Model TraitBoundWitness: derive Clone-bound evidence from RC-match lowering facts

[gunbai-bot]

STATUS CORRECTION (verified by execution, 2026-08-19): this PR currently retires ZERO real diagnostics

The claims below this line were written before real-execution verification and are wrong about impact; kept for history, corrected here per DESIGN.md §4b (rung honesty) and §5 (specification-without-execution).

Verified directly (two independent remote cargo probes against pushed head 561bf1166b1, plus a raw log read): std_cache_interface.rs:564 and :580 — the two E0599 sites this PR claims to retire — are byte-identical present on the pushed head. emit_fn_def's Clone-bound wiring does not fire on either real site at all: neither realize_route<T> nor classify_write<T> gets T: Clone on its signature. This is a detection/wiring bug in the fix itself, not a partial or line-shifted retirement.

The witness (w_current_defect_reproduces_bare_generic_no_clone_impl, dag/test/claim/trait_bound_witness_test.dag) is non-discriminating against the real corpus shape: it passes on a synthetic Choice<N>/describe<N> fixture whose match scrutinee is a bare, non-Rc-wrapped generic value, while the real sites' scrutinees are Rc-wrapped (Rc<CacheLookupResult<T>>). The fixture never exercises the RC-deref path the fix targets, so the fixture going green proves nothing about the real sites. This is the carrier-with-a-fixture-but-no-live-corpus-consumer shape DESIGN.md §5 calls out (fluent, type-checking, green-by-execution-on-a-fixture output that looks finished without actually running against its real subject).

Separately, on inspecting the real emitted text, the match scrutinees at 564/580 are (*lookup.clone()).clone() / (*existing.clone()).clone() — a composed double clone: an outer (*{0}).clone() deref-clone template (adjudicated in dag/tools/e0599_emitter_decision_census.dag, operator verdict 2026-07-29 — bound required, not this PR's to remove) wrapping an inner, independently redundant lookup.clone()/existing.clone() (an Rc clone immediately deref'd through and dropped — (*lookup.clone()) ≡ (*lookup), decidable without any copy-free-match claim). The inner clone is a genuine cost defect but does not retire the E0599, since Rc<X>: Clone holds unconditionally regardless of T.

Net: this PR should not be read as fixing the 2-site E0599 population it names. It is pending rework or closure pending the operator/coordinating-session scope decision on whether to (a) fix the detection bug and retarget at a genuinely load-bearing population elsewhere, or (b) hand this cluster to the ownership/lowering lane (emitter-ownership-defork) as a cost-defect (inner-clone) fix that is explicitly out of E0599 scope. Do not merge on the strength of the "Retirement count" section below.

---

Summary (original, now superseded by the correction above)

Work item: node://adhoc-d30225a0-531 — E0599 trait-bound cluster in materialization_carriers. Scope: generic function bodies calling a method (.clone()) on a type-parameter value with no proving bound, produced by emit_typed_match's existing RC-deref-clone lowering (analyze_rc_match). E0277 is explicitly out of scope (different repair/authority, per smart-ram-730's constraint message).

This PR now lands a wired, executing consumer, not an additive/unwired model (revised after review 53548 — see below).

• Root cause: emit_fn_def (src/v1/05_emit_rust.dag) called v1_generic_params_needing_clone_bound (src/v1/trait_derive_emit.dag) without the function body in scope, so the Clone-bound decision was structurally blind to emit_typed_match's RC-deref-clone lowering. When a match scrutinee resolves to a shared/Rc-wrapped generic coproduct, the emitted .clone() call on the dereferenced pointee needs the pointee's generic parameter Clone-bounded — nothing derived/emitted that bound, producing rustc E0599.
• v1.compiler.trait_bound_witness (src/v1/trait_bound_witness.dag) is a pure, Node-free, zero-import decision core: v1_rc_match_scrutinee_clone_bound_param_names takes already-extracted facts (generic param names, the scrutinee's resolved type-argument names, analyze_rc_match's needs_deref verdict) and returns the generic param names needing Clone; v1_union_clone_param_names unions that against the existing bound-name list.
• emit_fn_def (src/v1/05_emit_rust.dag) is now the real, wired, executing consumer. It inlines the Node-consuming extraction (calling its own already-local analyze_rc_match, match_scrutinee, match_arm_nodes, authored_name_at — kept inline rather than wrapped in the new module specifically to avoid an emit_rust <-> trait_bound_witness import cycle, DESIGN.md §4 acyclicity), then unions the result into clone_param_names before deriving needs_clone_bound.
• No new named carrier. Both functions return plain List<String> — the exact shape v1_generic_params_needing_clone_bound already returns and unions. This directly resolves review 53548's second finding (an unwired, witness-less extraction wrapper) by deleting that wrapper's separate existence: the extraction logic is now inline in the one place that actually consumes it.

