Substrate T-E-P P1 Slice 6: indirect-call fail-closed cementing tripwire

[briansrls]

Summary

T-E-P-Producer-Broadening Phase 1, Slice 6. Pure cementing slice — no producer extension, no termination-prover change, no substrate introduction.

Per Substrate Mgr clearance at gunbc#2068 #issuecomment-4402804374 (post-STOP-and-PING substrate-shape question response), this slice pins the fail-closed-on-indirect-call invariance at HEAD with a behavioral tripwire that fires atomically when the substrate eventually lands.

Substrate state at HEAD

• TransformDispatch::Indirect and ArrowPortRef are comment-only forward-looking references in prereq_x_call_on_field_access_ratchet_test.rs:105. The substrate types do not exist as enum variants.
• Indirect calls (w.f(x) over Wrapper { f: fn(Int) -> Int }) lower to a typed Diagnostic::ResolveError naming the X1.b prerequisite. They never reach a callable Transform node.
• The per-call descent producer therefore correctly emits NO evidence entries for indirect call sites — fail-closed by structural absence, not by classifier extension.

That's already the right behavior. The audit's load-bearing concern (don't let indirect calls fabricate SubValueRelation evidence) is satisfied by the existing X1.b diagnostic gate.

What this slice adds

A behavioral regression test that pins both halves of the invariance:

type Wrapper { f: fn(Int) -> Int }
fn invoke(w: Wrapper, x: Int) -> Int = w.f(x)

(a) The X1.b ResolveError must fire for the indirect call site.
(b) per_call_descent_evidence must emit NO entry attributed to invoke's body.

Tripwire shape

When TransformDispatch::Indirect substrate eventually lands — as a separate P1 substrate-fact-introduction slice with its own dispatch + DAG-ancestor / coproduct-vs-coordinate / primitive-vs-lens-extensible receipts per INVARIANTS.md — this test will fail because:

• the X1.b ResolveError will stop firing, OR
• per_call_descent_evidence will start producing entries for the indirect call

Either failure surfaces the producer-extension obligation atomically with the substrate landing. Same discipline pattern Slice 4's per-arg cementing established (#2192).

Cross-slice invariants reaffirmed

• ✓ No new CallPattern variant
• ✓ No TransformNode widening
• ✓ No termination-prover changes
• ✓ No INVARIANTS.md P1 substrate-fact-introduction trigger
• ✓ No producer extension — pure cementing
• ✓ Same fail-closed discipline (the audit's concern: indirect calls don't fabricate evidence — already satisfied at HEAD)

Why pure cementing here

After reading substrate at HEAD per Mgr's "your read" delegation (gunbc#2068 #issuecomment-4402786922), the (2a-substrate-introduction) option from the STOP-and-PING (gunbc#2068 #issuecomment-4402746171) was structurally inappropriate for a per-class slice — introducing a new TransformTarget variant would be a P1 substrate-fact-introduction with full procedure receipts, explicitly disallowed by the cross-slice invariants Mgr has been holding the lane to.

The right Slice 6 was the smaller, structurally-honest piece: cement the existing fail-closed behavior so future substrate work can't silently regress it. The substrate-introduction (real "indirect-call coverage" extension) needs its own dispatch when ratified.

Gate progress

• e_p_per_call_descent_evidence_full_coverage (gate Lane B tasks #76, P1): partial — Slice 6 cements the fail-closed-on-indirect-call invariance. No additional shapes classified, but the producer's structural correctness on a class previously covered only by absence is now behaviorally pinned.

Tests

• New: e_p_per_call_descent_evidence_indirect_call_fail_closed_invariance — compiles the Wrapper.f(x) fixture and asserts both halves of the invariance.
• All 9 prior e_p_per_call_descent_evidence_* tests should remain green.
• Local CI shim broken; relying on PR CI for verification.

Test plan

• Indirect-call fixture compiled
• X1.b ResolveError asserted
• No producer evidence for invoke asserted
• CI green (verifying via PR pipeline)

Authority

• Brief: docs/briefs/r3-t-e-p-producer-broadening-worker.md (PR R3 Substrate #1782, MERGED)
• Issue: Substrate T-E-P P1 re-dispatch: nested-match scrutinee + termination (post-#1865 abandonment) #2165
• Slices 1-4 (predecessors): Substrate T-E-P P1 first-slice broadening: match-payload self-call → StrictSubValue #2167 / Substrate T-E-P P1 Slice 2: match-field-projection self-call → StrictSubValue #2178 / Substrate T-E-P P1 Slice 3: nested-match scrutinee + termination #2182 / Substrate T-E-P P1 Slice 4: multi-arg composition cementing tests #2192 (all MERGED). Slice 5 (Substrate T-E-P P1 follow-up: proportional arithmetic descent termination #2198) closed — premise was wrong (v3 Div returns Result<T, DivError>; binary-halving recursion unreachable at v3 surface).
• Mgr clearance for cementing-only Slice 6 plan: gunbc#2068 #issuecomment-4402804374

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: codex / codex-default
• Commit: b9cabf3f · Trigger: schedule
• Comparison: origin/main @ 027fa6bd ... review/pr-2200-b9cabf3f @ b9cabf3f
• Thinking: 44s wall

---

Findings

• src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:987 violates TESTING.md’s “don’t assert on implementation details / error message text” rule. The new tripwire accepts the diagnostic only if ResolveError.name contains "Prereq-X1.b" or "parameter", which pins a free-form message substring rather than the structural contract this test actually cares about: that lowering fail-closes with a typed Diagnostic::ResolveError for the indirect-call site.

