Body-producer Stage A: FLAGs D/E/F signed + within-body fact layer (one sugar table, 3-edge seam Loop, definition closure)

[briansrls]

Body-producer Stage A: FLAGs D/E/F signed + the within-body fact layer, by execution

Operator signed all three design flags (2026-07-10) and asked for the A→D arc. This PR lands the flags and Stage A's within-body fact layer — the pieces provable without the namespace lane's containment index — and records the honest gate on the rest. Design doc: docs/plans/general-body-producer-design.md (§9 now carries the signs; the staged plan carries the landed/remaining split).

FLAG D — signed: conform now, re-grounding is REQUIRED pre-close cleanup

The lowering conforms to eval's structural-equality binding-key protocol. Per the operator's condition, the identity re-grounding of EnvironmentBindingKey (which also deletes the silent allocate_literal fall-through, a §5 fail-open) is now a hard conjunct of the feature's dissolution trigger — the doc cannot dissolve over the conform-time protocol.

FLAG E — signed: one rule table (landed)

SugarKey = SurfaceAtomKey | ProductionIdentityKey; the hand-inlined ^dag_surface_type_alias_rhs coproduct fold migrated onto the table as SugarFoldCoproductPipeChain — semantics preserved exactly (Disj-keep quirk + diagnostics threading), normalize has one hook. Key extraction stays compiler-side (the production-identity readers live in extdeps; std must not import upward). Receipts: type-alias emit witnesses 3/3, whole-tree --target dag compile 0 diagnostics.

FLAG F — signed: 3-edge seam Loop (landed)

• ^loop_carrier_edge is the exactly-one-legal-name (arbitrary extra Named edges stay illegal — both live RED controls still fire: loop_illegal_named, enforcement_consistency_gate_holds), at-most-one occurrence (2-edge Loops stay legal — no constructor cascade).
• The carrier is excluded from the iteration fold in the same motion — the cost product and 04_infer's τ→τ carrier check follow the single predicate automatically.
• Canonical hashing needed zero code change (the sorted middle bucket already handles it; pinned by claim_content_hash_loop_bound_edge_order_invariant, still green).
• The fold seam emits the carrier from the step-fn's first param (lexeme-stamped); an unreadable binder is ^fold_lowering_shape_invalid, never fabricated. New witnesses: lowered_loop_binds_carrier_binder (binds ^acc from real parsed source), duplicate_carrier_edge_is_malformed (RED).

Stage A fact layer (landed)

1. Carrier read = one authority. The lens's accumulator binding now comes from fold_call_to_loop + loop_carrier_binder_target (the design's "named-edge lookup"); the lens's duplicated surface navigation is deleted. fold_family_head moved to the seam and the lens imports it — the family-membership fork is gone; the seam accepts the whole family. ^fold_accumulator_unread narrows to the named-step residue (f: step — a callee-resolution fact, Stage B's), pinned green by the existing RED control.
2. Definition closure decides aliasing (^copied_port_name_may_alias bucket). Grammar: the let binder is now stamped by dag_grammar_binding_name_terminal (the single binding-name authority; the name was unreadable before — no consumer existed). Lens: a let-spine arm walks stmt spines lexically; a binder whose RHS closes to a carrier joins the carriers (transitive by construction), pure-literal RHS decides fresh, computed RHS decides computed — port readings are resolved before classification, so classify_call and all 10 unit witnesses are untouched. An unbound RHS records no binding — the refusal stands (the closure decides, never defaults clean).
   • let grown = acc → proven Poly2Suspect (was a may_alias refusal — the shadowing false-alarm class is dead)
   • let g = acc; let h = g → proven suspect (transitive)
   • let seed = 0 → provably clean (zero findings)
   • let grown = mystery → may_alias refusal stands (the residue RED control)

Verification (all by execution, wet)

Whole-tree --target dag compile 0 diagnostics ×3 (after each landing); fold-lowering suite 8/8; loop multiplicity 8/8; loop infer 5/5; lens corpus witnesses 13/13 (incl. the four new let-closure witnesses); lens unit witnesses 10/10 (unchanged); offline roster gate 7/7 with unchanged ceilings (behavior-identical carrier migration); hash-order invariance green; type-alias emit 3/3; DESIGN.md regen + drift gate PASS.

What is deliberately NOT in this PR (the honest gate)

The fn_decl/fn_literal → Arrow producer rows, the resolve scope-scaffold dissolution, and Stage D's MVP subsumption. Reason, verified in-tree: decl names bind via module-root edges / the namespace authority — not decl subtrees — and every wrapper consumer (fn_family, cost_coverage, the MVP producer, the scaffold) reads the wrapper shape. Landing a near-zero-coverage producer slice now would create a dual authority without dissolving anything (the scaffold deletes only at 100% coverage). The design doc's staged plan now records this: the producer rows ride the namespace lane's SymbolIndex, staged behind a typed wrapper-retained frontier (lowered | wrapper-retained{cause}, counted, corpus green) — the same typed-frontier pattern as the self-host seed roster. The let-binder StampLexeme landed here is the Bind-lowering prerequisite already paid.

🤖 Generated with Claude Code

[gunbai-bot]

The "CI FAILING (2 failing)" dashboard reading is the known superseded-run artifact: the draft-to-ready flip re-triggered CI under the concurrency group, cancelling the prior runs (29122451110 on this head, 29121977844/29121035026 on WIP heads). The live run is 29122711335 — all three checks in progress on head a962994. No fix needed; my watcher is on it. — sent from eager-ram-612