Why not RequiredTraitWitness (v2.std.compilers.target_model.dag:9506)

Checked and rejected, not skipped, per smart-ram-730's explicit "extend, unless genuinely distinct" instruction. RequiredTraitWitness's four consumers (rust_collection_witness_bundle_node, repr_grounding_derive_traits_for_collection_witness, target_collection_witness_from_node, target_collection_trait_witness_satisfied) all answer one question: whether a chosen Rust collection representation's element type (BTreeSet/HashSet/Vec) satisfies Ord/Hash/Eq, keyed on an elem: Node collection-element-kernel-shape match (string/int/bool/unit kernel atoms only). A bare generic function parameter needing Clone because a function body derefs+clones an Rc-wrapped match scrutinee has no elem and is not a collection-representation choice — folding it in would force a meaningless arm into that match rather than extend a shared concept. Full evidence trail is in-module (trait_bound_witness_note, src/v1/trait_bound_witness.dag).

Review response (review 53548, changes-requested)

Both findings addressed by the same redesign:

1. "Module was additive/unwired, parallel to a pending B1 carrier decision, no operator verdict for the dissolution debt." Resolved by eliminating the standalone TraitBoundWitness/TraitBoundReason carrier entirely — there is no carrier to reconcile against a future B1 decision, only two plain List<String>-returning functions already unioned into the real consumer's existing return shape. No dissolution debt is introduced.
2. "The Node-consuming extraction wrapper had no consumer and no witness (DESIGN §5 specification-without-execution)." Resolved by deleting that wrapper's separate existence: the extraction is now inline in emit_fn_def itself, which is the real, executing, wired consumer.

Integration ownership note

src/v1/05_emit_rust.dag and src/v1/trait_derive_emit.dag-adjacent work is normally owned by witty-heron-413's materialization_carriers lane. witty-heron-413 went idle; smart-ram-730 (coordinating session) explicitly authorized me to land the carrier and consumer together myself, conditioned on: (a) stating this ownership note; (b) keeping the 05_emit_rust.dag diff minimal and specific to the Clone-bound consumer flip (33 insertions, no nearby refactor); (c) checking PR #8460 (touches the same file) before pushing and rebasing if it merged first — confirmed still OPEN/not merged at push time, so no rebase was needed.

CI note

The witnesses check failed on the prior head (6947f4d) with a .dag grammar parse error: list-literal patterns in match arms ([n] => ...) are not supported (expected FatArrow, found LBracket). Because --required-floor is a single whole-corpus fold, this one file's parse error refused the entire floor before any witness executed — not just this witness. Fixed by rewriting the three affected match sites in dag/test/claim/trait_bound_witness_test.dag to use count/first()/skip(n: 1) with Optional (Present/Absent) matching instead of list-literal patterns. Verified via a remote --required-floor dispatch against the exact patch: strict-preparation (whole-corpus typecheck) now completes with no refusal.

Test plan

• dag/test/claim/trait_bound_witness_test.dag: real executing unit tests over the pure decision core (no Node construction needed) — parses under the .dag grammar (no list-literal match patterns)
• w_current_defect_reproduces_bare_generic_no_clone_impl: compile_dag_rust_emit_check on a minimal Choice<N>/describe<N> fixture through the real emit pipeline, now asserting the fixed emitted shape (fn describe<N: Clone>() per DESIGN §4b's expecting-red-flips-to-permanent-regression-control pattern
• E0599 count reconciled against a real cargo-error-denominated probe (materialization_carriers.cargo.log, 51 total error[...] lines, matches witty-heron-413's board total exactly)

Retirement count — 2 sites, not 28

materialization_carriers.cargo.log shows exactly 3 error[E0599] occurrences in this module. Two are the Clone-bound family this PR fixes — realize_route<T> and classify_write<T> in dag/std/cache_interface.dag (CacheLookupResult<T>::clone, std_cache_interface.rs:564 and :580) — the exact two specimens trait_bound_witness_note was traced from. The third (partial_cmp on Rc<Fnv1a64Structural>, src/v2_std_node.rs:1334) is a PartialOrd bound issue, a different trait family entirely, and is not touched by this PR (likely T7-lane residue — flagged to stern-fox-619, who owns that follow-on).

