De-fork ConstructorReferenceAdmission onto one exact-identity authority (+ full control envelope)

[briansrls]

De-forks ConstructorReferenceAdmission onto one exact declaration-grain authority.

Root: declaration provenance was lost through binding.resolved

The admission lookup returned a binding's resolved value node in four of its five arms. A value node is the right subject for type inference and the wrong subject for declaration policy: it carries no admit_callers property, so fn_admit_callers found nothing, saw no admission list, and admitted every caller of any name resolving through one of those arms.

Zero-arity sealed constructors were the live population — an unlisted caller could reference or invoke one with no diagnostic in either spelling. Arity was a correlate of which lookup path ran, never the distinguishing fact: a one-arity name happened to resolve through the symbol index and refused correctly. An earlier revision of this PR proposed a params |> count > 0 root cause; that hypothesis is refuted and the repair is uniform rather than arity-specific.

Authority: one exact declaration-grain decision

constructor_declaration_for_admission resolves the declaration by exact qualified name and returns ConstructorDeclarationLookup:

ExactConstructorDeclaration { identity, declaration }
NotAdmissionBearingReference {}
AdmissionBearingDeclarationUnavailable { identity, cause }

Admission facts are read from the declaration node only. #7859's second, module-grain decision (FuncSigCallerNotAdmitted on FuncSigLookup) is deleted along with both of its translation arms, leaving one post-resolution authority.

Shadowing: body_locals precedes constructor lookup

Admission decides a resolved declaration identity, never an identifier spelling. Hoisting the check above the ExprVar arm closed the fail-open and simultaneously refused a parameter named token — converting one DESIGN §5 violation into its mirror image. body_locals is the corpus's existing shadowing authority (call_locals_shadow_note), so it is reused rather than a second notion of shadowing being minted beside it.

Negative state: located-and-missing refuses; unlocated stays ordinary

The owner must be located, not guessed. Only func_decl_owner_module and borrowed_census_decl positively assert that a declaration of this name lives in the module they name. Resolving against a guessed owner and treating the index miss as unrecoverable turned a wrong guess into a hard refusal — measured on the whole tree, that fabricated 11 refusals over three ordinary data declarations (srv3_nbd_proxy_local_port, gnu_bash_subject_ref, extdeps_external_authority_anchor), none of them constructors.

So a name no locating authority claims is NotAdmissionBearingReference, and the unavailable arm is reserved for the genuinely anomalous case: a positively located declaration the index cannot produce, which refuses rather than falling back to a provenance-losing node. A fabricated refusal is a wrong answer exactly as a fabricated success is.

Evidence

Generated control envelope — executed, not merely written. Denominators kept separate on purpose:

6   generated Rust test functions   executed, 6 passed, 0 failed
16  direct assertions
8   looped named control cases

Covering: listed/unlisted zero-arity bare reference; listed/unlisted zero-arity explicit call; unlisted qualified call reporting an undoubled identity; listed/unlisted nonzero-arity function value; ordinary non-sealed function value; same-module listed/unlisted siblings; parameter shadowing; let shadowing.

The combination is what matters: ordinary is the widening detector — an implementation that satisfied the wall by refusing more things would pass the refusal controls and fail this one.

Self-host fixed point. Three generations were required, and the sequence is itself the finding: generation 1 rebuilt the generator, generation 2 emitted the controls from it, generation 3 was clean. Confirmed independently on BuildBuddy at this exact head:

regen_divergence_count=0
regen_stage0 --verify: committed stage0 matches fresh self-compile.

Until generation 2 landed, the seven controls existed only as generator source and had never been compiled, let alone executed.

Local Rust test attempt — stated as a differential receipt, because the ordinary/heavyweight partition does not exist in this tree and there is therefore no total denominator to claim a pass against:

every completed test passed except
  lying_substrate_inputs_only_stamp_census

main attribution:
  lying_substrate_inputs_only_stamp_census fails identically on clean
  origin/main (9bdefebc2d, same assertion, same message) — pre-existing,
  not introduced here

unobserved:
  three exact corpus-scanner identities terminated before producing verdicts
  (production_witness_cost_projection_preserves_exact_nanoseconds_and_ordering,
   floor_corpus_every_lens_is_justified,
   import_closure_live_drift_discriminates_under_declaration)

conclusion:
  no branch-specific Rust assertion failure observed;
  complete local-suite totality unavailable in this container

The repository CI job does not execute those three scanners, so it is independent build/regeneration/floor evidence and is explicitly not claimed as coverage for them.

Single-authority cleanup

04_lookup.dag briefly carried a local qualified_last_segment_local beside v1.std.core's qualified_last_segment. There was no layering constraint — 04_lookup already imports v1.std.core — so the duplicate is deleted. The two were not identical implementations (canonical routes through module_path_segments, which maps "" to the empty list; the local used raw split); they converge on every input, but two qualified-name splitters with different empty-case handling is the shape that later renders one identity differently from the other.

Scope — what this does NOT establish

admit_callers has no production population today; its live population is fixtures. This PR delivers the language capability and its exact-identity authority, not a production behavioural receipt.

Declaration totality is not proven. A declaration carrying admit_callers that enters through a path neither locating authority represents would land in NotAdmissionBearingReference and bypass admission. That is bounded today only because no production constructor carries admit_callers. The named successor is a declaration-totality wall — an exact identity join between all declarations carrying nonempty admit_callers and all admission-indexed constructor declarations, reporting missing / extra / duplicate / ambiguous / unresolvable — and it must land before the first production admission-bearing constructor, not after.

Shadowing evidence covers two binder forms, not four. The controls prove fn-parameter and let shadowing. Match binders and lambda parameters inherit the arm by construction, because it reads body_locals rather than enumerating forms — but inheritance by construction is not execution.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.