XL-2: named conversions for every non-String interpolation hole (std.nat / std.integer decimal renderers), stacked on #13405

[gunbai-bot]

XL-2, the explicit-conversion step that lands before PR2b. Census #13405 is on main.

HOLD is stale: #13388 merged 2026-10-06.

Acceptance: the instrument is the gate

gunbc test //gunbc/instruments:interpolation-hole-census at this head:

• STANDING held, CORPUS complete, exit 0
• 96 String body holes, 0 Int, 0 other
• Named routes only: std.nat nat_to_decimal_string, std.integer int_to_decimal_string, v2.std.node symbol_lexeme

Renderer homes remain dag/std (delete-first from v2.std.integer). No copies under v2.std. No implicit stringify. No PR2b lexer/template work. No infer edits.

[gunbai-bot]

Review 76681: fixed in a1603c0. contributor_onboarding_path line 114 again names the historical renderer, integer_nat_to_decimal_string, and notes that this PR moved it to std.nat as nat_to_decimal_string. Line 118 now cites std.integer int_to_decimal_string. I re-checked every line the rename touched: those were the only two comment lines changed, and every other hit is code.

The same push adds lively-crane-656's follow-ups, verified on one remote run with main e81d4d3 merged:

• New RFM row adjacent_interpolation_holes_fused_into_one_operator_hole: v1 fuses "{s}-{e}" into one hole holding s - e. The harm is that cron ranges and offset steps rendered as arithmetic. No live schedule was affected: the only constructed CronSchedule is gunbc.tools.review */10, there is no Schedule trigger, and no workflow has a cron: line.
• Control test.claim.cron_schedule_render_witness_test: 1-5, 5/15, the one-hole arms, and a whole schedule */10 9-17 * * 1-5. All four are true.
• lens/grounding.dag now imports its 21 bare providers, FieldRef included, and their debt-roster rows are retired as ImportsFixed. On main it fails to resolve with 25 effect summary incomplete errors; at this head it resolves with none.
• Census at this head: 98 String body holes, 0 non-String, 0 untyped, CORPUS complete, held. //gunbc/instruments:self-host exits 0, and the stage0 regen reaches a fixed point.

— sent from deep-newt-14

[gunbai-bot]

Retargeted to main after #13405 landed, then merged main (b3875e9). Census-owned files take main's final census. This PR's own import blocks keep main's std.optional repoint plus this PR's renderer homes (std.integer int_to_decimal_string, std.nat nat_to_decimal_string). Stage0 regenerated: required-regen drift was exactly extdeps_version_semver.rs, std_integer.rs and std_nat.rs, and those are committed. The census on this tree reports STANDING held. The 4 grounding.dag unresolved fr.field residuals are GONE (this PR's FieldRef import). The only residual is the spatial_dimension.dag cast hole observed at offset 0 (UNOBSERVED at 6645 / UNLEXED at 0), a v1 span defect on the cast node, not a missing conversion. — sent from lively-crane-656

[gunbai-bot]

Reviews 77969 and 77976 addressed at f1ce785.

Review 77969 (D9 default, minimum integer). The Nat ladder is deleted. A remainder's digit now comes from nat_decimal_split, a structural walk that advances a DecimalDigit and carries out of D9 (decimal_digit_successor covers all ten arms), so it has no default. decimal_digit_of_units now answers for every Int: it steps values of ten or more down by ten and values below -9 up by ten, then negates only a magnitude of at most nine. So the selection below it receives exactly 0..9. int_to_decimal_string divides the signed value and never negates it.
New cases: Nat 9, 19, 100; Int -10, -19, 99; and int_to_decimal_renders_the_minimum_machine_integer. Discriminating control: with the pre-fix std.integer and std.nat sources and the same binary, evaluating the minimum-integer claim ERRORS, while the existing formatter claim still holds on the old code.

Review 77976 (cost shape). Correct: the Succ walk over the whole value was O(n) on the host-realized Nat. nat_to_decimal_string again divides with the declared nat_div_rem_by_succ (O(digits)). The structural split applies only to the remainder, which is at most nine steps, so the construction stays and the linear walk is gone. Stage0 is regenerated: drift was only std_nat.rs. — sent from lively-crane-656

[gunbai-bot]

Took over from keen-lynx-519 after #13388. Merged origin/main (0f14618).

Post-merge gunbc test //gunbc/instruments:interpolation-hole-census (remote, this head):

• At the merge commit, CORPUS was incomplete: one Map body hole in canonical_order_enrolled_witness_test (v1_implicit_stringify) from main, plus the known spatial_dimension {o as String} span mismatch (UNOBSERVED 6645 / UNLEXED 0).
• 82da0e4 deletes the Map interpolation (canonical order stays on to_string; no fourth renderer). The Unknown arm is concat so the cast is not a template hole.
• Re-run: STANDING held, CORPUS complete, exit 0. 96 String body holes, 0 Int, 0 other. HOLD for Optional de-fork step 2: re-home v2.std.optional to std.optional under the dag root #13388 is stale.

Named routes unchanged: std.nat nat_to_decimal_string, std.integer int_to_decimal_string, v2.std.node symbol_lexeme. No implicit to_string, no PR2b, no infer edits.

[briansrls]

REQUEST_CHANGES at exact head 82da0e400eadd6f5479e1623d8aa084319cbc273. One P2 fail-open remains before this can join #13641.

decimal_digit_of_reduced_units fabricates D9 for every out-of-range Int

std.integer exports:

fn decimal_digit_of_reduced_units(value: Int) -> DecimalDigit {
  if value == 0 { D0 }
  ...
  else if value == 8 { D8 }
  else { D9 }
}

Its present caller reduces into 0..9 first, but the function's declared contract accepts every Int. Therefore -1, 10, 99, or any future caller error silently become D9. The precondition lives in one caller's reasoning rather than in the callee's input type or result, so it is not structural and the exported helper is a fail-open conversion authority.

This exact debt is already named in the closeout accounting; carrying it as a follow-up would violate the v2 reset. Make the invalid states unwritable or explicit now:

• take a bounded/constructed 0..9 carrier; or
• return a typed Optional/Outcome and refuse values outside 0..9.

Add discriminating controls that 9 maps to D9 while -1 and 10 refuse. Do not merely add a comment that the current caller reduces the value.

The rest of the reviewed direction is retained: named Nat/Int decimal conversions replace implicit stringify, the Nat renderer uses structural decimal splitting only on the bounded remainder, the Int renderer handles the minimum machine integer without negation, the census is complete, and exact-head workflow 37968190471 is green. Once the helper's contract is closed, fold the corrected head into #13641 and close this PR as superseded.