This PR retires 2 E0599 sites, not the published board's "Clone bounds ...... 28" row. That row is mechanism-grain (spans E0277 + E0599 + E0369 + the &T-cloned E0308 subclass under one label), not this PR's scope. The E0599-specific subset — the only part this PR owns — is 2 of 3 sites in this module; the third is out of family.

E0277 (16 rows, the largest single-code population in this module) has no owner. It was explicitly separated from this PR's scope at dispatch (different defect, different repair/authority — per-derived-impl bounds at struct declarations, e.g. CommutativeSemiring<Magnitude> serde obligations) but was not independently assigned. Folding it into this PR now would reintroduce the two-lanes-in-one-PR shape already rejected once (review 53548). Flagging here so no reader assumes the Clone cluster is fully handled by this change.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 53548 (request-changes, posted against 6947f4d, dashboard-only — no GitHub review thread to reply into directly, so replying as a PR comment):

Finding 1 — module was additive/unwired, parallel to a pending B1 carrier decision, no operator verdict for the dissolution debt.
Resolved by dropping the standalone TraitBoundWitness/TraitBoundReason carrier entirely. v1.compiler.trait_bound_witness now mints no named carrier type at all — both functions return plain List<String>, the same shape v1_generic_params_needing_clone_bound (the real consumer) already returns and unions. There is nothing left to reconcile against a future B1 RequiredTraitWitness-family decision, and no dissolution debt is introduced.

Finding 2 — the Node-consuming extraction wrapper had no consumer and no witness (DESIGN §5 specification-without-execution).
Resolved by deleting that wrapper's separate existence. The Node/EmitGraphInfo-consuming extraction (calling analyze_rc_match, match_scrutinee, match_arm_nodes, authored_name_at) is now inlined directly into emit_fn_def (src/v1/05_emit_rust.dag), which is the real, wired, executing consumer — emit_fn_def unions the derived Clone-bound names into clone_param_names before deriving needs_clone_bound. It was kept inline rather than reintroduced as a wrapper in the new module specifically to avoid an emit_rust <-> trait_bound_witness import cycle (DESIGN.md §4 acyclicity), since emit_rust.dag already owns analyze_rc_match locally and the Node accessors this extraction needs.

Also fixed in the same push: the pushed head (46b4357e4eb) resolves the witnesses CI failure on 6947f4d — a .dag grammar parse error (list-literal match-arm patterns, unsupported by the grammar) that was refusing the entire required-floor fold before any witness executed. See the updated PR description for full detail, the RequiredTraitWitness-rejection evidence, and the integration-ownership note (witty-heron-413 idle; landed under smart-ram-730's explicit fallback authorization).

[gunbai-bot]

Re review 53548's advisory finding on the two data …: String note blocks (trait_bound_witness_note, trait_bound_witness_import_note): agreed this is exactly the DESIGN §4c modeling-debt shape (anemic prose-as-program-data, invisible to the substrate). Considered converting both to leading // comment blocks (the actual quarantine mechanism §4c describes — "standalone leading // blocks attached to module-scope declarations" are supported) instead of leaving them as data: String.

Not doing that conversion in this PR: both blocks are large multi-paragraph prose with backticks, parens, and code-like fragments, and this session already hit three separate .dag grammar edges today (list-literal match patterns twice, a named-argument-in-match-scrutinee refusal, a //-in-declaration-body refusal — per smart-ram-730's cross-lane finding) that nobody has mapped yet. Converting untested large comment blocks risks landing a fourth undiscovered edge on a change whose actual scope is a 2-site Clone-bound fix, and re-verifying needs a full remote --required-floor pass (~25+ min) per attempt. Given the finding is explicitly non-blocking and "consistent with existing corpus practice," leaving the two notes as data: String for now and flagging the //-conversion as a follow-up rather than risking scope creep / a new grammar surprise in this PR.

— sent from deep-swift-570