Verdict

APPROVE_WITH_COMMENTS. The diff is small and the fail-closed intent is sound, but the new diagnostic assertion is more message-coupled than the testing rubric wants. Everything else in this change looks narrowly scoped and consistent with the current fail-closed boundary.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: b9cabf3f · Trigger: schedule
• Thinking: 207s wall

---

Non-blocking — Strengths

• src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs The added tripwire is implementation-layer test code, documents a bounded X1.b/Indirect trigger, and reinforces P3 fail-closed behavior without adding substrate authority.

✅ No blocking concerns; the test-only change is a tracked cementing ratchet for the current indirect-call absence.

[briansrls]

1. Story of the diff

This PR adds one cementing integration test for the current pre-substrate state of indirect calls through function-valued fields. The fixture declares Wrapper { f: fn(Int) -> Int } and attempts w.f(x) in invoke, then requires compilation to fail semantically rather than lowering that call into a callable Transform (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:969-981). After recovering the semantic Dag, the test checks two sides of the intended invariant: the indirect call should be rejected with a resolve diagnostic, and per_call_descent_evidence(&dag) should not emit any per-call evidence for invoke while no real indirect-call substrate exists (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:984-1006). The comments also make the test a future tripwire: once TransformDispatch::Indirect / ArrowPortRef land, this test is expected to fail and force the producer to classify indirect calls rather than silently omitting them (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:961-967).

2. Invariant categories

1. LAYER MODEL (substrate vs implementation).
   N/A — the diff does not introduce or mutate Dag-resident substrate types, dag.rs, or cross-pass data carriers; it is a Rust integration test only. The substrate references are explicitly comments about absent future types at src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:952-955.

2. INVARIANTS.md + modeling-discipline.md.
   Finding — C-5 / fail-closed typed authority.
   src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:987: name.contains("Prereq-X1.b") || name.contains("parameter")
   The test’s authority for “the X1.b prerequisite fired” is a substring probe over a diagnostic string/name, and the parameter fallback is broad enough that an unrelated ResolveError mentioning a parameter could satisfy the assertion. That weakens the fail-closed tripwire: the test may continue passing even if the specific X1.b rejection stops being the reason the indirect call is blocked. Prefer a typed diagnostic discriminator for the prerequisite if one exists; otherwise assert an exact bounded ResolveError.name value for this prerequisite, not a broad contains("parameter") fallback.

3. CODING.md.
   Compliant — the new code stays in the data/function style: it uses compile_to_dag(src, ...) and directly matches the structured CompileError::Semantic(dag) carrier rather than adding methods, hidden state, or a new helper abstraction (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:974-981).

4. TESTING.md.
   Finding — behavior-driven test is undermined by message-text probing.
   src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:987: name.contains("Prereq-X1.b") || name.contains("parameter")
   The test’s stated behavior is “X1.b ResolveError for the indirect parameter call site,” but the assertion accepts any ResolveError whose name contains parameter. For a cementing test, that is too loose: it can pass for the wrong diagnostic and fail to catch the regression it was written to surface. The second half of the test is well-shaped because it asserts the published behavior of per_call_descent_evidence directly with invoke_entries.is_empty() at src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1006; the diagnostic half should be made equally specific.

5. LOCKED DESIGN DECISIONS.
   N/A — the diff does not edit or diverge from a locked design document; it only references future substrate names in comments as a tripwire condition (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:961-967).

6. TRACKED vs UNTRACKED DEBT.
   Compliant — the forward-looking scaffold is documented, bounded, and has a named dissolution trigger: the comments say the current state is “comment-only” / absent substrate (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:952-955), bound the current expected behavior to no lowered callable transform (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:955-959), and name the trigger as the future landing of TransformDispatch::Indirect / ArrowPortRef causing entries to appear and requiring an indirect classifier slice (src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:961-967, src/v3/compiler/tests/integration/m2_substrate_inhabitance_test.rs:1007-1009).

3. Verdict

REQUEST_CHANGES. The production/substrate shape is untouched, and the no-evidence assertion is the right fail-closed tripwire, but the diagnostic assertion is too string-sentinel-shaped for a PR whose only purpose is cementing a fail-closed invariant. Tighten saw_x1b_diagnostic so it proves the specific X1.b rejection rather than any parameter-related ResolveError.