XL-2 PR3b-i: non-transport realization facts lower into the MIRROR sibling (transport fields at the 3b-ii frontier)

[gunbai-bot]

XL-2 PR3b-i. A service's non-transport realization facts lower into the realization sibling that PR3a (#12974) modeled. The transport's fields stay set aside, at a declared frontier whose trigger is 3b-ii. Rulings (XL-2 manager, 2026-10-02): split SPLIT (3b-i now, then 3b-ii after the interpolation lane), D1, D2 and D4 approved. Design: docs/plans/service-interface-and-uses-carriers.md.

What lowers, and where

v2.compiler.body_lowering_fold. Each service now lowers to its interface spine and a MIRROR sibling, <realization> -> <namespace body> { seg.. -> { Op -> ENTRY, <realization-config>? } }. The prefix bodies are marked, so services sharing a prefix merge through the spine's existing merge rule.

• transport KIND goes to the entry's <realization-transport> -> { <transport-kind> -> shell|rest|file|local }. local refuses at the wall as transport_unmodeled.
• exit / response arms go to <status-arms>, as a list introduction of { <arm-pattern>, <arm-payload>, <arm-doc>? }. The payload is a type, through the one type-position reader. An ordered block is a list, not a Conj of positional edges; the latter is ill-formed, and was found through the post-normalize well_formed refusal.
• mock_response arms go to <mock-arms>. The payload is a value, through the one value reader, so its references reach resolution.
• from "key" goes to one <projection> row field -> "key". It is no longer interface_member_unmodeled.
• service config goes to <realization-config>, with fields named as written.
• A repeated realization block refuses at the second (body_lowering_reason_realization_block_repeated).
• The wall (v2.compiler.service_realization) runs on every lowered service, and a non-conforming sibling refuses the service, located. That makes the wall's §3c frontier executed. It now reads arms as a list, and an optional <arm-doc> must be a string literal.

Declared frontier (3b-ii)

A transport's fields (argv, stdin, method, path, query, headers, body, ...) are not lowered. The transport member stays set aside (realization_member_set_aside), so the full route still refuses the service as service_realization_unreachable (3c removes that). Trigger: 3b-ii lowers transport fields through the template model (#12987 v2.std.template, plus the grammar template node from the interpolation lane), at which point the transport is no longer set aside. Resource capabilities keep their exact prior behaviour: their lowered realization members refuse as set-aside members.

Grammar

Each transport kind, each status-pattern form (class 5xx, exact code, name) and each config field name is now its own production (the #12964 precedent: a literal terminal publishes only its class). occurrence_role classifies the status-pattern name as a marker, not a reference.

D2: the declared vocabulary moves out of the runtime modules

extdeps.transports.{shell,rest,file}_declared hold the binding fields, the output channels and the status patterns, so the emitted compiler, which now reaches the wall through body lowering, doesn't import std.effect_grant.

Also

• a_default_tail_refuses_as_a_service_set_aside_RED has been red on main since v2: every default lowers onto its binder and is judged at the binder's declared type (XL-2 PR2c-ii) #12948 (re-run at 3756d62; CI didn't run it because its file was untouched). It is replaced by a_default_tail_lowers_onto_its_binder_holds.
• Review 74335's shape is carried into the list-arm wall: realization_node_shape at each site, and DecodedStatusPattern.

Evidence

claim_batch over service_declaration_lowering, resource_declaration_lowering, service_spine, service_realization_conformance and the new service_realization_lowering (BuildBuddy, 24 GB): 55/55 at c19da58, and again 55/55 at 059fa73 (this head, after merging main with PR3a landed). New claims, over the real census route:

• the_realization_facts_lower_into_the_sibling_holds: the kind, 2 exit arms (one with a doc), a mock arm, a from-row and config, plus the interface path.
• the_siblings_of_a_shared_prefix_merge_holds
• an_unrealizable_realization_refuses_located_holds: local, a repeated exit, and 5xx on shell.

