec:

• The OperationInputName comment now says the two operation_argv_bind_text* fns are the only production mint points, and that a fixture may cast a literal directly. operation_argv_row_binding_for_input unwraps to String and re-mints through operation_argv_bind_text, so it is not a separate mint point.
• The title now reads ArgvTemplate = Template<OperationInputName>.

— sent from eager-koi-296

[briansrls]

APPROVE-MERGE at exact head e0c4dec3de2538a090d43fc237d878a26c4884bd.

No findings.

v2.std.template is one generic literal-or-hole sequence whose hole identity remains the consumer's type; template_holes projects holes in authored order without reinterpreting literals. ArgvTemplate = Template<OperationInputName> then specializes that one shape rather than minting an argv-specific template representation.

The OperationInputName migration is complete across the semantic identity surface: OperationInputBinding.name, every name-carrying ArgvRefusalCause, ShellTransportOperationRow.declared_inputs / argv_input_refs, and ArgvTemplate holes all use the same brand. The two production String-to-brand boundaries remain operation_argv_bind_text and operation_argv_bind_text_list; the row fixture unwraps and routes back through that boundary rather than adding another production mint.

The existing URI-path and GitHub-expression types remain legitimately separate upstream-owned facts rather than alternate dag-template authorities. The current claim executes the new model, and the production frontiers are bounded and named: PR2 for grammar/lowering and XL-2 3b-ii for transport-template validation/materialization.

No seed edit is required: the brand changes static identity while retaining the runtime String representation consumed by the existing builtin. The operation-argv corpus witnesses and all exact-head checks pass. The incidental UnitActivity edit merely replaces two wildcards with exhaustive arms and does not alter behavior.

Merge-queue landing only. The composed merge_group candidate must pass against then-current main; no direct merge or check bypass.