Grammar sync tokens are an enumeration, not a predicate (unblocks the prepare_grammar memo for every language)

[gunbai-bot]

Grammar sync tokens were carried as Set<Symbol> — a PointwisePower characteristic function — to hold what every producer in the corpus writes as either nothing or a literal list of keyword classes. A characteristic function is a closure, and one closure anywhere in a value makes the whole value unhashable: the interpreter's content-hash walk has Value::Closure { .. } => EvalRecomputeStep::Bail, and both try_cross_claim_pure_memo and store_cross_claim_pure_memo return early when the key is None.

So prepare_grammar's cross-claim memo could never form its key, never store, and never hit — for every language in the corpus, not only .dag, because grammar_empty_sync_tokens() was Set { member: fn(_) { false } } too. A memo that exists and cannot fire is worse than none: it reads as solved.

What it cost

Measured remotely with claim_batch at a 900s budget, so rows run to completion instead of being interrupted at the 1552ms ceiling:

	cost
parse a one-line module	12015ms
parse an empty module (header only)	11706ms
grammar construction	4ms
prepare_grammar	~11.7s of the total

97% of parsing a module was independent of the module being parsed.

The change

GrammarRoot.sync_tokens becomes List<Symbol>. Set is not redefined: std.types grounds Set<element> = PointwisePower<element>, and std.state_durability carries an explicit note that this is "not a license for a Map-as-set or bitset nickname". The characteristic function stays the meaning of a set. What changes is a field that was never a power set — it is six literal keywords.

Blast radius is two producers (grammar_empty_sync_tokens, dag_sync_tokens) and exactly one consumer (parse_sync_step, .member(...) → contains(...)). No call site anywhere needed an arbitrary predicate, so no coproduct-with-an-enumerated-arm is introduced — that would be a variant with no producer.

Receipts

Same instrument, same flags, one dispatch, so before/after are comparable.

Cross-claim memo — one process, one entry group, three consecutive claims:

claim	before	after
zz_prepare_grammar_only	14407ms	10018ms	first claim still pays a full preparation
zz_prepare_then_parse	18815ms	165ms	114×
zz_full_parse_module	19298ms	166ms	116×

Within-claim dedup — dag_arrow_lambda_witness_test:

claim	before	after
witness_single_param_lambda_parses	12084ms	10527ms	first row, pays the preparation
witness_sum_decl_unchanged	12231ms	170ms	72×
witness_pre_repair_grammar_restores_the_RED	50120ms	11276ms	4.4×

The last row deduplicates by content, not by call count, which is the behaviour we want: it builds a modified grammar (one production swapped), so its hash legitimately differs and it must pay a second preparation — exactly one, not four.

What this does NOT establish

• The floor path is unproven. These receipts are claim_batch, which does not build the floor's per-module scopes. They show the cross-claim memo hits within one process; they do not show pointer stability across those scopes. The floor-side receipt is single_refinement_carrier_emits_no_unsupported_cast moving off its 45941ms on the next main run.
• This does not retire the over-budget population. The first preparation still costs ~10s, so rows that pay it remain over the 1552ms ceiling. That residue is the cost-shape defect in grammar_has_left_recursion — 38 left-corner closures where one shared relation answers all 38, a fixed 38 rounds with no convergence check, and grammar_lookup_production filtering 38 productions to find 1 — deliberately left to its own PR under DESIGN §6, so the improvement here stays attributable. This PR removes the per-row multiplier; that one removes the constant.

Guarantee

Regression is prevented by construction rather than by a check: with the field typed List<Symbol>, a closure cannot be written there at all, so the memo cannot be silently re-killed the way it was.