🤖 Generated with Claude Code

[briansrls]

HOLD at exact head cbd42b878abf7892a7976c1f2a85a443b17c01fd.

The MIRROR construction, marked-prefix merge, per-kind grammar productions, list-shaped status/mock arms, typed status decoding, from projection rows, declared-vocabulary split, resource-capability preservation, and the transport-field 3b-ii set-aside otherwise look coherent.

P1 — a config-only realization bypasses the pre-3c full-route refusal

The stated transition boundary is that the census route may carry the new sibling, while the full route continues to refuse services as body_lowering_reason_service_realization_unreachable until 3c.

That does not hold for an authorable service whose only realization fact is service-level config:

• body_lower_service_config_node lowers the config into BodyLowerServiceAcc.config and adds nothing to a.set_aside.
• body_lower_service_realization_leaf_optional therefore produces a leaf containing only <realization-config>.
• service_realization_refusal admits that leaf when the config is a nonempty Conj of distinct fields; it does not require an operation entry or transport alongside service-level config.
• after the wall, body_lower_service_decl(..., admit_set_aside: false) refuses only when a.set_aside is nonempty. For this shape it is empty, so full normalization releases the service and its realization sibling before 3c.

For example, a service with config { endpoint: "http://x" } and an otherwise interface-only operation has no transport member to populate the set-aside list. The current accepted fixture always includes transport shell { argv: ... }, so the transport itself masks the escape by keeping a.set_aside nonempty.

This is load-bearing: before 3c, downstream stages have not established how they consume or refuse the sibling. Allowing this one realization population through can silently drop it or surface under an unrelated later cause, and contradicts the PR's own full-route boundary.

Keep the full route closed whenever the service has a realization leaf until 3c—either gate Present realization independently of a.set_aside, or retain config as a set-aside member for that route. Add a paired control: census normalization carries the config-only MIRROR sibling, while ordinary normalization of the same source refuses as body_lowering_reason_service_realization_unreachable.

Exact-head floor, generated, emit-build, and witnesses are green. This hold is semantic; no direct merge or check bypass.

[gunbai-bot]

Side-chat P1 (a config-only realization slipped through the full route before 3c) is fixed at cfcbee9. A service lowers normally only when nothing is set aside AND it has no realization leaf. Otherwise the new body_lower_service_held applies: the census admits it with its sibling (and any set-aside advisories), and the full route refuses as service_realization_unreachable, with each set-aside member pending when there are any. New paired control a_config_only_realization_is_held_off_the_full_route_holds, on a service with only config and an op with no transport: the census carries .S., and ordinary normalization of the same source refuses as service_realization_unreachable. Both producers are warm. claim_batch reports 57/57.

— sent from eager-heron-413

[briansrls]

APPROVE for merge-queue landing at exact head cfcbee9b94b7e728fd0779e5ffa3edb8aa6f86dd.

No findings. This supersedes my CHANGES_REQUESTED review 5398847587 at cbd42b878abf7892a7976c1f2a85a443b17c01fd.

I reviewed only the one-commit delta:

• body_lower_service_decl now distinguishes the genuinely empty state (a.set_aside empty and no realization leaf) from either form of held state. A present realization leaf reaches body_lower_service_held even when a.set_aside is empty.
• At census grade, body_lower_service_held still returns the lowered interface plus MIRROR sibling, with any set-aside diagnostics advisory as before.
• On the ordinary route, it always refuses as body_lowering_reason_service_realization_unreachable; an empty set-aside list no longer releases a config-only sibling, while the existing pending-diagnostic behavior is retained when set-aside members exist.
• The paired real-route control uses one config-only source: normalize_census must carry <realization>.S.<realization-config>, and ordinary normalization must refuse with the owned unreachable cause. The fixture contains no transport member that could mask the leaf boundary.
• The two new nullary producers are enrolled warm, and exact-head generated, floor, emit-build, and witnesses checks all pass.

Merge-queue landing only. The composed merge_group candidate must pass against then-current main; no direct merge or check bypass.