Native broker 2K-b: identity-keyed type_summaries; Host-Option decided by declaration

dag/gunbc/recurring_failure_mode/an_imported_name_shadowed_by_a_kernel_name.dag

@@ -0,0 +1,28 @@
+module gunbc.recurring_failure_mode.an_imported_name_shadowed_by_a_kernel_name
+
+import std.types { NonEmptyStr }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import gunbc.recurring_failure_mode { RecurringFailureMode }
+
+data an_imported_name_shadowed_by_a_kernel_name: RecurringFailureMode = RecurringFailureMode {
+  identity: "an_imported_name_shadowed_by_a_kernel_name" as NonEmptyStr,
+
+  receipts: [
+    "an imported name shadowed by a kernel name -- residual after the Optional mint wall. v1.compiler.infer_env overlay_skips_kernel_name still sits above imports for the kernel types, the container spellings, Unit, Optional, Present, and Absent. lookup_binding still answers from env.bindings (declarations and named imports) before that overlay. INVALID STATE: one spelling, one module, two declarations, chosen by which lookup asks. The Optional instance of that fork is CLOSED: std.literal_elaboration kernel_named_import_standing / v1.compiler.resolve kernel_named_import_diags refuse a non-mint Optional import (gunbc.recurring_failure_mode.import_collides_with_a_kernel_name). The enrolled regression control is test.claim.infer_kernel_import_collision_witness importing_a_non_mint_optional_refuses_at_the_import (ImportCollidesWithKernelName). Names with no kernel_mint_declaration_rows row are KernelNamedImportAdmitted, so the two-lookup fork remains writable for every overlay_skips spelling that is not Optional.",
+
+    "RESIDUAL POPULATION: overlay_skips_kernel_name minus the one minted name. kernel_type_set is String, Int, Bool, Float, Secret, Json, Unit, Bytes; containers ride is_container_type; Present and Absent are listed beside Optional. Only Optional has a mint row (std.optional Optional). A module that declares a type of any other overlay name and is imported by that name is still admitted on v1, and the overlay can still disagree with lookup_binding. Dual-representation imports (v2.std.text String via carrier_by_spelling) are a declared admitted population, not this class -- a second String is a carrier pair, not a silent mint leak. A rival Int, List, Present, or other overlay spelling that is not a dual-rep carrier is this class.",
+
+    "HARM on the residual: silent wrongness (DESIGN section 5) wherever two readers take different paths on a non-mint overlay name. The Optional emit specimen (HeldChoice<present_value>) is historical of the closed instance; it is not the current red. FOUND 2026-10-06 on gunbc#13454 as the Optional instance; retargeted 2026-10-07 (cursor review 77440) once that instance climbed.",
+
+    "CURRENT RUNG: below the floor on the v1 residual -- the non-mint overlay import is still unrefused, so the two lookups can still disagree. The Optional path is mechanically preventable and is owned by import_collides_with_a_kernel_name; this row does not claim that rung. v2 already refuses an imported user Int at the reference (v2.test.claim.body_let_annotation bla_imported_user_int_refuses_rather_than_binding_the_kernel_int); that is a different class (kernel_type_spelling_captured_a_module_declaration) on a different compiler. ATTAINABLE CEILING: structurally guaranteed -- the residual collision is decidable at the import from overlay_skips_kernel_name and the mint-row set. NEXT-RUNG TRIGGER: the v1 import wall covers every overlay_skips spelling the same way Optional is covered (mint row or equivalent DeclarationRef ownership), except the declared dual-representation carriers, so a non-mint overlay import is unwritable and the two lookups can no longer disagree about it.",
+  ],
+
+  evidence: [
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "lookup_binding", field: WholeDeclaration },
+    DeclarationRef { module_path: "std.literal_elaboration", decl_name: "kernel_named_import_standing", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.structural_realization_bindings", decl_name: "kernel_mint_declaration_rows", field: WholeDeclaration },
+    DeclarationRef { module_path: "gunbc.recurring_failure_mode.import_collides_with_a_kernel_name", decl_name: "import_collides_with_a_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "test.claim.infer_kernel_import_collision_witness", decl_name: "importing_a_non_mint_optional_refuses_at_the_import", field: WholeDeclaration },
+  ],
+}

dag/gunbc/recurring_failure_mode/carrier_by_spelling.dag

@@ -8,7 +8,7 @@ data carrier_by_spelling: RecurringFailureMode = RecurringFailureMode {
   identity: "carrier_by_spelling" as NonEmptyStr,
 
   receipts: [
-    "**carrier by spelling** (INVALID STATE: a module imports the structural text carrier `v2.std.text` `String` and then authors a BARE `String` as if that import bound it; KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (`v1.compiler.infer` `overlay_skips_kernel_name`, kernel overlay unconditional since #9813), so the bare spelling binds the KERNEL host carrier beside the unused import.",
+    "**carrier by spelling** (INVALID STATE: a module imports the structural text carrier `v2.std.text` `String` and then authors a BARE `String` as if that import bound it; KERNEL NAMES ARE NEVER OVERRIDDEN BY IMPORTS (`v1.compiler.infer_env` `overlay_skips_kernel_name`, kernel overlay unconditional since #9813), so the bare spelling binds the KERNEL host carrier beside the unused import.",
 
     "A host-carrier value can therefore flow into a fold whose declared positions are the STRUCTURAL carrier, and the front end ACCEPTS the program.",
 
@@ -46,7 +46,7 @@ data carrier_by_spelling: RecurringFailureMode = RecurringFailureMode {
   ],
 
   evidence: [
-    DeclarationRef { module_path: "v1.compiler.infer", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1.compiler.infer_env", decl_name: "overlay_skips_kernel_name", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.rust_source_type_bindings", decl_name: "checkpoint_row_migration_rows", field: WholeDeclaration },
     DeclarationRef { module_path: "test.claim.self_host_structural_text_witness_test", decl_name: "w_bare_string_with_text_import_stays_host_deterministically", field: WholeDeclaration },
     DeclarationRef { module_path: "gunbc.self_host_compile_phase_frontier", decl_name: "receipt_2_66765317_raw_error_diagnostic_identities", field: WholeDeclaration },

dag/gunbc/recurring_failure_mode/emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer.dag

@@ -14,11 +14,11 @@ data emitter_index_keyed_on_a_type_leaf_takes_the_last_declarer: RecurringFailur
 
     "SPECIMEN, the native approval broker closure (entry dag/gunbc/auth/approval_broker_serve.dag, lane 2A of the native-broker program, main fd30a502): std.access declares AccessRequest<S, A, O, C, E> and gunbc.auth.access_request declares AccessRequest<Subject>. v1.compiler.infer_emit_info add_emit_item_summary inserted both under `AccessRequest`; v1.compiler.trait_derive_emit v1_clone_bounded_type_params therefore held the one-element set Subject for that key, v1_item_clone_bounded_param_names filtered std.access's own [S, A, O, C, E] against it and found none, and std_access.rs printed `pub struct AccessRequest<S, A, O, C, E>` over fields naming AccessContext<C: Clone> and AccessEvidence<E: Clone>: ten rustc errors (E0277, E0369). The paired control is the same emitter over dag/std/authorization_profile.dag, whose closure has one AccessRequest and prints all five bounds.",
 
-    "WHAT IS CLOSED AND WHAT IS NOT. The trait-derive family is re-keyed on the declaration -- v1.compiler.infer_emit_info TypeDeclIndex (EmitGraphInfo.type_decl_items), and with it clone_bounded_type_params, clone_impl_required_type_params and map_key_required_type_names -- under the item registry's own identity (v1.std.core callable_identity over owner module and declared name), and a reference reaches a row through resolve_type_decl_routed, whose spelling arm REFUSES a leaf two modules declare. STILL LEAF-KEYED, LAST WRITE WINS, on v1.compiler.infer_emit_info EmitGraphInfo: type_summaries (and its `Enum::Variant` rows), fn_decl_items, recursive_type_set, fielded_variants, positional_payload_variants, shared_types and variant_to_enum. data_variant_wire_spellings is keyed on the coproduct's leaf too but stores DataVariantSpellingRefused when two declarers disagree, so it fails closed; ownership_index and read_only_params_index are module-qualified and are not members.",
+    "WHAT IS CLOSED AND WHAT IS NOT. The trait-derive family is re-keyed on the declaration -- v1.compiler.infer_emit_info TypeDeclIndex (EmitGraphInfo.type_decl_items), and with it clone_bounded_type_params, clone_impl_required_type_params and map_key_required_type_names -- under the item registry's own identity (v1.std.core callable_identity over owner module and declared name), and a reference reaches a row through resolve_type_decl_routed, whose spelling arm REFUSES a leaf two modules declare. RE-KEYED IN A SECOND CUT: type_summaries is a TypeSummaryIndex keyed by the same declaration identity (variant-payload rows under `<identity>::<Variant>`), and variant_to_enum maps each variant to its owner's identity, so a second same-leaf declaration no longer replaces the first's summary for readers in other modules (the unit row same_leaf_type_elsewhere_leaves_other_modules_emission_unchanged). Readers that hold only a NAME read it through type_summary_decided, which answers no summary for a leaf two declarations own; that residue ends when TypeSummary's field_type_map and field_import_surface_names store identities. STILL LEAF-KEYED, LAST WRITE WINS, on v1.compiler.infer_emit_info EmitGraphInfo: fn_decl_items, recursive_type_set, fielded_variants, positional_payload_variants and shared_types. data_variant_wire_spellings is keyed on the coproduct's leaf too but stores DataVariantSpellingRefused when two declarers disagree, so it fails closed; ownership_index and read_only_params_index are module-qualified and are not members.",
 
     "A DECLARED MIDDLE STATE INSIDE THE CLOSED PART: kernel spellings. A kernel spelling (std.types is_kernel_type) is a reference resolve deliberately leaves unstamped, and the corpus also declares some of those leaves in two modules: v2.std.text and v2.std.node String, std.integer and v2.std.integer Int. Bool was a third until v2.std.logic Bool was retired; the arm is about any kernel-spelled leaf with two declarers, not about a fixed list. For such a reference the routed resolution answers TypeDeclKernelSpellingUndecided: it does NOT refuse, it derives no Clone or Ord bound from either declaration, and it carries a map-key requirement to EVERY declarer of the leaf, which is what the leaf-keyed set did. So for these leaves the emitted derives are unchanged by the re-keying and the question of which declaration a kernel-spelled position denotes is still open. Each occurrence is one row of v1.tests.claim.carrier_realization_census (emitter_decl_route). TRIGGER, at capability grain: resolve identifies a kernel-spelled reference -- as the kernel type or as the corpus declaration its scope binds -- at every type position the emitter reads; the owner is the text-boundary identity work (gunbc.rung_drop text_boundary_identity_wall), not the emitter. One stamped position does not retire the arm.",
 
-    "RUNG: for the trait-derive family, mechanically preventable -- gunbc.instruments.native_emission_controls (two ControlSlot declarations of different arity in one closure, emitted, built and run) and the unit row same_leaf_type_declarations_emit_their_own_bounds are the discriminating red and the positive control. For the seven indexes still leaf-keyed, mitigatable at best: the collision is observed only when rustc happens to refuse the foreign fact. ATTAINABLE CEILING: structurally impossible -- an index keyed on the declaration has no row two declarations can share. NEXT-RUNG TRIGGER, at capability grain: every EmitGraphInfo index that answers a question about a type declaration is keyed on the declaration's identity and reached from a reference through the one routed resolution, so that adding a same-leaf declaration to any module of a closure cannot change what is emitted for an existing one. Re-keying one more map is not that capability; the trigger is the set.",
+    "RUNG: for the trait-derive family, mechanically preventable -- gunbc.instruments.native_emission_controls (two ControlSlot declarations of different arity in one closure, emitted, built and run) and the unit row same_leaf_type_declarations_emit_their_own_bounds are the discriminating red and the positive control. For the five indexes still leaf-keyed, mitigatable at best: the collision is observed only when rustc happens to refuse the foreign fact. ATTAINABLE CEILING: structurally impossible -- an index keyed on the declaration has no row two declarations can share. NEXT-RUNG TRIGGER, at capability grain: every EmitGraphInfo index that answers a question about a type declaration is keyed on the declaration's identity and reached from a reference through the one routed resolution, so that adding a same-leaf declaration to any module of a closure cannot change what is emitted for an existing one. Re-keying one more map is not that capability; the trigger is the set.",
   ],
 
   evidence: [